Securely authorizing access to remote resources

• US 9,185,099 B2
• Filed: 09/23/2013
• Issued: 11/10/2015
• Est. Priority Date: 09/23/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Brannon, Jonathan Blake
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/033,682
• Publication Number:
  US 20140201816A1
• Time in Patent Office: 778 Days
• Field of Search: 726/2, 726/4, 726/21, 726/17, 726/27
• US Class Current: 1/1
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Securely authorizing access to remote resources may be provided. A method may include receiving a request to determine whether a user device is authorized to access at least one resource hosted by a resource server, determining whether the user device is authorized to access the at least one resource based at least in part on whether the user device has been issued a management identifier, providing a response indicating that the user device is authorized to access the at least one resource in response to a determination that the user device is authorized to access the at least one resource hosted by the resource server, and providing a response indicating that the user device is not authorized to access the at least one resource in response to a determination that the user device is not authorized to access the at least one resource.

Claims

1. A method comprising:

receiving a request to determine whether a user device communicatively coupled to a resource server is authorized to access at least one resource hosted by the resource server;

determining whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server based at least in part on whether the user device communicatively coupled to the resource server has been issued a management identifier;

responsive to a determination that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server, providing a response indicating that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server; and

,

responsive to a determination that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server, providing a response indicating that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server.

2. The method of claim 1, further comprising:

receiving an indication that the user device communicatively coupled to the resource server has not been issued the management identifier.

3. The method of claim 1, further comprising:

determining whether the user device communicatively coupled to the resource server is an authorized to be issued the management identifier;

responsive to a determination that the user device communicatively coupled to the resource server is an authorized to be issued the management identifier, issuing the management identifier to the user device communicatively coupled to the resource server; and

,

responsive to a determination that the at least one user device communicatively coupled to the resource server is not authorized to be issued the management identifier, causing at least one remedial action to be performed.

4. The method of claim 3, wherein determining whether the user device communicatively coupled to the resource server is authorized to be issued the management identifier comprises determining whether the user device communicatively coupled to the resource server is managed via a management service.

5. The method of claim 3, wherein determining whether the user device communicatively coupled to the resource server is authorized to be issued the management identifier comprises determining whether the user device communicatively coupled to the resource server satisfies at least one compliance rule.

6. The method of claim 3, wherein causing the at least one remedial action to be performed comprises causing the user device communicatively coupled to be resource server to be managed via a management service.

7. The method of claim 3, wherein issuing the management identifier to the user device communicatively coupled to the resource server comprises generating the management identifier.

8. The method of claim 3, wherein issuing the management identifier to the user device communicatively coupled to the resource server comprises adding the management identifier to a management record associated with the user device communicatively coupled to the resource server.

9. The method of claim 3, wherein issuing the management identifier to the user device communicatively coupled to the resource server comprises providing the user device communicatively coupled to the resource server with access to the management identifier.

10. The method of claim 1, further comprising:

providing the user device communicatively coupled to the resource server with an application configured to access the at least one resource hosted by the resource server.

11. The method of claim 1, further comprising:

establishing a communicative coupling with the resource server to which the user device is communicatively coupled.

12. The method of claim 1, wherein at least one stage of the method is performed by a management service executed by a management server.

13. The method of claim 1, wherein at least one stage of the method is performed by an agent application executed by the user device communicatively coupled to the resource server.

14. A system comprising at least one processor and at least one memory storing program code instructions, the at least one memory and program code instructions being configured to, with the at least one processor, direct the system to at least:

receive a request to determine whether a user device communicatively coupled to a resource server is authorized to access at least one resource hosted by the resource server;

determine whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server based at least in part on whether the user device communicatively coupled to the resource server has been issued a management identifier;

responsive to a determination that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server, provide a response indicating that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server; and

,

responsive to a determination that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server, provide a response indicating that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server.

15. The system of claim 14, wherein the management identifier is generated based at least in part on an element distinct from the user device communicatively coupled to the resource server.

16. The system of claim 15, wherein the element distinct from the user device communicatively coupled to the resource server comprises at least one of the following:

a random number, a random character, or a random symbol.

17. The system of claim 15, wherein the element distinct from the user device communicatively coupled to the resource server excludes at least one of the following:

a serial number, a Wi-Fi address, a Bluetooth address, a IMEI number, a ICCID number, or a MEID number.

18. A computer program product comprising a non-transitory computer-readable storage medium having program code portions embodied therein, the program code portions being configured to, upon execution, direct an apparatus to at least:

receive a request to determine whether a user device communicatively coupled to a resource server is authorized to access at least one resource hosted by the resource server;

determine whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server based at least in part on whether the user device communicatively coupled to the resource server has been issued a management identifier;

responsive to a determination that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server, provide a response indicating that the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server; and

,

responsive to a determination that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server, provide a response indicating that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server.

19. The computer program product of claim 18, wherein the determination of whether the user device communicatively coupled to the resource server is authorized to access the at least one resource hosted by the resource server is further based at least in part on whether the user device communicatively coupled to the resource server satisfies at least one compliance rule.

20. The computer program product of claim 18, wherein the apparatus is further directed to at least:

responsive to a determination that the user device communicatively coupled to the resource server is not authorized to access the at least one resource hosted by the resource server, cause at least one remedial action to be performed.