Patent ID: 7882538

Claim:
A method of controlling access to a remote network resource by a plurality of local endpoint devices, the method comprising: locally caching, with an intermediate device, a set of endpoint security information maintained by a remote server, wherein the locally cached set of endpoint security information specifies one or more policies to control access to a remote network resource by a plurality of local endpoint devices, wherein the policies comprise a plurality of user role policies and a plurality of endpoint health policies, wherein each of the user role policies contains a mapping between a username and a list of roles associated with the username, and wherein each of the endpoint health policies provides a list of user roles that are incompatible with access to a network resource for endpoint devices having a particular security state; and controlling, with the intermediate device, access to the remote network resource by a first one of the endpoint devices based on the locally cached endpoint security information, an identity of a user of the first one of the endpoint devices, and a security state of the first one of the endpoint devices, wherein controlling access comprises: authenticating the user; in response to authenticating the user, determining the list of roles associated with the identity of the user based on the user role policies; removing invalid roles from the list of roles based on application of the one or more endpoint health policies to the security state of the first one of the endpoint devices; generating device-specific access rights for the first one of the endpoint devices based on remaining roles in the list of roles associated with the identity of the user after removing the invalid roles when there is at least one remaining role in the list of roles; and governing access to the remote network resource based on the device-specific access rights for the first one of the endpoint devices.