Systems and methods for controlling email access

• US 9,450,921 B2
• Filed: 12/22/2014
• Issued: 09/20/2016
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: Omnissa, LLC
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Dabbiere, Alan, Stuntebeck, Erich, Brannon, Jonathan Blake
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US14/579,042
• Publication Number:
  US 20150113606A1
• Time in Patent Office: 638 Days
• Field of Search: 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Embodiments of the disclosure relate to controlling access to email content. According to various embodiments as described herein, an email message may be accessed by a computing device to identify a uniform resource locator (URL) within the email message, wherein the URL corresponds to a resource residing in a protected location that is not accessible by a native browser application of the client device. The computing device may determine whether the client device is permitted to access the URL and request access to the resource via the secure browser application of the client device upon a determination that the client device is permitted to access the resource in accordance with the at least one resource rule.

Claims

1. A non-transitory computer-readable medium embodying a program executable in a computing device comprising code that, when executed, causes the computing device to at least:

access an email message received by the computing device;

identify a uniform resource locator (URL) within the email message, wherein the URL corresponds to a resource residing in a protected location that is not accessible by a native browser application of the computing device;

determine whether the computing device is permitted to access the URL; and

request access to the resources through a secure browser application of the computing device, the secure browser application being different from the native browser application, upon a determination that the computing device is permitted to access the resource in accordance with at least one resource rule, wherein the secure browser application is capable of accessing the resource residing in the protected location in compliance with the at least one resource rule.

2. The non-transitory computer-readable medium of claim 1, wherein the program further comprises code that, when executed, causes the computing device to at least identify the URL as being unauthorized from a list of unauthorized locations specified by the at least one resource rule.

3. The non-transitory computer-readable medium of claim 1, wherein the program further comprises code that, when executed, causes the computing device to at least prompt a user of the computing device with a notification in a user interface stating that the native browser application is not permitted to access the resource.

4. The non-transitory computer-readable medium of claim 1, wherein the protected location further comprises a network location residing in an intranet network.

5. The non-transitory computer-readable medium of claim 1, wherein the program further comprises code that, when executed, causes the computing device to request access to the resource by the secure browser application based at least in part on a manipulation of the URL.

6. The non-transitory computer-readable medium of claim 5, wherein the manipulation of the URL further comprises a modification of the URL, the modification of the URL comprising a call to the secure browser application.

7. The non-transitory computer-readable medium of claim 5, wherein the manipulation of the URL further comprises a function call initiating a launching of the secure browser application, the function call comprising at least the URL.

8. A method, comprising:

accessing, by a computing device, an email message received by the computing device;

identifying, by the computing device, a uniform resource locator (URL) within the email message, wherein the URL corresponds to a resource residing in a protected location that is not accessible by a native browser application of the computing device;

determining, by the computing device, whether the computing device is permitted to access the URL; and

requesting, by the computing device, access to the resource through a secure browser application of the computing, the secure browser application being different from the native browser application, upon a determination that the computing device is permitted to access the resource in accordance with at least one resource rule, wherein the secure browser application is capable of accessing the resource residing in the protected location in compliance with the at least one resource rule.

9. The method of claim 8, further comprising identifying, by the computing device, the URL as being authorized from a list of authorized locations specified by the at least one resource rule.

10. The method of claim 8, further comprising prompting, by the computing device, a user of the computing device with a notification in a user interface stating that the native browser application is not permitted to access the resource.

11. The method of claim 8, wherein the protected location further comprises a network location residing in an intranet network.

12. The method of claim 8, further comprising requesting, by the computing device, access to the resource by the secure browser application based at least in part on a manipulation of the URL.

13. The method of claim 12, wherein the manipulation of the URL further comprises a modification of the URL, the modification of the URL comprising a call to the secure browser application.

14. The method of claim 12, wherein the manipulation of the URL further comprises a function call initiating a launching of the secure browser application, the function call comprising at least the URL.

15. A system, comprising:

a client device comprising processing circuitry; and

at least one client application executable by the client device, the at least one client application comprising program code that, when executed, causes the client device to;

access an email message received by the client device;

identify a uniform resource locator (URL) within the email message, wherein the URL corresponds to a resource residing in a protected location that is not accessible by a native browser application of the client device;

determine whether the client device is permitted to access the URL; and

request access to the resource through a secure browser application of the client device, the secure browser application being different from the native browser application, upon a determination that the client device is permitted to access the resource in accordance with the at least one resource rule, wherein the secure browser application is capable of accessing the resource residing in the protected location in compliance with the at least one resource rule.

16. The system of claim 15, wherein the at least one client application further comprises program code that, when executed, causes the client device to identify the URL as being authorized from a list of authorized locations specified by the at least one resource rule.

17. The system of claim 15, wherein the protected location further comprises a network location residing in an intranet network.

18. The system of claim 15, wherein the at least one client application further comprises program code that, when executed, causes the client device to request access to the resource by the secure browser application based at least in part on a manipulation of the URL.

19. The system of claim 18, wherein the manipulation of the URL further comprises a modification of the URL, the modification of the URL comprising a call to the secure browser application.

20. The system of claim 18, wherein the manipulation of the URL further comprises a function call initiating a launching of the secure browser application, the function call comprising at least the URL.