Patent ID: 7512970

Claim:
A method for controlling access to a device, the method comprising: receiving a request for access to the device from a host, wherein the request for access includes host credentials describing a state of the host with respect to its execution of an anti-virus application; forwarding the request for access from said device to a first server; initiating a posture validation session between an authentication, authorization and accounting (AAA) server and a posture validation server, said posture validation session utilizing a host credentials authorization protocol (HCAP); the posture validation server being operated by an application vendor that provides the anti-virus application executed by the host and is utilized to enforce a network access policy requiring a virus scan of the host with the anti-virus application within a predetermined preceding period; determining whether to allow access by said host to said device by said first server based on a result from said posture validation session, wherein the determining whether to allow access includes: creating, from the host credentials, one or more attribute-value pairs each containing an attribute and a value of the attribute, each attribute-value pair conveying information pertaining to the state of the host with respect to its execution of the anti-virus application; creating a posture validation request message and sending the posture validation request message to the posture validation server, the posture validation request message including a Vendor AppType frame including (i) a vendor identifier identifying the vendor, (ii) an application type field describing an anti-virus application type, and (iii) the attribute value pairs created from the host credentials; receiving a posture validation response message from the posture validation server, the posture validation response message including a result for the posture validation request message, the result providing information pertaining to whether the host is in compliance with the network access policy; and determining, based on the result in the posture validation response message, whether the host is in compliance with the network access policy; and when it is determined that access is allowed, allowing access by said host to said device; and when it is determined that access is not allowed, disabling access by said host to said device.