APPLICATION PROGRAM AS KEY FOR AUTHORIZING ACCESS TO RESOURCES

• US 20140282897A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: Sky Socket Llc (Broadcom, Inc.)
• Inventors: Stuntebeck, Erich
• Granted Patent: US 9,203,820 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/303 Terminal profiles

Abstract

In a networked environment, a client side application executed on a client device may transmit a request to an authorization service for access to a resource. The authorization service may authenticate the user of client device and/or the client device based on user credentials and/or a device identifier. In response to authenticating the user and/or the client device, the authorization service may send to the client side application a request for confirmation that the client device complies with a distribution rule associated with the resource, where the distribution rule requires a specific application or specific type of application to be installed, enabled and/or executing on the client device as a prerequisite to accessing the resource. If the client device complies with the distribution rule, the client side application accesses the resource. Accessing the resource may include receiving an authorization credential required for access to the resource.

Claims

1. A method performed by a client side application executed on a client device comprising:

transmitting a request to an authorization service for access to a resource;

receiving from the authorization service a request for confirmation that the client device complies with a distribution rule associated with the resource, wherein the distribution rule requires a key application to be installed on the client device as a prerequisite to accessing the resource; and

in response to a determination that the client device complies with the distribution rule, accessing the resource.

2. The method of claim 1, wherein the resource is stored on an enterprise server.

3. The method of claim 1, wherein the resource is stored on the client device.

4. The method of claim 1, further comprising receiving the distribution rule along with the request for confirmation.

5. The method of claim 1, wherein the determination that the client device complies with the distribution rule is performed by the client side application.

6. The method of claim 1, wherein the determination that the client device complies with the distribution rule is performed by the authorization service.

19. The method of claim 1, wherein providing the client side application authorization to access the resource comprises providing an authorization credential the client side application, wherein the authorization credential is required for access to the resource.

20. The method of claim 1, wherein providing the client side application authorization to access the resource comprises providing an authorization credential to a distribution service on behalf of the client side application, wherein the distribution services provides the client side application access to resources in response to authenticating the authorization credential.

7. The method of dam 1, accessing the resources further comprises receiving authorization to access the resource, wherein the authorization comprises an authorization credential required for access to the resource.

8. A client device comprising:

a network connectivity interface for enabling communication between the client device and an authorization service via a network;

a memory for storing a client side application and a key application;

a processor communicatively coupled to the memory for executing said client side application, wherein said client side application comprises executable instructions for;

transmitting to an authorization service, via the network connectivity interface, a request for access to a resource,

receiving from the authorization service, via the network connectivity interface, a request for confirmation that the client device complies with a distribution rule associated with the resource, wherein the distribution rule requires a key application to be installed on the client device as a prerequisite to accessing the resource,

in response to determining that the client device complies with the distribution rule, receiving an authorization credential from the key application, and

using the authorization credential to access the resource.

9. The client device of claim 8, wherein the authorization credential comprises at least one of a PIN, a key, a password, a certificate, and a token.

10. The client device of claim 8, wherein the distribution rule further requires the key application to be enabled on the client device as the prerequisite to accessing the resource.

11. The client device of claim 8, wherein the distribution rule further requires the key application to be executing on the client device as the prerequisite to accessing the resource.

12. The client device of claim 8, wherein the request for confirmation includes a key application identifier identifying the key application.

13. The client device of claim 8, wherein the client side application further comprises executable instructions for receiving the resource from the authorization service and storing the resource in the memory.

14. The client device of claim 8, wherein the resource is stored in the memory.

15. A network server comprising:

a network connectivity interface for enabling communication between the network server and a client side application executed by a client device via a network;

a memory for storing a resource, an authorization service, and at least one distribution rule;

a processor communicatively coupled to the memory for executing said authorization service, wherein said authorization service comprises executable instructions for;

receiving from the client side application, via the network connectivity interface, a request for access to the resource,

determining that the distribution rule is associated with the resource, wherein the distribution rule requires a key application to be installed on the client device as a prerequisite to the client side application accessing the resource,

in response to a determination that the client device complies with the distribution rule, providing the client side application authorization to access the resource.

16. The network server of claim 15, wherein the authorization service further comprises executable instructions for receiving from the client device information to allow the authorization service to make the determination that the client device complies with the distribution rule.

17. The network server of claim 15, wherein the authorization service further comprises executable instructions for authenticating at least one of user credentials and a device identifier received from the client side application.

18. The network server of claim 17, wherein authenticating at least one of user credentials and a device identifier comprises determining that at least one of the user credentials and the device identifier is associated with the resource.