System and method for providing conditional access to server-based applications from remote access devices

• US 20040162876A1
• Filed: 02/13/2004
• Published: 08/19/2004
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Whale Communications Ltd.
• Inventors: Kohavi, Lior
• Granted Patent: US 7,801,964 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 16/90 Details of database functions independent of the retrieved data types
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems and methods are provided for providing users at remote access devices with conditional access to server-based applications. Requests for access to server-based applications (e.g., requests to launch or obtain data associated with the server-based applications) by remote access devices may be prevented or allowed based on device compliance with one or more policies including whether data-retention prevention code can be downloaded to and operational on the remote access devices. The data-retention prevention code may be used to both determine whether data can be automatically deleted from a cache or file directory at the remote access device and to delete potentially retention-sensitive data once the data is downloaded to the remote access device from the server-based application.

Claims

1. A method for providing conditional access to server-based applications from remote access devices, the method comprising:

receiving a request for access to a server-based application from a remote access device;

downloading to the remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory; and

preventing the remote access device from accessing the server-based application when the code is not operative to delete data from the one or both of the cache and the file directory.

2. The method of claim 1, wherein receiving a request for access to a server-based application comprises receiving a request to launch the server-based application.

3. The method of claim 1, wherein receiving a request for access to a server-based application comprises receiving a request to access data associated with the server-based application.

4. The method of claim 1, wherein receiving a request for access from a remote access device comprises receiving a request for access from an untrusted remote access device.

5. The method of claim 1, wherein receiving a request for access from a remote access device comprises receiving a request for access from a trusted remote access device.

6. The method of claim 1, wherein determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises receiving a signal indicating whether the code is operative to delete data from the one or both of the cache and the file directory.

7. The method of claim 1, wherein determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises:

downloading sample data to the one or both of the cache and the file directory; and

determining whether the sample data can be deleted from the one or both of the cache and the file directory.

8. The method of claim 1, wherein preventing the remote access device from accessing the server-based application comprises notifying the remote access device that access to the server-based application is disallowed.

9. The method of claim 1, wherein preventing the remote access device from accessing the server-based application comprises preventing the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the code is not operative to delete data from the one or both of the cache and the file directory, wherein the method further comprises providing trusted remote access devices with access to the server-based application irrespective of whether the code is operative on the trusted remote access devices.

10. The method of claim 1, further comprising providing the remote access device with access to the server-based application when the code is operative to delete data from the one or both of the cache and the file directory.

11. The method of claim 10, wherein providing the remote access device with access to the server-based application comprises providing the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.

35. The system of claim 1, wherein the conditional access application is further configured to:

prevent the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the code is not operative to delete data from the one or both of the cache and the file directory; and

provide trusted remote access devices with access to the server-based application irrespective of whether the code is operative on the trusted remote access devices.

12. A method for providing conditional access to server-based applications from remote access devices, the method comprising:

downloading sample data to one or both of a cache and a file directory at a remote access device, wherein data associated with a server-based application is downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

attempting to delete the sample data from the one or both of the cache and the file directory; and

determining whether the sample data has been deleted from the one or both of the cache and the file directory, wherein the remote access device is prevented from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

13. A method for providing conditional access to server-based applications from remote access devices, the method comprising:

downloading to a remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

14. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

means for receiving a request for access to a server-based application from a remote access device;

means for downloading to the remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

means for determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory; and

means for preventing the remote access device from accessing the server-based application when the code is not operative to delete data from the one or both of the cache and the file directory.

15. The system of claim 14, wherein the request for access to the server-based application comprises a request to launch the server-based application.

16. The system of claim 14, wherein the request for access to the server-based application comprises a request to access data associated with the server-based application.

17. The system of claim 14, wherein the remote access device comprises an untrusted remote access device.

18. The system of claim 14, wherein the remote access device comprises a trusted remote access device.

19. The system of claim 14, wherein the means for determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises means for receiving a signal indicating whether the code is operative to delete data from the one or both of the cache and the file directory.

