Configuring network security based on device management characteristics

Patent metadata

Field	Value
Publication number	US-11290425-B2
Application number	US-201615012185-A
Country	US
Kind code	B2
Filing date	Feb 1, 2016
Priority date	Feb 1, 2016
Publication date	Mar 29, 2022
Grant date	Mar 29, 2022

Abstract

Disclosed are various examples for configuring network security based on device management characteristics. In one example, a specification of a set of network resources on an internal network is received from an administrator client. The set of network resources are those network resources that a particular application executed in client devices on an external network should be authorized to access. A gateway from the external network to the internal network is then configured to permit the particular application to have access to the set of network resources.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying at least one program executable in at least one computing device, the at least one program, when executed by the at least one computing device, being configured to cause the at least one computing device to at least:
determine a plurality of security groups for display on an administrator client based on security group data from a gateway data store, the security group data comprising a mapping of the security groups to a plurality of network address ranges for a plurality of virtual network segments in an internal network;
display a user interface that is configured for uploading and configuring a particular application to be added to an application catalog, the user interface comprises an upload component for receiving a package containing the particular application and a selection component for specifying a subset of the plurality of security groups for the particular application;
receive, from the administrator client, a specification of the subset of the plurality of security groups for the particular application executed in client devices on an external network, the subset of the security groups comprising: a compliant security group for compliant client devices, and a default security group for non-compliant client devices;
configure a gateway that connects the external network to the internal network, the gateway being configured to permit the particular application to access network resources based on the subset of the security groups, wherein the compliant security group is associated with a first set of network resources, and the default security group is associated with a second set of network resources;
establish a virtual private network tunnel with a client device based on an evaluation of compliance of the client device, wherein the evaluation is based on: at least one compliance rule, and device management attribute data received from the client devices;
receive, from the administrator client, a specification of the at least one compliance rule that should be present on the client device on which the particular application is deployed in order to permit access to the first set of network resources; and
configure the gateway to verify that the client device complies with the at least one device management attribute before permitting the virtual private network tunnel to be assigned to a virtual network segment that provides access to the first set of network resources.

2. The non-transitory computer-readable medium of claim 1 , wherein the at least one device management attribute includes at least one of: a location of the client device, a user of the client device, an operating system of the client device, and a jailbreak status of the client device.

3. The non-transitory computer-readable medium of claim 1 , wherein when executed the at least one program further causes the at least one computing device to at least:
receive the package containing the particular application from the administrator client; and
configure the application catalog to make the particular application available for deployment to the client devices.

4. A system, comprising:
at least one computing device; and
at least one program executable by the at least one computing device, the at least one program configured to cause the at least one computing device to at least:
determine a plurality of security groups for display on an administrator client based on security group data from a gateway data store, the security group data comprises a mapping of the security groups to a plurality of network address ranges for a plurality of virtual network segments in an internal network;
display a user interface that is configured for uploading and configuring a particular application to be added to an application catalog, the user interface comprises an upload component for receiving a package containing the particular application and a selection component for specifying a subset of the plurality of security groups for the particular application;
receive, from the administrator client, a specification of the subset of the plurality of security groups for the particular application executed in client devices on an external network, the subset of the security groups comprising: a compliant security group for compliant client devices, and a default security group for non-compliant client devices;
configure a gateway that connects the external network to the internal network, the gateway being configured to permit the particular application to access network resources based on the subset of the security groups, wherein the compliant security group is associated with a first set of network resources, and the default security group is associated with a second set of network resources;
establish a virtual private network tunnel with a client device based on an evaluation of compliance of the client device, wherein the evaluation is based on: at least one compliance rule, and device management attribute data received from the client device;
receive, from the administrator client, a specification of the at least one compliance rule that should be present on the client device on which the particular application is deployed in order to permit access to the first set of network resources; and
configure the gateway to verify that the client device complies with the at least one device management attribute before permitting the virtual private network tunnel to be assigned to a virtual network segment that provides access to the first set of network resources.

5. The system of claim 4 , wherein configuring the gateway further comprises configuring the gateway to assign a network address meeting predefined criteria to a tunnel endpoint associated with the particular application, wherein network traffic from network addresses meeting the predefined criteria is permitted to be forwarded to the first set of network resources by the internal network.

6. The system of claim 4 , wherein the at least one device management attribute includes at least one of: a location of the client device, a user of the client device, an operating system of the client device, and a jailbreak status of the client device.

7. The system of claim 4 , wherein when executed the at least one program is further configured to cause the at least one computing device to at least configure the gateway to route network traffic from the particular application on the client device to the virtual network segment comprising the second set of network resources in response to determining, based on the evaluation, that the client device is a non-compliant device.

8. The system of claim 7 , wherein when executed the at least one program is further configured to cause the at least one computing device to at least receive a specification of the default network resource from the administrator client.

9. The system of claim 4 , wherein the gateway includes an endpoint for the virtual private network tunnel through the external network to the client device upon which the particular application is executed, and upon configuration the gateway is configured to assign a particular network address to the endpoint, wherein the internal network is configured to route network traffic from the particular network address to the virtual network segment of the internal network through which the first set of network resources are accessible.

10. The system of claim 4 , wherein the client devices are managed by an organization, and the internal network is operated by the organization.

11. The system of claim 4 , wherein when executed the at least one program is further configured to cause the at least

Assignees

• Airwatch Llc

Inventors

• Newell Craig Farley
• Shah Sulay
• Kwok Leung Tao
• Rykowski Adam

Classifications

• H04W4/50

  Service provisioning or reconfiguring · CPC title

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04W12/088

  using filters or firewalls · CPC title

• H04W12/082

  using revocation of authorisation · CPC title