SYSTEM AND METHOD FOR APPLICATION USAGE CONTROLS THROUGH POLICY ENFORCEMENT

• US 20140173700A1
• Filed: 08/20/2013
• Published: 06/19/2014
• Est. Priority Date: 12/16/2012
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Kshirsagar, Shekhar, Awan, Asif, Kumar, Chetan, Agarwal, Deepak, Maradani, Suman, Babu, Sunil G. V.
• Granted Patent: US 9,326,145 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A method includes a particular user application, without operating system kernel access, performing the operations of: identifying a set of applications that a user has permission to access, receiving a request to a access a particular application of the set of applications, and causing execution of the particular application.

Claims

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors causes performance of operations comprising:

identifying, by a particular user application, a first set of one or more applications that a user has permission to access, the first set of applications being selected from a plurality of applications;

providing, by the particular user application to a user, an option to select at least one application of the first set of applications;

receiving, by the particular user application from the user, a request to access a first application in the first set of applications;

responsive at least to receiving the request;

causing, by the particular user application, execution of the first application.

2. The medium of claim 1, wherein the particular user application does not have kernel access for an Operating System executing on a same device as the particular user application.

3. The medium of claim 1, wherein providing the option to select at least one application of the first set of applications comprises:

determining a subset of applications from the first set of applications that the user has permission to access;

displaying at least one or more icons representing the subset of applications that the user has permission to access.

4. The medium of claim 1, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a physical location of a device executing the particular user application.

5. The medium of claim 1, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a network connection of a device executing the particular user application.

6. The medium of claim 1, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a configuration of a device executing the particular user application.

7. The medium of claim 1, wherein providing the option comprises:

displaying an interface comprising;

a first plurality of icons representing the first set of applications that the user has permission to access;

a second plurality of icons representing a second set of one or more applications that the user does not have permission to access;

where the interface indicates that (a) the first plurality of icons represents applications that the user has permission to access and (b) the second plurality of icons represents applications that the user does not have permission to access.

8. The medium of claim 1, wherein the operations further comprise responsive to identifying the first set of applications that the user has permission to access, installing the first set of applications on a device executing the particular user application.

9. The medium of claim 1, wherein the operations further comprise:

subsequent to causing execution of the first application, determining a change in permissions associated with the user;

identifying, by the particular user application, that the user does not have permission to access the first application based on the change in permissions associated with the user;

preventing, by the particular user application, the user from accessing the first application.

10. The medium of claim 1, wherein the operations further comprise:

identifying, by the particular user application, a second set of one or more applications that a second user has permission to access, the second set of applications being selected from the plurality of applications, and the second set of applications being different than the first set of applications;

providing, by the particular user application to the second user, an option to select at least one application of the second set of applications;

receiving, by the particular user application from the second user, a second request to access a second application in the second set of applications;

responsive at least to receiving the second request;

causing, by the particular user application, execution of the second application.

11. A system comprising:

a device including at least one hardware processor;

the system being configured to perform operations comprising;

identifying, by a particular user application, a first set of one or more applications that a user has permission to access, the first set of applications being selected from a plurality of applications;

providing, by the particular user application to a user, an option to select at least one application of the first set of applications;

receiving, by the particular user application from the user, a request to access a first application in the first set of applications;

responsive at least to receiving the request;

causing, by the particular user application, execution of the first application.

12. The system of claim 11, wherein the particular user application does not have kernel access for an Operating System executing on a same device as the particular user application.

13. The system of claim 11, wherein providing the option to select at least one application of the first set of applications comprises:

determining a subset of applications from the first set of applications that the user has permission to access;

displaying at least one or more icons representing the subset of applications that the user has permission to access.

14. The system of claim 11, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a physical location of a device executing the particular user application.

15. The system of claim 11, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a network connection of a device executing the particular user application.

16. The system of claim 11, wherein identifying the first set of applications that the user has permission to access comprises:

determining, by the particular user application, whether the user has permission to access the first application based on a configuration of a device executing the particular user application.

17. The system of claim 11, wherein providing the option comprises:

displaying an interface comprising;

a first plurality of icons representing the first set of applications that the user has permission to access;

a second plurality of icons representing a second set of one or more applications that the user does not have permission to access;

where the interface indicates that (a) the first plurality of icons represents applications that the user has permission to access and (b) the second plurality of icons represents applications that the user does not have permission to access.

18. The system of claim 11, wherein the operations further comprise responsive to identifying the first set of applications that the user has permission to access, installing the first set of applications on a device executing the particular user application.

19. The system of claim 11, wherein the operations further comprise:

subsequent to causing execution of the first application, determining a change in permissions associated with the user;

identifying, by the particular user application, that the user does not have permission to access the first application based on the change in permissions associated with the user;

preventing, by the particular user application, the user from accessing the first application.

20. The system of claim 11, wherein the operations further comprise:

identifying, by the particular user application, a second set of one or more applications that a second user has permission to access, the second set of applications being selected from the plurality of applications, and the second set of applications being different than the first set of applications;

providing, by the particular user application to the second user, an option to select at least one application of the second set of applications;

receiving, by the particular user application from the second user, a second request to access a second application in the second set of applications;

responsive at least to receiving the second request;

causing, by the particular user application, execution of the second application.