20. The system of claim 14, wherein the means for determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises:

means for downloading sample data to the one or both of the cache and the file directory; and

means for determining whether the sample data can be deleted from the one or both of the cache and the file directory.

21. The system of claim 14, wherein the means for preventing the remote access device from accessing the server-based application comprises means for notifying the remote access device that access to the server-based application is disallowed.

22. The system of claim 14, wherein the means for preventing the remote access device from accessing the server-based application comprises means for preventing the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the code is not operative to delete data from the one or both of the cache and the file directory, wherein the system further comprises means for providing trusted remote access devices with access to the server-based application irrespective of whether the code is operative on the trusted remote access devices.

23. The system of claim 14, further comprising means for providing the remote access device with access to the server-based application when the code is operative to delete data from the one or both of the cache and the file directory.

24. The system of claim 23, wherein the means for providing the remote access device with access to the server-based application comprises means for providing the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.

25. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

means for downloading sample data to one or both of a cache and a file directory at a remote access device, wherein data associated with a server- based application is downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

means for attempting to delete the sample data from the one or both of the cache and the file directory; and

means for determining whether the sample data has been deleted from the one or both of the cache and the file directory, wherein the remote access device is prevented from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

26. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

means for downloading to a remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

means for downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

means for receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

means for automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

27. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

an application server;

a remote access device; and

a conditional access application configured to;

receive a request for access to a server-based application associated with the application server from the remote access device;

download to the remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

determine whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory; and

prevent the remote access device from accessing the server-based application when the code is not operative to delete data from the one or both of the cache and the file directory.

28. The system of claim 27, wherein the request for access to the server-based application comprises a request to launch the server-based application.

29. The system of claim 27, wherein the request for access to the server-based application comprises a request to access data associated with the server-based application.

30. The system of claim 27, wherein the remote access device comprises an untrusted remote access device.

31. The system of claim 27, wherein the remote access device comprises a trusted remote access device.

32. The system of claim 27, wherein determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises receiving a signal indicating whether the code is operative to delete data from the one or both of the cache and the file directory.

33. The system of claim 27, wherein the conditional access application is further configured to:

download sample data to the one or both of the cache and the file directory; and

determine whether the sample data can be deleted from the one or both of the cache and the file directory.

34. The system of claim 27, wherein the conditional access application is further configured to notify the remote access device that access to the server-based application is disallowed.

36. The system of claim 27, wherein the conditional access application is further configured to provide the remote access device with access to the server-based application when the code is operative to delete data from the one or both of the cache and the file directory.

37. The system of claim 36, wherein the conditional access application is further configured to provide the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.

38. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

a downloader for downloading sample data to one or both of a cache and a file directory at a remote access device, wherein data associated with a server-based application is downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

a deletion unit for attempting to delete the sample data from the one or both of the cache and the file directory; and

processing circuitry for determining whether the sample data has been deleted from the one or both of the cache and the file directory, wherein the remote access device is prevented from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

39. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

downloading circuitry for downloading to a remote access device code for deleting data from one or both of a cache and a file directory at the remote access device and for downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

processing circuitry for receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

a deletion unit for automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

40. A data storage medium encoded with machine-executable code for performing the method comprising:

receiving a request for access to a server-based application from a remote access device;

downloading to the remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

determining whether the code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory; and

preventing the remote access device from accessing the server-based application when the code is not operative to delete data from the one or both of the cache and the file directory.

41. A data storage medium encoded with machine-executable instructions for performing the method comprising:

downloading sample data to one or both of a cache and a file directory at a remote access device, wherein data associated with a server-based application is downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

attempting to delete the sample data from the one or both of the cache and the file directory; and

determining whether the sample data has been deleted from the one or both of the cache and the file directory, wherein the remote access device is prevented from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

42. A data storage medium encoded with machine-executable instructions for performing the method comprising:

downloading to a remote access device code for deleting data from one or both of a cache and a file directory at the remote access device;

downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.