# US 8,151,323 B2 · Systems and methods for providing levels of access and action control via an SSL VPN appliance

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,151,323 B2
- Document ID: US8151323B2
- Status: Granted
- Kind: B2
- Application number: 11/566,975
- Filed: 2006-12-05
- Published: 2007-10-18
- Granted: 2012-04-03
- Earliest claimed: 2006-04-12
- Assignees: Citrix Systems, Inc.
- Inventors: James Harris; Max He; Arkesh Kumar; Ajay Soni; Charu Venkatraman; Shashi Najundaswamy; Amarnath Mullick
- Web page: https://patentgrep.com/patent/US8151323B2

## CPC

- H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP]
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching
- H04L 69/10: Streamlined, light-weight or high-speed protocols, e.g. express transfer protocol [XTP] or byte stream
- H04L 63/0272: {Virtual private networks}
- H04L 63/105: {Multiple levels of security}
- H04L 63/166: {at the transport layer}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/165: Combined use of TCP and UDP protocols; selection criteria therefor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present invention relates to systems and methods to identify a level of access for a resource being accessed via a secure socket layer virtual private network (SSL VPN) connection to a network, and to control the action on the resource based on the identified level of access. The appliance described herein provides intelligent secure access and action control to resources based on a sense and respond mechanism. When a user requests access to a resource via the SSL VPN connection of the appliance, the appliance obtains information about the client to determine the user access scenario—the location, device, connection and identify of the user or client. Based on the collected information, the appliance responds to the detected user scenario by identifying a level of access to the resource for the user/client, such as rights to view, print, edit or save a document, Based on the identified level of access, the appliance controls the actions performs on the resource by various techniques described herein so that the user can only perform the allowed action n accordance with the level of access. As such, the present invention allows organization to control and provide the appropriate level of access to valuable, confidential or business critical information accessed remotely or via a pubic network while protecting such information by controlling the types of actions performed or allowed to be performed remotely on the information.

## Claims

### Claim 1

A method of controlling by an appliance an action performed by a client on a resource accessed via a virtual private network connection provided by the appliance to a network, the method comprising:
(a) receiving, by an appliance, a request from a client operated by a user to perform an action on a resource on a network being accessed via a secure socket layer virtual private network (SSL VPN) connection provided by the appliance to the network, the client comprising a computing environment, the action comprising one of printing, editing or saving the resource via the SSL VPN connection;
(b) receiving, by the appliance, characteristics of the computing environment provided by a collection agent;
(c) providing, by a policy engine of the appliance, one or more policies for controlling actions by the computing environment; and
(d) controlling, by the appliance via the SSL VPN connection, whether the computing environment is allowed to perform the requested action on the resource based on application of the one or more policies on the received characteristics and the requested action.

### Claim 2 (depends on 1)

The method of claim 1, comprising requesting, by the user of the client, access to a file on the network via the appliance, and controlling, by the appliance, the action the user of the client is allowed to perform on the file.

### Claim 3 (depends on 1)

The method of claim 1, comprising determining, by the appliance, the level of access to allow one or more of the following actions to be performed on a file: view, print, edit and save.

### Claim 4 (depends on 1)

The method of claim 1, comprising preventing, by the appliance, a download of the resource to storage of the client.

### Claim 5 (depends on 1)

The method of claim 1, wherein step (d) comprises one of allowing or denying, by the appliance, the user of the client to view the resource.

### Claim 6 (depends on 1)

The method of claim 1, comprising transmitting, by the appliance, the collection agent to the client.

### Claim 7 (depends on 1)

The method of claim 1, comprising automatically executing the collection agent on the client in response to one of a request to establish the SSL VPN connection with the network or the request to access the resource.

### Claim 8 (depends on 1)

The method of claim 1, comprising determining, by the collection agent, information comprising one or more of the following: an HTTP header, a local network of the client, an internet protocol address of the client on the local network, a method of authentication used by the client, a machine ID of the client, a type of operating system type, existence of a patch to the operating system, or a Machine Access Control (MAC) address of a network card.

### Claim 9 (depends on 1)

The method of claim 1, comprising transmitting, by the policy engine, instructions to the collection agent identifying the type of information for the collection agent to collect.

### Claim 10 (depends on 1)

The method of claim 1, comprising requesting, by the collection agent, instructions from the policy engine on the type of information to collect.

### Claim 11 (depends on 1)

The method of claim 1, determining, by the policy engine, the type of information to collect from the client based on a policy.

