Approach for managing access to data on client devices

• US 9,213,805 B2
• Filed: 06/20/2012
• Issued: 12/15/2015
• Est. Priority Date: 06/20/2012
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Motoyama, Tetsuro
• Primary Examiner(s): GOODCHILD, WILLIAM J
• Application Number:
  US13/528,647
• Publication Number:
  US 20130347055A1
• Time in Patent Office: 1,273 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A device management system is configured to manage access to electronic documents on client devices using policies. The policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices for example, particular hardware and software configurations that are required at client devices before data is permitted to be downloaded to those client devices. The policies may also specify other requirements that must be satisfied before data is permitted to be downloaded to those client devices, for example, user authentication.

Claims

1. A computer-readable medium for managing access to a particular electronic document, the computer-readable medium storing instructions which, when processed by one or more processors, causes:

a device management system receiving, from a client device, a request to access a particular electronic document;

determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices based at least in part on a user authentication level;

determining, based upon the one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices, that user authentication is required to download the particular electronic document to the client device;

in response to determining that user authentication is required to download the particular electronic document to the client device, determining whether a user of the client device is authorized to download the particular electronic document based at least in part on the user authentication level of the user of the client device;

in response to determining that the user of the client device is authorized to download the particular electronic document;

determining one or more attributes of the client device to which the particular electronic document is to be downloaded,

determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device,

determining, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices based at least in part on the user authentication level of the user of the one or more other devices, and

in response to determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, that the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices and enforce the plurality of policies on the one or more other devices based, at least in part, on the user authentication level of the user of the one or more other devices, then providing the particular electronic document to the client device.

2. The computer-readable medium of claim 1, wherein determining whether a user of the client device is authorized to download the particular electronic document includes:

obtaining user authentication data for the user of the client device, and

determining, based upon the user authentication data, whether the user is authorized to download the particular electronic document.

3. The computer-readable medium of claim 1, wherein determining whether a user of the client device is authorized to download the particular electronic document includes:

determining an authorization level that corresponds to the user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level that corresponds to the user of the client device and the one or more attributes of electronic documents that are permitted to be downloaded to client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device.

4. The computer-readable medium of claim 1, wherein the one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

5. The computer-readable medium of claim 1, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or not allow a copy of the particular electronic document to be forwarded from the client device to another device.

6. The computer-readable medium of claim 1, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device includes determining whether the current hardware and software configuration of the client device allows only the display of the particular electronic document at the client device, does not allow a copy of the particular electronic document to be stored at the client device, allows a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or does not allow a copy of the particular electronic document to be forwarded from the client device to another.

7. The computer-readable medium of claim 1, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.

8. An apparatus for managing access to a particular electronic document, the apparatus including a memory storing instructions which, when processed by one or more processors, cause:

a device management system receiving, from a client device, a request to access a particular electronic document;

determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices;

determining, based upon the one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices, that user authentication is required to download the particular electronic document to the client device;

in response to determining that user authentication is required to download the particular electronic document to the client device, determining whether a user of the client device is authorized to download the particular electronic document;

in response to determining that the user of the client device is authorized to download the particular electronic document;

determining one or more attributes of the client device to which the particular electronic document is to be downloaded,

determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device,

determining, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices based at least in part on the user authentication level of the user of the one or more other devices, and

in response to determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, that the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices and enforce the plurality of policies on the one or more other devices based, at least in part, on the user authentication level of the user of the one or more other devices, then providing the particular electronic document to the client device.

9. The apparatus of claim 8, wherein determining whether a user of the client device is authorized to download the particular electronic document includes:

obtaining user authentication data for the user of the client device, and

determining, based upon the user authentication data, whether the user is authorized to download the particular electronic document.

10. The apparatus of claim 8, wherein determining whether a user of the client device is authorized to download the particular electronic document includes:

determining an authorization level that corresponds to the user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level that corresponds to the user of the client device and the one or more attributes of electronic documents that are permitted to be downloaded to client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device.

11. The apparatus of claim 8, wherein the one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

12. The apparatus of claim 8, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and on one or more other devices includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or not allow a copy of the particular electronic document to be forwarded from the client device to another device.

13. The apparatus of claim 8, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and on one or more other devices includes determining whether the current hardware and software configuration of the client device allows only the display of the particular electronic document at the client device, does not allow a copy of the particular electronic document to be stored at the client device, allows a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or does not allow a copy of the particular electronic document to be forwarded from the client device to another device.

14. The apparatus of claim 8, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.

15. A computer-implemented method for managing access to a particular electronic document, the computer-implemented method comprising:

a device management system receiving, from a client device, a request to access a particular electronic document;

determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices based at least in part on a user authentication level;

determining, based upon the one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices, that user authentication is required to download the particular electronic document to the client device;

in response to determining that user authentication is required to download the particular electronic document to the client device, determining whether a user of the client device is authorized to download the particular electronic document based at least in part on the user authentication level of the user of the client device;

in response to determining that the user of the client device is authorized to download the particular electronic document;

determining one or more attributes of the client device to which the particular electronic document is to be downloaded,

determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device,

determining, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices based at least in part on the user authentication level of the user of the one or more other devices, and

in response to determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, that the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and, based upon one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to determine a user authentication level of a user of one or more other devices and enforce the plurality of policies on the one or more other devices based, at least in part, on the user authentication level of the user of the one or more other devices, then providing the particular electronic document to the client device.

16. The computer-implemented method of claim 15, wherein determining whether a user of the client device is authorized to download the particular electronic document includes:

determining an authorization level that corresponds to the user of the client device,

determining, based upon the one or more policies that apply to the particular electronic document, one or more attributes of electronic documents that are permitted to be downloaded to client device, and

determining, based upon the authorization level that corresponds to the user of the client device and the one or more attributes of electronic documents that are permitted to be downloaded to client device and one or more attributes of the particular electronic document, whether the user is authorized to download the particular electronic document to the client device.

17. The computer-implemented method of claim 15, wherein the one or more processing restrictions to be enforced with respect to the particular electronic document at client devices include one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only the display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document.

18. The computer-implemented method of claim 15, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and on one or more other devices includes determining whether the client device is currently configured to allow only the display of the particular electronic document at the client device, not allow a copy of the particular electronic document to be stored at the client device, allow a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or not allow a copy of the particular electronic document to be forwarded from the client device to another device.

19. The computer-implemented method of claim 15, wherein determining, based upon the one or more attributes of the client device to which the particular electronic document is to be downloaded, whether the client device is currently configured to enforce the one or more download and processing restrictions with respect to the particular electronic document on the client device and on one or more other devices includes determining whether the current hardware and software configuration of the client device allows only the display of the particular electronic document at the client device, does not allow a copy of the particular electronic document to be stored at the client device, allows a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, or does not allow a copy of the particular electronic document to be forwarded from the client device to another device.

20. The computer-implemented method of claim 15, wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.