Policy based compliance management and remediation of devices in an enterprise system

Patent metadata

Field	Value
Publication number	US-9749311-B2
Application number	US-201514690045-A
Country	US
Kind code	B2
Filing date	Apr 17, 2015
Priority date	Sep 24, 2014
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

The present disclosure relates generally to managing compliance of remote devices that access an enterprise system. More particularly, techniques are disclosed for using a compliance policy to manage remediation of non-compliances of remote devices that access an enterprise system. A device access management system may be implemented to automate remediation of non-compliances of remote devices accessing an enterprise system. Remediation may be controlled based on different levels of non-compliance, each defined by one or more different non-compliances. In some embodiments, a level of non-compliance may be conditionally defined by one or more user roles for which non-compliance is assessed. Access to computing resources of an enterprise system may be controlled for a remote device based on compliance of the remote device. Access may be inhibited for those resources not permitted during a time period of a non-compliance.

First claim

What is claimed is:

1. A method comprising:
identifying a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;
detecting, based on the compliance policy, a non-compliance of the remote device;
assessing, by a computer system, based on the compliance policy, a level of non-compliance of the remote device;
establishing, based on the compliance policy and the level of non-compliance, a time period for remediation of the non-compliance;
receiving a request to access a computing resource in the enterprise computer system;
providing access to the computing resource based on the level of non-compliance;
inhibiting access to the computing resource in the enterprise computer system based on the level of non-compliance and based on determining that the time period for remediation of the non-compliance has expired; and
instructing the remote device to perform an action to remedy the non-compliance based on determining that the time period for remediation of the non-compliance has expired.

2. The method of claim 1 , wherein the compliance policy indicates the action to remedy the non-compliance and indicates a time period for performing the action.

3. The method of claim 1 , wherein the compliance policy indicates a condition for the non-compliance, and wherein the condition is based on a first user role, and wherein the compliance policy identifies the time period for remediation of the non-compliance and the action for remedying the non-compliance based on determining that the condition is satisfied.

4. The method of claim 3 , further comprising:
identifying a user role associated with an identity of a user of the remote device, the user role enabling the identity to access the enterprise computer system; and
determining that the condition is satisfied based on the user role matching the first user role.

5. The method of claim 3 , further comprising:
determining one or more device attributes of the remote device and a geolocation of the remote device, wherein the condition is further based on a remote device attribute and a remote device geolocation; and
determining that the condition is satisfied based on the remote device attribute matching a device attribute of the remote device and based on the geolocation of the remote device matching the remote device geolocation.

6. The method of claim 1 , wherein the non-compliance of the remote device includes altering a hardware configuration of the remote device.

7. The method of claim 1 , wherein the non-compliance of the remote device includes installing a blacklisted application on the remote device.

8. The method of claim 1 , wherein the non-compliance of the remote device includes use of the remote device in a manner that is non-compliant with a policy related to registration of the remote device to access the enterprise computer system.

9. The method of claim 1 , wherein the non-compliance of the remote device includes adjusting a security configuration of the remote device in a manner that is non-compliant with a security policy for accessing the enterprise computer system.

10. The method of claim 1 , further comprising:
wherein access to the computing resource is provided based on determining that the level of non-compliance satisfies a compliance threshold, and wherein access to the computing resource is inhibited based on determining that the level of non-compliance does not satisfy a compliance threshold.

11. The method of claim 1 , further comprising:
identifying a second compliance policy for using the remote device with the enterprise computer system, wherein the compliance policy is a first compliance policy that is different from the second compliance policy;
detecting a second non-compliance of the remote device based on the second compliance policy; and
wherein the time period for remediation of the non-compliance is established based on selecting a first time period from one of the first compliance policy or the second compliance policy.

12. The method of claim 11 , further comprising:
assessing, based on the second compliance policy, a second level of non-compliance of the remote device, wherein the level of non-compliance corresponds to a first level of non-compliance, and wherein the time period for remediation of the non-compliance is selected based on comparing the first level of non-compliance or the second level of non-compliance.

13. The method of claim 1 , wherein the action includes preventing access to use of the remote device with the enterprise computer system.

14. The method of claim 1 , wherein the action includes altering registration of the remote device to access the enterprise computer system.

15. A system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:
identify a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;
detect, based on the compliance policy, a non-compliance of the remote device;
assess, by a computer system, based on the compliance policy, a level of non-compliance of the remote device;
establish, based on the compliance policy and the level of non-compliance, a time period for remediation of the non-compliance;
receive a request to access a computing resource in the enterprise computer system;
provide access to the computing resource based on the level of non-compliance;
inhibit access to the computing resource in the enterprise computer system based on the level of non-compliance and based on determining that the time period for remediation of the non-compliance has expired; and
instruct the remote device to perform an action to remedy the non-compliance based on determining that the time period for remediation of the non-compliance has expired.

16. The system of claim 15 , wherein the instructions,
when executed by the one or more processors, further cause the one or more processors to:
identify a second compliance policy for using the remote device with the enterprise computer system, wherein the compliance policy is a first compliance policy that is different from the second compliance policy;
detect a second non-compliance of the remote device based on the second compliance policy; and
assess, based on the second compliance policy, a second level of non-compliance of the remote device, wherein the level of non-compliance corresponds to a first level of non-compliance, and
wherein the time period for remediation of the non-compliance is established based on selecting a first time period from one of the first compliance policy or the second compliance policy.

17. A method comprising:
identifying a compliance policy for using a remote device with an enterprise computer system, wherein the remote device is registered to access the enterprise computer system;
detecting, by a computer system, a non-compliance of the remote device based on the compliance policy;
categorizing the non-compliance into a level of non-compliance based on the compliance policy and establishing a time period for remediation of the non-compliance;
allowing access to a first computing resource in the enterprise computer system despite the level of non-compliance;
inhibiting access to a second computing resource in the enterprise computer system based on the level of non-compliance;
determining that the time period for remediation of the non-c

Assignees

• Oracle Int Corp

Inventors

• Jayanti Venkata Bhagavati Kumar
• Maheshwari Harsh
• Mohamad Abdul Mohamad Raja Gani
• Kandasamy Parthipan

Classifications

• H04W4/60

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04W4/50

  Service provisioning or reconfiguring · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title