Providing a managed browser

• US 9,158,895 B2
• Filed: 10/01/2013
• Issued: 10/13/2015
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed
• Primary Examiner(s): Walsh, John B
• Application Number:
  US14/043,229
• Publication Number:
  US 20140297860A1
• Time in Patent Office: 742 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Methods, systems, computer-readable media, and apparatuses for providing a managed browser are presented. In various embodiments, a computing device may load a managed browser. The managed browser may, for instance, be configured to provide a managed mode in which one or more policies are applied to the managed browser, and an unmanaged mode in which such policies might not be applied and/or in which the browser might not be managed by at least one device manager agent running on the computing device. Based on device state information and/or one or more policies, the managed browser may switch between the managed mode and the unmanaged mode, and the managed browser may provide various functionalities, which may include selectively providing access to enterprise resources, based on such state information and/or the one or more policies.

Claims

1. A method, comprising:

receiving, at an application store, from a managed browser on a user computing device, a request to access a first portion of the application store, the application store being configured to provide one or more applications for download to one or more user devices to enable the one or more applications to be run natively on the one or more user devices;

determining, by the application store, whether the managed browser is operating in a managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser based on device state information associated with the user computing device;

based on determining that the managed browser is operating in the managed mode, allowing, by the application store, the managed browser to access the first portion of the application store; and

based on determining that the managed browser is operating in an unmanaged mode in which the one or more policies are not applied to the managed browser;

preventing, by the application store, the managed browser from accessing the first portion of the application store; and

providing, by the application store, the managed browser with access to a second portion of the application store different from the first portion,

wherein the managed browser is configured to monitor the device state information associated with the user computing device and enforce the one or more policies based on the device state information, and

wherein determining whether the managed browser is operating in the managed mode comprises interrogating, by the application store, the managed browser to determine a current operating mode of the managed browser.

2. The method of claim 1, further comprising:

based on determining that the managed browser is not operating in the managed mode, sending, by the application store, a command to the managed browser, the command being configured to cause the managed browser to enter the managed mode.

3. The method of claim 2, further comprising:

reevaluating, by the application store, whether the managed browser is operating in the managed mode after sending the command to the managed browser.

4. The method of claim 3, further comprising:

based on determining, after the reevaluating, that the managed browser is operating in the managed mode, allowing, by the application store, the managed browser to access the first portion of the application store.

5. The method of claim 3, further comprising:

based on determining, after the reevaluating, that the managed browser is not operating in the managed mode, sending, by the application store, a notification to the managed browser.

6. The method of claim 1, wherein at least one policy of the one or more policies is configured to direct the managed browser to the application store based on a state of the managed browser and user account information.

7. The method of claim 1, wherein allowing the managed browser to access the first portion of the application store comprises providing access to at least one application in the application store that is only available for download when the application store is accessed with the managed browser.

8. The method of claim 1, wherein at least one policy of the one or more policies is configured to restrict at least one of a time at which the managed browser can be used to access specific information and a location at which the managed browser can be used to access specific information.

9. The method of claim 1,

wherein the managed browser is configured to provide secure browsing and caching of data obtained from at least one enterprise resource, and

wherein providing secure browsing and caching of the data obtained from the at least one enterprise resource comprises providing access to the data obtained from the at least one enterprise resource based on compliance with the one or more policies.

10. The method of claim 1, wherein the managed browser is further configured to operate as a mobile resource management agent that enforces the one or more policies on one or more other applications on the user computing device based on the device state information.

11. The method of claim 1, wherein the managed browser is configured to access data stored in a secure data container on the user computing device when operating in the managed mode, and the managed browser is further configured to access data stored in an unsecured data container on the user computing device when operating in the unmanaged mode.

12. The method of claim 1, wherein the managed browser is configured to block access to locally-cached data that was obtained from one or more enterprise resources when the managed browser is operating in the unmanaged mode.

13. The method of claim 1,

wherein access to enterprise-specific information associated with the application store is provided by the application store to the user computing device only when the application store is accessed with the managed browser, and

wherein the enterprise-specific information comprises one or more enterprise templates associated with at least one application that is available in the application store.

14. A computing device, comprising:

at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing device to;

receive, at an application store provided by the computing device, from a managed browser on a user computing device, a request to access a first portion of the application store, the application store being configured to provide one or more applications for download to one or more user devices to enable the one or more applications to be run natively on the one or more user devices;

determine, by the application store, whether the managed browser is operating in a managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser based on device state information associated with the user computing device;

based on determining that the managed browser is operating in the managed mode, allow, by the application store, the managed browser to access the first portion of the application store; and

based on determining that the managed browser is operating in an unmanaged mode in which the one or more policies are not applied to the managed browser;

prevent, by the application store, the managed browser from accessing the first portion of the application store; and

provide, by the application store, the managed browser with access to a second portion of the application store different from the first portion,

wherein the managed browser is configured to monitor the device state information associated with the user computing device and enforce the one or more policies based on the device state information, and

wherein determining whether the managed browser is operating in the managed mode comprises interrogating, by the application store, the managed browser to determine a current operating mode of the managed browser.

15. The computing device of claim 14, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

based on determining that the managed browser is not operating in the managed mode, send, by the application store, a command to the managed browser, the command being configured to cause the managed browser to enter the managed mode.

16. The computing device of claim 15, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

reevaluate, by the application store, whether the managed browser is operating in the managed mode after sending the command to the managed browser.

17. The computing device of claim 16, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

based on determining, after the reevaluating, that the managed browser is operating in the managed mode, allow, by the application store, the managed browser to access the first portion of the application store.

18. The computing device of claim 16, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, further cause the computing device to:

based on determining, after the reevaluating, that the managed browser is not operating in the managed mode, send, by the application store, a notification to the managed browser.

19. One or more non-transitory computer-readable media having instructions stored thereon that, when executed, cause a computing device to:

receive, at an application store provided by the computing device, from a managed browser on a user computing device, a request to access a first portion of the application store, the application store being configured to provide one or more applications for download to one or more user devices to enable the one or more applications to be run natively on the one or more user devices;

determine, by the application store, whether the managed browser is operating in a managed mode in which one or more policies are applied to the managed browser, the one or more policies being configured to limit at least one function of the managed browser based on device state information associated with the user computing device;

based on determining that the managed browser is operating in the managed mode, allow, by the application store, the managed browser to access the first portion of the application store; and

based on determining that the managed browser is operating in an unmanaged mode in which the one or more policies are not applied to the managed browser;

prevent, by the application store, the managed browser from accessing the first portion of the application store; and

provide, by the application store, the managed browser with access to a second portion of the application store different from the first portion,

wherein the managed browser is configured to monitor the device state information associated with the user computing device and enforce the one or more policies based on the device state information, and

wherein determining whether the managed browser is operating in the managed mode comprises interrogating, by the application store, the managed browser to determine a current operating mode of the managed browser.

20. The one or more non-transitory computer-readable media of claim 19, having additional instructions stored thereon that, when executed, further cause the computing device to:

based on determining that the managed browser is not operating in the managed mode, send, by the application store, a command to the managed browser, the command being configured to cause the managed browser to enter the managed mode.