Secure Virtual File Management System

• US 20130297662A1
• Filed: 01/04/2013
• Published: 11/07/2013
• Est. Priority Date: 01/06/2012
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Rahul Sharma, Sanjeev Krishnan, Venkata Sastry Akella
• Inventors: SHARMA, Rahul, AKELLA, Venkata Sastry, KRISHNAN, Sanjeev
• Granted Patent: US 8,863,299 B2
• Time in Patent Office: Days
• US Class Current: 707/827
• CPC Class Codes: G06F 16/185 Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof details of archiving G06F16/11
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A virtual file management system provides user access to managed content on mobile devices. The system comprises storage domains storing the managed content distributively using file systems, and a data infrastructure that organizes the managed content into a virtual file system that maintains information of storage domain specific file system primitives for accessing corresponding portions of the managed content. The data infrastructure, which maintains metadata of the storage domains and the mobile devices, comprises a policy definition and decision component that maintains policies defining controls for permissible operations on the managed content, the permissible operations including the file system primitives. A client application hosted on the mobile devices is coupled to the data infrastructure and the storage domains and includes an enforcement component that communicates with the policy definition and decision component to retrieve and enforce the policies by applying the controls on the mobile devices.

Claims

1. A virtual file management system (VFMS) providing a user access to managed content on one or more mobile devices, the system comprising:

a plurality of storage domains that store the managed content distributively using one or more file systems;

at least one server hosting a data infrastructure that organizes the managed content into a virtual file system that maintains information of storage domain specific file system primitives for accessing corresponding portions of the managed content, the data infrastructure collecting and maintaining metadata of the plurality of storage domains and the one or more mobile devices, wherein the data infrastructure comprises a policy definition and decision component that generates and maintains policies defining controls for permissible operations on the managed content with respect to the user on the one or more mobile devices, the permissible operations including the file system primitives, wherein the generating and maintaining the policies includes combining native policies associated with the plurality of storage domains and the one or more mobile devices with additional policies; and

a client application hosted on the one or more mobile devices;

the client application coupled to the data infrastructure and the plurality of storage domains and including an enforcement component, wherein the enforcement component communicates with the policy definition and decision component to retrieve and enforce the policies by applying the controls on the one or more mobile devices, the client application retrieving information of the virtual file system from the data infrastructure and providing access to the managed content through an interface by processing data requests using the permissible operations, wherein the client application exposes the permissible operations and the information of the virtual file system to one or more mobile applications that run on the one or more mobile devices and provides the access to the managed content through the interface, the exposing the permissible operations and the information of the virtual file system to the one or more mobile applications including the one or more mobile applications retrieving and enforcing the polices.

2. The system of claim 1, wherein the plurality of storage domains include one or more of shared storage of an enterprise and cloud based storage.

3. The system of claim 2, wherein the shared storage of an enterprise includes enterprise content management systems including at least one of SharePoint, shared drives, and Active Directory, wherein the shared drives include one or more of NFS, CIFS, and DFS based shared drives, wherein the cloud based storage includes one or more of iCloud, DropBox, and Box.

4. The system of claim 1, wherein the client application comprises a native mobile application for the one or more mobile devices.

5. The system of claim 1, the one or more file systems including a first file system and a second file system, wherein a content hierarchy of the first file system is different than the content hierarchy of the second file system.

6. The system of claim 1, wherein the data infrastructure is one or more of a private and public cloud based service.

7. The system of claim 6, wherein the data infrastructure implements a pluggable mechanism to couple with the plurality of storage domains, wherein the coupling with the plurality of storage domains includes interfacing with the plurality of storage domains using one or more of a public interface and a protocol.

8. The system of claim 7, the interfacing with the plurality of storage domains including collecting the storage domain specific file system primitives, the data infrastructure mapping the storage domain specific file system primitives to corresponding content of the plurality of storage domains.

9. The system of claim 8, the information of the storage domain specific file system primitives including a first and a second set of primitives, wherein the first set is different than the second set, wherein the storage domain specific file system primitives include read, write, delete, update, copy, and move.

10. The system of claim 9, the interfacing with the plurality of storage domains comprising collecting the metadata.

11. The system of claim 10, the organizing the managed content into a virtual file system comprising using the information of the storage domain specific file system primitives, information of the one or more storage domains and the metadata.