### Claim 12 (depends on 1)

The method of claim 1, wherein the collection agent comprises one of the following: a script, bytecode, or a program.

### Claim 13 (depends on 1)

The method of claim 1 wherein the collection agent transmits a request to the policy engine for instructions identifying the type of information the collection agent gathers.

### Claim 14

A system for controlling an action performed by a client on a resource accessed via a virtual private network connection provided by an appliance to a network, the system comprising:
an appliance providing one or more clients a secure socket layer virtual private network (SSL VPN) connection to a network;
a client, operated by a user, requesting to perform an action on a resource on a network via the appliance, the client comprising a computing environment, the action comprising one of printing, editing or saving the resource via the SSL VPN connection;
a collection agent providing to the appliance characteristics of the computing environment;
a policy engine providing one or more policies for controlling actions by the computing environment; and
wherein the appliance controls, via the SSL VPN connection, whether the computing environment is allowed to perform the requested action on the resource based on application of the one or more policies on the received characteristics and the requested action.

### Claim 15 (depends on 14)

The system of claim 14, wherein a user of the client requests access to a file on the network via the appliance, and the appliance controls the action the user of the client is allowed to perform on the file.

### Claim 16 (depends on 14)

The system of claim 14, wherein the policy engine determines the level of access to allow one or more of the following actions to be performed on a file: view, print, edit and save.

### Claim 17 (depends on 14)

The system of claim 14, wherein the appliance prevents a download of the resource to storage of the client.

### Claim 18 (depends on 14)

The system of claim 14, wherein the appliance one of allows or denies a user of the client to view the resource.

### Claim 19 (depends on 14)

The system of claim 14, the appliance transmits the collection agent to the client.

### Claim 20 (depends on 14)

The system of claim 14, wherein the collection agent automatically executes on the client in response to one of a request to establish the SSL VPN connection with the network or the request to access the resource.

### Claim 21 (depends on 14)

The system of claim 14, wherein the collection agent determines information comprising one or more of the following: an HTTP header, a local network of the client, an internet protocol address of the client on the local network, a method of authentication used by the client, a machine ID of the client, a type of operating system type, existence of a patch to the operating system, or a Machine Access Control (MAC) address of a network card.

### Claim 22 (depends on 14)

The system of claim 14, wherein the policy engine transmits instructions to the collection agent identifying the type of information for the collection agent to collect.

### Claim 23 (depends on 14)

The system of claim 14, wherein the collection agent requests instructions from the policy engine on the type of information to collect.

### Claim 24 (depends on 14)

The system of claim 14, wherein the policy engine determines the type of information to collect from the client based on a policy.

### Claim 25 (depends on 14)

The system of claim 14, wherein the collection agent comprises one of the following: a script, bytecode, or a program.

### Claim 26 (depends on 14)

The system of claim 14, wherein the collection agent transmits a request to the policy engine for instructions identifying the type of information the collection agent gathers.

### Claim 27

An appliance for controlling an action performed by a client on a resource accessed via a virtual private network connection provided by the appliance to a network, the appliance comprising:
means for receiving a request from a client operated by a user to perform an action on a resource on a network via a secure socket layer virtual private network (SSL VPN) connection provided by the appliance to the network, the client comprising a computing environment, the action comprising one of printing, editing or saving the resource via the SSL VPN connection;
means for receiving characteristics of the computing environment from a collection agent;
means for providing one or more policies controlling actions by the computing environment; and
means for controlling, via the SSL VPN connection, whether the computing environment is allowed to perform the requested action on the resource based on application of the one or more policies on the received characteristics and the requested action.

### Claim 28

A method of controlling by an appliance an action performed by a client on a resource accessed via a virtual private network connection provided by the appliance to a network, the method comprising the steps of:
(a) receiving, by an appliance, a request from a client operated by a user to access a resource on a network via a secure socket layer virtual private network (SSL VPN) connection provided by the appliance to the network, the client comprising a computing environment;
(b) receiving, by the appliance characteristics of the computing environment collected by a collection agent from the client;
(c) providing, by a policy engine of the appliance, one or more policies for controlling actions by the computing environment based on a type of delivery for the resource from the network; and
(d) controlling, by the appliance via the SSL VPN connection, whether the computing environment is allowed to perform the requested action on the resource via the type of delivery based on-application of the one or more policies on the received characteristics and the requested action.