System and method for geofencing

• US 10,116,697 B2
• Filed: 09/19/2014
• Issued: 10/30/2018
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Ip Ot Sub Ulc
• Original Assignee: Open Text Sa Ulc (Open Text Corporation)
• Inventors: Beckman, Gregory, Laird, Robert, Gagne, Alain
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Malinowski, Walter J.
• Application Number:
  US14/491,483
• Publication Number:
  US 20150089673A1
• Time in Patent Office: 1,502 Days
• Field of Search: 726 1, 726 29, 709217
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/5683 Storage of data provided by user terminals, i.e. reverse caching
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A managed container may have a managed cache storing content managed by or through an application gateway server computer. The managed container may receive a request for content from an application running in a secure shell provided by the managed container on a client device. The managed container may determine whether the client device is within a specified geographical location. If not, the managed container may deny or restrict the application access to the requested content. The access denial or restriction may continue until a connection is made to the application gateway server computer or until the client device has returned to within the specified geographical location. If the client device is within the specified geographical location, the managed container may provide or restore access to requested content. Embodiments of the managed container can therefore perform geofencing by disabling or limiting access to content based on predetermined secure/insecure designations.

Claims

1. A method, comprising:

downloading, by a client device of a server computer, a managed container from a network source, the managed container written in a programming language native to the client device and comprising a managed cache and an application framework with an execution engine that provides a runtime environment for applications associated with backend systems running in an enterprise computing environment;

receiving, over a network by the managed container embodied on a non-transitory computer memory of the client device, an application retrieved from an application repository by the server computer, the application repository and the server computer residing in the enterprise computing environment outside of a firewall, the application hosted or required by a backend system operating in the enterprise computing environment behind the firewall;

storing the application in the managed cache of the managed container on the client device, the storing performed by the managed container;

managing, by the managed container, the application and content stored in the managed container in accordance with one or more rules, the one or more rules including a geolocking or geofencing rule propagated from the backend system through the firewall to the server computer to the managed container on the client device;

displaying an icon for the application in a user interface of the managed container on the client device;

providing, by the managed container on the client device, a secure shell or runtime environment for running the application when the icon for the application is selected or invoked from within the user interface of the managed container;

receiving, by the managed container on the client device, a request for content from the application running in the secure shell or runtime environment provided by the managed container on the client device;

determining, by the managed container on the client device, whether the client device is located within a specified geographical location that is secure for viewing the content;

permitting, by the managed container on the client device to the application running in the secure shell or runtime environment provided by the managed container on the client device, access to the content if the client device is located within the specified geographical location that is secure for viewing the content;

denying or restricting, by the managed container on the client device based at least in part on the geolocking or geofencing rule, access by the application to the content requested by the application if the client device is not located within the specified geographical location that is secure for viewing the content; and

automatically deleting the content from the managed cache if the client device is outside of the specified geographical location for a predetermined amount of time and, after the predetermined amount of time has passed, the client device has not made a connection to the server computer or returned to within the specified geographical location.

2. The method according to claim 1, further comprising:

continuously performing the denying or restricting by the managed container until a connection is made to the server computer or until the client device has returned to within the specified geographical location.

3. The method according to claim 1, wherein the content requested by the application is stored in the managed cache of the managed container and wherein the denying by the managed container comprises denying, by the managed container, the application access to the managed cache of the managed container.

4. The method according to claim 1, wherein the denying by the managed container comprises preventing, by the managed container, the application from downloading the content requested by the application via the server computer from a backend system communicatively connected to the server computer.

5. The method according to claim 1, wherein the restricting comprises watermarking or transforming the content requested by the application.

6. The method according to claim 1, wherein the specified geographical location refers to a building, an area, a city, or a country.

7. The method according to claim 1, wherein the determining comprises:

obtaining geographical information from a location service running on the client device, the geographical information containing a current location of the client device based on information received over a network; and

comparing the current location of the client device with the specified geographical location.

8. The method according to claim 1, wherein the denying or restricting is performed by the managed container independently of a local operating system of the client device, the application, or both.

9. The method of claim 1, wherein the application is under the control of the managed container.

10. The method of claim 1, wherein the specified geographical location is received from the server computer.

11. The method of claim 10, wherein the client device is geographic-positioning-system-enabled to determine a geographic location of the client device.

12. The method of claim 11, comprising:

determining a geographic location of the client device; and

comparing the geographic location of the client device to a list of predetermined geographic locations, the list including information as to whether each of the predetermined geographic locations is secure or insecure.

13. The method of claim 12, wherein at least one of the predetermined geographical locations includes a bounded geographic area.

14. The method of claim 1, wherein the specified geographical location is provided to the managed container on the client device as part of the geolocking or geofencing rule.

15. A system, comprising:

an application gateway server computer communicatively connected to an application repository, the application repository and the application gateway server computer residing in an enterprise computing environment outside of a firewall; and

a managed container downloaded from a network source by a client device of the application gateway server, the managed container having a managed cache and an application framework with an execution engine that provides a runtime environment for applications associated with backend systems running in the enterprise computing environment, the managed container embodied on a non-transitory computer memory of the client device, wherein the managed container is configured to;

receive an application from the application gateway server computer over a network, the application retrieved by the application gateway server computer from the application repository, the application hosted or required by a backend system operating in the enterprise computing environment behind the firewall;

store the application in the managed cache of the managed container on the client device;

manage the application and content stored in the managed cache in accordance with one or more rules, the one or more rules including a geolocking or geofencing rule propagated from the backend systems through the firewall to the application gateway server computer to the managed container on the client device;

display an icon for the application in a user interface of the managed container on the client device;

provide a secure shell or runtime environment for running the application when the icon for the application is selected or invoked from within the user interface of the managed container;

receive a request for content from the application running in the secure shell or runtime environment provided by the managed container on the client device;

determine whether the client device is located within a specified geographical location that is secure for viewing the content;

permit the application running in the secure shell or runtime environment provided by the managed container on the client device to access to the content if the client device is located within the specified geographical location that is secure for viewing the content;

deny or restrict, based at least in part on the geolocking or geofencing rule, access by the application to the content requested by the application if the client device is not located within the specified geographical location that is secure for viewing the content; and

automatically delete the content from the managed cache if the client device is outside of the specified geographical location for a predetermined amount of time and, after the predetermined amount of time has passed, the client device has not made a connection to the application gateway server computer or returned to within the specified geographical location.

16. The system of claim 15, wherein the denying or restricting by the managed container is continuous until a connection is made to the application gateway server computer or until the client device has returned to within the specified geographical location.

17. The system of claim 15, wherein the managed container performs the denying or restricting access by the application to the content requested by the application independently of a local operating system of the client device, the application, or both.

18. The system of claim 15, wherein the denying by the managed container comprises preventing, by the managed container, the application from downloading the content requested by the application via the application gateway server computer from a backend system communicatively connected to the application gateway server computer.