12. The system of claim 11, the virtual file system providing virtual file system primitives including one or more of create, read, update, delete, rename, list, move, copy, get metadata, view, edit, annotate, copy and move across physical file systems, and open in specific applications for editing/viewing, wherein the plurality of storage domains comprise the physical file systems.

13. The system of claim 1, wherein the metadata comprises at least one of an identity component, a content metadata component, a device component, and a policy component.

14. The system of claim 13, wherein the device component comprises information of mobile device configuration parameters of the one or more mobile devices, the mobile device configuration parameters including device specific policies and permissions in place for the one or more mobile devices, wherein the native policies include the device specific policies and permissions.

15. The system of claim 14, wherein the policy component comprises storage domain specific policies inherited from each of the plurality of storage domains, the storage domain specific policies including user and group level permissions and policies with respect to the managed content, wherein the native policies include the storage domain specific policies.

16. The system of claim 13, the identity component including unique device identifiers for each of the one or more mobile devices and identity and credentials of the user for each of the plurality of storage domains, the data infrastructure storing the identity and credentials only as needed to synchronize information of the content metadata component with the plurality of storage domains.

17. The system of claim 16, the identity component associating the storage domain identities and the device identifiers with a system user identity.

18. The system of claim 13, the content metadata component including storage domain metadata of the managed content stored on each of the plurality of storage domains, wherein the storage domain metadata includes name of files, creation date of files, owner of files and corresponding storage domain content hierarchy.

19. The system of claim 15, the generating and maintaining the policies comprising the policy definition and decision component coupled to a management console configured to allow an administrator an ability to define additional policies using information of the metadata, the additional policies defining one or more additional controls for the permissible operations on the managed content.

20. The system of claim 19, wherein the additional policies are defined for an enterprise, wherein the additional policies define the one or more additional controls for a user associated with the enterprise, wherein the user associated with the enterprise comprises the user of the one or more mobile devices.

21. The system of claim 20, wherein the additional polices define the one or more additional controls for groups of users associated with the enterprise.

22. The system of claim 21, wherein the groups of users comprise the user associated with the enterprise.

23. The system of claim 22, the administrator creating the groups of users using custom groups and standard groups, the groups of users including one or more of owners, members, visitors, viewers, employees, offsite employees, partners and customers.

24. The system of claim 23, wherein the additional policies define the one or more additional controls for a specific mobile device, wherein the specific mobile device includes the one or more mobile devices.

25. The system of claim 24, wherein the additional policies define the one or more additional controls for the plurality of storage domains.

26. The system of claim 25, wherein the additional policies define the one or more additional controls for a portion of the managed content.

27. The system of claim 26, the additional policies including a second set of controls applicable to the specific mobile device, wherein the specific mobile device includes a configuration of operating system, operating system version and device type.

28. The system of claim 27, the additional policies including a third set of controls applicable to the user associated with the enterprise or the groups of users associated with the enterprise.

29. The system of claim 28, the generating and maintaining the policies including storing the additional policies, the device specific policies and permissions and the storage domain specific policies in a policy store of the data infrastructure.

30. The system of claim 29, the generating and maintaining the additional policies comprising algorithmically compiling at least one of the additional policies for the user associated with the enterprise accessing the portion of the managed content of the plurality of storage domains using the specific mobile device.

31. The system of claim 30, the compiling comprising retrieving and aggregating the one or more additional controls for the user and groups of users associated with the enterprise, the one or more additional controls for the portion of the managed content, the one or more additional controls for the plurality of storage domains, the one or more additional controls of the specific mobile device, the second set of controls, the third set of controls, the device specific policies and permissions and the storage domain specific policies.

32. The system of claim 1, the generating and maintaining the policies comprising defining the controls according to a most restrictive derivation, the most restrictive derivation comprising defining the most restrictive controls for the permissible operations on the managed content.

33. The system of claim 1, the retrieving the policies including retrieving the policies when the user accesses the client application on the one or more mobile devices, the retrieving the policies including automatically retrieving changes to the policies.

34. The system of claim 1, wherein a policy of the policies represents a set of persistent rules associated with a content entity to govern and control actions on that entity, the policy including one or more of policy rules, the actions, policy item value, capability, policy definition entity and policy enforced entity.

