Secure virtual file management system

• US 8,863,297 B2
• Filed: 01/04/2013
• Issued: 10/14/2014
• Est. Priority Date: 01/06/2012
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Sharma, Rahul, Krishnan, Sanjeev, Drewry, John, Akella, Venkata Sastry
• Primary Examiner(s): Zee, Edward
• Application Number:
  US13/734,525
• Publication Number:
  US 20130219456A1
• Time in Patent Office: 648 Days
• Field of Search: 726/26, 726/28, 726/29, 713/189
• US Class Current: 726/26
• CPC Class Codes: G06F 16/185 Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof details of archiving G06F16/11
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A virtual file management system provides user access to managed content on mobile devices. The system comprises storage domains storing the managed content distributively using file systems, and a data infrastructure that organizes the managed content into a virtual file system that maintains information of storage domain specific file system primitives for accessing corresponding portions of the managed content. The data infrastructure, which maintains metadata of the storage domains and the mobile devices, comprises a policy definition and decision component that maintains policies defining controls for permissible operations on the managed content, the permissible operations including the file system primitives. A client application hosted on the mobile devices is coupled to the data infrastructure and the storage domains and includes an enforcement component that communicates with the policy definition and decision component to retrieve and enforce the policies by applying the controls on the mobile devices.

Claims

1. A virtual file management system (VFMS) providing a user access to managed content on one or more mobile devices, the system comprising:

a plurality of storage domains that store the managed content distributively using one or more file systems;

at least one server hosting a data infrastructure that organizes the managed content into a virtual file system that maintains information of storage domain specific file system primitives for accessing corresponding portions of the managed content, the data infrastructure collecting and maintaining metadata of the plurality of storage domains and the one or more mobile devices, wherein the data infrastructure comprises a policy definition and decision component that generates and maintains policies defining controls for permissible operations on the managed content with respect to the user on the one or more mobile devices, the permissible operations including the file system primitives; and

a client application hosted on the one or more mobile devices, the client application coupled to the data infrastructure and the plurality of storage domains and including an enforcement component, wherein the enforcement component communicates with the policy definition and decision component to retrieve and enforce the policies by applying the controls on the one or more mobile devices, the client application retrieving information of the virtual file system from the data infrastructure and providing access to the managed content through an interface by processing data requests using the permissible operations, and processing data requests through one or more of direct communication with the plurality of storage domains and secure overlay communication, through the data infrastructure, with the plurality of storage domains, wherein the client application exposes the permissible operations and the virtual file system information to one or more mobile applications that run on the one or more mobile devices and provides the access to the managed content through the interface.

2. The system of claim 1, wherein the plurality of storage domains include one or more of shared storage of an enterprise and cloud based storage.

3. The system of claim 2, wherein the shared storage of an enterprise includes enterprise content management systems including at least one of an enterprise storage domain, shared drives, and a directory service, the shared drives including one or more of Network File System (NFS), Common Internet File System (CIFS), and Distributed File System (DFS) based shared drives.

4. The system of claim 2, wherein the cloud-based storage includes a cloud based storage domain.

5. The system of claim 1, wherein the client application comprises a native mobile application for the one or more mobile devices.

6. The system of claim 5, wherein the client application includes a web based hypertext markup language 5 (HTML5) application, wherein the one or more mobile devices includes a web browser client accessing the HTML5 application.

7. The system of claim 1, wherein the one or more mobile devices include one or more of a smartphone device and a tablet.

8. The system of claim 1, the one or more file systems including a first file system and a second file system, wherein a content hierarchy of the first file system is different than the content hierarchy of the second file system.

9. The system of claim 1, wherein the data infrastructure is one or more of a private and a public cloud based service.

10. The system of claim 9, wherein the data infrastructure implements a pluggable mechanism to couple with the plurality of storage domains.

11. The system of claim 10, wherein the coupling with the plurality of storage domains includes interfacing with the plurality of storage domains using one or more of a public interface and a protocol.

