Method and apparatus for providing policy-based document control

• US 7,870,294 B2
• Filed: 10/01/2004
• Issued: 01/11/2011
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy Ernest, Braddy, Ricky Gene, Calvin, Phillip N.
• Primary Examiner(s): Winder; Patrice L
• Application Number:
  US10/956,764
• Publication Number:
  US 20060075463A1
• Time in Patent Office: 2,293 Days
• Field of Search: 709/246
• US Class Current: 709/246
• CPC Class Codes: G06F 16/88 Mark-up to mark-up conversion conversion for visualization in web browsing G06F16/9577
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/18 Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

A method and apparatus for providing policy-based document control includes a client node, a collection agent, a policy engine, and a transformation server. The client node requests access to a resource. The collection agent gathers information about the client node. The policy engine receives the gathered information and makes an access control decision based on the received information. The transformation server transforms the contents of the file from a native format to a second format and presents the transformed contents of the file to the client node.

Claims

1. A system of granting access to resources comprising:

(a) a client node requesting access to a file;

(b) a collection agent gathering information about the client node in response to the request to access the file;

(c) a first component of a policy engine receiving the gathered information and generating a dataset comprising a plurality of identifiers, each of the plurality of identifiers identifying a respective condition satisfied by the gathered information;

(d) a second component of the policy engine granting one of a plurality of levels of access granted to the client node to access the file responsive to application of a policy to the generated dataset; and

(e) a transformation server receiving the request for the file from the policy engine, and in response to the one of the plurality of levels of access granted, transforming the contents of the file from a native format to a second format, and presenting the transformed contents of the file to the client node.

2. The system of claim 1 wherein the transformation server receives the request for the file from the policy engine via a proxy server.

3. The system of claim 1 wherein the policy engine makes an access control decision based on applying a policy to the gathered information.

4. The system of claim 1 wherein the policy engine further identifies the transformation server for receiving the request for the file and transforming the contents of the file from a native format to a second format, the identification based on the received information about the client node.

5. The system of claim 1 wherein the policy engine further comprises a logon agent.

6. The logon agent of claim 5 wherein the logon agent receives the gathered information from the collection agent.

7. The system of claim 1 wherein the collection agent executes on the client node.

8. The system of claim 1 wherein the policy engine transmits the collection agent to the client node.

9. The system of claim 1 wherein the collection agent comprises at least one script.

10. The system of claim 1 wherein the collection agent comprises bytecode.

11. The system of claim 1 wherein the policy engine transmits instructions to the collection agent determining the type of information the collection agent gathers.

12. The system of claim 1 wherein the collection agent gathers the information by running at least one script on the client node.

13. The system of claim 1 wherein the collection agent gathers information regarding the client node device type.

14. The system of claim 1 wherein the collection agent gathers information regarding the client node network connection.

15. The system of claim 1 wherein the collection agent gathers information comprising browser type.

16. The system of claim 1 wherein the collection agent gathers information comprising operating system type.

17. A method of granting access to resources, the method comprising:

(a) requesting, by a client node, access to a file;

(b) gathering, by a collection agent, information about the client node in response to the request to access the file;

(c) receiving, by a first component of a policy engine, the gathered information, and generating a dataset comprising a plurality of identifiers, each of the plurality of identifiers identifying a respective condition satisfied by the gathered information;

(d) granting, by a second component of the policy engine, one of a plurality of levels of access granted to the client node to access the file responsive to application of a policy to the generated dataset;

(e) transforming, by a transformation server, contents of the file from a native format to a second format in response to the one of the plurality of levels of access granted; and

(f) presenting, by the transformation server, the transformed contents of the file to the client node.

18. The method of claim 17 further comprising transmitting, by the policy engine, the request for the file to the transformation server.

19. The method of claim 17 further comprising routing the request for the file to the transformation server through a proxy server.

20. The method of claim 17 further comprising routing, by the policy engine, the request for the file to the transformation server through a proxy server.

21. The method of claim 17 wherein step (a) further comprises requesting the resource over a network connection.

22. The method of claim 17 wherein step (b) further comprises gathering, by the collection agent, the information over a network connection.

23. The method of claim 17 wherein step (b) further comprises gathering, by the collection agent, the information by executing at least one script on the client node.

24. The method of claim 17 wherein step (c) further comprises determining, by the policy engine, if the received information satisfies a condition.

25. The method of claim 17 further comprising determining, by the policy engine, if the received information satisfies a condition by comparing the received information to at least one condition.

26. The method of claim 25 wherein step (d) further comprises making, by the policy engine, an access control decision by applying a policy to the condition.