Method and apparatus for controlling client computer systems

• US 6,381,631 B1
• Filed: 06/03/1999
• Issued: 04/30/2002
• Est. Priority Date: 06/03/1999
• Status: Expired due to Term

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: Marimba, Inc. (KKR & Co., Inc.)
• Inventors: van Hoff, Arthur A.
• Primary Examiner(s): Wiley, David
• Assistant Examiner(s): Jean, Frantz B.
• Application Number:
  US09/324,891
• Time in Patent Office: 1,062 Days
• Field of Search: 709/202, 709/200, 709/201, 709/203, 709/227, 709/229, 709/217, 709/220, 709/245, 709/225, 707/1, 707/10, 707/205, 713/201
• US Class Current: 709/202
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

A method and apparatus connects a user to a remote network, and enforces operation of management software before the user is allowed to perform other tasks on the remote network. The method and apparatus also allows connection of the user to a third party network. The user may be restricted from accessing third party networks not on a trusted list of networks, which may be updated by the management software. The method and apparatus enforces access rules for the third party software to prevent unauthorized retrieval or deletion of information by the third party software.

Claims

1. A system for managing files in a client computer, the system comprising:

a log in manager having an input, an output and an input/output operatively coupled for communication with a first network, the log in manager for receiving identification information of a user at the log in manager input and providing to the first network at the log in manager inpuL/ouLput authentication information responsive to the identification information received at the log in manager input, and. for providing a signal at the log in manager output after at least some of the information is provided at the log in manager input/output;

client manager having an input coupled to the log in manager output, an input/output operatively coupled for communication with the first network, a first output and a second output, the client manager for;

receiving the signal at the client management input;

requesting at least one selected from a first file and update instructions to a second file responsive to the signal received at the client manager input;

providing at least one selected from the first file and the update to the second file at the client manager first output; and

providing a completion signal at the client manager second output responsive to receipt of at least one selected from the first file and the update; and

a connection manager for receiving at a first input/output a request for a communication session with the first network, for receiving the completion signal at an input coupled to the client manager second output and for enabling communication between the first input/output and a second input/output operatively coupled for communication with the first network responsive to the completion signal received at the connection manager input.

2. The system of claim 1, wherein:

the client manager is additionally for providing at the client manager input/output a first identifier of the user responsive to a second identifier of the user received at an identifier input; and

the log in manager is additionally for providing the second identifier of the user at an identifier output responsive to the identification information received at the log in manager input.

3. The system of claim 1 additionally comprising:

a storage system for storing at least a portion of at least one file;

at least one client application having an input/output operatively coupled for communication with a second network and for accessing the at least a portion of the at least one file;

an application database containing a description of access privileges for the at least one client application with respect to the storage system; and

an access manager coupled to the at least one client application, the storage system and the application database for controlling access to the at least the portion of the at least one file by the at least one client application responsive to the application database.

4. The system of claim 1 additionally comprising:

a trusted network storage having an input operatively coupled to receive at least one identifier of at least one network and an output for providing at least one of the at least one identifier of the at least one network; and

wherein at least one selected from the log in manager and the connection manager additionally has a trusted network input coupled to the trusted network storage output for receiving at least one of the at least one identifier of the at least one network and is for establishing a connection with the first network responsive to the at least one identifier received at the trusted network input.

5. The system of claim 4 wherein the client manager is additionally for receiving the at least one identifier of the at least one network and providing said identifier at a trusted network output coupled to the trusted network storage input.

6. A method of connecting to a remote network, comprising:

receiving a request to connect to a remote network;

establishing a connection to the remote network;

restricting user communication with the remote network responsive to the receiving the request step;

receiving at least one selected from at least one first file, at least one update to a second file, and at least one update instruction to the second file responsive to the receiving the request step;

removing a restriction on user communication with the remote network responsive to the receiving at least one step; and

forwarding communication between the user and the remote network.

7. The method of claim 6 comprising the additional steps of:

receiving a trusted network file comprising identifiers of at least one first additional network;

receiving a request to connect to at least one second additional network; and

connecting to the at least one second additional network responsive to the at least one second additional network comprising at least one of the at least one first additional network.

8. The method of claim 7 wherein the trusted network file is at least one selected from the first file and the second file.

9. The method of claim 6 comprising the additional steps of:

receiving from a first client application a request to access an area of storage;

locating at least one access permission for the client application; and

allowing access to the area of storage responsive to the access request received and the access permission located.

10. The method of claim 9 wherein the area of storage comprises a file.

11. The method of claim 9 wherein the area of storage comprises one selected from a directory or a subdirectory.

12. A computer program product comprising a computer useable medium having computer readable program code embodied therein for connecting to a remote network, the computer program product comprising:

computer readable program code devices configured to cause a computer to receive a request to connect to a remote network;

computer readable program code devices configured to cause a computer to establish a connection to the remote network;

computer readable program code devices configured to cause a computer to restrict user communication with the remote network responsive to the computer readable program code devices configured to cause a computer to receive the request;

computer readable program code devices configured to cause a computer to receive at least one selected from at least one first file, at least one update to a second file, and at least one update instruction to the second file responsive to the computer readable program code devices configured to cause a computer to receive the request;

computer readable program code devices configured to cause a computer to remove a restriction on user communication with the remote network responsive to the computer readable program code devices configured to cause computer to receive at least one; and

computer readable program code devices configured to cause a computer to forward communication between the user and the remote network.

13. The computer program product of claim 12 additionally comprising:

computer readable program code devices to configure to cause a computer to receive a trusted network file comprising identifiers of at least one first additional network;

computer readable program code devices configured to cause a computer to receive a request to connect to at least one second additional network; and

computer readable program code devices configured to cause a computer to connect to the at least one second additional network responsive to the at least one second additional network comprising at least one of the at least one first additional network.

14. The computer program product of claim 13 wherein the trusted network file is at least one selected from the first file and the second file.

15. The computer program product of claim 12 additionally comprising:

computer readable program code devices configured to cause a computer to receive from a first client application a request to access an area of storage;

computer readable program code devices configured to cause a computer to locate at least one access permission for the client application; and

computer readable program code devices configured to cause a computer to allow access to the area of storage responsive to the access request received and the access permission located.

16. The computer program product of claim 15 wherein the area of storage comprises a file.

17. The computer program of claim 15 wherein the area of storage comprises one selected from a directory or a subdirectory.