Secure virtual file management system

• US 9,465,953 B2
• Filed: 11/09/2015
• Issued: 10/11/2016
• Est. Priority Date: 01/06/2012
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Sharma, Rahul, Krishnan, Sanjeev, Akella, Venkata Sastry, Drewry, John
• Primary Examiner(s): Zee, Edward
• Application Number:
  US14/936,364
• Publication Number:
  US 20160063272A1
• Time in Patent Office: 337 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/185 Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof details of archiving G06F16/11
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Virtual file management is disclosed. Managed content from multiple separate storage domains is organized into a virtual file system that maintains with respect to each of at least a subset of said separate storage domains information of storage domain specific file system primitives to perform primitive operations with respect to content stored in that storage domain. Policies are determined that apply to the managed content. Each policy indicates primitive operations permitted to be performed with respect to the managed content. Information comprising the virtual file system and the policies is provided to a client application on a mobile device. The client application is configured to provide access to the managed content in the virtual file system in a manner at least in part indicated in the policies, including by allowing the permitted primitive operations to be performed using said storage domain specific file system primitives.

Claims

1. A method, comprising:

aggregating managed content from a plurality of storage domains into a virtual file system that maintains information relating to a plurality of sets of operations with respect to content stored in each of at least a subset of the plurality of storage domains, wherein the plurality of sets of operations respectively correspond to at least one of the plurality of storage domains; and

providing, to a client application on a mobile device, information comprising the virtual file system and one or more policies that apply to the managed content, wherein at least one of the one or more policies indicates one or more operations permitted to be performed with respect to the managed content, and the client application is configured to provide access to the managed content in the virtual file system based at least in part on the one or more policies, including by allowing the one or more permitted operations to be performed with respect to the managed content using one or more of the plurality of sets of operations corresponding to the at least one of the plurality of storage domains associated with the managed content.

2. The method of claim 1, wherein the plurality of storage domains include at least an enterprise storage domain and a cloud based storage domain.

3. The method of claim 1, wherein:

the plurality of storage domains include at least a first storage domain and a second storage domain; and

a first set of operations associated with the first storage domain is different from a second set of operations associated with of the second storage domain.

4. The method of claim 1, wherein:

the plurality of storage domains include at least a first storage domain and a second storage domain; and

a first file system hierarchy of the first storage domain is different from a second file system hierarchy of the second storage domain.

5. The method of claim 1, further comprising:

determining the one or more policies that apply to the managed content.

6. The method of claim 5, wherein the one or more policies are determined based at least in part on a role of a user of the mobile device.

7. The method of claim 5, wherein determining the one or more policies comprises combining storage domain specific policies with device management policies associated with the mobile device.

8. The method of claim 1, wherein at least a subset of the one or more policies include domain-specific policies each associated with one or more of the plurality of storage domains.

9. The method of claim 1, wherein the one or more policies include user and group level permissions with respect to the managed content.

10. The method of claim 1, wherein the client application is configured to provide access to the managed content through secure overlay communication with the plurality of storage domains.

11. The method of claim 1, wherein aggregating the managed content includes mapping the corresponding one or more of the sets of operations to content stored in the plurality of storage domains.

12. The method of claim 1, wherein the client application is configured to provide access to the managed content by processing data requests using the permitted operations.

13. The method of claim 1, wherein the client application is configured to provide access to the managed content by exposing the permissible operations and the information comprising the virtual file system to an application included on the mobile device.

14. A system, comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to;

aggregate managed content from a plurality of storage domains into a virtual file system that maintains information relating to a plurality of sets of operations with respect to content stored in each of at least a subset of the plurality of storage domains, wherein the plurality of sets of operations respectively correspond to at least one of the plurality of storage domains; and

provide, to a client application on a mobile device, information comprising the virtual file system and one or more policies that apply to the managed content, wherein at least one of the one or more policies indicates one or more operations permitted to be performed with respect to the managed content, and the client application is configured to provide access to the managed content in the virtual file system based at least in part on the one or more policies, including by allowing the one or more permitted operations to be performed with respect to the managed content using one or more of the plurality of sets of operations corresponding to the at least one of the plurality of storage domains associated with the managed content.

15. The system of claim 14, wherein the storage domains include at least an enterprise storage domain and a cloud based storage domain.

16. The system of claim 14, wherein the processor is configured to aggregate the managed content at least in part by mapping the corresponding one or more of the sets of operations to content stored in the plurality of storage domains.

17. The system of claim 14, wherein:

the plurality of storage domains include at least a first storage domain and a second storage domain; and

a first set of operations associated with the first storage domain is different from a second set of operations associated with of the second storage domain.

18. The system of claim 14, wherein:

the plurality of storage domains include at least a first storage domain and a second storage domain; and

a first file system hierarchy of the first storage domain is different from a second file system hierarchy of the second storage domain.

19. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

aggregating managed content from a plurality of storage domains into a virtual file system that maintains information relating to a plurality of sets of operations with respect to content stored in each of at least a subset of the plurality of storage domains, wherein the plurality of sets of operations respectively correspond to at least one of the plurality of storage domains; and

providing, to a client application on a mobile device, information comprising the virtual file system and one or more policies that apply to the managed content, wherein at least one of the one or more policies indicates one or more operations permitted to be performed with respect to the managed content, and the client application is configured to provide access to the managed content in the virtual file system based at least in part on the one or more policies, including by allowing the one or more permitted operations to be performed with respect to the managed content using one or more of the plurality of sets of operations corresponding to the at least one of the plurality of storage domains associated with the managed content.

20. The computer program product of claim 19, wherein the plurality of storage domains include at least an enterprise storage domain and a cloud based storage domain.

21. The computer program product of claim 19, wherein the computer program further comprises instructions for determining the one or more policies that apply to the managed content, wherein the determining the one or more policies comprises combining storage domain specific policies with device management policies associated with the mobile device.