Methods and apparatus for secure online access on a client device

• US 7,797,724 B2
• Filed: 08/31/2004
• Issued: 09/14/2010
• Est. Priority Date: 08/31/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Calvin, Phil
• Primary Examiner(s): Lipman; Jacob
• Application Number:
  US10/931,405
• Publication Number:
  US 20060047956A1
• Time in Patent Office: 2,205 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method of securely accessing at a client device content from a server without using the non-volatile memory of the client device is disclosed. The bypassing of non-volatile memory lessens the security risk of unauthorized viewing of the server originated content. An transport mechanism is initiated on a client device and creates a document container. Downloaded documents from a server are mapped into the document container and saved within the document container in volatile memory. Substitute menus are generated within the container to replace application menus. User documents are saved directly to the originating server via the substitute menus. The downloaded copies in volatile memory automatically delete when the document container is destroyed thereby reducing security concerns of unauthorized viewing of the content at the client device.

Claims

1. A method for securely providing access to a content file, the method comprising:

(a) requesting, by a user via a client device, access to a content file;

(b) creating, by a transport mechanism executing on the client device, a document container on the client device;

(c) receiving, by the document container from a server, the content file;

(d) storing, by a storage buffer on the client device, the received content file in a volatile memory element;

(e) invoking, by the document container, an application program associated with the content file, the application program providing a set of menu commands for interacting with the application program; and

(f) generating, by the document container, a replacement set of menu commands comprising a subset of the set of menu commands provided by the application program.

2. The method of claim 1 wherein step (a) further comprises requesting access to a content file using an URL moniker.

3. The method of claim 1 further comprising creating a storage location in a volatile memory element.

4. The method of claim 1 further comprising instantiating a transport mechanism.

5. The method of claim 4 further comprising

invoking an application program, associated with the content file, for execution within the document container.

6. The method of claim 1 further comprising receiving a command to save the content file;

and transmitting the content file to the server.

7. The method of claim 6 further comprising releasing the memory associated with the content file in the volatile memory element.

8. A method for securely providing access to a content file, the method comprising the steps of:

(a) requesting, by a user via a client device, access to a content file;

(b) filtering, by a filtering mechanism, the request by applying pre-determined rules;

(c) creating, by a transport mechanism executing on the client device, a document container on the client device;

(d) receiving, by the document container from a server, the content file following said filtering;

(e) storing, by a storage buffer on the client device, the received content file in a volatile memory element;

(f) invoking, by the document container, an application program associated with the content file, the application program providing a set of menu commands for interacting with the application program; and

(g) generating, by the document container, a replacement set of menu commands comprising a subset of the set of menu commands provided by the application program.

9. The method of claim 8 wherein, said rules are applied based upon a profile of a requesting user.

10. The method of claim 8 wherein said rules are applied based upon a category of the content file requested.

11. The method of claim 8 wherein said filtering takes place before the request is forwarded to the server.

12. The method of claim 8 wherein said filtering takes place after the request is for the server.

13. The method of claim 8 further comprising modifying said request based on said rules.

14. The method of claim 13 further comprising restricting the at least one of the type and amount of the content requested.

15. An article of manufacture having embodied thereon computer-readable program means for securely providing access to a content file, the article of manufacture comprising:

(a) computer-readable program means for requesting, by a user via a client device, access to a content file;

(b) computer-readable program means for creating, by a transport mechanism executing on the client device, a document container on the client device;

(c) computer-readable program means for receiving, by the document container from a server, the content file;

(d) computer-readable program means for storing, by a storage buffer on the client device, the received content file in a volatile memory element;

(e) computer-readable program means for invoking, by the document container, an application program associated with the content file, the application program providing a set of menu commands for interacting with the application program; and

(f) computer-readable program means for generating, by the document container, a replacement set of menu commands comprising a subset of the set of menu commands provided by the application program.

16. The article of manufacture of claim 15 wherein the computer-readable program means of step (a) further comprises requesting access to a content file using an URL moniker.

17. The article of manufacture of claim 15 further comprising:

computer-readable program means for creating a storage location in a volatile memory element.

18. The article of manufacture of claim 15 further comprising:

computer-readable program means for instantiating a transport mechanism.

19. The article of manufacture of claim 16 further comprising computer-readable program means for invoking an application program, associated with the content file, for execution within the document container.

20. The article of manufacture of claim 15 further comprising:

computer-readable program means for receiving a command to save the content file; and

computer-readable program means for transmitting the content file to the server.

21. The article of manufacture of claim 20 further comprising:

computer-readable program means for releasing the memory associated with the content file in the volatile memory element.

22. A system for securely providing access to a content file, the system comprising:

a server for processing a request for access to a content file;

a client device that receives, from the server, the requested content file, the client device containing a volatile memory element;

a file transport mechanism on the client device;

a storage buffer, created by the transport mechanism in the volatile memory element, the storage buffer storing the received content file;

a document container, created by the transport mechanism on the client device, that provides a context for invoking an application program associated with the content file, the application program providing a set of menu commands for interacting with the application program,

the document container further providing a replacement set of menu commands comprising a subset of the set of menu commands provided by the application program.

23. The system of claim 22 wherein the document container further comprises a container instance created by the transport mechanism, and the application program executes within the created container instance.

24. The system of claim 22 wherein the client device saves the content file, and transmits the content file to the server.

25. The system of claim 24 wherein the client device deletes the content file.