# US 8,543,696 B1 · Network access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,696 B1 - Document ID: US8543696B1 - Status: Granted - Kind: B1 - Application number: 13/633,349 - Filed: 2012-10-02 - Granted: 2013-09-24 - Earliest claimed: 2012-10-02 - Assignees: Appsense Limited - Applicants: AppSense Limited - Inventors: Mark Williamson - Web page: https://patentgrep.com/patent/US8543696B1 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed is a method of administering an access policy during a virtual desktop session including steps of: determining open inbound connection information; determining current open outbound connection information; and evaluating an access policy, wherein the open inbound and outbound connection information are assessed to determine whether the open inbound connection is from an insecure environment and the open outbound connection is to a protected web page or resource only accessible to a connection from a secure environment, whereby if it is so determined, the open outbound connection is disconnected or redirected to a second web page or resource accessible to a connection from the insecure environment in accordance with the access policy. ## Claims ### Claim 1 A method, comprising: monitoring an open inbound connection from a computing device to a virtual desktop session to define open inbound connection information relating to the open inbound connection, the open inbound connection information including a connection type used for connecting the computing device to the virtual desktop session, or a connection port or network address assigned to a server providing the open inbound connection; monitoring an open outbound connection from the virtual desktop session to define open outbound connection information relating to the open outbound connection, the open outbound connection information including a Uniform Resource Locator (URL), or a connection port or network address to a resource; evaluating the open inbound connection information and the open outbound connection information based, at least in part, on an access policy to determine whether (1) the open inbound connection is from an insecure environment and (2) the open outbound connection is to a protected web page or resource accessible from a secure environment; and redirecting the open outbound connection to an unprotected web page or resource accessible from the insecure environment in accordance with the access policy, if the open inbound connection is from the insecure environment and the open outbound connection is to a protected web page or resource accessible from the secure environment. ### Claim 2 (depends on 1) The method of claim 1, further comprising detecting a change in the connection type used for connecting the computing device to the virtual desktop session. ### Claim 3 (depends on 2) The method of claim 2, wherein the evaluating is performed in response to detecting the change in the connection type. ### Claim 4 (depends on 1) The method of claim 1, further comprising detecting a change in the connection port or network address assigned to the server providing the inbound connection. ### Claim 5 (depends on 4) The method of claim 4, wherein the evaluating is performed in response to detecting the change in the connection port or network address. ### Claim 6 (depends on 1) The method of claim 1, further comprising detecting a change in the open inbound connection in response to a change in a state of the virtual desktop session, the state of the virtual desktop session including a suspension or stand-by mode. ### Claim 7 (depends on 6) The method of claim 6, wherein the evaluating is performed in response to detecting the change in the open inbound connection. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining a location of the computing device based on the open inbound connection information and to be either in the secure environment or in the insecure environment, the evaluating being based on the location of the computing device. ### Claim 9 (depends on 1) The method of claim 1, wherein: the secure environment includes a first network of computing devices implementing a predetermined access policy; and the insecure environment includes a second network of computing devices not implementing the predetermined access policy. ### Claim 10 (depends on 1) The method of claim 1, wherein: the secure environment includes a first network of devices located inside a predetermined physical boundary; and the insecure environment includes a second network of devices located outside a predetermined physical boundary. ### Claim 11 (depends on 1) The method of claim 1, further comprising: classifying the computing device as being insecure based on at least one open inbound connection from the computing device being from the insecure environment. ### Claim 12 (depends on 1) The method of claim 1, wherein the open inbound connection is from a plurality of open inbound connections, the monitoring includes monitoring each open inbound connection from the plurality of open inbound connections. ### Claim 13 A computer system, comprising: a first computing device having at least one of a memory and a processor; and a second computing device having at least one of a memory and a processor, the first computing device is configured to establish an inbound connection to the second computing device from an insecure environment, the second computing device is configured to establish the inbound connection with the first computing device and provide a virtual desktop session for the first computing device, the first computing device is configured to establish an outbound connection from the virtual desktop session to a protected resource or Uniform Resource Locator (URL) intended for a secure environment, the second computing device is configured to determine that the inbound connection is from the insecure environment, the second computing device is configured, to disconnect the outbound connection to the protected resource, based on the inbound connection being from the insecure environment. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the outbound connection is a first outbound connection, the second computing device is configured to establish a second outbound connection when the first outbound connection is disconnected, the second computing device configured to redirect data for the first outbound connection to the second outbound connection. ### Claim 15 A method, comprising: monitoring an open inbound connection from a computing device to a virtual desktop session to define open inbound connection information relating to the open inbound connection, the open inbound connection information including a connection type used for connecting the computing device to the virtual desktop session, or a connection port or network address assigned to a server providing the open inbound connection; monitoring an open outbound connection from the virtual desktop session to define open outbound connection information relating to the open outbound connection, the open outbound connection information including a Uniform Resource Locator (URL), or a connection port or network address to a resource; and selecting an access policy from a plurality of access policies based, at least in part, on a connection protocol associated with the open inbound connection; determining an allowed level of access for the virtual desktop session based, at least in part, on the access policy; and disallowing access from the virtual desktop session to a secure resource based, at least in part, on the allowed level of access. ### Claim 16 (depends on 15) The method of claim 15, wherein the connection protocol is based on the virtual desktop session being implemented as, at least one of, a Virtual Desktop Infrastructure (VDI) session or a Remote Desktop Services (RDS) session. ### Claim 17 (depends on 15) The method of claim 15, wherein the open inbound connection is from a plurality of open inbound connections, the method further comprising: classifying the computing device as being from an insecure environment based on at least one open inbound connection from the plurality of open inbound connections being from the insecure environment. ### Claim 18 (depends on 15) The method of claim 15, further comprising detecting a change in the open inbound connection, in response to a change in the connection protocol, the selecting being in response to the detecting. ### Claim 19 (depends on 15) The method of claim 15, further comprising: determining a location of the computing device based on the open inbound connection information to be either in a secure environment or in an insecure environment, the selecting being based on the location of the computing device. ### Claim 20 (depends on 18) The method of claim 18, wherein: the secure environment includes a first network of computing devices implementing a predetermined access policy; and the insecure environment includes a second network of computing devices not implementing the predetermined access policy.