12. The system of claim 11, wherein the public interface includes Representational State Transfer (REST) communications, Simple Object Access Protocol (SOAP) communications and proprietary application programming interfaces (APIs), wherein the protocol includes Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS) and Network File System (NFS).

13. The system of claim 11, the interfacing with the plurality of storage domains including collecting the storage domain specific file system primitives, the data infrastructure mapping the storage domain specific file system primitives to corresponding content of the plurality of storage domains.

14. The system of claim 13, the information of the storage domain specific file system primitives including a first and a second set of primitives, wherein the first set is different than the second set, wherein the storage domain specific file system primitives include read, write, delete, update, copy, and move.

15. The system of claim 13, the interfacing with the plurality of storage domains comprising collecting the metadata.

16. The system of claim 15, the organizing the managed content into a virtual file system comprising using the information of the storage domain specific file system primitives, information of the plurality of storage domains and the metadata.

17. The system of claim 16, the virtual file system providing virtual file system primitives including one or more of create, read, update, delete, rename, list, move, copy, get metadata, view, edit, annotate, copy and move across physical file systems, and open in specific applications for editing and viewing, wherein the plurality of storage domains comprise the physical file systems.

18. The system of claim 1, wherein the metadata comprises at least one of an identity component, a content metadata component, a device component, and a policy component.

19. The system of claim 18, wherein the device component comprises information of mobile device configuration parameters of the one or more mobile devices, the mobile device configuration parameters including device specific policies and permissions in place for the one or more mobile devices.

20. The system of claim 19, wherein the configuration parameters include device posture and configuration settings.

21. The system of claim 20, wherein the device component incorporates a mobile device management policy from a third party service, the mobile device management policy specifying the configuration settings.

22. The system of claim 21, wherein the mobile device management policy is defined for a set of enterprise devices, wherein the mobile device management policy is defined according to a role of an enterprise user.

23. The system of claim 19, wherein the policy component comprises storage domain specific policies inherited from each of the plurality of storage domains, the storage domain specific policies including user and group level permissions and policies with respect to the managed content.

24. The system of claim 18, the identity component including unique device identifiers for each of the one or more mobile devices.

25. The system of claim 24, the identity component including storage domain identities including identity and credentials of the user for each of the plurality of storage domains, the identity and credentials of the user enabling authentication and authorization of the user for access to each of the plurality of storage domains.

26. The system of claim 25, the data infrastructure storing the identity and credentials only as needed to synchronize information of the content metadata component with the plurality of storage domains.

27. The system of claim 26, the identity component associating the storage domain identities and the device identifiers with a system user identity in the data infrastructure, wherein the system user identity is unique to each user.

28. The system of claim 27, the identity component associating the system user identity with an enterprise using an enterprise directory management system.

29. The system of claim 28, wherein the identity component maintains a plurality of system user identities associated with the enterprise.

30. The system of claim 29, wherein at least one of the plurality of storage domains include additional user and group associations, wherein the identity component associates the system user identity with the additional user and group associations.

31. The system of claim 30, wherein the additional user and group associations include enterprise level associations including directory service distribution groups and security groups and cloud storage system accounts comprising cloud based storage domain accounts that are established by enterprises or groups of users.

32. The system of claim 18, the content metadata component including storage domain metadata of the managed content stored on each of the plurality of storage domains.

33. The system of claim 32, wherein the storage domain metadata includes name of files, creation date of files, owner of files, and corresponding storage domain content hierarchy, wherein the storage domain content hierarchy includes information of a file hierarchy.

34. The system of claim 23, the generating and maintaining the policies comprising the policy definition and decision component coupled to a management console configured to enable an administrator an ability to define additional policies using information of the metadata, the additional policies defining one or more additional controls for the permissible operations on the managed content.

35. The system of claim 34, wherein the additional policies are defined for an enterprise, wherein the additional policies define the one or more additional controls for a user associated with the enterprise, wherein the user associated with the enterprise comprises the user of the one or more mobile devices.

