Providing a managed browser

• US 8,850,050 B1
• Filed: 10/01/2013
• Issued: 09/30/2014
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed
• Primary Examiner(s): Fan, Hua
• Application Number:
  US14/043,343
• Publication Number:
  US 20140297862A1
• Time in Patent Office: 364 Days
• Field of Search: 709/229
• US Class Current: 709/229
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, computer-readable media, and apparatuses for providing a managed browser are presented. In various embodiments, a computing device may load a managed browser. The managed browser may, for instance, be configured to provide a managed mode in which one or more policies are applied to the managed browser, and an unmanaged mode in which such policies might not be applied and/or in which the browser might not be managed by at least one device manager agent running on the computing device. Based on device state information and/or one or more policies, the managed browser may switch between the managed mode and the unmanaged mode, and the managed browser may provide various functionalities, which may include selectively providing access to enterprise resources, based on such state information and/or the one or more policies.

Claims

1. A method, comprising:

loading, by a computing device, a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser; and

providing, by the computing device, a managed execution environment within the managed browser,

wherein the managed execution environment is configured to facilitate execution of one or more web applications,

wherein the managed execution environment is configured to apply at least one policy of the one or more policies to the one or more web applications, and

wherein the managed execution environment is configured to expose a mobile resource management (MRM) agent on the computing device to the one or more web applications, the MRM agent being configured to monitor state information associated with the computing device and enforce policies based on the state information,

wherein the managed execution environment is configured to expose one or more functions to the one or more web applications via an application programming interface, and

wherein at least one function of the one or more functions exposed to the one or more web applications via the application programming interface includes a secure data storage function.

2. The method of claim 1, wherein the managed execution environment is configured to facilitate execution of at least one HTML5 application.

3. The method of claim 1, wherein at least one policy of the one or more policies is received from a policy management server.

4. The method of claim 1, wherein the at least one policy is configured to prevent the one or more web applications from accessing at least one local storage resource.

5. The method of claim 1, wherein the at least one policy is configured to selectively enable the one or more web applications to access at least one local storage.

6. The method of claim 1, wherein the managed execution environment is configured to provide an authentication service for the one or more web applications.

7. The method of claim 1, wherein the managed execution environment is configured to apply a default set of policies to the one or more web applications.

8. The method of claim 1, wherein the managed execution environment is configured to dynamically update a set of policies applied to the one or more web applications.

18. The method of claim 1, wherein the managed execution environment is configured to extend at least one secure key management function to the one or more web applications via the MRM agent.

9. A computing device, comprising:

at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing device to;

load a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser; and

provide a managed execution environment within the managed browser,

wherein the managed execution environment is configured to facilitate execution of one or more web applications,

wherein the managed execution environment is configured to apply at least one policy of the one or more policies to the one or more web applications, and

wherein the managed execution environment is configured to expose a mobile resource management (MRM) agent on the computing device to the one or more web applications, the MRM agent being configured to monitor state information associated with the computing device and enforce policies based on the state information,

wherein the managed execution environment is configured to expose one or more functions to the one or more web applications via an application programming interface, and

wherein at least one function of the one or more functions exposed to the one or more web applications via the application programming interface includes a secure data storage function.

10. The computing device of claim 9, wherein the managed execution environment is configured to facilitate execution of at least one HTML5 application.

11. The computing device of claim 9, wherein at least one policy of the one or more policies is received from a policy management server that is configured to communicate with the MRM agent to provide policies to be applied to the one or more web applications.

12. The computing device of claim 9, wherein the at least one policy is configured to prevent the one or more web applications from accessing at least one local storage resource based on the state information monitored by the MRM agent.

13. The computing device of claim 9,

wherein the at least one policy is configured to selectively enable the one or more web applications to access at least one local storage based on the state information monitored by the MRM agent, and

wherein the at least one policy is further configured to require the one or more web applications to utilize an encryption function when interacting with the at least one local storage.

14. The computing device of claim 9,

wherein at least one function of the one or more functions exposed to the one or more web applications via the application programming interface includes a secure tunneling function.

15. The computing device of claim 9,

wherein the managed execution environment is configured to provide an authentication service for the one or more web applications,

wherein providing the authentication service for the one or more web applications includes handling at least one multi-factor authentication process for at least one web application of the one or more web applications, and

wherein handling the at least one multi-factor authentication process for the at least one web application includes obtaining one or more credentials, maintaining one or more keys, and providing at least one of the one or more credentials and the one or more keys to facilitate at least one handshake.

16. The computing device of claim 9, wherein the managed execution environment is configured to apply a default set of policies to the one or more web applications, the default set of policies including a policy bundle for one or more specific web applications of the one or more web applications.

17. One or more non-transitory computer-readable media having instructions stored thereon that, when executed, cause a computing device to:

load a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser; and

provide a managed execution environment within the managed browser,

wherein the managed execution environment is configured to facilitate execution of one or more web applications,

wherein the managed execution environment is configured to apply at least one policy of the one or more policies to the one or more web applications, and

wherein the managed execution environment is configured to expose a mobile resource management (MRM) agent on the computing device to the one or more web applications, the MRM agent being configured to monitor state information associated with the computing device and enforce policies based on the state information,

wherein the managed execution environment is configured to expose one or more functions to the one or more web applications via an application programming interface, and

wherein at least one function of the one or more functions exposed to the one or more web applications via the application programming interface includes a secure data storage function.