Controlling distribution of resources on a network

• US 10,404,615 B2
• Filed: 06/13/2017
• Issued: 09/03/2019
• Est. Priority Date: 02/14/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Marshall, John, Stuntebeck, Erich, Jayaprakash, Gopinath, Manton, John Joseph, Brannon, Jonathon Blake
• Primary Examiner(s): Salad, Abdullahi E
• Application Number:
  US15/620,922
• Publication Number:
  US 20170279733A1
• Time in Patent Office: 812 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Disclosed are various embodiments for controlling distribution of resources on a network. In one embodiment, among others, a processor receives a request from a client device to access resources hosted by a distribution service. In response, the processor determines whether the client device is authorized to access the distribution service. The processor identifies which of the resources hosted by the distribution service are accessible to the client device based on the resource grouping identifiers associated with the client device. The processor determines which distribution rules are associated with the identified resources, the distribution rules including location rules and time rules. The processor then transmits the identified resources and identified distribution rules to the client device, where the resources are configured to be exclusively accessible via a containerized client application on the client device while the client device satisfies the distribution rules associated with the resources.

Claims

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, the program comprising code that, when executed by the at least one computing device, causes the at least one computing device to at least:

store a plurality of resources in a data store associated with a distribution service in response to a request to transfer the plurality of resources;

receive a plurality of access rights associated with the plurality of resources;

receive, from a client device, a request to access the plurality of resources hosted by the distribution service;

determine that a pairing of a user of the client device and the client device is authorized to access the distribution service based at least in part on the access rights associated with the plurality of resources;

identify a plurality of resource grouping identifiers that are associated with the pairing in response to determining that the pairing is authorized to access the distribution service;

identify which of the plurality of resources are associated with the resource grouping identifiers;

identify which of a plurality of distribution rules are associated with the identified resources, the distribution rules comprising at least one of a plurality of location rules that specify at least one authorized location and at least one authorized perimeter area that surrounds the at least one authorized location, the at least one authorized location and the at least one authorized perimeter area having different access rights associated with the identified resources; and

transmit the identified resources and the identified distribution rules to the client device, the identified resources being configured to be exclusively accessible by a containerized client side application while the client device satisfies the identified distribution rules associated with the identified resources.

2. The non-transitory computer-readable medium of claim 1, wherein the containerized client side application is configured to remove the identified resources from the client device in response to a determination that the client device does not comply with the identified distribution rules.

3. The non-transitory computer-readable medium of claim 1, wherein the program further causes the at least one computing device to at least render a user interface on a display of the client device, the user interface displaying an indication of a subset of the identified resource being accessible based at least in part on the plurality of location rules.

4. The non-transitory computer-readable medium of claim 1, wherein the program further causes the at least one computing device to at least render a user interface on a display of the client device, the user interface displaying an indication of a subset of the identified resource being accessible based at least in part on a plurality of time rules.

5. The non-transitory computer-readable medium of claim 1, wherein a magnitude of the at least one authorized perimeter area is based at least in part on a sensitivity associated with the plurality of resources.

6. A system, comprising:

a processor;

a memory device including instructions that when executed by the processor cause the processor to perform a method comprising;

storing a plurality of resources in a data store associated with a distribution service in response to a request from a user interface to transfer the plurality of resources;

receiving a plurality of authorized time windows associated with the plurality of resources, wherein a time period of the authorized time windows is based at least in part on a sensitivity level associated with the resources;

receiving, from a client device, a request to access the plurality of resources hosted by the distribution service;

determining that a current time associated with the client device is within one of the plurality of authorized time windows associated with the plurality of resources;

transmitting the resources to a containerized client side application on the client device, the resources being configured to be exclusively accessible by the containerized client side application;

updating the current time; and

removing the resources from the client device in response to the current time being not within at least one of the plurality of authorized time windows.

7. The system of claim 6, wherein removing the resources from the client device further comprises transmitting a command to the containerized client side application to block access to the resources on the client device.

8. The system of claim 6, wherein removing the resources from the client device further comprises transmitting a command to the containerized client side application to execute at least one of removing a local copy of the resources or removing a hyperlink to a downloadable copy of the resources.

9. The system of claim 6, wherein the authorized time windows correspond to a plurality of time windows of meetings, and wherein the resources associated with the authorized time windows are specifically related to the meetings.

10. The system of claim 6, wherein the containerized client side application prevents the resources from being at least one of cut, copied, or pasted outside of a containerized environment associated with the containerized client side application.

11. The system of claim 6, wherein transmitting the resources to the containerized client side application on the client device is based at least in part on the client device being in an authorized location associated with the resources.

12. The system of claim 11, wherein the authorized location comprises a geographic center coordinate and a radius.

13. The system of claim 11, wherein the client device comprises a first client device, and wherein the method comprises rendering, on a second client device, a user interface of a drawing tool that enables a user to visually designate at least one boundary of the authorized location on a map.

14. The system of claim 6, wherein the client device comprises a first client device, and wherein the method comprises rendering, on a second client device, a user interface on a display of the client device, the user interface displaying an indication of a subset of the resources being accessible based at least in part on the plurality of authorized time windows.

15. A method comprising:

transmitting a request to store a plurality of resources to a distribution service via a user interface;

transmitting a selection of a plurality of authorized locations and a sensitivity level associated with the plurality of resources;

determining, in a containerized client side application being executed by a client device, that the client device is located at one of the plurality of authorized locations;

transmitting a request for access to the plurality of resources to the distribution service;

receiving the resources that are configured to be exclusively accessible by the containerized client side application;

updating a location of the client device; and

removing the resources from the client device in response to the client device not being located at a respective one of the plurality of authorized locations and in response to the sensitivity level associated with the resources.

16. The method of claim 15, wherein at least one of the plurality of authorized locations comprises at least one boundary specified by one or more geographic coordinates.

17. The method of claim 15, further comprising determining whether a pairing of a user of the client device and the client device is authorized to access the distribution service before transmitting the request to access resources, wherein the client device is authorized to access the distribution service based at least in part on a plurality of user credentials associated with the user of the client device and a device identifier associated with the client device.

18. The method of claim 15, wherein removing the resources from the client device in response to the client device not being located at the respective one of the plurality of authorized locations further comprises removing the resources from the client device by at least one of deleting the resources from the client device, disabling the resources on the client device, restoring the client device to a default state, or deleting all data from the client device.

19. The method of claim 15, further comprising determining that the client device satisfies a plurality of distribution rules associated with the resources before transmitting the request to access resources, wherein the distribution rules comprise at least one of a plurality of client device hardware requirements, a plurality of client device software requirements, or a plurality of resource related requirements.

20. The method of claim 15, wherein the containerized client side application is configured to enforce a plurality of transmission restrictions while the resources are being accessed by the containerized client side application, and wherein the transmission restrictions comprise prohibiting transmitting and copying the resources.