36. The system of claim 35, wherein the additional policies define the one or more additional controls for groups of users associated with the enterprise, wherein the groups of users comprise the user associated with the enterprise.

37. The system of claim 36, the administrator creating the groups of users associated with the enterprise using custom groups and standard groups, the groups of users including one or more of owners, members, visitors, viewers, on-premise employees, offsite employees, partners and customers.

38. The system of claim 37, wherein the additional policies define the one or more additional controls for a specific mobile device, wherein the specific mobile device includes the one or more mobile devices.

39. The system of claim 38, wherein the additional policies define the one or more additional controls for the plurality of storage domains.

40. The system of claim 39, wherein the additional policies define the one or more additional controls for a portion of the managed content.

41. The system of claim 40, the additional policies including a second set of controls applicable to the specific mobile device, wherein the specific mobile device includes a configuration of operating system, operating system version and device type.

42. The system of claim 41, the additional policies including a third set of controls applicable to the user associated with the enterprise or the groups of users associated with the enterprise.

43. The system of claim 42, the maintaining and generating the policies including storing the additional policies, the device specific policies and permissions and the storage domain specific policies in a policy store of the data infrastructure.

44. The system of claim 43, the maintaining and generating the policies comprising algorithmically compiling at least one of the additional policies for the user associated with the enterprise accessing the portion of the managed content of the plurality of storage domains using the specific mobile device.

45. The system of claim 44, the compiling comprising retrieving and aggregating the one or more additional controls for the user and groups of users associated with the enterprise, the one or more additional controls for the portion of the managed content, the one or more additional controls for the plurality of storage domains, the one or more additional controls of the specific mobile device, the second set of controls, the third set of controls, the device specific policies and permissions and the storage domain specific policies.

46. The system of claim 34, wherein the ability of the administrator to define the additional policies comprises establishing management policies of the enterprise to enforce security controls for the managed content.

47. The system of claim 46, wherein the management policies include information management policies.

48. The system of claim 47, wherein the management policies include file collaboration and sharing policies.

49. The system of claim 48, wherein the management policies include compliance and auditing policies, mobile application specific policies, device management policies, and information rights policies.

50. The system of claim 49, wherein the management policies including cross-domain routing of the managed content across the plurality of storage domains.

51. The system of claim 50, wherein the management policies include synchronization policies.

52. The system of claim 1, the generating and maintaining the policies comprising defining the controls according to a most restrictive derivation, the most restrictive derivation comprising defining the most restrictive controls for the permissible operations on the managed content.

53. The system of claim 1, the retrieving the policies including retrieving the policies when the user accesses the client application on the one or more mobile devices, the retrieving the policies including automatically retrieving changes to the policies.

54. The system of claim 21, wherein the data infrastructure communicates with the one or more mobile devices to verify proper configuration of the one or more mobile devices, the proper configuration including the configuration settings of the mobile device management policy.

55. The system of claim 54, wherein the verifying includes querying the one or more mobile devices for at least one of device name, operating system and build version, model name and number, capacity and space available, network information including current carrier network and phone number, compliance and security information including configuration profiles installed, certificates installed with expiry dates, list of restrictions enforced, hardware encryption capabilities and passcode present, applications installed including application identification (ID), name, version, size, and application data size, and provisioning profiles installed with expiry date.

56. The system of claim 55, comprising the data infrastructure creating a configuration profile using information of the querying and communicating with the one or more mobile devices to configure settings of the one or more devices.

57. The system of claim 56, the settings including at least one of pre-configured sites and folders on the client application for access to the managed content based on user identity, group, permissions and policies, certificates used to setup trust between the client application and the data infrastructure, certificates and credentials used for access to the plurality of storage domains, and the generated and maintained policies.

58. The system of claim 57, the configuring the settings comprising at least one of granting, denying and revoking access to a portion of the managed content.

