Enterprise-specific functionality watermarking and management

• US 9,699,193 B2
• Filed: 11/19/2015
• Issued: 07/04/2017
• Est. Priority Date: 07/03/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Marshall, John
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/945,601
• Publication Number:
  US 20160072813A1
• Time in Patent Office: 593 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments for enterprise-specific functionality watermarking and management are provided. A request, originated in response to an attempt to perform an enterprise function on a client device, can be received by at least one computing device over a network, where the enterprise function is associated with a remotely-stored compliance rule. At least one watermark template can be identified from a plurality of available watermark templates based at least in part on the enterprise function, and a communication can be generated that, when received by the client device, authorizes the client device to: perform the enterprise function where at least one resource is generated or modified, and apply the at least one watermark template to the at least one resource such that performing the enterprise function complies with the compliance rule.

Claims

1. A non-transitory computer-readable medium embodying program code executable in the at least one computing device that, when executed by the at least one computing device, causes the at least one computing device to:

receive a request from a client device originated in response to an attempt to perform an enterprise function on the client device, the request being received from the client device over a network, the enterprise function being associated with a compliance rule stored remotely from the client device;

identify at least one watermark template from a plurality of available watermark templates based at least in part on the enterprise function; and

generate a communication that, when received by the client device, causes the client device to;

configure the client device such that, when the enterprise function is performed, the at least one watermark template is added to the at least one resource generated or modified as a result of the enterprise function being performed;

in response to the enterprise function being performed, identify that a wrapper is acting as a security layer encapsulating the at least one resource, the wrapper protecting the at least one resource from certain actions being taken on the at least one resource; and

apply the at least one watermark template to the wrapper encapsulating the at least one resource such that performing the enterprise function complies with the compliance rule.

2. The non-transitory computer-readable medium of claim 1, wherein the at least one computing device comprises at least one of:

a resource server, a watermark template server, or a compliance server.

3. The non-transitory computer-readable medium of claim 1, wherein the enterprise function of the client device further comprises a function of the client device that configures the client device for an enterprise use, accesses enterprise data, or executes an enterprise application.

4. The non-transitory computer-readable medium of claim 1, wherein applying the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule further comprises adding descriptive data to the at least one watermark template applied to the wrapper encapsulating the at least one resource, the descriptive data being descriptive of the enterprise function of the client device requested to be performed.

5. The non-transitory computer-readable medium of claim 1, further comprising program code that, when executed by the at least one computing device, causes the at least one computing device to apply the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule by:

graphically overlaying the at least one watermark template onto the at least one resource generated or modified by the enterprise function of the client device;

or

adding the at least one watermark template to the at least one resource associated with the enterprise function of the client device in a predefined position within the at least one resource.

6. The non-transitory computer-readable medium of claim 5, wherein the predefined position within the at least one resource is at least one of:

a header of the at least one resource, a body of the at least one resource, a footer of the at least one resource, a structural metadata element of the at least one resource, and a descriptive metadata element of the at least one resource.

7. The non-transitory computer-readable medium of claim 1, further comprising program code that, when executed by the at least one computing device, causes the at least one computing device to communicate the at least one resource to a resource server over the network in response to the at least one resource being generated or modified by the enterprise function.

8. A system, comprising:

at least one computing device in data communication with a client device over a network; and

program instructions executable in the at least one device that, when executed by the at least one computing device, cause the at least one computing device to;

receive a request from the client device originated in response to an attempt to perform an enterprise function on the client device, the request being received from the client device over the network, the enterprise function being associated with a compliance rule stored remotely from the client device;

identify at least one watermark template from a plurality of available watermark templates based at least in part on the enterprise function; and

generate a communication that, when received by the client device, causes the client device to;

configure the client device such that, when the enterprise function is performed, the at least one watermark template is added to the at least one resource generated or modified as a result of the enterprise function being performed;

in response to the enterprise function being performed, identify that a wrapper is acting as a security layer encapsulating the at least one resource, the wrapper protecting the at least one resource from certain actions being taken on the at least one resource; and

apply the at least one watermark template to the wrapper encapsulating the at least one resource such that performing the enterprise function complies with the compliance rule.

9. The system of claim 8, wherein the at least one computing device comprises at least one of:

a resource server, a watermark template server, and a compliance server.

10. The system of claim 8, wherein the enterprise function of the client device further comprises a function of the client device that configures the client device for an enterprise use, accesses enterprise data, or executes an enterprise application.

11. The system of claim 8, further comprising program instructions that, when executed by the at least one computing device, cause the at least one computing device to apply the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule by adding descriptive data to the at least one watermark template applied to the at least one resource, the descriptive data being descriptive of the enterprise function of the client device requested to be performed.

12. The system of claim 8, further comprising program instructions that, when executed by the at least one computing device, cause the at least one computing device to apply the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule by:

graphically overlaying the at least one watermark template onto the at least one resource generated or modified by the enterprise function of the client device;

or

adding the at least one watermark template to the at least one resource associated with the enterprise function of the client device in a predefined position within the at least one resource.

13. The system of claim 12, wherein the predefined position within the at least one resource is at least one of:

a header of the at least one resource, a body of the at least one resource, a footer of the at least one resource, a structural metadata element of the at least one resource, and a descriptive metadata element of the at least one resource.

14. The system of claim 12, further comprising program instructions that, when executed by the at least one computing device, cause the at least one computing device to communicate the at least one resource to a resource server over the network in response to the at least one resource being generated or modified by the enterprise function.

15. A computer-implemented method, comprising:

receiving, by at least one computing device comprising at least one hardware processor, a request from a client device originated in response to an attempt to perform an enterprise function on the client device, the request being received from the client device over a network, the enterprise function being associated with a compliance rule stored remotely from the client device;

identifying, by the at least one computing device, at least one watermark template from a plurality of available watermark templates based at least in part on the enterprise function; and

generating, by the at least one computing device, a communication that, when received by the client device, authorizes the client device to;

configure the client device such that, when the enterprise function is performed, the at least one watermark template is added to the at least one resource generated or modified as a result of the enterprise function being performed;

in response to the enterprise function being performed, identify that a wrapper is acting as a security layer encapsulating the at least one resource, the wrapper protecting the at least one resource from certain actions being taken on the at least one resource; and

apply the at least one watermark template to the wrapper encapsulating the at least one resource such that performing the enterprise function complies with the compliance rule.

16. The computer-implemented method of claim 15, wherein the at least one computing device comprises at least one of:

a resource server, a watermark template server, and a compliance server.

17. The computer-implemented method of claim 15, wherein the enterprise function of the client device further comprises a function of the client device that configures the client device for an enterprise use, accesses enterprise data, or executes an enterprise application.

18. The computer-implemented method of claim 15, further comprising applying, by the at least one computing device, the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule by adding descriptive data to the at least one watermark template applied to the at least one resource, the descriptive data being descriptive of the enterprise function of the client device requested to be performed.

19. The computer-implemented method of claim 15, further comprising applying, by the at least one computing device, the at least one watermark template to the at least one resource such that the performance of the enterprise function complies with the compliance rule further comprises:

graphically overlaying the at least one watermark template onto the at least one resource generated or modified by the enterprise function of the client device;

or

adding the at least one watermark template to the at least one resource associated with the enterprise function of the client device in a predefined position within the at least one resource.

20. The computer-implemented method of claim 15, further comprising communicating, by the at least one computing device, the at least one resource to a resource server over the network in response to the at least one resource being generated or modified by the enterprise function.