System and method for automated configuration of software installation package

• US 8,839,234 B1
• Filed: 03/27/2013
• Issued: 09/16/2014
• Est. Priority Date: 12/25/2012
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Voronkov, Konstantin P., Deshevykh, Stepan N., Yablokov, Victor V.
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US13/851,811
• Publication Number:
  US 20140298324A1
• Time in Patent Office: 538 Days
• Field of Search: 717172-177, 709203-204
• US Class Current: 717/176
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/4451 User profiles; Roaming

Abstract

Automated configuration of a software application to be installed via a software installation package onto different user devices for different users. An initial software installation package is obtained, as is information representing (a) associations between the plurality of users and the plurality of user devices, and (b) user attributes from which access privilege level information for individual users is determinable. The initial software installation package is configured for the user devices based on the information representing (a) and (b), to produce a plurality of different specially-configured software installation packages, each one of which corresponds to one or more specific users and one or more specific user devices. Each specially-configured package includes parameters that establish functionality for the software application based on the access privilege level of the users. Each user is authenticated, and completion of installation of the software application is conditioned on a result of the authentication.

Claims

1. A system for automated configuration of a software application to be installed, via a software installation package provided over a computer network, onto a plurality of different user devices for a plurality of different users, the system comprising:

set of instructions executable by computing hardware and stored in a non-transitory storage medium that, when executed, cause the computing hardware to implement;

a task manager module that obtains an initial software installation package, and communicates with a network attributes data store via the computer network to obtain information representing (a) associations between the plurality of users and the plurality of user devices, and (b) user attributes from which access privilege level information for individual users is determinable;

a configurator module that custom-configures the initial software installation package for individual ones of the plurality of user devices based on the information representing (a) and (b), to produce a plurality of different specially-configured software installation packages, each one of which corresponds to one or more specific users and one or more specific user devices, wherein each specially-configured software installation package includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding one or more specific users;

an authorization module that performs authentication of each user of each user device in response to an initiation of installation of the software application via execution of a corresponding specially-configured software installation package on each corresponding user device, and which either permits or prevents completion of the installation of the software application on that user device in response to a corresponding result of the authentication, wherein the authentication of each user of each user device is a distinct authentication operation from a local authentication operation performed by each user device to authenticate an authorized user.

2. The system of claim 1, wherein the software application is a security application user agent.

3. The system of claim 1, wherein the functionality for the software application based on the access privilege level of the corresponding one or more specific users includes a capability to provide certain access credential information.

4. The system of claim 1, wherein the task manager module is adapted to obtain information representing device attributes for each of the plurality of user devices, and wherein the configurator module is adapted to produce each specially-configured software installation package such that the installation parameters establish functionality based further on device attributes corresponding to the one or more user devices.

5. The system of claim 4, wherein the authorization module performs verification of attributes of each user device on which the software application is being installed against a set of device attributes according to which each specially-configured software installation package is produced, and wherein based on a result of the verification installation of the software application is either permitted or prevented.

6. The system of claim 1, wherein the task manager module is adapted to obtain information representing a security policy, and wherein the configurator module is adapted to produce each specially-configured software installation package such that the installation parameters establish functionality based further on that security policy.

7. The system of claim 6, wherein the configurator module applies a set of expert rules to produce each specially-configured software installation package, wherein the set of expert rules define various software installation package parameter settings according to various characteristics of the security policy.

8. The system of claim 1, wherein the network attributes data store includes a directory service.

9. The system of claim 1, wherein the task manager module, the configurator module, and the authorization module are executed on an administration server that is remotely situated from, but communicatively coupled to, the plurality of user devices and the network attributes data store.

10. The system of claim 1, wherein user attributes from which the access privilege level information for individual users is determinable includes at least one attribute selected from the group consisting of:

a title or role of the user in an organization;

a configuration of the user device, attributes of a network connection between the user device and the task manager module, a list of network resources accessible to the user via the user device;

an identification of an organization to which the user is assigned.

11. A method for automated configuration of a software application to be installed, via a software installation package provided over a computer network, onto a plurality of different user devices for a plurality of different users, the method comprising:

obtaining an initial software installation package;

obtaining information representing (a) associations between the plurality of users and the plurality of user devices, and (b) user attributes from which access privilege level information for individual users is determinable;

configuring the initial software installation package for individual ones of the plurality of user devices based on the information representing (a) and (b), to produce a plurality of different specially-configured software installation packages, each one of which corresponds to one or more specific users and one or more specific user devices, wherein each specially-configured software installation package includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding one or more specific users;

authenticating each user of each user device in response to an initiation of installation of the software application via execution of a corresponding specially-configured software installation package on each corresponding user device, including either permitting or preventing completion of the installation of the software application on each user device in response to a corresponding result of the authenticating, wherein the authentication of each user of each user device is a distinct authentication operation from a local authentication operation performed by each user device to authenticate an authorized user.

12. The method of claim 11, wherein obtaining information representing (a) and (b) includes communicating with a network attributes data store via the computer network.

13. The method of claim 11, wherein the functionality for the software application based on the access privilege level of the corresponding one or more specific users includes a capability to provide certain access credential information.

14. The method of claim 11, further comprising:

obtaining information representing device attributes for each of the plurality of user devices, and producing each specially-configured software installation package such that the installation parameters establish functionality based further on device attributes corresponding to the one or more user devices.

15. The method of claim 11, further comprising:

obtaining information representing a security policy; and

producing each specially-configured software installation package such that the installation parameters establish functionality based further on that security policy.

16. The method of claim 15, wherein configuring the initial software installation package includes applying a set of expert rules to produce each specially-configured software installation package, wherein the set of expert rules define various software installation package parameter settings according to various characteristics of the security policy.

17. A method for automated configuration of a software application to be installed, via a software installation package provided over a computer network, onto a user device for a specific user, the method comprising:

performing, by the user device, a local authentication of a user to either permit or prevent login of that user onto the user device;

downloading, by the user device, a first specially-configured software installation package that is produced remotely by a service that;

obtains an initial software installation package;

obtains information representing (a) associations between a plurality of users and a plurality of user devices, and (b) user attributes from which access privilege level information for individual users is determinable;

configures the initial software installation package for individual ones of the plurality of user devices based on the information representing (a) and (b), to produce a plurality of different specially-configured software installation packages, including the first specially-configured software installation package, each one of the plurality of different specially-configured software installation packages corresponding to one or more specific users and one or more specific user devices, wherein each specially-configured software installation package includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding one or more specific users; and

downloading, by the user device, the first specially-configured software installation package;

initiating, via execution of the first specially-configured software installation package, installation of the software application via execution of the first specially-configured software installation package by the user device;

in response to the initiating of the installation of the software application, authenticating, by the user device, the user of the user device, including either permitting or preventing completion of installation of the software application on the user device via the first specially-configured software installation package in response to a result of the authenticating, wherein the authentication of each user of each user device is a distinct authentication operation from a local authentication operation performed by each user device to authenticate an authorized user.