Providing a managed browser

• US 9,112,853 B2
• Filed: 10/01/2013
• Issued: 08/18/2015
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed
• Primary Examiner(s): Lewis, Lisa
• Assistant Examiner(s): LWIN, MAUNG T
• Application Number:
  US14/043,086
• Publication Number:
  US 20140298348A1
• Time in Patent Office: 686 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, computer-readable media, and apparatuses for providing a managed browser are presented. In various embodiments, a computing device may load a managed browser. The managed browser may, for instance, be configured to provide a managed mode in which one or more policies are applied to the managed browser, and an unmanaged mode in which such policies might not be applied and/or in which the browser might not be managed by at least one device manager agent running on the computing device. Based on device state information and/or one or more policies, the managed browser may switch between the managed mode and the unmanaged mode, and the managed browser may provide various functionalities, which may include selectively providing access to enterprise resources, based on such state information and/or the one or more policies.

Claims

1. A method, comprising:

loading, by a computing device, a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser;

receiving, by the computing device, a request to access one or more enterprise resources via the managed browser;

obtaining, by the computing device, enterprise data from the one or more enterprise resources based on the request; and

storing, by the computing device, the obtained enterprise data in a secure document container,

wherein the managed browser is further configured to provide an unmanaged mode in which the managed browser is no longer managed by at least one device manager and in which no policies are enforced on the managed browser.

2. The method of claim 1, further comprising:

selectively blocking, by the computing device, access to the obtained enterprise data when the managed browser is operating in the unmanaged mode.

3. The method of claim 1, further comprising:

providing, by the computing device, access to the secure document container via the managed browser only when the managed browser is operating in the at least one managed mode.

4. The method of claim 1, further comprising:

selectively wiping, by the computing device, data from the secure document container.

5. The method of claim 4, wherein selectively wiping data from the secure document container includes deleting the enterprise data obtained from the one or more enterprise resources based on the request.

6. The method of claim 4, wherein the data is selectively wiped from the secure document container when the managed browser is closed.

7. The method of claim 4,

wherein the data is selectively wiped from the secure document container based on the one or more policies, and

wherein selectively wiping the data from the secure document container includes deleting data that was stored during a specific time period while leaving other data in the secure document container.

8. The method of claim 1, wherein at least one policy of the one or more policies includes one or more rules that are configured to cause the managed browser to switch from the at least one managed mode to the unmanaged mode based on device state information associated with the computing device.

9. The method of claim 8, wherein the managed browser is further configured to transition from the unmanaged mode back to the at least one managed mode based on updated device state information.

10. The method of claim 8, wherein the device state information associated with the computing device includes at least one of:

information identifying one or more applications on the computing device;

information identifying a location of the computing device; and

information identifying at least one network to which the computing device is connected.

11. A computing device, comprising:

at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing device to;

load a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser;

receive a request to access one or more enterprise resources via the managed browser;

obtain enterprise data from the one or more enterprise resources based on the request; and

store the obtained enterprise data in a secure document container,

wherein the managed browser is further configured to provide an unmanaged mode in which the managed browser is no longer managed by at least one device manager and in which no policies are enforced on the managed browser.

12. The computing device of claim 11,

wherein the managed browser is configured to provide secure browsing and caching of data obtained from at least one enterprise resource, and

wherein providing secure browsing and caching of the data obtained from the at least one enterprise resource includes caching the data obtained from the at least one enterprise resource in one or more encrypted local caches.

13. The computing device of claim 11, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

provide access to the obtained enterprise data stored in the secure document container via the managed browser only when the managed browser is operating in the at least one managed mode,

wherein providing access to the obtained enterprise data includes enforcing at least one policy of the one or more policies based on a single sign-on (SSO) credential, and

wherein the at least one enforced policy of the one or more policies is configured to limit access to the obtained enterprise data.

14. The computing device of claim 11, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

selectively wipe data from the secure document container.

15. The computing device of claim 14, wherein selectively wiping data from the secure document container includes deleting the enterprise data obtained from the one or more enterprise resources based on the request.

16. The computing device of claim 14, wherein the data is selectively wiped from the secure document container when the managed browser is closed.

17. The computing device of claim 14,

wherein the data is selectively wiped from the secure document container based on the one or more policies, and

wherein selectively wiping the data from the secure document container includes deleting data that was stored in connection with a specific session while leaving other data in the secure document container.

18. One or more non-transitory computer-readable media having instructions stored thereon that, when executed, cause a computing device to:

load a managed browser, the managed browser being configured to provide at least one managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser;

receive a request to access one or more enterprise resources via the managed browser;

obtain enterprise data from the one or more enterprise resources based on the request; and

store the obtained enterprise data in a secure document container,

wherein the managed browser is further configured to provide an unmanaged mode in which the managed browser is no longer managed by at least one device manager and in which no policies are enforced on the managed browser.

19. The one or more non-transitory computer-readable media of claim 18,

wherein the managed browser is configured to provide secure browsing and caching of data obtained from at least one enterprise resource, and

wherein providing secure browsing and caching of the data obtained from the at least one enterprise resource includes providing access to the data obtained from the at least one enterprise resource based on compliance with the one or more policies.

20. The one or more non-transitory computer-readable media of claim 18, having additional instructions stored thereon that, when executed, further cause the computing device to:

provide access to the secure document container via the managed browser only when the managed browser is operating in the at least one managed mode.

21. The one or more non-transitory computer-readable media of claim 18, having additional instructions stored thereon that, when executed, further cause the computing device to:

selectively wipe data from the secure document container.

22. The one or more non-transitory computer-readable media of claim 21, wherein the data is selectively wiped from the secure document container based on at least one policy that is applied to the managed browser when the managed browser is operating in the managed mode.

23. The one or more non-transitory computer-readable media of claim 21, wherein the data is selectively wiped from the secure document container when the managed browser is closed.