Patent Application
20090327497
A corporation or the like (e.g., an enterprise) wants to give its personnel access to its network, including direct (local) and remote access. However, there are multiple considerations as to what type of access is allowed, depending on the location of the user, the user's identity, the security state (health) of the requesting device and so on.
In many organizations, more and more people need to work from various locations, sometimes temporarily, and sometimes or on a regular basis. Such locations include locally (within the company), home, a friend's personal computer, an Internet kiosk in an airport or hotel, a branch office, another company (e.g., partner or vendor), a wireless hotspot, and so forth.
In general, each of these locations has a different access method associated with it, such as full tunnel IPSec or SSL-VPN, Web Publishing, Terminal Service Gateway, and so forth. This makes it complicated for end users to connect, as each user needs to consider which method to use from each scenario, and remember what steps are needed to gain access.
This Summary is provided to introduce a selection of representative concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used in any way that would limit the scope of the claimed subject matter.
Briefly, various aspects of the subject matter described herein are directed towards a technology by which a connection to a network (e.g., enterprise, corporate, public, home and so forth) is seamlessly made from the perspective of the user of a client device. Upon detecting a need for a connection to a network, location network reachability data corresponding to the client device location is determined, and used with policy information to obtain a list of available connection methods. An available connection method from the list is selected, and an attempt is made to establish a connection via that connection method. If the attempt fails, a different connection method is automatically selected for another attempt, and so on, until a connection method succeeds. Additional seamlessness is provided via a credentials vault, by which stored credentials are accessed and used in association with the access method.
Other advantages may become apparent from the following detailed description when taken in conjunction with the drawings.
The present invention is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:
Various aspects of the technology described herein are generally directed towards allowing users to seamlessly access a network, through a process that automatically detects a user's desire to access a network location, and automatically attempts to use an access method that is appropriate given the user's current location. Note that as used herein, “seamless” and the like does not mean that the user only has to indicate the network destination and never do anything else to gain access. For example, sometimes a user may have to insert a smartcard, type in credentials, and so forth, although stored credentials may be retrieved and automatically applied on behalf of the user, and such retrieved credentials may often succeed without needing further user participation.
In one aspect, a user indicates a desired destination, and transparent to the user, when the destination is a network location, an attempt to reach the destination occurs seamlessly. For example, the mechanisms described herein may traverse the following connectivity methods, one by one, until reaching availability:
The logic may bypass an actual connection attempt based upon existing knowledge; for example, if known that a user is not connected via the LAN, the other access methods may be attempted, in order. Further, as part of this logic, the proper authentication method is used with each of the access methods. For example, if a specific access method requires the use of smart card authentication, and the user is trying to access the network from a location where smart card is not available (e.g., an internet kiosk), then the mechanisms revert to an access method that uses a less strict authentication method at the expense of a reduced access level.
While some of the examples described herein are directed towards various user locations and various access methods, it is understood that these are only examples. For example, other locations and/or ways to connect may be available, and other access methods including those not yet developed may be used in addition to or instead of one or more other access methods. As such, the present invention is not limited to any particular embodiments, aspects, concepts, structures, functionalities or examples described herein. Rather, any of the embodiments, aspects, concepts, structures, functionalities or examples described herein are non-limiting, and the present invention may be used various ways that provide benefits and advantages in computing and networking in general.
Turning to the drawings,
In
For remote access, a unified access gateway server 110 is shown in this example network. Among other aspects, the unified access gateway server 110 is able to check the health of client endpoints, and via granular access, may differentiate users based on each user's identity and a health statement regarding their current client endpoint device's state, such as whether patches, antivirus software and so on are properly installed and updated.
Step 204 represents determining providing the client with any needed software, such as an agent that is used for health inspection, and/or the client components that are used for seamless network connectivity, as described below with reference to
Step 206 represents requesting that the client perform a health check, e.g., run the agent, to receive a report. If the health is not good as evaluated by step 210, then the client access attempt is limited (or rejected). In the example of
If the health check is good, step 214 allows access based on network policy. For example, the user's identity is one criterion that determines a level of access, and as described herein, an access level may be based on the access method in use, as some are more secure than others.
When an outbound request is made to a destination 334, a communication interceptor mechanism 336 intercepts the communication and determines whether it is aimed towards an internal network resource. If so, and a connection is needed, the communication interceptor mechanism 336 communicates with a connectivity establisher mechanism 338 to direct that a connection be established.
