US 8,528,047 B2Granted

Multilayer access control security system

AssigneeCitrix Systems, Inc.

InventorsAndreas Terzis, Marco A. Murgia, Ashwin Baskaran

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer-based system provides secure, configurable access to computer network resources. A human-readable language is provided for defining access policy rules. Rules in this language are converted in an automated fashion into filters applied within the various subsystems and components in a multi-layer security system. Network users are authenticated by an access control security system that obtains basic information about that user. Based on the user ID, a set of abstract policies can be retrieved. The retrieved policies are associated with the user and the groups associated with that user. Based on the retrieved rules, a set of rules for multiple layers of the network are generated and applied to those subsystems. Two or more of the subsystems may be placed in series with different types of processing occurring in each of the subsystems, reducing the workload of subsequent subsystems.

Claims17

Dependent claims

A method of providing secure access via a network device, the method comprising:

(a) receiving, by a processor of the device intermediary to a client and one or more servers, a request of a user to access a server, the device controlling access via a plurality of security layers, each of the plurality of security layers operating at a different layer of network communications;
(b) generating, by a policy engine executing on the processor of the device, an access rule for the user for each of the plurality of security layers based on a set of access policies corresponding to the user;
(c) converting, by the policy engine executing on the processor of the device, each access rule for each of the plurality of security layers to a user specific filter for a corresponding security layer;
(d) installing, by the processor of the device, each user specific filter to the corresponding security layer of the device;
(e) determining, by a first user specific filter of the device for a first security layer corresponding to one layer of network communication, the user is permitted to access a resource;
and
(f) determining, by a second user specific filter of the device for a second security layer corresponding to a second layer of network communication, the user is not permitted to access a resource.

4 more elements

A system of providing secure access via a network device, the system comprising:

a device intermediary to a client and one or more servers, receiving a request of a user to access a server, the device controlling access via a plurality of security layers, each of the plurality of security layers operating at a different layer of network communications;
a hardware processor of the device;
and
a policy engine executing on the hardware processor of the device generating an access rule for the user for each of the plurality of security layers based on a set of access policies corresponding to the user and converts each access rule for each of the plurality of security layers to a user specific filter for a corresponding security layer;
and
wherein the hardware processor of the device installs each user specific filter to the corresponding security layer of the device;
and wherein
a first user specific filter of the device for a first security layer corresponding to one layer of network communication determines that the user is permitted to access a resource;
and
a second user specific filter of the device for a second security layer corresponding to a second layer of network communication determines that the user is not permitted to access a resource.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/873,042Filed 31 Aug 2010 · continuation
Priority: 28 May 2003
Published: US 2010/0325697 A123 Dec 2010
Granted: 3 Sep 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/0263
Filtering policies: rule management
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
H04L 63/102
For controlling access to devices or network resources: entity profiles

Family

Application60/473,961Us provisional application · filed 28 May 2003
Application10/857,224Parent of this continuation · filed 28 May 2004
US 2010/0325697 A1Pre-grant publication · published 23 Dec 2010
US 7,900,240 B2Parent of this continuation
US 2004/0243835 A1Published application
US 8,528,047 B2This patent

From the US filing history. Foreign family members aren’t listed.