35. The system of claim 34, the policy rules including a logical collection of the rules and the actions associated with the policy item value.

36. The system of claim 35, the policy item value including a policy specification associated with the policy rules.

37. The system of claim 36, the capability including software or device level functionality required for enforcing the policy rules.

38. The system of claim 37, wherein the policy definition entity includes the content entity on which the policy is defined including one or more of groups and users, device of the one or more mobile devices, an application, storage domains of the plurality of storage domains, and a portion of the managed content including site and subsite, folder, document library, list, and document, wherein the groups and users comprise the user.

39. The system of claim 38, wherein a policy enforced entity includes the content entity on which the actions corresponding to the policy are applied and enforced.

40. The system of claim 39, wherein the policy rules include device local encryption rules, the device local encryption rules specifying the portion to be encrypted when stored locally on the device either on cache or device local storage, wherein the device local encryption includes software encryption, wherein the device local encryption rules comprise enforcing the software encryption prior to downloading of the portion locally to the device and blocking the download if the portion cannot be encrypted.

41. The system of claim 39, wherein the policy rules include hardware encryption rules, the hardware encryption rules specifying hardware encryption and corresponding secure storage for the portion when stored locally on the device, wherein the hardware encryption rules comprise enforcing the hardware encryption prior to downloading of the portion locally to the device and blocking the download if the portion cannot be encrypted, wherein the capability includes support for hardware encryption on the device.

42. The system of claim 39, wherein the policy rules include access to cloud storage rules, the access to cloud storage rules indicating whether the user and the device can add and configure cloud storage domains on the client application, wherein the storage domains include the cloud storage domains.

43. The system of claim 39, wherein the policy rules includes requiring encryption on cloud storage rules, the requiring encryption on cloud storage rules specifying encrypting the portion on the device prior to uploading the portion to cloud storage and specifying storing the portion in an encrypted form on the cloud storage.

44. The system of claim 39, wherein the policy rules include offline access rules, the offline access rules specifying whether the document can be tagged for offline access in a disconnected mode of the device and stored locally on the device, wherein the offline access rules are enforced when the user chooses an action to mark the document for offline access on the device.

45. The system of claim 39, wherein the policy rules include local caching rules, the local caching rules determining whether the portion can be stored in local cache of the device after being downloaded onto the device, wherein local caching of the client application is disabled if local caching is disabled at level of the device, the client application deleting the downloaded portion after the client application exits out of an active user session when the local caching is disabled.

46. The system of claim 39, wherein the policy rules include export rules for exporting the portion from the client application to other applications on the device, the export rules determining whether the portion can be exported to the other applications using a content export protocol as supported by an operating system of the device, wherein the export rules are enforced when the user interacts with the export protocol of the device.

47. The system of claim 39, wherein the policy rules include audit log rules, wherein the audit log rules indicate audit log to be maintained by the data infrastructure for every action on the content entity and the policy enforced entity.

48. The system of claim 47, wherein the audit log rules are enforced on every action performed on the content entity and the policy enforced entity.

49. The system of claim 39, wherein the policy rules includes sharing via cloud storage rules, wherein the sharing via cloud storage rules specify mechanisms allowed for sharing of the portion via cloud storage, wherein the sharing via cloud storage rules are enforced when the user chooses a share option on the device for sharing the portion via the cloud storage.

50. The system of claim 39, wherein the policy rules include viewers and editors rules, wherein the viewers and editors rules restrict the viewers and the editors that can be used on the device to view the portion, wherein the viewers and editors rules are enforced when the user interacts with an access protocol on the device to export the portion for viewing or editing using the viewers or the editors.

51. The system of claim 39, wherein the policy rules include document classification rules, wherein the document classification rules include classifying the portion as public, confidential, proprietary, legal hold, or records management, wherein the document classification rules define additional rules that restrict actions on the portion according to the document classification.

52. The system of claim 39, wherein the policy rules include document expiration rules, the document expiration rules specifying a time limit after which the document expires and is deleted from all applications including offline and cached document locations managed by the client application and the data infrastructure.

