Unified provisioning of applications on devices in an enterprise system

• US 9,692,748 B2
• Filed: 04/17/2015
• Issued: 06/27/2017
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maheshwari, Harsh, Mohamad Abdul, Mohamad Raja Gani, Pakkath, Rajesh, Das, Sidhartha, Katti, Sreedhar
• Primary Examiner(s): Zee, Edward
• Application Number:
  US14/690,062
• Publication Number:
  US 20160087956A1
• Time in Patent Office: 802 Days
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The present disclosure relates generally to managing access to an enterprise system using remote devices. Techniques are disclosed for provisioning applications on remote devices to access resources in an enterprise system. Specifically, applications may be automatically configured with access information (e.g., account information) and connection information to access a resource in an enterprise system using a remote device. Configuring an application may include determining an account for accessing a resource using the application. An account may be provisioned if one has not been established. Upon configuring an application, the device access management system may provide a configured application to the remote device(s) for which the application is configured. Once the configured application is received, the application may be automatically installed on the remote device, after which the application may be executed to access a resource.

Claims

1. A method comprising:

identifying a user role associated with an identity for a user of an enterprise system;

retrieving device information of a first remote device registered for the identity to access the enterprise system;

determining, based on the user role, an account providing the identity with access to a first resource accessible in the enterprise system, wherein the first resource is accessible from the first remote device using a first application of a plurality of applications accessible to the user role;

configuring, by a computer system, the first application with connection information that enables the first application to connect to a first target system to access the first resource for the account using the first remote device, wherein the first target system provides access to the first resource;

configuring, by the computer system, the first application with access information that permits the first application to access the first resource, wherein the access information is based on access permitted to the user by the account; and

transmitting the first application to the first remote device upon configuring the first application with the connection information and the access information.

2. The method of claim 1, further comprising:

detecting a second remote device of a plurality of remote devices registered for the identity to access the enterprise system; and

transmitting the first application to the second remote device upon configuring the first application with the connection information and the access information.

3. The method of claim 1, further comprising:

detecting a change in the user role from a first user role to a second user role;

determining a change in access by the identity to the first resource based on the second user role; and

instructing the first remote device to modify a configuration of the first application based on the change in access.

4. The method of claim 3, further comprising:

discovering a plurality of remote devices registered for the identity to access the enterprise system;

transmitting the first application to the plurality of remote devices upon configuration of the first application; and

instructing each of the plurality of remote devices to modify the configuration of the first application based on the change in access.

5. The method of claim 3, wherein the change in access to the first resource includes revoking access to the first resource, and wherein modifying the configuration of the first application includes deleting the connection information and the access information configured for the first application.

6. The method of claim 3, wherein the change in access to the first resource includes revoking access to the first resource, and wherein modifying the configuration of the first application includes removing the first application from the first remote device.

7. The method of claim 3, wherein modifying the configuration of the first application includes adjusting the access information configured for the first application.

8. The method of claim 1, further comprising:

detecting a change in the user role from a first user role to a second user role;

discovering, based on the second user role, a second application of the plurality of applications accessible to the second user role;

configuring the second application for access from the first remote device using the identity, wherein the second application is configured with information to access a second resource provided by a second target system; and

transmitting the second application to the first remote device.

9. The method of claim 1, wherein the device information indicates a configuration of the first remote device, the configuration indicating an operating system configuration on the first remote device and a hardware configuration of the first remote device, and wherein the first application is configured using the configuration of the first remote device.

10. The method of claim 1, wherein the connection information includes a port address of the first target system, a host address of the first target system, and a lightweight directory access protocol (LDAP) of the first target system.

11. The method of claim 1, further comprising:

identifying, based on the user role, a second application of the plurality of applications, the second application enabling the user to perform the user role;

provisioning the second application to access a second resource in the enterprise system;

configuring the second application to access the second resource from the first remote device; and

transmitting the second application upon configuration of the second application.

12. The method of claim 1, wherein determining the account includes:

determining whether the account is provisioned for accessing the first resource of the first target system;

provisioning the account to provide the identity with access to the first resource of the first target system upon determining that the account is not provisioned for accessing the first resource; and

retrieving account information about the account upon determining that the account is provisioned for the identity.

13. A non-transitory computer-readable medium comprising instructions stored thereon, that when executed on a processor, cause the processor to perform operations comprising:

identifying a user role associated with an identity for a user of an enterprise system;

retrieving device information of a first remote device registered for the identity to access the enterprise system;

determining, based on the user role, an account providing the identity with access to a first resource accessible in the enterprise system, wherein the first resource is accessible from the first remote device using a first application of a plurality of applications accessible to the user role;

configuring, by a computer system, the first application with connection information that enables the first application to connect to a first target system to access the first resource for the account using the first remote device, wherein the first target system provides access to the first resource;

configuring, by the computer system, the first application with access information that permits the first application to access the first resource, wherein the access information is based on access permitted to the user by the account; and

transmitting the first application to the first remote device upon configuring the first application with the connection information and the access information.

14. The non-transitory computer-readable medium of claim 13, wherein the device information indicates a configuration of the first remote device, the configuration indicating an operating system configuration on the first remote device and a hardware configuration of the first remote device, and wherein the first application is configured using the configuration of the first remote device.

15. A system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to;

identify a user role associated with an identity for a user of an enterprise system;

retrieve device information of a plurality of remote devices registered for the identity to access the enterprise system;

determine, based on the user role, an account providing the identity with access to a first resource accessible in the enterprise system, wherein the first resource is accessible from the plurality of remote devices using a first application of a plurality of applications accessible to the user role;

configure, by a computer system, the first application with connection information that enables the first application to connect to a first target system to access the first resource for the account using the plurality of remote devices, wherein the first target system provides access to the first resource;

configure, by the computer system, the first application with access information that permits the first application to access the first resource, wherein the access information is based on access permitted to the user by the account; and

transmit the first application to each of the plurality of remote devices upon configuring the first application with the connection information and the access information.

16. The system of claim 15, wherein configuring the first application includes configuring an instance of the first application for each of the plurality of remote devices, and wherein the instance of the first application is configured for a remote device based on a configuration of the remote device.

17. The system of claim 16, wherein the configuration of the remote device includes one or both of a device configuration or an operating system configuration of the remote device.

18. The system of claim 16, wherein the instance of the first application is configured differently for each of a first remote device and a second remote device of the plurality of remote devices, and wherein a configuration of the first remote device is different from a configuration of the second remote device.

19. The system of claim 15, wherein the device information indicates a configuration of the first remote device, the configuration indicating an operating system configuration on the first remote device and a hardware configuration of the first remote device, and wherein the first application is configured using the configuration of the first remote device.

20. The system of claim 15, wherein the connection information includes a port address of the first target system, a host address of the first target system, and a lightweight directory access protocol (LDAP) of the first target system.