GATEWAY FOR CONTROLLING MOBILE DEVICE ACCESS TO ENTERPRISE RESOURCES

• US 20140007214A1
• Filed: 10/10/2012
• Published: 01/02/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Zenprise, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed, McGinty, John M.
• Granted Patent: US 9,378,359 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/029 : Location-based management or tracking services

Abstract

A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user'"'"'s position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.

Claims

1. An enterprise system configured to control mobile device accesses to enterprise resources, the enterprise system comprising:

an enterprise resource configured to electronically communicate with computing devices over a communication network; and

a gateway comprising computer hardware, said gateway configured to;

receive a request from a mobile device to access the enterprise resource, the request formatted according to a protocol that includes properties associated with the mobile device;

receive gateway rules from one or more gateway rule providers, each gateway rule comprising;

one or more values of one or more of said properties of the protocol; and

an indication to take a selected action, when the request has one or more property values that correspond to the one or more property values of the gateway rule;

determine whether the request has one or more property values that correspond to one or more property values of any of the gateway rules; and

when the request has one or more property values that correspond to one or more property values of one of the gateway rules, cause the action indicated in the one gateway rule to be taken based on the indication in the one gateway rule.

2. The computer system of claim 1, wherein the selected action comprises at least one of allowing access to the enterprise resource or denying access to the enterprise resource.

3. The computer system of claim 2, wherein the one or more property of said protocol indicate one or more mobile applications are stored on the mobile device, and wherein the gateway is configured to determine whether to allow the mobile device access to the enterprise resource or deny the mobile device access to the enterprise resource based on the one or more mobile applications are stored on the mobile device.

4. The computer system of claim 1, wherein the gateway is configured deny a request to access the enterprise resource when the mobile device has a particular application stored thereon based on the instruction of the gateway rule.

5. The computer system of claim 1, wherein the selected action comprises encrypting data transmitted to the mobile device via the gateway.

6. The computer system of claim 1, wherein the selected action comprises blocking the mobile device from receiving an email attachment.

7. The computer system of claim 1, wherein the gateway rules comprise rules with instructions to take different actions when the user of the mobile device has a different role in the enterprise.

8. The computer system of claim 1, wherein the one or more computing devices configured to implement the gateway comprise at least one of a firewall server, a computing device configured to control a firewall server, or an other enterprise resource.

9. The computer system of claim 1, wherein the gateway rules comprise at least one statically defined rule and at least one rule received from the one or more gateway rules providers.

10. The computer system of claim 1, wherein the gateway is configured to determine whether the request has one or more property values that correspond to one or more property values of any of the gateway rules at least partly by inspecting a payload of the request and comparing data from the payload with at least one of the gateway rules.

11. The computer system of claim 1, wherein said properties of the protocol are associated with mobile device applications stored on the mobile device.

12. The computer system of claim 1, wherein said properties of the protocol are associated with a user of the mobile device.

13. Non-transitory computer storage that stores a gateway component for controlling mobile device accesses to enterprise resources, said gateway component comprising executable code that directs a computing system to perform a process that comprises:

receiving a request from a mobile device to access an enterprise resource, the request formatted according to a protocol that includes properties associated with the mobile device;

determining whether the request has one or more property values that correspond to one or more property values of one or more gateway rules, each gateway rule comprising;

one or more values of one or more of said properties of the protocol; and

an indication of an action to be taken when the request has one or more property values that correspond to the one or more property values of the gateway rule; and

when the request has one or more property values that correspond to one or more property values of one of the gateway rules, causing the action indicated in the one gateway rule to be taken.

14. The non-transitory computer storage of claim 13, wherein the process further comprises determining a relative priority among a plurality of gateway rules having one or more property values corresponding to one or more property values of the request, wherein the action taken corresponds to the indication in the gateway rule of the plurality of gateway rules that has the highest relative priority of the plurality of gateway rules.

15. Non-transitory computer storage that stores executable gateway software for an enterprise computing system, said gateway software comprising:

a gateway configuration service configured to receive gateway rules from one or more gateway rule providers, each gateway rule comprising;

one or more values of one or more of said properties of the protocol; and

an indication of an action to be taken when a request formatted according to said protocol has one or more property values that match the one or more property values of the gateway rule; and

a gateway filter configured to;

receive requests from mobile devices to access computer-implemented resources of the enterprise computing system, at least some of the requests formatted according to a protocol that includes properties associated with at least one of the mobile devices, mobile device applications, or mobile device users;

access the gateway rules received by the gateway configuration service;

for each of the requests formatted according to said protocol, determine whether the request has one or more property values that match one or more property values of any of the gateway rules; and

for each of the requests having one or more property values that match one or more property values of one of the gateway rules, allow or deny the request based on the instruction of the gateway rule.

16. The non-transitory computer storage of claim 15, wherein the gateway configuration service is configured to:

periodically send requests to the one or more gateway rule providers for new gateway rules; and

receive new gateway rules from the one or more gateway rule providers, in response to the new gateway rule requests.

17. The non-transitory computer storage of claim 15, wherein the gateway configuration service is configured to receive at least one of the gateway rules from a meta-application.

18. The non-transitory computer storage of claim 15, wherein the action to be taken comprises allowing or denying the request.

19. A system for controlling mobile device access policies, the system comprising:

a first machine-readable repository of enterprise access policies defining conditions under which to execute actions related to requests from mobile devices to access computer-implemented resources of an enterprise;

a second machine-readable repository of attributes of mobile devices associated with the enterprise and/or users associated with the mobile devices; and

a computer system that runs a gateway rule generator that is configured to;

read the enterprise access policies from the first repository;

query the attributes of the second repository; and

create gateway rules to enforce the access policies read from the first repository, each of the gateway rules comprising;

one or more values of one or more properties of a protocol for mobile device requests for accessing computer-implemented enterprise resources, at least some of the properties corresponding to specific mobile devices; and

an indication to take an action associated with a mobile device request formatted according to said protocol, when the request has one or more property values that match the one or more property values of the gateway rule;

wherein the system is configured to cause transmission of the gateway rules to a gateway configured to receive the mobile device requests for accessing the enterprise resources.

20. A computer-implemented method of facilitating communication between a mobile device and an enterprise computing system, the method comprising:

under control of at least one computing device programmed with specific executable instructions;

monitoring communications between a mobile device and an enterprise resource of an enterprise computing system;

detecting that a selected one of the communications between the mobile device and the enterprise resource is formatted according to a protocol;

determining a selected action identified in one or more predefined rules that corresponds to a protocol-specific condition of the protocol, the protocol-specific condition being associated with the selected communication; and

executing the selected action for the selected communication responsive to said determining.

21. The computer-implemented method of claim 20, wherein executing the selected action comprises granting or denying a request from the mobile device to access the enterprise resource.

22. The computer-implemented method of claim 20, wherein the selected action comprises granting a request from the mobile device to access the enterprise resource, and wherein the protocol-specific condition comprises a particular role of the user associated with the mobile device in the enterprise and one or more properties of the mobile device.

23. The computer-implemented method of claim 20, wherein the protocol-specific condition comprises whether a particular application is installed on the mobile device.

24. The computer-implemented method of claim 20, wherein the protocol-specific condition comprises a geographical location of the mobile device.

25. The computer-implemented method of claim 20, wherein the protocol-specific condition comprises a time associated with the communication.

26. The computer-implemented method of claim 20, wherein the protocol is an email protocol.

27. The computer-implemented method of claim 20, wherein executing the selected action comprises encrypting data from the enterprise resource addressed to the mobile device.

28. The computer-implemented method of claim 27, wherein the encrypted data comprises an encrypted email attachment.