Approach for managing access to data on client devices

• US 8,732,792 B2
• Filed: 06/20/2012
• Issued: 05/20/2014
• Est. Priority Date: 06/20/2012
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Motoyama, Tetsuro
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US13/528,638
• Publication Number:
  US 20130347053A1
• Time in Patent Office: 699 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A device management system is configured to manage access to electronic documents on client devices using policies. The policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices for example, particular hardware and software configurations that are required at client devices before data is permitted to be downloaded to those client devices. The policies may also specify other requirements that must be satisfied before data is permitted to be downloaded to those client devices, for example, user authentication.

Claims

1. One or more non-transitory computer-readable media for managing access to a particular electronic document, the one or more non-transitory computer-readable media storing instructions which, when processed by one or more processors, causes:

a device management system retrieving policy data for a particular electronic document, wherein the policy data specifies one or more policies that apply to the particular electronic document, wherein the one or more policies that apply to the particular electronic document specify that a) user authentication is required for a client device to receive the particular electronic document, and b) the client device must have one or more of one or more required hardware configuration attributes or one or more required software configuration attributes for the client device to receive the particular electronic document;

determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or the one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document;

performing user authentication for the client device by;

determining an authorization level of a user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device; and

in response to determining that both the user of the client device is authorized to download the particular electronic document to the client device and the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.

2. The one or more non-transitory computer-readable media of claim 1, wherein:

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device includes;

determining an authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device,

comparing the authorization level of the user of the client device to the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device, and

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device.

3. The one or more non-transitory computer-readable media of claim 2, wherein:

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device includes determining whether the authorization level of the user of the client device is less restrictive than the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded.

4. The one or more non-transitory computer-readable media of claim 1, wherein the one or more of one or more required hardware configuration attributes or one or more required software configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

5. The one or more non-transitory computer-readable media of claim 1, wherein determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allow a copy of the particular electronic document to be forwarded from the client device to another device or allow a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level.

6. The one or more non-transitory computer-readable media of claim 1, further comprising:

receiving, from the client device, a request to access the particular electronic document, wherein the request to access the particular electronic document specifies a requested format of the electronic document, and

wherein transmitting the particular electronic document to the client device includes transmitting the particular electronic document to the client device in the format specified in the request to access the particular electronic document.

7. The one or more non-transitory computer-readable media of claim 1, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.

8. An apparatus for managing access to a particular electronic document, the apparatus including a memory storing instructions which, when processed by one or more processors, cause:

a device management system retrieving policy data for a particular electronic document, wherein the policy data specifies one or more policies that apply to the particular electronic document, wherein the one or more policies that apply to the particular electronic document specify that a) user authentication is required for a client device to receive the particular electronic document, and b) the client device must have one or more of one or more required hardware configuration attributes or one or more required software configuration attributes for the client device to receive the particular electronic document;

determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or the one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document;

performing user authentication for the client device;

determining an authorization level of a user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device; and

in response to determining that both the user of the client device is authorized to download the particular electronic document to the client device and the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.

9. The apparatus of claim 8, wherein:

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device includes;

determining an authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device,

comparing the authorization level of the user of the client device to the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device, and

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device.

10. The apparatus of claim 9, wherein:

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device includes determining whether the authorization level of the user of the client device is less restrictive than the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded.

11. The apparatus of claim 8, wherein the one or more of one or more required hardware configuration attributes or one or more required software configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

12. The apparatus of claim 8, wherein determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allow a copy of the particular electronic document to be forwarded from the client device to another device or allow a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level.

13. The apparatus of claim 8, wherein the memory stores additional instructions which, when processed by the one or more processors, cause:

receiving, from the client device, a request to access the particular electronic document, wherein the request to access the particular electronic document specifies a requested format of the electronic document, and

wherein transmitting the particular electronic document to the client device includes transmitting the particular electronic document to the client device in the format specified in the request to access the particular electronic document.

14. The apparatus of claim 8, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.

15. A computer-implemented method for managing access to a particular electronic document, the computer-implemented method comprising:

a device management system retrieving policy data for a particular electronic document, wherein the policy data specifies one or more policies that apply to the particular electronic document, wherein the one or more policies that apply to the particular electronic document specify that a) user authentication is required for a client device to receive the particular electronic document, and b) the client device must have one or more of one or more required hardware configuration attributes or one or more required software configuration attributes for the client device to receive the particular electronic document;

determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or the one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document;

performing user authentication for the client device by;

determining an authorization level of a user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device; and

in response to determining that both the user of the client device is authorized to download the particular electronic document to the client device and the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.

16. The computer-implemented method of claim 15, wherein:

determining, based upon the authorization level of the user of the client device, the one or more attributes of electronic documents that are permitted to be downloaded to the client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device includes;

determining an authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device,

comparing the authorization level of the user of the client device to the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device, and

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device.

17. The computer-implemented method of claim 16, wherein:

determining that the user is authorized to download the particular electronic document to the client device if the authorization level of the user of the client device satisfies the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded to the client device includes determining whether the authorization level of the user of the client device is less restrictive than the authorization level specified by the one or more attributes of electronic documents that are permitted to be downloaded.

18. The computer-implemented method of claim 15, wherein the one or more of one or more required hardware configuration attributes or one or more required software configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

19. The computer-implemented method of claim 15, wherein determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allow a copy of the particular electronic document to be forwarded from the client device to another device or allow a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level.

20. The computer-implemented method of claim 15, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.