59. The system of claim 58, the configuring the settings comprising selective wipe of the portion of the managed content.

60. The system of claim 59, the configuring the settings comprising backup and restore of the portion of the managed content, the portion comprising one or more of sites, documents, libraries and folders associated with the managed content.

61. The system of claim 60, the configuring the settings including blocking access of the user to the virtual file system.

62. The system of claim 1, wherein the permissible operations include capabilities of a user to use the client application to at least one of view, edit, create, and manage content hierarchy of the managed content, wherein the content hierarchy includes one or more of document, libraries and folders.

63. The system of claim 62, wherein the permissible operations include capabilities of a user to use the client application to at least one of view, edit, create, and manage at least one of the metadata of the managed content and a portion of the managed content.

64. The system of claim 63, wherein the permissible operations include capabilities to export the portion of the managed content to a first application of the one or more mobile devices.

65. The system of claim 64, wherein the permissible operations include capabilities to import content from a second application to the client application, wherein the managed content includes the imported content, wherein the one or more mobile applications include the first application and the second application.

66. The system of claim 65, wherein the permissible operations include capabilities to share the portion of the managed content across the plurality of storage domains, wherein the sharing the portion of the managed content includes sharing directly using the client application and sharing indirectly using one or more other applications.

67. The system of claim 66, wherein the permissible operations include capabilities to share the portion of the managed content across groups and users.

68. The system of claim 67, wherein the permissible operations include cross-domain routing, the cross-domain routing comprising transferring the portion of the managed content from a first location to a second location, wherein the plurality of storage domains includes the first location and the second location, wherein the first location is different than the second location.

69. The system of claim 68, wherein the permissible operations include storing the portion of the managed content locally on the one or more mobile devices.

70. The system of claim 69, wherein the permissible operations include managing and tagging items for offline access.

71. The system of claim 70, wherein the permissible operations include capability to subscribe to notifications or alerts for conditions and events relating to the managed content including one or more of sharing, workflow and system events.

72. The system of claim 71, wherein the permissible operations comprise applying encryption to the managed content according to the policies, the applying the encryption including applying hardware encryption to the portion of the managed content that is locally cached, applying symmetric key encryption to the portion of the managed content stored in the local folders and applying master key based encryption in cooperation with the data infrastructure to at least a portion of the managed content, the at least a portion including one or more of the exported, shared and cross-domain routed portions of the managed content.

73. The system of claim 72, the data infrastructure tracking actions on the managed content, the actions including the permissible operations, the data infrastructure using the tracked actions to run audit logs, audit reports and analytics, wherein the audit logs, audit reports and analytics provide traceability and auditing of the actions.

74. The system of claim 1, wherein the client application searches the managed content.

75. The system of claim 74, wherein the searching includes a device local search, a remote search and a federated search across the plurality of storage domains.

76. The system of claim 75, wherein the device local search comprises searching for items in a local content model, wherein the managed content includes the searched items, wherein the local content model includes one or more of local device domain information, local favorites and offline files and content models corresponding to the plurality of storage domains.

77. The system of claim 76, wherein the device local search comprises retrieving identified items from a local cache or local content folder of the client application and issuing a GET request to retrieve the identified items from the plurality of storage domains when the device local search confirms absence of the identified items in the local cache or the local content folder.

78. The system of claim 75, wherein the remote search comprises searching for items using the metadata.

79. The system of claim 78, wherein the remote search comprises the data infrastructure exposing a Representational State Transfer (REST) search application programming interface (API) to the client application, the remote search including the client application submitting input parameters to the REST search API.

80. The system of claim 79, wherein the input parameters include query string and metadata fields to return in entity metadata, the metadata fields including one or more of uniform resource indicator (URI) for content access, a metadata entity id, and domain type.

81. The system of claim 80, wherein the input parameters include type of query, number of entities to return, type of entities including one or more of lists, sites, folders and files, and search path.

