Incremental compliance remediation

Patent metadata

Field	Value
Publication number	US-10652242-B2
Application number	US-201313839112-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 15, 2013
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

Disclosed are various embodiments for enforcing device compliance parameters by inhibiting access to devices, networks or resources. Methods may include associating a compliance rule with a client device. If the compliance rule is violated, a setting associated with the client device may be altered. The altered setting may inhibit access to the client device, a network, a client device resource and/or a network resource. For example, necessary password complexities may be increased, password lifetimes may be decreased and/or resources may be restricted based on a geofence, a time of day and/or a day of the week.

First claim

Therefore, the following is claimed:

1. A method, comprising:
receiving, using at least one computing device, a request from a client device to access a first networked resource;
determining, using the at least one computing device, that a second networked resource is associated with accessing the first networked resource for the client device based on a resource group identifier, the resource group identifier being associated with a pairing of a user credential and a device identifier associated with the client device;
associating, using the at least one computing device, a compliance rule with the client device based on the resource group identifier, the compliance rule being associated with the first networked resource and the second networked resource;
determining, using the at least one computing device, whether the compliance rule is violated;
responsive to determining that the compliance rule is violated, determining, using the at least one computing device, whether the compliance rule is associated with an alternative setting that is more stringent than a current setting associated with the client device;
responsive to determining that the compliance rule is associated with the alternative setting that is more stringent than the current setting associated with the client device, changing, using the at least one computing device, the current setting to the alternative setting, wherein changing the current setting to the alternative setting comprises increasing a password complexity requirement, wherein increasing the password complexity requirement causes access to at least one of the client device, a network, a client device resource, or a network resource to be restricted until a user of the client device has configured a new password that complies with the password complexity requirement; and
responsive to determining that the compliance rule is not associated with the alternative setting that is more stringent than the current setting associated with the client device, causing, using the at least one computing device, access to at least one of the client device, the network, the client device resource, or the network resource to be restricted.

2. The method of claim 1 , wherein the access is restricted based on at least one of a location, a date, a time of day, or a day of week.

3. The method of claim 1 , wherein the at least one computing device is the client device.

4. The method of claim 1 , wherein the at least one computing device comprises a remote server.

5. The method of claim 1 , wherein increasing the required password complexity is performed based on at least one instruction provided by a remote server.

6. The method of claim 1 , wherein at least one of the client device resource or the network resource comprises at least one of an application, a computer folder, a data file, an electronic document, or a network address.

7. The method of claim 1 , further comprising generating, using the at least one computing device, an alert indicative of the required password complexity being increased.

8. A computing device, comprising:
a processor; and
a storage device accessible to the processor, wherein the storage device comprises a plurality of program instructions that, upon execution by the processor, cause the processor to at least:
receive a request from a client device to access a first networked resource;
determine that a second networked resource is associated with accessing the first networked resource for the client device based on a resource group identifier, the resource group identifier being associated with a pairing of a user credential and a device identifier associated with the client device;
associate a compliance rule with the client device based on the resource group identifier, the compliance rule being associated with the first networked resource and the second networked resource;
detect whether the compliance rule is violated;
in response to detecting that the compliance rule is violated, determine whether the compliance rule is associated with an alternative setting that is more stringent than a current setting;
in response to determining that the compliance rule is associated with the alternative setting that is more stringent than the current setting, change the current setting to the alternative setting, wherein changing the current setting to the alternative setting comprises increasing a password complexity requirement, wherein increasing the password complexity requirement causes access to at least one of the computing device, a network, a computing device resource, or a network resource to be restricted until a new password that complies with the password complexity requirement has been created; and
responsive to determining that the compliance rule is not associated with the alternative setting that is more stringent than the current setting associated with the client device, cause access to at least one of the client device, the network, the client device resource, or the network resource to be restricted.

9. The computing device of claim 8 , wherein the access is restricted based on at least one of a location, a date, a time of day, or a day of week.

10. The computing device of claim 9 , wherein the access is restricted based on a location, and the access is restricted by at least one of:
blocking an outgoing call;
blocking an outgoing message;
routing an inbound call to an alternate number, an alternate address, or an alternate device; or
providing an automated response for an inbound communication.

11. The computing device of claim 9 , wherein the access is restricted based on a location, and wherein the access is restricted by at least one of:
blocking a first outgoing call via a first carrier;
routing a second outgoing call to an NFC-enabled device; or
routing an incoming call to the NFC-enabled device.

12. The computing device of claim 9 , wherein the access is restricted by at least one of:
blocking an outgoing call during a first predetermined time period;
blocking an outgoing message during a second time period;
routing a first inbound call to an alternate number, an alternate address, or an alternate device during a third predetermined time period; or
providing an automated response for an inbound communication during a fourth time period.

13. The computing device of claim 8 , wherein the processor is further configured to at least one of:
determine whether the compliance rule is violated; or
receive an indication that the compliance rule is violated from a remote server.

14. The computing device of claim 8 , wherein changing the current setting to the alternative setting further comprises decreasing a password lifetime, and wherein the password lifetime is decreased based on a plurality of instructions provided by a remote server.

15. The computing device of claim 8 , wherein the plurality of program instructions are further configured to cause the processor to at least send an alert to a remote server including an indication of a setting being altered.

16. A system comprising:
a server device comprising a processor; and
a storage device that is accessible to the processor, wherein the storage device comprises program instructions that, upon execution by the processor, cause the processor to at least:
receive a request from a client device to access a first networked resource;
determine that a second networked resource is associated with accessing the first networked resource for the client device based on a resource group identifier, the resource group identifier being associated with a pairing of a u

Assignees

• Airwatch Llc

Inventors

• Dabbiere Alan
• Stuntebeck Erich

Classifications

• G06Q10/0631

  Resource planning, allocation, distributing or scheduling for enterprises or organisations · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title