Systems and methods for controlling email access

• US 9,882,850 B2
• Filed: 04/15/2015
• Issued: 01/30/2018
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Stuntebeck, Erich
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US14/687,394
• Publication Number:
  US 20150222582A1
• Time in Patent Office: 1,021 Days
• Field of Search: 709206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Embodiments of the disclosure relate to proxying at least one email resource from at least one email service to at least one client device, determining whether the email resources are accessible to the client devices via at least one unauthorized application on the client devices, and modifying the email resources to be inaccessible via the unauthorized applications on the client devices in response to a determination that the email resources are accessible via the unauthorized applications on the client devices.

Claims

1. A method for managing access to content by an access control server that determines whether a client can access e-mail provided by an email server, comprising:

obtaining content for transmission to a client, the content comprising an e-mail message and an attachment to the e-mail message;

determining that access to the content should be restricted to an authorized email client installed on the client;

encrypting the attachment to the e-mail message;

transmitting the attachment to the client; and

transmitting at least one instruction to the authorized email client installed on the client, the at least one instruction including a key for decrypting the attachment, wherein the key for decrypting the attachment is inaccessible to a native email client installed on the client.

2. The method of claim 1, further comprising:

removing a portion of a body of the e-mail message;

encrypting the portion of the body of the e-mail message; and

attaching the encrypted portion of the body to the e-mail message.

3. The method of claim 1, further comprising:

receiving the content and the key at a client application;

receiving a request to access the content; and

restricting, by the client application, access to the content to one or more authorized applications.

4. The method of claim 1, further comprising generating the key at a client application, wherein transmitting the at least one instruction including the key comprises transmitting the key from the client application to one or more authorized applications.

5. The method of claim 1, further comprising generating the key at a server application, wherein transmitting the at least one instruction including the key comprises transmitting the key from the server application to the authorized e-mail client.

6. A non-transitory computer-readable medium comprising instructions which, when executed by a processor:

obtain content for transmission to a client, the content comprising an e-mail message and an attachment to the e-mail message;

determine that access to the content should be restricted to an authorized email client installed on the client;

encrypt the attachment to the e-mail message;

transmit the attachment to the client; and

transmit at least one instruction to the authorized email client installed on the client, the at least one instruction including a key for decrypting the attachment, wherein the key for decrypting the attachment is inaccessible to a native email client installed on the client.

7. The non-transitory computer-readable medium of claim 6, wherein the content comprises an e-mail, and the non-transitory computer-readable medium further comprises instructions which, when executed by the processor:

remove a portion of a body of the e-mail;

encrypt the portion of the body of the e-mail; and

attach the encrypted portion of the body to the e-mail.

8. The non-transitory computer-readable medium of claim 6, further comprising instructions which, when executed by the processor:

receive the content and the key at a client application;

receive a request to access the content; and

restrict, by the client application, access to the content to one or more authorized applications.

9. The non-transitory computer-readable medium of claim 6, further comprising instructions which, when executed by the processor, generate the key at a client application and transmit the key from the client application to the authorized e-mail client.

10. The non-transitory computer-readable medium of claim 6, further comprising instructions which, when executed by the processor, generate the key at a server application and transmit the key from the server application to the authorized e-mail client.

11. An access control server that manages access to content, the access control server executing an application that is configured to at least:

obtain content for transmission to a client, the content comprising an e-mail message and an attachment to the e-mail message;

determine that access to the content should be restricted to an authorized email client installed on the client;

encrypt the attachment to the e-mail message;

transmit the attachment to the client; and

transmit at least one instruction to the authorized email client installed on the client, the at least one instruction including a key for decrypting the attachment, wherein the key for decrypting the attachment is inaccessible to a native email client installed on the client.

12. The access control server of claim 11, wherein the content comprises an e-mail, and the access control server is further configured to:

remove a portion of a body of the e-mail;

encrypt the portion of the body of the e-mail; and

attach the encrypted portion of the body to the e-mail.

13. The access control server of claim 11, wherein the server is further configured to transmit the key from a server application to the authorized e-mail client.