Rule-based application access management

• US 9,699,194 B2
• Filed: 12/23/2016
• Issued: 07/04/2017
• Est. Priority Date: 10/23/2006
• Status: Active Grant

• Current Assignee: Numecent Holdings Incorporated
• Original Assignee: Numecent Holdings Incorporated
• Inventors: Hitomi, Arthur S., Tran, Robert, Kammer, Peter J., Pfiffner, Doug, Nguyen, Huy
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/390,326
• Publication Number:
  US 20170111361A1
• Time in Patent Office: 193 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.

Claims

1. A method comprising:

receiving, at a client device, a portion of a streaming software application executing at a remote location in a streaming software container;

executing the streaming software application virtualized at the client device using the portion of the streaming software application;

generating, at the client device, a request for an other portion of the streaming software application based on user interaction with the executing of the streaming software application at the client device using the portion of the streaming software application;

sending the request for the other portion of the streaming software application to the remote location;

intercepting the request for the other portion of the streaming software application at a DMZ;

determining if the request for the other portion of the streaming software application is associated with the DMZ;

if it is determined that the request for the other portion of the streaming software application in unaffiliated with the DMZ;

determining if rule-based access to the other portion of the streaming software application can be provided to the client device according to rule-based access associated with the client device;

providing the other portion of the streaming software application to the client device if it is determined that the rule-based access indicates the other portion of the streaming software application can be provided to the client device;

receiving the other portion of the streaming software application from the remote location, the other portion of the streaming software application specifically retrieved according to the continued execution of the streaming software application in the streaming software container based on the request for the other portion of the streaming software application;

continuing execution of the streaming software application virtualized at the client device using the other portion of the streaming software application received from the remote location.

2. The method of claim 1, wherein the portion of the streaming software application is a jumpstart partial used to begin execution of the streaming software application virtualized at the client device.

3. The method of claim 1, wherein the streaming software container is a protected and non-integrated environment that prevents public viewing of resources of the streaming software application.

4. The method of claim 1, wherein the streaming software container is open and allows public viewing of resources of the streaming software application.

5. The method of claim 1, further comprising:

determining a runtime model to use in executing the streaming software application in the streaming software container;

running the streaming software application in the streaming software container based on the request for the other portion of the streaming software application and according to the determined runtime model to retrieve the other portion of the streaming software application.

6. The method of claim 1, wherein the streaming software application is uniquely associated with the streaming software container.

7. The method of claim 1, further comprising:

determining a modification level to the other portion of the streaming software application the client device has according to rule-based access rights associated with the client device and the streaming software application;

modifying the other portion of the streaming software application based on the modification level the client device has according to the rule-based access rights.

8. A system comprising:

at least one processor and memory configured to store instructions to instruct the at least one processor to;

receive, at a client device, a portion of a streaming software application executing at a remote location in a streaming software container;

execute the streaming software application virtualized at the client device using the portion of the streaming software application;

generate, at the client device, a request for an other portion of the streaming software application based on user interaction with the executing of the streaming software application at the client device using the portion of the streaming software application;

send the request for the other portion of the streaming software application to the remote location;

intercept the request for the other portion of the streaming software application at a DMZ;

determine if the request for the other portion of the streaming software application is associated with the DMZ;

determine if rule-based access to the other portion of the streaming software application can be provided to the client device according to rule-based access associated with the client device, if it is determined that the request for the other portion of the streaming software application in unaffiliated with the DMZ;

provide the other portion of the streaming software application to the client device if it is determined that the rule-based access indicates the other portion of the streaming software application can be provided to the client device;

receive the other portion of the streaming software application from the remote location, the other portion of the streaming software application specifically retrieved according to the continued execution of the streaming software application in the streaming software container based on the request for the other portion of the streaming software application;

continue execution of the streaming software application virtualized at the client device using the other portion of the streaming software application received from the remote location.

9. The system of claim 8, wherein the portion of the streaming software application is a jumpstart partial used to begin execution of the streaming software application virtualized at the client device.

10. The system of claim 8, wherein the streaming software container is a protected and non-integrated environment that prevents public viewing of resources of the streaming software application.

11. The system of claim 8, wherein the streaming software container is open and allows public viewing of resources of the streaming software application.

12. The system of claim 8, further comprising a streaming server configured to:

determine a runtime model to use in executing the streaming software application in the streaming software container;

run the streaming software application in the streaming software container based on the request for the other portion of the streaming software application and according to the determined runtime model to retrieve the other portion of the streaming software application.

13. The system of claim 8, wherein the streaming software application is uniquely associated with the streaming software container.

14. A system comprising:

at least one hardware processor;

memory storing instructions configured to be executed by the at least one hardware processor to implement;

means for receiving, at a client device, a portion of a streaming software application executing at a remote location in a streaming software container;

means for executing the streaming software application virtualized at the client device using the portion of the streaming software application;

means for generating, at the client device, a request for an other portion of the streaming software application based on user interaction with the executing of the streaming software application at the client device using the portion of the streaming software application;

means for sending the request for the other portion of the streaming software application to the remote location;

means for intercepting the request for the other portion of the streaming software application at a DMZ;

means for determining if the request for the other portion of the streaming software application is associated with the DMZ;

means for determining if rule-based access to the other portion of the streaming software application can be provided to the client device according to rule-based access associated with the client device, if it is determined that the request for the other portion of the streaming software application in unaffiliated with the DMZ;

means for providing the other portion of the streaming software application to the client device if it is determined that the rule-based access indicates the other portion of the streaming software application can be provided to the client device;

means for receiving the other portion of the streaming software application from the remote location, the other portion of the streaming software application specifically retrieved according to the continued execution of the streaming software application in the streaming software container based on the request for the other portion of the streaming software application;

means for continuing execution of the streaming software application virtualized at the client device using the other portion of the streaming software application received from the remote location.