82. The system of claim 80, wherein the REST search API returns the metadata fields.

83. The system of claim 75, wherein the remote search comprises retrieving identified items from the plurality of storage domains.

84. The system of claim 83, wherein the remote search comprises the client application retrieving the identified items directly from the plurality of storage domains.

85. The system of claim 83, wherein the remote search comprises the data infrastructure retrieving the identified items on behalf of the client application.

86. The system of claim 85, the retrieving the identified items on behalf of the client application comprising retrieving the identified items using connectors corresponding the plurality of storage domains.

87. The system of claim 83, the retrieving the identified items comprising retrieving the identified items using an inside out proxy of the data infrastructure.

88. The system of claim 75, wherein the federated search comprises searching for the items across the plurality of storage domains.

89. The system of claim 88, wherein the federated search comprises the client application performing search calls to the exposed application programming interfaces (APIs) of the plurality of storage domains.

90. The system of claim 88, wherein the federated search comprises the data infrastructure issuing search calls to the exposed application programming interfaces (APIs) of the plurality of storage domains on behalf of the client application, the data infrastructure issuing the search calls on behalf of the client application comprising using connectors corresponding to the plurality of storage domains.

91. The system of claim 88, wherein the searching comprises using an inside out proxy of the data infrastructure to issue search calls.

92. The system of claim 75, wherein the searching comprises a global search.

93. The system of claim 92, wherein the global search includes conducting the device local search, the remote search and the federated search.

94. The system of claim 93, wherein the global search unions results of the device local search, the remote search and the federated search, wherein the global search presents the unioned results together with corresponding location information of the plurality of storage domains.

95. The system of claim 93, wherein the global search presents the results of the device local search, the remote search and the federated search incrementally.

96. The system of claim 95, wherein the presenting the results incrementally comprises initially presenting the device local results and continuing the remote search and the federated search while presenting the device local results.

97. The system of claim 96, wherein the presenting the results incrementally comprises posting the results of the federated and the remote search with the results of the local search upon completion of the federated search and the remote search.

98. The system of claim 1, wherein the enforcement component of the client application communicates with the policy definition and decision component using a secure file control protocol, wherein the secure file control protocol supports synchronization of the policies across the one or more mobile devices.

99. The system of claim 98, wherein the secure file control protocol facilitates certificate-based trust between policy definition and decision component and the enforcement component.

100. The system of claim 99, wherein the secure file control supports Hypertext Transfer Protocol Secure (HTTPS) based Representational State Transfer (REST) communications, the HTTPS based REST communications including GET, DELETE, PUT, and POST.

101. The system of claim 100, wherein the secure file control protocol supports online and offline modes, the online mode comprising the enforcement component retrieving the policies from the policy definition and decision component using the HTTPS based REST communications, the offline mode comprising locally cached storage of the policies on the one or more mobile devices, the offline mode comprising the enforcement component retrieving the policies from the locally cached storage, wherein the locally cached polices policies are updated when the one or more mobile devices establishes communications with the policy definition and decision component using the secure file control protocol.

102. The system of claim 1, the exposing the permissible operations and the virtual file system information comprising exposing a lightweight virtual file management system library (VFMS library) on the one or more mobile devices, the exposing the permissible operations and the virtual file system information comprising the one or more mobile applications integrating the lightweight VFMS library.

103. The system of claim 102, the exposing the permissible operations and the virtual file system information comprising the one or more mobile applications communicating with the data infrastructure using the lightweight VFMS library.

104. The system of claim 103, the communicating with the data infrastructure comprising communicating with the policy definition and decision component using the secure file control protocol to retrieve and enforce the policies by applying the controls on the one or more mobile devices.

105. The system of claim 104, the communicating with the data infrastructure comprising accessing the managed content using the interface.

106. The system of claim 1, wherein the secure overlay communication, through the infrastructure, with the plurality of storage domains comprises an inside out proxy system.