53. The system of claim 39, wherein the policy rules include network usage rules, wherein the network usage rules place at least one restriction on the device and the client application including an upper limit on downloads to the device while on cellular, prohibiting the sending of audit reports from the device while on cellular, synchronizing with the data infrastructure only on cellular, and prohibiting downloading or synchronization when the device is roaming.

54. The system of claim 39, wherein the policy rules include cache expiration rules, the cache expiration rules specifying that local cache of the client application expires and is cleaned after the user closes the client application and ends an active session.

55. The system of claim 39, wherein the policy rules includes autodiscovery of storage domain rules, wherein the autodiscovery rules indicate auto-discovery and setup of the storage domains for the user when the user starts the client application.

56. The system of claim 39, wherein the policy rules include document size limitation rules, wherein the document size limitation rules place upper limit on size of the document downloaded to the device.

57. The system of claim 39, wherein the policy rules include document media type rules, wherein the document media type rules specify document media types supported for a specific combination of the customer, the device and the user and blocking the download of non-specified document media types.

58. The system of claim 39, wherein the policy rules include restriction on access to enterprise storage domain including SharePoint if cloud storage applications including Dropbox and Box exist on the device, wherein the storage domains comprise the enterprise storage domains and the cloud storage domains.

59. The system of claim 39, wherein the policy rules includes virtual private network (VPN) on demand rules, wherein the VPN on demand rules control setup of VPN policy and settings prior to access of the device to enterprise storage domains, wherein the storage domains include the enterprise storage domains.

60. The system of claim 39, wherein the policy rules include device restriction rules, wherein the device restriction rules restrict the device from access to enterprise storage domains based on one or more of settings of the device including iOS and build number, model name and number, device capacity and space available, current carrier network, subscriber carrier network, data roaming on or off, hardware encryption capabilities, passcode present, certificates installed with expiry dates, list of restrictions enforced, applications installed, provisioning profiles installed with expiry date, and web proxy settings, wherein the storage domains include the enterprise storage domains.

61. The system of claim 39, wherein the policy rules include policy compliance rules, wherein the policy compliance rules restrict the device from access to enterprise storage domains if the device fails to pass mobile device management level policy compliance of an enterprise, wherein the storage domains include enterprise storage domains.

62. The system of claim 39, wherein the policy rules include domain joined rules, the domain joined rules blocking access of the client application to enterprise storage domains if the device is not domain joined to enterprise Active Directory infrastructure, wherein the storage domains include the enterprise storage domains.

63. The system of claim 39, wherein the policy rules include location rules restricting access of the user to the portion based on a designated location of the device, the restricting including blocking access to the portion when client application determines that the device is at a location other than the designated location and blocking access to the portion when the client application cannot determine the location.

64. The system of claim 39, wherein the policy rules include time based rules restricting access of the user to the portion to a period of time.

65. The system of claim 1, wherein the enforcement component of the client application communicates with the policy definition and decision component using a secure file control protocol, wherein the secure file control protocol facilitates certificate-based trust between policy definition and decision component and enforcement component.

66. The system of claim 65, wherein the secure file control supports HTTPS based communications, wherein the HTTPS based REST style communications include GET, DELETE, PUT, and POST.

67. The system of claim 66, wherein the secure file control protocol supports online and offline modes, the online mode comprising the enforcement component retrieving the policies from the policy definition and decision component using the HTTPS based REST communications, the offline mode comprising locally cached storage of the policies on the one or more mobile devices, the enforcement component retrieving the policies from the locally cached storage.

68. The system of claim 67, wherein the locally cached polices are updated when the one or more mobile devices establishes communications with the policy definition and decision component using the secure file control protocol.

69. The system of claim 68, wherein the secure file control protocol supports synchronization of the polices across the one or more mobile devices.

70. The system of claim 1, the exposing the permissible operations and the information of the virtual file system comprising exposing a lightweight virtual file management system library (VFMS library) on the one or more mobile devices.

71. The system of claim 70, the exposing the permissible operations and the information of the virtual file system comprising the one or more mobile applications integrating the lightweight VFMS library.

72. The system of claim 71, the exposing the permissible operations and the information of the virtual file system comprising the one or more mobile applications communicating with the data infrastructure using the lightweight VFMS library, the communicating with the data infrastructure comprising one or more of retrieving and enforcing the policies and accessing the managed content using the interface.