Security system providing methodology for cooperative enforcement of security policies during SSL sessions

A system for providing enforcement of a security policy by manipulating retrieval of certificates normally exchanged during a certificate-based protocol session, the system comprising:

• a computer having at least one processor and a memory;
• a security policy indicating conditions under which a client is permitted to participate in a certificate-based protocol session;
• a module that manipulates retrieval of certificates that would otherwise normally be exchanged during the certificate-based protocol session, by intercepting a request to retrieve a certificate for authenticating the client;
• a module that determines whether the client complies with the security policy;
• and
• a module that blocks retrieval of said certificate in instances where the client does not comply with the security policy, so that the computer is blocked from participating in said certificate-based protocol session when the computer does not comply with said conditions.

An improved method implemented in a computer system for retrieving manipulating normal retrieval of certificates for use used in a certificate-based protocols protocol, the improvement comprising:

• monitoring requests to retrieve certificates at a machine during a session employing said certificate-based protocol, for ensuring the machine's compliance with a security policy as a prerequisite to certificate retrieval, said security policy specifying additional conditions beyond those specified by the protocol;
• as each given certificate is requested to be retrieved at the machine, determining whether the machine complies with the security policy;
• and
• blocking retrieval of a given requested certificate in instances where the machine violates said security policy, so that the machine is blocked from participating in said certificate-based protocol session when the machine does not comply with said additional conditions specified by said security policy.

A system for controlling access to certificates comprising:

• a machine having at least one processor and a memory;
• a certificate store for storing certificates on the machine, said certificates for authenticating the machine according to an existing protocol;
• a security policy specifying conditions that the machine must comply with, in addition to any conditions specified by the existing protocol;
• means for monitoring requests for retrieving a certificate from the certificate store during a session employing said existing protocol, for allowing the system to manipulate retrieval of the certificates in the certificate store in order to enforce compliance with the security policy;
• means for monitoring compliance of the machine with the security policy;
• and means for blocking retrieval of a particular certificate when the machine does not comply with the security policy, so that the machine is blocked from participating in said session when the machine does not comply with said security policy.