System and Method For Providing Conditional access to Server-based Applications From Remote Access Devices

• US 20130347121A1
• Filed: 08/23/2013
• Published: 12/26/2013
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kohavi, Lior
• Granted Patent: US 9,152,799 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/90 Details of database functions independent of the retrieved data types
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems and methods are provided for providing users at remote access devices with conditional access to server-based applications. Requests for access to server-based applications (e.g., requests to launch or obtain data associated with the server-based applications) by remote access devices may be prevented or allowed based on device compliance with one or more policies including whether data-retention prevention code can be downloaded to and operational on the remote access devices. The data-retention prevention code may be used to both determine whether data can be automatically deleted from a cache or file directory at the remote access device and to delete potentially retention-sensitive data once the data is downloaded to the remote access device from the server-based application.

Claims

1. A computer-implemented method for providing conditional access to server-based applications from remote access devices, the method comprising:

downloading sample data to one or both of a cache and a file directory at a remote access device, the sample data being associated with a server-based application and downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

attempting to delete the sample data from the one or both of the cache and the file directory;

determining whether the sample data has been deleted from the one or both of the cache and the file directory; and

preventing the remote access device from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

2. The method of claim 1, further comprising downloading a data-retention prevention code to the remote access device to delete the sample data from the one or both of the cache and the file directory.

3. The method of claim 2, wherein if the sample data is deleted from the one or both of the cache and the file directory the data-retention prevention code uninstalls itself from the remote access device.

4. The method of claim 2, wherein if the sample data is not deleted from the one or both of the cache and the file directory the data-retention prevention code retries to delete the sample data until the operation is successful.

5. The method of claim 1, further comprising:

receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

6. The method of claim 5, wherein automatically deleting the data is in response to an indication or in response to a command from a conditional access application.

7. The method of claim 1, wherein if the sample data is deleted from the one or both of the cache and the file directory the data-retention prevention code may uninstall itself from the remote access device.

8. A data storage medium encoded with machine-executable instructions for performing the method comprising:

downloading sample data to one or both of a cache and a file directory at a remote access device, the sample data being associated with a server-based application and downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

downloading a data-retention prevention code to the remote access device to delete the sample data from the one or both of the cache and the file directory

attempting to delete the sample data from the one or both of the cache and the file directory; and

determining whether the sample data has been deleted from the one or both of the cache and the file directory.

9. The data storage medium of claim 8, further comprising providing the remote access device with access to the server-based application when the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory.

10. The data storage medium of claim 8, further comprising:

determining whether the data-retention prevention code is operative to delete the sample data from the one or both of the cache and the file directory; and

receiving a signal indicating whether the data-retention code is operative to delete the sample data from the one or both of the cache and the file directory.

11. The data storage medium of claim 8, further comprising determining whether the remote access device is a trusted device or an untrusted device.

12. The data storage medium of claim 11, wherein if the remote access device is the trusted device, providing the remote access device with access to the server-based application even if the data-retention prevention code is not operable or not completely operable to delete the sample data from the remote access device.

13. The data storage medium of claim 11, wherein if the remote access device is the untrusted device, providing the remote access device with access to the server-based application only if the data-retention prevention code is downloaded and operable to delete the sample data from the remote access device.

14. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

means for downloading to a remote access device data-retention prevention code for deleting data from one or both of a cache and a file directory at the remote access device;

means for downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

means for receiving a signal indicating that data downloaded to the one or both of the cache and the file directory is to be deleted; and

means for automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

15. The system of claim 14, further comprising means for preventing the remote access device from accessing the server based application when the code is not operative to delete the sample data from the one or both of the cache and the file directory comprising means for notifying the remote access device that access to the server-based application is disallowed.

16. The system of claim 14, further comprising means for registering the downloading of the data-retention prevention code as failed.

17. The system of claim 14, further comprising means for receiving another signal indicating that the data-retention prevention code is to be launched.

18. The system of claim 17, further comprising:

means for launching the data-retention prevention code, wherein the data-retention prevention code issues notification of the successful launch.

19. The system of claim 14, wherein the remote access devices comprises an untrusted remote access device.

20. The system of claim 14, wherein the remote access devices comprises a trusted remote access device.