Systems and methods for controlling email access

• US 9,391,960 B2
• Filed: 05/07/2014
• Issued: 07/12/2016
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Dabbiere, Alan, Stuntebeck, Erich, Brannon, Jonathan Blake
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US14/272,036
• Publication Number:
  US 20140245008A1
• Time in Patent Office: 797 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Embodiments of the disclosure relate to proxying at least one email resource in transit to at least one client device from at least one email service, removing at least one URL from the email resources, and adding at least one modified URL to the email resources.

Claims

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, comprising program code that, when executed, causes the at least one computing device to:

access an email resource requested by a client device from at least one email service;

identify a uniform resource locator (URL) within the email resource;

determine whether the URL is required to be accessed by a particular browser application; and

responsive to determining that the URL is required to be accessed by the particular browser application, modify the URL within the email resource to include a designation of the particular browser application, wherein the URL as modified cannot be accessed by at least one browser application other than the particular browser application.

2. The non-transitory computer-readable medium of claim 1, wherein the particular browser application is configured to unauthorize the client device from accessing the email resource responsive to at least one resource rule not being satisfied.

3. The non-transitory computer-readable medium of claim 2, wherein the resource rule further comprises a variably stringent resource rule, wherein a stringency of the variably stringent resource rule is based at least in part on a device state associated with the client device.

4. The non-transitory computer-readable medium of claim 3, wherein the device state further comprises information associated with a current time associated with the client device, a geographic location of the client device, at least one network accessible by the client device, or at least one network beacon accessible by the client device.

5. The non-transitory computer-readable medium of claim 4, wherein the device state further comprises information associated with a hardware feature of the client device, a software feature of the client device, or an application accessible by the client device.

6. The non-transitory computer-readable medium of claim 1, wherein the URL is designated as unauthorized.

7. The non-transitory computer-readable medium of claim 1, wherein the program further comprises program code that, when executed, causes the at least one computing device to unauthorize the client device from accessing the email resource responsive to at least one resource rule not being satisfied.

8. The non-transitory computer-readable medium of claim 1, wherein the program further comprises program code that, when executed, causes the at least one computing device to receive a request to access the email resource from the client device, the request comprising information regarding a device state associated with the client device.

9. A system, comprising:

at least one computing device that comprises at least one hardware processor; and

program code executed in the at least one computing device that causes the at least one computing device to at least;

proxy an email server executing an email service to access an email resource requested by a client device from the email service;

identify a uniform resource locator (URL) within the email resource;

determine whether the URL is required to be accessed by a particular browser application; and

responsive to determining that the URL is required to be accessed by the particular browser application, modify the URL within the email resource to include a designation of the particular browser application, wherein the URL as modified cannot be accessed by at least one browser application other than the particular browser application.

10. The system of claim 9, wherein the program code that causes the at least one computing device to modify the URL within the email resource further comprises program code that causes the at least one computing device to encrypt the URL according to a particular encryption protocol, wherein the at least one browser application is not capable of decrypting the URL as encrypted.

11. The system of claim 10, wherein the particular browser application is capable of decrypting the URL as encrypted utilizing the particular encryption protocol.

12. The system of claim 9, further comprising program code that causes the at least one computing device to at least:

determine whether at least one resource rule is satisfied; and

responsive to the at least one resource rule being satisfied, authorize the client device to access the email resource.

13. The system of claim 12, wherein the program code that causes the at least one computing device to authorize the client device to access the email resource further comprises program code that causes the at least one computing device to cause at least one decryption key to be transmitted to the client device, the at least one decryption key being required to access the email resource.

14. The system of claim 12, wherein the program code that authorizes the client device to access the email resource further comprises program code that causes the at least one computing device to initiate a transmission of the email resource to the client device.

15. The system of claim 12, wherein the program code that authorizes the client device to access the email resource further comprises program code that causes the at least one computing device to initiate a transmission of an authorization indication to the client device, the authorization indication specifying that the client device is authorized to access the email resource.

16. A method, comprising:

accessing, by at least one computing device that comprises at least one hardware processor, an email resource requested by a client device from an email service;

identifying, by the at least one computing device, a uniform resource locator (URL) within the email resource;

determining, by the at least one computing device, whether the URL is required to be accessed by a particular browser application; and

responsive to determining that the URL is required to be accessed by the particular browser application, modifying, by the at least one computing device, the URL within the email resource to include a designation of the particular browser application, wherein the URL as modified cannot be accessed by at least one browser application other than the particular browser application.

17. The method of claim 16, wherein modifying the URL within the email resource further comprises encrypting, by the at least one computing device, the URL according to a particular encryption protocol, wherein the at least one browser application is not capable of decrypting the URL as encrypted.

18. The method of claim 17, wherein the particular browser application is capable of decrypting the URL as encrypted utilizing the particular encryption protocol.

19. The method of claim 16, further comprising:

determining, by the at least one computing device, whether at least one resource rule is satisfied; and

responsive to the at least one resource rule being satisfied, authorizing, by the at least one computing device, the client device to access the email resource.

20. The method of claim 19, wherein authorizing the client device to access the email resource further comprises causing, by the at least one computing device, at least one decryption key to be transmitted to the client device, the at least one decryption key being required to access the email resource.