Systems and methods for controlling email access

• US 9,021,037 B2
• Filed: 01/25/2013
• Issued: 04/28/2015
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Stuntebeck, Erich
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US13/750,887
• Publication Number:
  US 20140165213A1
• Time in Patent Office: 823 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments of the disclosure relate to proxying at least one email resource from at least one email service to at least one client device, determining whether the email resources are accessible to the client devices via at least one unauthorized application on the client devices, and modifying the email resources to be inaccessible via the unauthorized applications on the client devices in response to a determination that the email resources are accessible via the unauthorized applications on the client devices.

Claims

1. A system, comprising:

a client device;

at least one email service; and

,

at least one memory device that stores computer-executable instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising;

proxying at least one email resource from the at least one email service to the client device;

determining whether the at least one email resource is accessible using at least one unauthorized application on the client device, the at least one unauthorized application comprising a native mail application bundled with the client device; and

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application, modifying the at least one email resource to be inaccessible using the at least one unauthorized application on the client device.

2. The system of claim 1, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

3. The system of claim 1, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises changing a file format of the at least one email resource.

4. The system of claim 3, wherein the at least one email resource is modified in accordance with at least one email resource rule that specifies the file format.

5. The system of claim 1, wherein the computer executable instructions, when executed by the at least one processor, further cause the at least one processor to perform operations comprising:

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application on the client device, modifying the at least one email resource to be accessible using only at least one authorized application on the client device.

6. The system of claim 5, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

7. The system of claim 5, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises providing at least one cryptographic key used to encrypt the at least one email resource to the at least one authorized application on the client device.

8. The system of claim 5, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises changing a file format of the at least one email resource.

9. The system of claim 5, wherein the at least one authorized application restricts at least one of cutting, copying, pasting, transmitting, screen capturing, or printing the at least one email resource.

10. A method, comprising the steps of:

identifying at least one email resource on a client device;

determining whether the at least one email resource is accessible using at least one unauthorized application on the client device, the at least one unauthorized application comprising a native mail application bundled with the client device; and

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application, modifying the at least one email resource to be inaccessible using the at least one unauthorized application on the client device.

11. The method of claim 10, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

12. The method of claim 10, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises changing a file format of the at least one email resource.

13. The method of claim 12, wherein the at least one email resource is modified in accordance with at least one email resource rule that specifies the file format.

14. The method of claim 10, further comprising the step of:

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application on the client device, modifying the at least one email resource to be accessible using only the at least one authorized application on the client device.

15. The method of claim 14, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

16. The method of claim 14, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises providing at least one cryptographic key used to encrypt the at least one email resource to the at least one authorized application.

17. The method of claim 14, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises changing a file format of the at least one email resource.

18. The method of claim 14, wherein the at least one authorized application restricts at least one of cutting, copying, pasting, transmitting, screen capturing, or printing the at least one email resource.

19. The method of claim 10, further comprising the step of:

authorizing the client device to access the at least one email resource.

20. A non-transitory computer-readable medium embodying code executable in a client device, the code, which when executed, causes the client device to perform a method comprising the steps of:

identifying at least one email resource;

determining whether the at least one email resource is accessible using at least one unauthorized application on the client device, the at least one unauthorized application comprising a native mail application bundled with the client device; and

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application on the client device, modifying the at least one email resource to be inaccessible using the at least one unauthorized application on the client device.

21. The non-transitory computer-readable medium of claim 20, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

22. The non-transitory computer-readable medium of claim 20, wherein modifying the at least one email resource to be inaccessible using the at least one unauthorized application comprises changing a file format of the at least one email resource.

23. The non-transitory computer-readable medium of claim 22, wherein the method further comprises:

authorizing the client device to access the at least one email resource.

24. The non-transitory computer-readable medium of claim 20, wherein the at least one unauthorized application comprises at least one client-side application that is not subject to at least one rule that is provided by at least one access control server.

25. The non-transitory computer-readable medium of claim 24, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises encrypting the at least one email resource based at least in part on at least one cryptographic key.

26. The non-transitory computer-readable medium of claim 24, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises providing at least one cryptographic key used to encrypt the at least one email resource to the at least one authorized application on the client device.

27. The non-transitory computer-readable medium of claim 24, wherein modifying the at least one email resource to be accessible using only the at least one authorized application on the client device comprises changing a file format of the at least one email resource.

28. The non-transitory computer-readable medium of claim 24, wherein the at least one unauthorized application comprises at least one client-side application that is not subject to at least one rule that is provided by an access control server.

29. The non-transitory computer-readable medium of claim 24, wherein the at least one authorized application comprises at least one client-side application that is subject to at least one rule that is provided by an access control server.

30. The non-transitory computer-readable medium of claim 20, wherein the method further comprises the step of:

responsive to a determination that the at least one email resource is accessible using the at least one unauthorized application on the at least one client device, modifying the at least one email resource to be accessible using only at least one authorized application on the client device.