Unified provisioning of applications on devices in an enterprise system

• US 10,116,647 B2
• Filed: 05/22/2017
• Issued: 10/30/2018
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maheshwari, Harsh, Mohamad Abdul, Mohamad Raja Gani, Das, Sidhartha, Pakkath, Rajesh, Katti, Sreedhar
• Primary Examiner(s): Zee, Edward
• Application Number:
  US15/601,832
• Publication Number:
  US 20170257362A1
• Time in Patent Office: 526 Days
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The present disclosure relates generally to managing access to an enterprise system using remote devices. Techniques are disclosed for provisioning applications on remote devices to access resources in an enterprise system. Specifically, applications may be automatically configured with access information (e.g., account information) and connection information to access a resource in an enterprise system using a remote device. Configuring an application may include determining an account for accessing a resource using the application. An account may be provisioned if one has not been established. Upon configuring an application, the device access management system may provide a configured application to the remote device(s) for which the application is configured. Once the configured application is received, the application may be automatically installed on the remote device, after which the application may be executed to access a resource.

Claims

1. A method comprising:

determining, based on a user role associated with an identity of a user, an account enabling the identity to access a first resource, wherein the first resource is accessible from a first device using a first application, wherein the first device is registered for the identity of the user;

configuring, by a computer system, the first application with connection information that enables the first application to connect the first device to a first target system based on the account, wherein the first target system provides access for the first resource according to the account;

configuring, by the computer system, the first application with access information that permits the first application to access the first resource, wherein the access information is based on access permitted to the identity by the account; and

transmitting the first application to the first device upon configuring the first application with the connection information and the access information.

2. The method of claim 1, further comprising:

detecting a second device registered for the identity of the user, wherein the connection information configured for the first application further enables the first application to connect the second device to the first target system based on the account; and

transmitting the first application to the second device upon configuring the first application with the connection information and the access information.

3. The method of claim 1, further comprising:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, a change in access permitted to the identity by the account; and

instructing the first device to modify a configuration of the first application based on the change in access.

4. The method of claim 3, wherein the change in access permitted to the identity includes revoking access permitted to the first resource by the account for the identity, and wherein modifying the configuration of the first application includes deleting the connection information and the access information configured for the first application.

5. The method of claim 3, wherein the change in access permitted to the identity includes revoking access permitted to the first resource by the account for the identity, and wherein modifying the configuration of the first application includes removing the first application from the first device.

6. The method of claim 3, wherein modifying the configuration of the first application includes adjusting the access information configured for the first application.

7. The method of claim 1, further comprising:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, a change in access permitted to the identity by the account;

detecting a plurality of devices registered for the identity of the user;

transmitting the first application to the plurality of devices upon configuring the first application with the connection information and the access information; and

instructing each of the plurality of devices to modify a configuration of the first application based on the change in access.

8. The method of claim 1, further comprising:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, that the account enables the identity to access a second resource, wherein the second resource is accessible from the first device using a second application;

configuring, by the computer system, the second application to connect the first device to a second target system based on the account, wherein the second target system provides access for the second resource according to the account;

transmitting the second application to the first device.

9. A non-transitory computer-readable medium comprising instructions stored thereon, that when executed by one or more processors, cause the one or more processors to perform operations comprising:

determining, based on a user role associated with an identity of a user, an account enabling the identity to access a first resource, wherein the first resource is accessible from a first device using a first application, wherein the first device is registered for the identity of the user;

configuring, by a computer system, the first application with connection information that enables the first application to connect the first device to a first target system based on the account, wherein the first target system provides access for the first resource according to the account;

configuring, by the computer system, the first application with access information that permits the first application to access the first resource, wherein the access information is based on access permitted to the identity by the account; and

transmitting the first application to the first device upon configuring the first application with the connection information and the access information.

10. The non-transitory computer-readable medium of claim 9, wherein of the operations further comprise:

detecting a second device registered for the identity of the user, wherein the connection information configured for the first application further enables the first application to connect the second device to the first target system based on the account; and

transmitting the first application to the second device upon configuring the first application with the connection information and the access information.

11. The non-transitory computer-readable medium of claim 9, wherein the operations further comprise:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, a change in access permitted to the identity by the account; and

instructing the first device to modify a configuration of the first application based on the change in access.

12. The non-transitory computer-readable medium of claim 11, wherein the change in access permitted to the identity includes the account revoking access of the identity to the first resource, and wherein modifying the configuration of the first application includes deleting the connection information and the access information configured for the first application.

13. The non-transitory computer-readable medium of claim 11, wherein the change in access permitted to the identity includes the account revoking access of the identity to the first resource, and wherein modifying the configuration of the first application includes removing the first application from the first device.

14. The non-transitory computer-readable medium of claim 11, wherein modifying the configuration of the first application includes adjusting the access information configured for the first application.

15. The non-transitory computer-readable medium of claim 9, wherein the operations further comprise:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, a change in access permitted to the identity by the account;

detecting a plurality of devices registered for the identity of the user;

transmitting the first application to the plurality of devices upon configuration of the first application; and

instructing each of the plurality of devices to modify a configuration of the first application based on the change in access.

16. The non-transitory computer-readable medium of claim 9, wherein the operations further comprise:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, that the account enables the identity to access a second resource, wherein the second resource is accessible from the first device using a second application;

configuring, by the computer system, the second application to connect the first device to a second target system based on the account, wherein the second target system provides access for the second resource according to the account;

transmitting the second application to the first device.

17. A method comprising:

provisioning, based on a user role associated with an identity of a user, access for the identity to a first application and a second application, wherein the first application is provisioned for access to a first resource using a first remote device registered to the identity, and wherein the second application is provisioned for access to a second resource using the first remote device;

configuring, by a computer system, the first application with first connection information and first access information to access the first resource using the first remote device, wherein the first access information is based on the access provisioned for the identity to the first application;

configuring, by the computer system, the second application with second connection information and second access information to access the second resource using the first remote device, wherein the second access information is based on the access provisioned for the identity to the second application;

transmitting the first application to the first remote device upon the configuring of the first application; and

transmitting the second application to the first remote device upon the configuring of the second application.

18. The method of claim 17, further comprising:

detecting a second remote device registered to the identity, wherein the first connection information and first access information further enable the first application to access the first resource using the second remote device, and wherein the second connection information and second access information further enable the second application to access the second resource using the second remote device;

transmitting the first application to the second remote device upon configuring the first application with the first connection information and the first access information; and

transmitting the second application to the second remote device upon configuring the second application with the second connection information and the second access information.

19. The method of claim 17, further comprising:

detecting a change in the user role from a first user role to a second user role;

determining, based on the second user role, a change in the access provisioned for the identity to the first application and a change in the access provisioned for the identity to the second application;

instructing the first remote device to modify a configuration of the first application based on the change in access provisioned for the identity to the first application; and

instructing the first remote device to modify a configuration of the second application based on the change in access provisioned for the identity to the second application.

20. The method of claim 19, wherein modifying the configuration of the first application includes adjusting the first access information configured for the first application, and wherein the modifying the configuration of the second application includes adjusting the second access information configured for the second application.