The connectivity establisher mechanism 338 invokes a policy advisor 340 that advises what connectivity methods are available, based on the policy factors in conjunction with the actual location. Based on the available methods returned (e.g., in a listed order), connectivity establisher mechanism 338 accesses a credentials vault 342 that stores one or more sets of credentials to be used for establishing the connection.
The connectivity establisher obtains the appropriate credentials, and attempts to establish a connection to the network using one of the available and allowed methods. When connected, a connectivity gauge 344 indicates (e.g., via a user interface) the connectivity method in use and other available access methods.
By way of example as generally represented in the flow diagram of
As represented via step 406, the connectivity establisher mechanism 338 consults with the network location awareness mechanism 332 in order to decide whether the endpoint is in the network or outside of it. Note that a further differentiation may be made between different remote endpoints, such as branch-office, home network, hotel, friend, kiosk and so forth in any event, location-based reachability data is returned. At step 408, the connectivity establisher mechanism 338 notifies the policy advisor 340 of the network address that the endpoint is trying to access, and also supplies the network location data. The policy advisor 340 returns with a list of allowed access methods, in order of precedence, as generally represented by step 410.
At step 412, the connectivity establisher mechanism 338 accesses the credentials vault 342 for the credentials that are required to establish a connection to the network. If such credentials do not exist (step 414), the user is prompted to enter credentials (step 416), which are also stored on the credentials vault 342 for future use. When obtained, the credentials are used in the access attempt at step 418.
If access does not succeed at step 420, it may be because the credentials were wrong, e.g., typed incorrectly if manually entered, or changed in some other way relative to those in the vault, e.g., via a different computer. If so, step 418 returns to step 416 to get the credentials.
Access also may not succeed because of the access method used. If so, step 418 returns to step 410 to get the next method on the list and attempt access with that method.
Once successful and the connectivity establisher mechanism 338 has verified a connection to the network, it indicates this state to the connectivity gauge 344, which in turn reflects the status to the user. This is represented via step 422.
Thus, to summarize the seamless connectivity operation, when the user (e.g., via an application) enters a destination address, the communication is intercepted. If identified as aimed toward an resource, the connectivity establisher mechanism 338 checks the network location and policy compliance, and starts attempting to establish connectivity. Once challenged with an authentication request, the connectivity establisher mechanism 338 accesses the credentials vault and authenticates of the user's behalf.
Seamless connectivity is thus achieved by making connectivity decisions based on the network location, the device's health and the security policy of the organization. Failure handling logic (built into step 420 of
The invention is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to: personal computers, server computers, hand-held or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, embedded systems, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
The invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and so forth, which perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in local and/or remote computer storage media including memory storage devices.
With reference to
The computer 510 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by the computer 510 and includes both volatile and nonvolatile media, and removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by the computer 510. Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above may also be included within the scope of computer-readable media.
The system memory 530 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 531 and random access memory (RAM) 532. A basic input/output system 533 (BIOS), containing the basic routines that help to transfer information between elements within computer 510, such as during start-up, is typically stored in ROM 531. RAM 532 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 520. By way of example, and not limitation,
The computer 510 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,
The drives and their associated computer storage media, described above and illustrated in
The computer 510 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 580. The remote computer 580 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 510, although only a memory storage device 581 has been illustrated in
When used in a LAN networking environment, the computer 510 is connected to the LAN 571 through a network interface or adapter 570. When used in a WAN networking environment, the computer 510 typically includes a modem 572 or other means for establishing communications over the WAN 573, such as the Internet. The modem 572, which may be internal or external, may be connected to the system bus 521 via the user input interface 550 or other appropriate mechanism. A wireless networking component 574 such as comprising an interface and antenna may be coupled through a suitable device such as an access point or peer computer to a WAN or LAN. In a networked environment, program modules depicted relative to the computer 510, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,
An auxiliary subsystem 599 (e.g., for auxiliary display of content) may be connected via the user interface 550 to allow data such as program content, system status and event notifications to be provided to the user, even if the main portions of the computer system are in a low power state. The auxiliary subsystem 599 may be connected to the modem 572 and/or network interface 570 to allow communication between these systems while the main processing unit 520 is in a low power state.
While the invention is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the invention.
