System and method for providing conditional access to server-based applications from remote access devices

• US 7,801,964 B2
• Filed: 02/13/2004
• Issued: 09/21/2010
• Est. Priority Date: 02/14/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Whale Communications Ltd.
• Inventors: Kohavi, Lior
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US10/779,110
• Publication Number:
  US 20040162876A1
• Time in Patent Office: 2,412 Days
• Field of Search: 709/203, 709217-228, 709/211
• US Class Current: 709/211
• CPC Class Codes: G06F 16/90 Details of database functions independent of the retrieved data types
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems and methods are provided for providing users at remote access devices with conditional access to server-based applications. Requests for access to server-based applications (e.g., requests to launch or obtain data associated with the server-based applications) by remote access devices may be prevented or allowed based on device compliance with one or more policies including whether data-retention prevention code can be downloaded to and operational on the remote access devices. The data-retention prevention code may be used to both determine whether data can be automatically deleted from a cache or file directory at the remote access device and to delete potentially retention-sensitive data once the data is downloaded to the remote access device from the server-based application.

Claims

1. A method for providing conditional access to server-based applications from remote access devices, the method comprising:

receiving a request for access to a server-based application from a remote access device;

downloading to the remote access device data-retention prevention code for deleting data from one or both of a cache and a file directory at the remote access device;

determining whether the data-retention prevention code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory, wherein determining whether the data-retention prevention code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises receiving a signal indicating whether the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory;

downloading sample data to the one or both of the cache and the file directory;

determining whether the sample data can be deleted from the one or both of the cache and the file directory; and

preventing the remote access device from accessing the server-based application when the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory.

2. The method of claim 1, wherein receiving a request for access to a server-based application comprises receiving a request to launch the server-based application.

3. The method of claim 1, wherein receiving a request for access to a server-based application comprises receiving a request to access data associated with the server-based application.

4. The method of claim 1, wherein receiving a request for access from a remote access device comprises receiving a request for access from an untrusted remote access device.

5. The method of claim 1, wherein receiving a request for access from a remote access device comprises receiving a request for access from a trusted remote access device.

6. The method of claim 1, wherein preventing the remote access device from accessing the server-based application comprises notifying the remote access device that access to the server-based application is disallowed.

7. The method of claim 1, wherein preventing the remote access device from accessing the server-based application comprises preventing the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory, wherein the method further comprises providing trusted remote access devices with access to the server-based application irrespective of whether the data-retention prevention code is operative on the trusted remote access devices.

8. The method of claim 1, further comprising providing the remote access device with access to the server-based application when the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory.

9. The method of claim 8, wherein providing the remote access device with access to the server-based application comprises providing the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.

28. A data storage medium, the data storage medium being hardware, encoded with machine-executable data-retention prevention code for performing the method of claim 1.

10. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

means for receiving a request for access to a server-based application from a remote access device;

means for downloading to the remote access device data-retention prevention code for deleting data from one or both of a cache and a file directory at the remote access device;

means for determining whether the data-retention prevention code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory, wherein the means for determining whether the data-retention code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory comprises;

means for receiving a signal indicating whether the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory;

means for downloading sample data to the one or both of the cache and the file directory; and

means for determining whether the sample data can be deleted from the one or both of the cache and the file directory; and

means for preventing the remote access device from accessing the server-based application when the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory.

11. The System of claim 10, wherein the request for access to the server-based application comprises a request to launch the server-based application.

12. The system of claim 10, wherein the request for access to the server-based application comprises a request to access data associated with the server-based application.

13. The system of claim 10, wherein the remote access device comprises an untrusted remote access device.

14. The system of claim 10, wherein the remote access device comprises a trusted remote access device.

15. The system of claim 10, wherein the means for preventing the remote access device from accessing the server-based application comprises means for notifying the remote access device that access to the server-based application is disallowed.

16. The system of claim 10, wherein the means for preventing the remote access device from accessing the server-based application comprises means for preventing the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory, wherein the system further comprises means for providing trusted remote access devices with access to the server-based application irrespective of whether the data-retention prevention code is operative on the trusted remote access devices.

17. The system of claim 10, further comprising means for providing the remote access device with access to the server-based application when the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory.

18. The system of claim 17, wherein the means for providing the remote access device with access the server-based application comprises means for providing the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.

19. A system for providing conditional access to server-based applications from remote access devices, the system comprising:

an application server;

a remote access device; and

a conditional access application configured to;

receive a request for access to a server-based application associated with the application server from the remote access device;

download to the remote access device data-retention prevention code for deleting data from one or both of a cache and a file directory at the remote access device;

determine whether the data-retention prevention code downloaded to the remote access device is operative to delete data from the one or both of the cache and the file directory, the determination comprises;

receive a signal indicating whether the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory;

download sample data to the one or both of the cache and the file directory; and

determine whether the sample data can be deleted from the one or both of the cache and the file directory; and

prevent the remote access device from accessing the server-based application when the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory.

20. The system of claim 19, wherein the request for access to the server-based application comprises a request to launch the server-based application.

21. The system of claim 19, wherein the request for access to the server-based application comprises a request to access data associated with the server-based application.

22. The system of claim 19, wherein the remote access device comprises an untrusted remote access device.

23. The system of claim 19, wherein the remote access device comprises a trusted remote access device.

24. The system of claim 19, wherein the conditional access application is further configured to notify the remote access device that access to the server-based application is disallowed.

25. The system of claim 19, wherein the conditional access application is further configured to:

prevent the remote access device from accessing the server-based application when the remote access device is an untrusted remote access device and the data-retention prevention code is not operative to delete data from the one or both of the cache and the file directory; and

provide trusted remote access devices with access to the server-based application irrespective of whether the data-retention prevention code is operative on the trusted remote access devices.

26. The system of claim 19, wherein the conditional access application is further configured to provide the remote access device with access to the server-based application when the data-retention prevention code is operative to delete data from the one or both of the cache and the file directory.

27. The system of claim 26, wherein the conditional access application is further configured to provide the remote access device with access to the server-based application without requiring the remote access device to install either or both of client software and client hardware associated with the server-based application.