Method and system for dynamically associating access rights with a resource

• US 9,401,931 B2
• Filed: 08/19/2013
• Issued: 07/26/2016
• Est. Priority Date: 11/08/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rivera, Juan
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US13/969,796
• Publication Number:
  US 20130332991A1
• Time in Patent Office: 1,072 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for dynamically associating, by a server, access rights with a resource includes the step of receiving, by the server, a request for a resource from a client. The server requests, from a policy engine, an identification of a plurality of access rights to associate with the resource, the plurality of access rights identified responsive to an application of a policy to the client. The server associates the resource with the plurality of access rights via a rights markup language. The server transmits the resource to the client with the identification of the associated plurality of access rights. An application program on the client makes an access control decision responsive to the associated plurality of access rights. The application program provides restricted access to the resource responsive to the access control decision.

Claims

1. A method for dynamically associating, by a server, access rights with a resource, the method comprising steps of:

(a) receiving, by a server, a request for a resource from a client;

(b) generating, by a first component of a policy engine, a dataset responsive to an application of a first policy to the client;

(c) transmitting, by the first component of the policy engine to a second component of the policy engine, the dataset;

(d) applying, by the second component of the policy engine, a second policy to the dataset to identify a plurality of levels of access rights associated with the resource;

(e) requesting, by the server, from the second component of the policy engine, the plurality of levels of access rights to associate with the resource;

(f) signing, by the server, the resource with the plurality of levels of access rights via an extensible rights markup language;

(g) transmitting, by the server, the resource signed with the plurality of levels of access rights to the client;

(h) making, by an application program responsive to receiving from the server the signed resource, an access control decision using the plurality of levels of access rights, the application program executing on the client; and

(i) providing, by the application program, restricted access to the resource responsive to the access control decision.

2. The method of claim 1, wherein the client is a mobile device.

3. The method of claim 1, wherein step (a) further comprises receiving via a wireless connection.

4. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to retrieve a file.

5. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to view a version of a file displayed using a version of the Hypertext Markup Language (HTML) standard.

6. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to receive output data generated by an execution of the resource on an application server.

7. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to print a copy of the resource.

8. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to save a local copy of the resource.

9. The method of claim 1, wherein step (b) further comprises receiving, by the server, an identification of the plurality of levels of access rights including a right to transmit via electronic mail a copy of the resource.

10. The method of claim 1, wherein step (i) further comprises denying, by the application program, a request to retrieve the resource.

11. The method of claim 1, wherein step (i) further comprises denying, by the application program, a request to modify the resource.

12. The method of claim 1, wherein step (i) further comprises the step of denying, by the application program, a request to receive output data generated by an execution of the resource on an application server.

13. The method of claim 1, wherein step (i) further comprises allowing, by the application program, a request to retrieve the resource.

14. The method of claim 1, wherein step (i) further comprises displaying, by the application program, a version of the resource displayed using a version of the Hypertext Markup Language (HTML) standard, responsive to a request to retrieve the resource.

15. The method of claim 1, wherein step (i), comprises providing, by the application program executing on a second server, restricted access to the resource responsive to the access control decision.

16. The method of claim 1, wherein step (i) further comprises transmitting, by a second server, output data generated by executing the application program, access to the output data restricted responsive to the access control decision.

17. A system for dynamically associating access rights with a resource comprising:

a server comprising a microprocessor that receives a request for access to a resource from a client;

a first component of a policy engine that executes on the microprocessor of the server to cause the microprocessor to;

generate a dataset responsive to an application of a first policy to the client;

transmit the dataset to a second component of the policy engine;

the second component of the policy engine that executes on one or more microprocessors of the server to;

apply a second policy to the dataset to identify a plurality of levels of access rights associated with the resource;

wherein the server requests from the second component of the policy engine the plurality of levels of access rights to associate with the resource, signs the resource with the plurality of levels of access rights via an extensible rights markup language, and transmits the resource signed with the plurality of levels of access rights to the client; and

an application program that executes on at least one microprocessor of the client to;

receive, from the server, a copy of the resource signed with the plurality of levels of access rights,

make an access control decision in response to receiving the resource signed with the plurality of levels of access rights using the plurality of levels of access rights, and

provide restricted access to the resource responsive to the access control decision.

18. The system of claim 17, wherein the client is a mobile device.

19. The system of claim 17, wherein the policy engine further comprises a collection agent to gather information about the client.

20. The system of claim 19, wherein the policy engine further comprises a policy database, wherein the policy engine applies a policy from the policy database to the gathered information.