Secure application access system

• US 9,769,148 B2
• Filed: 09/30/2016
• Issued: 09/19/2017
• Est. Priority Date: 08/01/2013
• Status: Active Grant

• Current Assignee: Bitglass, Inc. (Francisco Partners Management LLC)
• Original Assignee: Bitglass, Inc. (Francisco Partners Management LLC)
• Inventors: Kahol, Anurag, Bhattacharjya, Anoop Kumar, Kausik, Balas Natarajan
• Primary Examiner(s): Chacko, Joe
• Application Number:
  US15/283,216
• Publication Number:
  US 20170019405A1
• Time in Patent Office: 354 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A proxy server receives a synchronization request from an application program resident on a user device. The proxy server determines that the user device requires removal of application program data and synchronizes the application program resident on the user device with a null account that is associated with application program.

Claims

1. A method, comprising:

receiving, by a first device, a request from a second device;

detecting whether data is to be erased from the second device;

in response to detecting that data is not to be erased from the second device, passing the request to a server; and

in response to detecting that data is to be erased from the second device;

determining, by the first device, two or more application programs resident on the second device for which the server has responsibility, wherein the first device stores, for each resident application program of the two or more resident application programs, an associated valid account having a format appropriate to that particular resident application program, but devoid of data; and

synchronizing, by the first device, each resident application program of the two or more resident application programs on the second device with a stored associated valid account that is devoid of data, thereby causing data for that resident application program to be removed from the second device.

2. The method as recited in claim 1, further comprising:

receiving by the server, a request from the second device;

redirecting, by the server, the second device to the network address of the first device for authentication;

receiving by the first device, the redirected request from the second device.

3. The method as recited in claim 1, further comprising:

receiving by the server, a request from the second device;

redirecting, by the server, the second device to the network address of the first device for authentication;

receiving by the first device, the redirected request from the second device;

wherein the detecting whether data is to be erased from the second device further comprises;

determining whether the second device is authorized to access the server;

upon successful authentication, detecting whether data is to be erased from the second device.

4. The method as recited in claim 1, wherein the first device is a proxy server.

5. The method as recited in claim 1, wherein at least one of the one or more resident application programs is an email application program.

6. A method, comprising:

receiving, by a first device, a request from an application program resident on a second device;

detecting whether data for the application program is to be erased from the second device;

in response to detecting that data for the application program is not to be erased from the second device, passing the request to a server; and

in response to detecting that data for the application program is to be erased from the second device;

determining, by the first device, that the server has responsibility for the application program, wherein the first device stores a valid account associated with the application program that has a format appropriate to the application program, but devoid of data; and

in response to determining that the server has responsibility for the application program, synchronizing, by the first device, the application program on the second device with the stored associated valid account that is devoid of data, thereby causing data for the application program to be removed from the second device.

7. The method as recited in claim 6, further comprising:

receiving by the server, a request from the second device;

redirecting, by the server, the second device to the network address of the first device for authentication;

receiving by the first device, the redirected request from the second device.

8. The method as recited in claim 6, further comprising:

receiving by the server, a request from the second device;

redirecting, by the server, the second device to the network address of the first device for authentication;

receiving by the first device, the redirected request from the second device;

wherein the detecting whether data is to be erased from the second device further comprises;

determining whether the second device is authorized to access the server;

upon successful authentication, detecting whether data is to be erased from the second device.

9. The method as recited in claim 6, wherein the first device is a proxy server.

10. The method as recited in claim 6, wherein the application program is an email application program.

11. An apparatus, comprising:

a subsystem on a first device, implemented at least partially in hardware, that receives a request from a second device;

an account evaluation subsystem on the first device, implemented at least partially in hardware, that detects whether data is to be erased from the second device;

an account synchronizing subsystem on the first device, implemented at least partially in hardware, that, in response to detecting that data is not to be erased from the second device, passes the request to a server; and

wherein the account synchronizing subsystem, in response to detecting that data is to be erased from the second device;

determines two or more application programs resident on the second device for which the server has responsibility, wherein the first device stores, for each resident application program of the two or more resident application programs, an associated valid account having a format appropriate to that particular resident application program, but devoid of data; and

synchronizes each resident application program of the two or more resident application programs on the second device with a stored associated valid account that is devoid of data, thereby causing data for that resident application program to be removed from the second device.

12. The apparatus as recited in claim 11, further comprising:

a subsystem on the server, implemented at least partially in hardware, that receives a request from the second device;

a subsystem on the server, implemented at least partially in hardware, that redirects the second device to the network address of the first device for authentication;

a subsystem on the first device, implemented at least partially in hardware, that receives the redirected request from the second device.

13. The apparatus as recited in claim 11, further comprising:

a subsystem on the server, implemented at least partially in hardware, that receives a request from the second device;

a subsystem on the server, implemented at least partially in hardware, that redirects the second device to the network address of the first device for authentication;

a subsystem on the first device, implemented at least partially in hardware, that receives the redirected request from the second device;

wherein the account evaluation subsystem further;

determines whether the second device is authorized to access the server;

upon successful authentication, detects whether data is to be erased from the second device.

14. The apparatus as recited in claim 11, wherein the first device is a proxy server.

15. The apparatus as recited in claim 11, wherein at least one of the one or more resident application programs is an email application program.

16. An apparatus, comprising:

a subsystem on a first device, implemented at least partially in hardware, that receives a request from an application program resident on a second device;

an account evaluation subsystem on the first device, implemented at least partially in hardware, that detects whether data for the application program is to be erased from the second device;

an account synchronizing subsystem on the first device, implemented at least partially in hardware, that, in response to detecting that data for the application program is not to be erased from the second device, passes the request to a server; and

wherein the account synchronizing subsystem in response to detecting that data for the application program is to be erased from the second device;

determines that the server has responsibility for two or more application programs resident on the second device, wherein the first device stores, for each application program of the two or more application programs, an associated valid account having a format appropriate to that particular application program, but devoid of data; and

synchronizes in response to determining that the server has responsibility for application program, synchronizing, by the first device, the each application program of the two or more application programs resident on the second device with a stored associated valid account that is within a format appropriate to the application program, but devoid of data, thereby causing data for that the application program to be removed from the second device.

17. The apparatus as recited in claim 16, further comprising:

a subsystem on the server, implemented at least partially in hardware, that receives a request from the second device;

a subsystem on the server, implemented at least partially in hardware, that redirects the second device to the network address of the first device for authentication;

a subsystem on the first device, implemented at least partially in hardware, that receives the redirected request from the second device.

18. The apparatus as recited in claim 16, further comprising:

a subsystem on the server, implemented at least partially in hardware, that receives a request from the second device;

a subsystem on the server, implemented at least partially in hardware, that redirects the second device to the network address of the first device for authentication;

a subsystem on the first device, implemented at least partially in hardware, that receives the redirected request from the second device;

wherein the account evaluation subsystem further;

determines whether the second device is authorized to access the server;

upon successful authentication, detects whether data is to be erased from the second device.

19. The apparatus as recited in claim 16, wherein the first device is a proxy server.

20. The apparatus as recited in claim 16, wherein the application program is an email application program.