# US 9,438,577 B2 · Query interface to policy server > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,577 B2 - Document ID: US9438577B2 - Status: Granted - Kind: B2 - Application number: 13/967,202 - Filed: 2013-08-14 - Published: 2013-12-26 - Granted: 2016-09-06 - Earliest claimed: 1997-03-10 - Assignees: Dell Software Inc. - Applicants: Dell Software Inc. - Inventors: Clifford Lee Hannel; Anthony May - Web page: https://patentgrep.com/patent/US9438577B2 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter uses a local copy of an access control data base to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL entity. The policy server assembles the information needed for the response to the query from various information sources, including source external to the policy server. ## Claims ### Claim 1 A method for end-to-end encryption, the method comprising: receiving an encrypted message at a first access filter in a virtual private network session, the data packet sent from a client device associated with the first access filter, the data packet addressed to a server associated with a second access filter, wherein there are one or more intermediate access filters between the first access filter and the second access filter, each intermediate access filter applying one or more access policies; executing instructions stored in memory of the first access filter, wherein execution of the instructions by a processor: decrypts the message based on a secret shared between the client device and the first access filter, wherein the decrypted message includes authentication information related to a user of the client device, verifies that the user of the client device is permitted to access the server based on the authentication information, and reencrypts the message based on a transport key shared between the first access filter and the second access filter, wherein the transport key is generated from public and private keys; and sending the reencrypted message through one or more intermediate access filters to the second access filter, wherein the one or more intermediate access filters allow the reencrypted message through based on authentication at the first access filter without requiring decryption at the respective intermediate access filter, wherein the second filter decrypts the reencrypted message sent through the one or more intermediate access filters and performs IP-level access checking on an original header before further reencrypting the message for the server, wherein the original header is encrypted while passing through the one or more intermediate access filters, wherein the only unencrypted IP address associated with the reencrypted message are associated with the first access filter or the second access filter, and wherein the second access filter further reencrypts the message for the server. ### Claim 2 (depends on 1) The method of claim 1, wherein a tunnel is constructed on a path between the first access filter and the second access filter. ### Claim 3 (depends on 1) The method of claim 1, further comprising maintaining an access control database in memory, wherein the access control database stores identification and certification information for the client, the server, and the first and second access filters. ### Claim 4 (depends on 3) The method of claim 3, wherein the access control database further stores identification and certification information for the intermediate access filters along a path between the first and second access filters. ### Claim 5 (depends on 4) The method of claim 4, wherein the one or more access filters allow the session based on authentication at the first access filter. ### Claim 6 (depends on 1) The method of claim 1, wherein the transport key is encrypted. ### Claim 7 (depends on 1) The method of claim 1, further comprising configuring the client device by providing the client device with a certificate associated with the first access filter, wherein the first access filter is provided with a certificate associated with the client device. ### Claim 8 (depends on 1) The method of claim 1, wherein the second access filter determines that the reencrypted message sent through the one or more intermediate access filters is really from the first access filter before further reencrypting the message for the server. ### Claim 9 (depends on 1) The method of claim 1, wherein the second access filter determines that the reencrypted message sent through the one or more intermediate access filters has not been tampered with before further reencrypting the message for the server. ### Claim 10 A system for end-to-end encryption, the system comprising: a client device; a server; and a first access filter associated with the client device that: receives an encrypted message in a virtual private network session, the data packet sent from the client device, the data packet addressed to a server associated with a second access filter, wherein there are one or more intermediate access filters between the first access filter and the second access filter, each intermediate access filter applying one or more access policies, and executes instructions stored in memory, wherein execution of the instructions by a processor: decrypts the message based on a secret shared between the client device and the first access filter, wherein the decrypted message includes authentication information related to a user of the client device, verifies that the user of the client device is permitted to access the server based on the authentication information, and reencrypts the message based on a transport key shared between the first access filter and a second access filter associated with the server, wherein the transport key is generated from public and private keys; and sends the reencrypted message through one or more intermediate access filters to the second access filter, wherein the one or more intermediate access filters allow the reencrypted message through based on authentication at the first access filter without requiring decryption at the respective intermediate access filter, wherein the second filter decrypts the reencrypted message sent through the one or more intermediate access filters and performs IP-level access checking on an original header before further reencrypting the message for the server, wherein the original header is encrypted while passing through the one or more intermediate access filters, wherein the only unencrypted IP address associated with the reencrypted message are associated with the first access filter or the second access filter, and wherein the second access filter further reencrypts the message for the server. ### Claim 11 (depends on 10) The system of claim 10, further comprising the second access filter associated with the server. ### Claim 12 (depends on 10) The system of claim 10, wherein a tunnel is constructed on a path between the first access filter and the second access filter. ### Claim 13 (depends on 10) The system of claim 10, further comprising an access control database that stores identification and certification information for the client, the server, and the first and second access filters. ### Claim 14 (depends on 13) The system of claim 13, wherein the access control database further stores identification and certification information for the intermediate access filters along a path between the first and second access filters. ### Claim 15 (depends on 14) The system of claim 14, wherein the one or more access filters allow the session based on authentication at the first access filter. ### Claim 16 (depends on 10) The system of claim 10, wherein the transport key is encrypted. ### Claim 17 (depends on 10) The system of claim 10, wherein the client device is configured by providing the client device with a certificate associated with the first access filter, wherein the first access filter is provided with a certificate associated with the client device. ### Claim 18 A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for end-to-end encryption, the method comprising: receiving an encrypted message in a virtual private network session, the data packet sent from a client device associated with the first access filter, the data packet addressed to a server associated with a second access filter, wherein there are one or more intermediate access filters between the first access filter and the second access filter, each intermediate access filter applying one or more access policies; decrypting the message based on a secret shared between the client device and the first access filter, wherein the decrypted message includes authentication information related to a user of the client device; verifying that the user of the client device is permitted to access the server based on the authentication information; reencrypting the message based on a transport key shared between the first access filter and the second access filter, wherein the transport key is generated from public and private keys; and sending the reencrypted message through one or more intermediate access filters to the second access filter, wherein the one or more intermediate access filters allow the reencrypted message through based on authentication at the first access filter without requiring decryption at the respective intermediate access filter, wherein the second filter decrypts the reencrypted message sent through the one or more intermediate access filters and performs IP-level access checking on an original header before further reencrypting the message for the server, wherein the original header is encrypted while passing through the one or more intermediate access filters, wherein the only unencrypted IP address associated with the reencrypted message are associated with the first access filter or the second access filter, and wherein the second access filter further reencrypts the message for the server.