Dynamic enterprise boundary determination for external mobile devices

Patent metadata

Field	Value
Publication number	US-9307451-B1
Application number	US-201414558388-A
Country	US
Kind code	B1
Filing date	Dec 2, 2014
Priority date	Dec 2, 2014
Publication date	Apr 5, 2016
Grant date	Apr 5, 2016

Abstract

Methods and arrangements for according access of a mobile device to an enterprise network. the presence of a mobile device relative to an enterprise network is detected, the enterprise network including a plurality of defined zones, wherein each zone is associated with a security level and with one or more resources. An agent of the mobile device is negotiated with to accord access to at least one of the defined zones. The negotiating includes: assessing at least one security constraint relative to the mobile device; and thereupon designating at least one zone to be accessible to the mobile device. Other variants and embodiments are broadly contemplated herein.

First claim

What is claimed is:

1. A method comprising:
detecting the presence of a mobile device relative to an enterprise network; and
automatically negotiating with an agent of the mobile device to accord access to at least one defined zone associated with one or more resources of the enterprise network, wherein the at least one defined zone comprises a plurality of zones defined by security level and with respect to accessibility of at least one resource of the enterprise network;
said negotiating comprising:
assigning the mobile device to a quarantine zone;
examining the mobile device for policy compliance;
assessing at least one security constraint of the mobile device; and
thereupon designating at least one zone to be accessible to the mobile device; and

assigning one or more credentials to the mobile device subsequent to said negotiating, wherein the one or more credentials are employable in according future access of the mobile device to one or more of the defined zones.

2. The method according to claim 1 , wherein the at least one security constraint comprises at least one policy associated with the mobile device.

3. The method according to claim 1 , wherein the at least one security constraint comprises at least one policy associated with the enterprise network.

4. The method according to claim 1 , wherein said negotiating comprises inputting from the mobile device a list comprising one or more service requests.

5. The method according to claim 1 , comprising issuing a request to the mobile device for remediation action in response to examining the mobile device for policy compliance and detecting at least one item of non-compliance.

6. The method according to claim 5 , comprising according access to at least one defined zone in response to a notification of successful remediation action from the mobile device.

7. The method according to claim 1 , wherein said negotiating comprises detecting at least one change associated with the mobile device and re-negotiating at least one credential associated with the mobile device.

8. The method according to claim 7 , wherein the at least one change comprises one or more of: a state of the mobile device, and a resource requirement of the mobile device.

9. The method according to claim 1 , wherein said negotiating comprises dynamically determining the suitability of one or more enterprise resources to be accessed by the mobile device.

10. An apparatus for according access of a mobile device to an enterprise network, said apparatus comprising:
at least one processor; and
a non-transitory computer readable storage medium having computer readable program code embodied therewith and executable by the at least one processor, the computer readable program code comprising:
computer readable program code configured to detect the presence of a mobile device relative to the enterprise network;
computer readable program code configured to automatically negotiate with an agent of the mobile device to accord access to at least one defined zone associated with one or more resources of the enterprise network, wherein the at least one defined zone comprises a plurality of zones defined by security level and with respect to accessibility of at least one resource of the enterprise network;
the negotiating comprising:
assigning the mobile device to a quarantine zone;
examining the mobile device for policy compliance;
assessing at least one security constraint relative to the mobile device; and
thereupon designating at least one zone to be accessible to the mobile device; and

assigning one or more credentials to the mobile device subsequent to the negotiating, wherein the one or more credentials are employable in according future access of the mobile device to one or more of the defined zones.

11. A computer program product for according access of a mobile device to an enterprise network, said computer program product comprising:
a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to detect the presence of a mobile device relative to the enterprise network;
computer readable program code configured to automatically negotiate with an agent of the mobile device to accord access to at least one defined zone associated with one or more resources of the enterprise network, wherein the at least one defined zone comprises a plurality of zones defined by security level and with respect to accessibility of at least one resource of the enterprise network;
the negotiating comprising:
assigning the mobile device to a quarantine zone;
examining the mobile device for policy compliance;
assessing at least one security constraint relative to the mobile device; and
thereupon designating at least one zone to be accessible to the mobile device; and

assigning one or more credentials to the mobile device subsequent to the negotiating, wherein the one or more credentials are employable in according future access of the mobile device to one or more of the defined zones.

12. The computer program product according to claim 11 , wherein the at least one security constraint comprises at least one policy associated with the mobile device.

13. The computer program product according to claim 11 , wherein the at least one security constraint comprises at least one policy associated with the enterprise network.

Assignees

• IBM

Inventors

• Kodeswaran Palanivel
• Mukherjea Sougata
• Naldurg Prasad G
• Ramakrishna Venkatraman
• Seshadri Arvind

Classifications

• H04W8/005

  Discovery of network devices, e.g. terminals · CPC title

• H04W48/02 Primary

  Access restriction performed under specific conditions · CPC title

• H04W28/20 Primary

  Negotiating bandwidth · CPC title

• H04W12/08

  Access security · CPC title

• H04W8/18

  Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data · CPC title