Client device connectivity with integrated business rules

• US 9,197,617 B1
• Filed: 12/15/2010
• Issued: 11/24/2015
• Est. Priority Date: 12/15/2010
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Millwood, Lorne A., Lopez Suarez, Xavier Federico, Hill, Peter F., Willhoit, Donald Ryan
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): KOROBOV, VITALI A
• Application Number:
  US12/969,202
• Time in Patent Office: 1,805 Days
• Field of Search: 709/218, 709/229, 370/230, 455/456.1, 726/1, 726/2, 726/22, 726/26
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Applications executing on mobile client devices may access remote resources via network connections. Operational capabilities and financial costs of these connections may differ. Developers, network administrators, and other parties may wish to moderate usage of various available conditions to conform to business rules. Connectivity information including one or more network grants are integrated into an application received from a developer at ingestion by an application management server, which accesses those business rules. The client devices may coordinate with a proxy server to provide additional controls. Networking public interfaces provide the developer with a simplified pathway for development of applications which use network connections, particularly on mobile devices.

Claims

1. One or more non-transitory computer-readable storage media storing instructions that, when executed on a proxy server, instruct a processor of the proxy server to perform acts comprising:

receiving, over a network, a request for communication with a remote resource from an active content module executing on a first client device;

denying the request for communication with the remote resource based, at least in part, on determining that the first client device is not registered with the proxy server;

determining that a business rule associated with a second client device is present based, at least in part, on determining that the second client device is registered with the proxy server;

determining that communication with the remote resource is allowable based, at least in part, on a network grant, the network grant specifying that the communication use a local area network;

initiating data communications with the remote resource using the local area network;

performing an analysis of at least a portion of the data communications between the active content module and the remote resource; and

determining that the active content module is in compliance with licensing rights associated with data included in the at least the portion of the data communications based at least partly on the analysis.

2. The one or more non-transitory computer-readable storage media of claim 1, wherein denying the request for communication comprises providing, to the first client device, an updated business rule including a restriction on communication between the remote resource and the active content module.

3. The one or more non-transitory computer-readable storage media of claim 1, further comprising:

receiving an identity of the second client device; and

registering the second client device with the proxy server.

4. The one or more non-transitory computer-readable storage media of claim 1, wherein the network grant comprises one or more restrictions on accessing a network resource using a wireless local area network connection, a wireless wide-area network connection, or both.

5. The one or more non-transitory computer-readable storage media of claim 1, wherein the network grant comprises permission to access a network resource using a pre-determined hardware network interface of the second client device.

6. The one or more non-transitory computer-readable storage media of claim 1, wherein the business rule comprises a restriction on the meted communication by the second client device via the proxy server.

7. The one or more non-transitory computer-readable storage media of claim 1, wherein the business rule comprises a restriction on functions of the active content module.

8. The one or more non-transitory computer-readable storage media of claim 1, wherein the business rule comprises a restriction on a quantity of data transferred during a pre-determined interval of time.

9. The one or more non-transitory computer-readable storage media of claim 1, wherein the business rule comprises a restriction on an amount of data that can be transferred based at least in part on a time of day during a particular time period.

10. The one or more non-transitory computer-readable storage media of claim 1, wherein the business rule comprises a restriction on data transfer based at least in part on a location of the second client device.

11. The one or more non-transitory computer-readable storage media of claim 10, wherein the location of the second client device comprises a geographic location.

12. A proxy server configured to perform acts comprising:

receiving, over a network, a request for communication with a remote resource, the request sent from an active content module executing on a first client device;

determining that the first client device is not registered with the proxy server;

denying the request for communication with the remote resource based, at least in part, on determining that the first client device is not registered with the proxy server;

determining that a business rule associated with a second client device is present, the business rule unmodifiable by the second client device, wherein the second client device is registered with the proxy server;

receiving, over a network, a request for communication with a remote resource, the request sent from an active content module executing on a first client device;

determining that the first client device is not registered with the proxy server;

denying the request for communication with the remote resource based, at least in part, on determining that the first client device is not registered with the proxy server;

determining that a business rule associated with a second client device is present, the business rule unmodifiable by the second client device, wherein the second client device is registered with the proxy server;

determining that the communication is allowable based at least in part on a network grant specifying use of a local area network for the communication;

initiating communication with the remote resource using the local area network; and

determining that the active content module is in compliance with licensing rights associated with a content included in data traffic between the active content module and the remote resource based, at least in part, on analyzing the communication between the active content module and the remote resource.

13. The proxy server of claim 12, wherein an explicit blocking business rule denies communication for one or more of the first client device or the active content module when the first client device is not located in a specified country.

14. The proxy server of claim 12, wherein the denying the requested communication comprises providing an updated business rule including a restriction on communication to the first client device.

15. The proxy server of claim 12, further comprising receiving an identity of the second client device during registration with the proxy server.

16. The proxy server of claim 12, wherein the network grant identifies that the active content module can access a network resource using at least one of:

a wireless local area network connection that is accessible to the second client device, or a wireless wide-area network connection that is accessible to the second client device.

17. The proxy server of claim 12, wherein the network grant comprises permission to access a network resource using a pre-determined hardware network interface of the second client device.

18. The proxy server of claim 12, wherein the business rule comprises a restriction on the requested communication by the second client device via the proxy server.

19. The proxy server of claim 12, wherein the business rule comprises a restriction on functions of the active content module.

20. The proxy server of claim 12, wherein the business rule comprises a restriction on a quantity of data transferred during a pre-determined interval of time.

21. The proxy server of claim 12, wherein the business rule comprises a restriction on data transfer based at least in part on a time of day, a date, or a combination thereof.

22. The proxy server of claim 12, wherein the business rule comprises a restriction on data transfer based at least in part on a location of the second client device.

23. The proxy server of claim 22, wherein the location of the second client device comprises a geographic location.

24. A method performed by one of or more processors configured with instructions to perform acts comprising:

receiving, over a network, a request for communication with a remote resource from an active content module executing on a first client device;

determining that the first client device is not registered with a proxy server;

denying the request, from the active content module executing on the first client device, for communication with the remote resource;

determining that a second client device is registered with the proxy server;

determining that a business rule associated with the second client device is present;

approving the communication with the remote resource based at least partly on a network grant specifying that the communication use a local area network;

initiating data communications with the remote resource using the local area network; and

determining that the active content module is in compliance with licensing rights based at least partly on an analysis of at least a portion of the data communications between the active content module and the remote resource.

25. The method of claim 24, the acts further comprising:

receiving a second request for communication with the remote resource from a third client device;

determining that the network grant prohibits the second request for communication; and

denying the second request for communication based, at least in part, on the network grant.

26. The method of claim 24, wherein the business rule comprises a limitation on accessing a network resource via a wireless local area network connection, a wireless wide-area network connection or both.

27. The method of claim 24, wherein the business rule comprises a restriction on a quantity of data transferred during a pre-determined interval of time.

28. The method of claim 24, wherein the business rule comprises a restriction on data transfer based at least in part on a model of the second client device.

29. The method of claim 24, wherein the business rule comprises a restriction on data transfer based at least in part on time of day, date, or a combination thereof.

30. The method of claim 24, wherein the business rule comprises a restriction on data transfer based at least in part on a current location of the second client device.

31. The method of claim 30, wherein the second client device is located at a particular geographic location.

32. The method of claim 24, wherein an active content module is capable of calling a networking public interface.