Method and system for dynamically associating access rights with a resource

• US 8,533,846 B2
• Filed: 11/08/2006
• Issued: 09/10/2013
• Est. Priority Date: 11/08/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rivera, Juan
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Branske, Hilary
• Application Number:
  US11/557,683
• Publication Number:
  US 20080109912A1
• Time in Patent Office: 2,498 Days
• Field of Search: 726/2, 726/21, 726/26, 726/27, 726/28, 726/29, 726/30, 726/1
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for dynamically associating, by a server, access rights with a resource includes the step of receiving, by the server, a request for a resource from a client. The server requests, from a policy engine, an identification of a plurality of access rights to associate with the resource, the plurality of access rights identified responsive to an application of a policy to the client. The server associates the resource with the plurality of access rights via a rights markup language. The server transmits the resource to the client with the identification of the associated plurality of access rights. An application program on the client makes an access control decision responsive to the associated plurality of access rights. The application program provides restricted access to the resource responsive to the access control decision.

Claims

1. A method for dynamically associating, by a server, access rights with a resource, the method comprising the steps of:

(a) receiving, by a server, a request for a resource from a client;

(b) transmitting, by a policy engine executing on the server, a collection agent to the client in response to receiving the request;

(c) receiving, by the policy engine from the collection agent executing on the client, client information;

(d) applying, by a first component of the policy engine, policies to the client information to generate a dataset comprising a plurality of identifiers, each of the plurality of identifiers identifying a respective condition satisfied by the client information;

(e) transmitting, by the first component of the policy engine to a second component of the policy engine, the dataset comprising the plurality of identifiers;

(f) applying, by the second component of the policy engine, policies to the dataset to identify a plurality of levels of access rights associated with the resource;

(g) requesting, by the server from the second component of the policy engine, the plurality of levels of access rights to associate with the resource;

(h) signing, by the server, the resource with the plurality of levels of access rights via an extensible rights markup language;

(i) transmitting, by the server, the resource signed with the plurality of levels of access rights to the client;

(j) making, by an application program responsive to receiving from the server the signed resource, an access control decision using the plurality of levels of access rights, the application program executing on the client; and

(k) providing, by the application program, restricted access to the resource responsive to the access control decision.

2. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to retrieve a file.

3. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to view a version of a file displayed using a version of the Hypertext Markup Language (HTML) standard.

4. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to receive output data generated by an execution of the resource on an application server.

5. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to print a copy of the resource.

6. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to save a local copy of the resource.

7. The method of claim 1, wherein step (g) further comprises receiving, by the server, an identification of a plurality of levels of access rights including a right to transmit via electronic mail a copy of the resource.

8. The method of claim 1, wherein step (k) further comprises denying, by the application program, a request to retrieve the resource.

9. The method of claim 1, wherein step (k) further comprises denying, by the application program, a request to modify the resource.

10. The method of claim 1, wherein step (k) further comprises the step of denying, by the application program, a request to receive output data generated by an execution of the resource on an application server.

11. The method of claim 1, wherein step (k) further comprises allowing, by the application program, a request to retrieve the resource.

12. The method of claim 1, wherein step (k) further comprises displaying, by the application program, a version of the resource displayed using a version of the Hypertext Markup Language (HTML) standard, responsive to a request to retrieve the resource.

13. The method of claim 1, wherein step (k) further comprises allowing, by the application program, a request to receive output data generated by an execution of the resource on an application server.

14. The method of claim 1, wherein step (k), comprises providing, by the application program executing on a second server, restricted access to the resource responsive to the access control decision.

15. The method of claim 1, wherein step (k) further comprises transmitting, by a second server, output data generated by executing the application program, access to the output data restricted responsive to the access control decision.

16. The method of claim 1 wherein step (h) comprises signing, by the server, the resources with the plurality of levels of access rights using an extensible right markup language assertion grant.

17. The method of claim 1 wherein step (h) comprises signing, by the server, the resource with the plurality of levels of access rights using an expression of terms and conditions applicable to the resource using the Open Digital Rights Language standard.

18. A system for dynamically associating access rights with a resource comprising:

a server receiving a request for access to a resource from a client;

a policy engine executing on the server to;

transmit a collection agent to the client in response to receiving the request,

receive from the collection agent executing on the client, client information,

a first component of the policy engine executing on the server to;

apply policies to the client information to generate a dataset comprising a plurality of identifiers, each of the plurality of identifiers indentifying a respective condition satisfied by the client information,

transmit the dataset comprising the plurality of identifiers to a second component of the policy engine,

the second component of the policy engine executing on the server to;

apply policies to the dataset to identify a plurality of levels of access rights associated with the resource,

receive a request from the server for an identification of a plurality of levels of access rights to associate with the resource;

wherein the server signs the resource with the plurality of levels of access rights via an extensible rights markup language, and transmits the resource signed with the associated plurality of levels of access rights to the client; and

an application program executing on the client to;

receive, from the server, a copy of the resource signed with the plurality of levels of access rights,

make an access control decision in response to receiving from the server the resource signed with the plurality of levels of access rights using the plurality of levels of access rights, and

provide restricted access to the resource responsive to the access control decision.

19. The system of claim 18, wherein the server further comprises a means for associating the resource with a right to retrieve the resource.

20. The system of claim 18, wherein the server further comprises a means for associating the resource with a requirement to view a version of a file displayed using a version of the Hypertext Markup Language (HTML) standard.

21. The system of claim 18, wherein the server further comprises a means for associating the resource with a right to receive output data generated by an execution of the resource on an application server.

22. The system of claim 18, wherein the server further comprises a means for associating the resource with a right to print a copy of the resource.

23. The system of claim 18, wherein the server further comprises a means for associating the resource with a right to save a local copy of the resource.

24. The system of claim 18, wherein the server further comprises a means for associating the resource with a right to transmit via electronic mail a copy of the resource.

25. The system of claim 18, wherein the application program further comprises a component for applying an access right in the associated plurality of levels of access rights to the request for the resource.

26. The system of claim 18, wherein the application program further comprises a means for denying a request to retrieve the resource.

27. The system of claim 18, wherein the application program further comprises a means for allowing a request to retrieve the resource.

28. The system of claim 18, wherein the application program further comprises a means for viewing a version of the resource displayed using a version of the Hypertext Markup Language (HTML) standard.

29. The system of claim 18, wherein the application program further comprises a connection to a client agent displaying on the client received output data generated by an execution of the resource on an application server.

30. The system of claim 18, wherein the server further comprises a transmitter sending the resource and the identification of the associated plurality of levels of access rights to an application program executing on a second server.

31. The system of claim 30, wherein the application program executing on the second server further comprises a means for making an access control decision responsive to an access right in the associated plurality of levels of access rights.

32. The system of claim 30, wherein the application program executing on the second server further comprises a means for providing restricted access to the resource responsive to the access control decision.

33. The system of claim 30, wherein the application program executing on the second server further comprises an agent for transmitting output data generated by the application program to the client and providing restricted access to the output data responsive to the access control decision.

34. The system of claim 18 wherein the server signs the resource with the plurality of levels of access rights using an extensible right markup language assertion grant.

35. The system of claim 18 wherein the server signs the resource with the plurality of levels of access rights using an expression of terms and conditions applicable to the resource using the Open Digital Rights Language standard.