System and method for providing conditional access to server-based applications from remote access devices

• US 8,521,829 B2
• Filed: 08/31/2010
• Issued: 08/27/2013
• Est. Priority Date: 02/14/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kohavi, Lior
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US12/872,699
• Publication Number:
  US 20100325362A1
• Time in Patent Office: 1,092 Days
• Field of Search: 709/211, 709/201, 709/203, 709217-228
• US Class Current: 709/211
• CPC Class Codes: G06F 16/90 Details of database functions independent of the retrieved data types
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems and methods are provided for providing users at remote access devices with conditional access to server-based applications. Requests for access to server-based applications (e.g., requests to launch or obtain data associated with the server-based applications) by remote access devices may be prevented or allowed based on device compliance with one or more policies including whether data-retention prevention code can be downloaded to and operational on the remote access devices. The data-retention prevention code may be used to both determine whether data can be automatically deleted from a cache or file directory at the remote access device and to delete potentially retention-sensitive data once the data is downloaded to the remote access device from the server-based application.

Claims

1. A computer-implemented method for providing conditional access to server-based applications from remote access devices, the method comprising:

downloading sample data to one or both of a cache and a file directory at a remote access device, the sample data being associated with a server-based application and downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

downloading a data-retention prevention code to the remote access device to delete the sample data from one or both of the cache and the file directory;

receiving a signal indicating that the data-retention prevention code is to be launched;

notifying the server-based application that the data-retention prevention code is enabled in response to launching the data-retention prevention code;

attempting to delete the sample data from the one or both of the cache and the file directory;

determining whether the sample data has been deleted from the one or both of the cache and the file directory; and

preventing the remote access device from accessing the server-based application when the sample data has not been deleted from the one or both of the cache and the file directory.

2. The method of claim 1, wherein the remote access device comprises an untrusted remote access device.

3. The method of claim 1, wherein when the sample data is deleted from the one or both of the cache and the file directory the data-retention prevention code uninstalls itself from the remote access device.

4. The method of claim 1, wherein when the sample data is not deleted from the one or both of the cache and the file directory the data-retention prevention code retries to delete the sample data until the operation is successful.

5. The method of claim 1, further comprising:

receiving an indication that data downloaded to the one or both of the cache and the file directory is to be deleted; and

deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

6. The method of claim 5, wherein deleting the data downloaded is in response to an indication or in response to a command from a conditional access application.

7. The method of claim 1, wherein when the sample data is deleted from the one or both of the cache and the file directory the data-retention prevention code uninstall itself from the remote access device.

8. A computer-readable storage device storing instructions which when executed by one or more processors, cause the one or more processors to:

download sample data to one or both of a cache and a file directory at a remote access device, the sample data being associated with a server-based application and downloaded to the one or both of the cache and the file directory when the remote access device is provided with access to the server-based application;

download a data-retention prevention code to the remote access device to delete the sample data from the one or both of the cache and the file directory;

receive a signal indicating that the data-retention prevention code is to be launched;

notify the server-based application that the data-retention prevention code is enabled;

attempt to delete the sample data from the one or both of the cache and the file directory;

determine whether the sample data has been deleted from the one or both of the cache and the file directory; and

provide the remote access device with access to the server-based application when the data-retention prevention code has deleted the data from the one or both of the cache and the file directory.

9. The computer-readable storage device of claim 8, further comprising instructions which when executed by the one or more processors, cause the one or more processors to:

determine whether the data-retention prevention code is operative to delete the sample data from the one or both of the cache and the file directory.

10. The computer-readable storage device of claim 8, further comprising instructions which when executed by the one or more processors, cause the one or more processors to determine whether the remote access device is a trusted device or an untrusted device.

11. The computer-readable storage device of claim 10, wherein when the remote access device is the trusted device, the instructions when executed by the one or more processor, cause the one or more processors to provide the remote access device with access to the server-based application even if the data-retention prevention code is not operable or not completely operable to delete the sample data from the remote access device.

12. The computer-readable storage device of claim 10, wherein when the remote access device is the untrusted device, the instructions when executed by the one or more processor, cause the one or more processors to provide the remote access device with access to the server-based application only if the data-retention prevention code is downloaded and operable to delete the sample data from the remote access device.

13. A system comprising:

a remote access device comprising executable instructions which when executed by one or more processors, cause the one or more processors to perform operations including;

downloading a data-retention prevention code from a server-based application, the data-retention prevention code for deleting data from one or both of a cache and a file directory at the remote access device;

downloading data from a server-based application to the one or both of the cache and the file directory of the remote access device;

receiving a signal indicating that the data-retention prevention code is to be launched;

notifying the server-based application that the data-retention prevention code is enabled in response to launching the data-retention prevention code;

receiving another signal indicating that data downloaded to the one or both of the cache and the file directory is to be deleted; and

automatically deleting the data downloaded to the one or both of the cache and the file directory from the one or both of the cache and the file directory.

14. The system of claim 13, the operations further comprising receiving notification from the server-based application that access to the server-based application is disallowed, in response to an attempt to access the server based application when the data-retention prevention code is disabled.

15. The system of claim 13, the operations further comprising notifying the server-based application when the downloading of the data-retention prevention code failed.

16. The system of claim 13, wherein the remote access device comprises an untrusted remote access device.

17. The system of claim 13, wherein the remote access device comprises a trusted remote access device.

18. The system of claim 13, wherein when the data downloaded is deleted from the one or both of the cache and the file directory the data-retention prevention code uninstalls itself from the remote access device.