Generating secure roaming user profiles over a network

• US 9,306,951 B1
• Filed: 02/09/2015
• Issued: 04/05/2016
• Est. Priority Date: 05/01/2008
• Status: Expired due to Fees

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Shigapov, Andrey
• Primary Examiner(s): Jhaveri, Jayesh
• Application Number:
  US14/617,786
• Time in Patent Office: 421 Days
• Field of Search: 726/3, 726/4, 726/22, 726 26- 28, 718100-101
• US Class Current: 1/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Embodiments are directed to providing access to a resource over a network. A client device may request access to a server. An application may be provided to the client device. The application may cause control of the client device to be switched from a first desktop to a secure desktop. The secure desktop may be configured to restrict applications access to within the secure desktop. An indication of the resource on the server to map to may be received at the client device. The indicated resource may be mapped onto a file system on the client device. Mapping may comprise using a remote file access protocol, using DLL injection, or adding a kernel module to an operating system on the client device. The mapped resource may be constrained to be accessed through the secure desktop.

Claims

1. A network device for providing access to a resource over a network, comprising:

a memory arranged to store data and instructions; and

a processor arranged to enable actions embodied by at least a portion of the stored instructions, the actions comprising;

sending an application over the network to a client device;

determining an affirmative association between a resource and the client device based on one or more of (i) an authorization level of the client device, or (ii) when an operating system of the client device matches an operating system of the resource;

sending an indication of the resource to map onto a file system controlled by a secure desktop, the resource being requested by the client device and affirmatively associated with the resource;

enabling a mapping of the resource onto the secure desktop, wherein the secure desktop is launched on the client device by the application and wherein the mapped resource is constrained to be accessed through the secure desktop such that the mapped resource appears local to the client device, and wherein mapping the resource further includes adding to an operating system of the client device a kernel module configured to provide access to the resource; and

when the secure desktop is closed, unmapping the resource, and further when the resource is cached on the client device, sending the resource to a server to synchronize the resource with the server.

2. The network device of claim 1, wherein the indication is provided over the network separately from the application to the client device.

3. The network device of claim 1, wherein the indication further comprises one or more of a path within a file system of the resource, a registry hive for the resource, or a name for a registry entry of the resource.

4. The network device of claim 1, further comprising enabling a user of the client device to perform one or more actions, including creating the resource or modifying the resource.

5. The network device of claim 1, further comprising restricting access to an unmapped resource to read only by the client device.

6. The network device of claim 1, wherein the authorization level is based on one or more of a password or a profile.

7. A non-transitory computer-readable storage device having computer-readable instructions stored thereon, which when executed by one or more processors, causes the one or more processors to perform actions, comprising:

sending an application over the network to a client device;

determining an affirmative association between a resource and the client device based on one or more of (i) an authorization level of the client device, or (ii) when an operating system of the client device matches an operating system of the resource;

sending an indication of the resource to map onto a file system controlled by a secure desktop, the resource being requested by the client device and affirmatively associated with the resource;

enabling a mapping of the resource onto the secure desktop, wherein the secure desktop is launched on the client device by the application and wherein the mapped resource is constrained to be accessed through the secure desktop such that the mapped resource appears local to the client device, and wherein mapping the resource further includes adding to an operating system of the client device a kernel module configured to provide access to the resource; and

when the secure desktop is closed, unmapping the resource, and further when the resource is cached on the client device, sending the resource to a server to synchronize the resource with the server.

8. The storage device of claim 7, wherein the indication is provided over the network separately from the application to the client device.

9. The storage device of claim 7, wherein the indication further comprises one or more of a path within a file system of the resource, a registry hive for the resource, or a name for a registry entry of the resource.

10. The storage device of claim 7, further comprising enabling a user of the client device to perform one or more actions, including creating the resource or modifying the resource.

11. The storage device of claim 7, further comprising restricting access to an unmapped resource to read only by the client device.

12. The storage device of claim 7, wherein the authorization level is based on one or more of a password or a profile.

13. A system, comprising:

a plurality of server devices configured to provide access to a resource over a network; and

a network device having one or more processors that perform actions, including;

sending an application over the network to a client device;

determining an affirmative association between a resource and the client device based on one or more of (i) an authorization level of the client device, or (ii) when an operating system of the client device matches an operating system of the resource;

sending an indication of the resource to map onto a file system controlled by a secure desktop, the resource being requested by the client device and affirmatively associated with the resource;

enabling a mapping of the resource onto the secure desktop, wherein the secure desktop is launched by the application on the client device and wherein the mapped resource is constrained to be accessed through the secure desktop such that the mapped resource appears local to the client device, and wherein mapping the resource further includes adding to an operating system of the client device a kernel module configured to provide access to the resource; and

when the secure desktop is closed, unmapping the resource, and further when the resource is cached on the client device, sending the resource to a server to synchronize the resource with the server.

14. The system of claim 13, wherein the indication is provided over the network separately from the application to the client device.

15. The system of claim 13, wherein the indication further comprises one or more of a path within a file system of the resource, a registry hive for the resource, or a name for a registry entry of the resource.

16. The system of claim 13, further comprising enabling a user of the client device to perform one or more actions, including creating the resource or modifying the resource.

17. The system of claim 13, further comprising restricting access to an unmapped to read only by the client device.

18. The system of claim 13, wherein the authorization level is based on one or more of a password or a profile.

19. The system of claim 13, wherein the mapping of the resource employs a security sandbox.

20. The system of claim 13, wherein the mapping of the resource further comprise routing of a remote file access protocol message through a secure tunnel.

21. The system of claim 13, wherein the application enables access to a user of the client device operating as the public kiosk.