Patent ID: 8104077

Claim:
A method of controlling access in a network, the method comprising: receiving, from a connection to a client by a device connected between said client and said network, a request for access to a resource on the network; determining, by said device, a level of compliance for at least one software program on the client; comparing, by said device, the client compliance level to a predetermined policy to determine if the client is allowed access to the resource, wherein the policy is rules-based and at least one of the rules define a first time period during which a surrogate connection will not be established on behalf of the client; determining, from the policy by the device, if a surrogate connection to the resource is authorized to be established on behalf of the client after said comparing determining that the client compliance level does not allow access to the resource; establishing, in the device, the surrogate connection from said connection to the client to the resource on behalf of the client if said surrogate connection to the resource is authorized by the policy, wherein said device, in the establishing, uses a bridge mode of operation to connect the client to the resource for inline processing of information as the information flows through a direct channel between the resource and the client, and said device provides surrogate connection compliance for the client by the inline processing of the information as the information flows through the direct channel between the resource and the client; and quarantining, by the device, the client if said surrogate connection to the resource is not authorized by the policy.