System and method for secure management of mobile user access to enterprise network resources

• US 8,275,356 B2
• Filed: 06/22/2009
• Issued: 09/25/2012
• Est. Priority Date: 09/30/2008
• Status: Active Grant

• Current Assignee: XE2 Limited
• Original Assignee: XE2 Limited
• Inventors: Hickie, Thomas William
• Primary Examiner(s): Hu, Jinsong
• Assistant Examiner(s): Elhag, Magdi
• Application Number:
  US12/488,959
• Publication Number:
  US 20100081417A1
• Time in Patent Office: 1,191 Days
• Field of Search: 455/410, 455/411, 455/414.1, 455/414.2, 726 1- 21, 726 26- 33
• US Class Current: 455/410
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A system and method are provided for managing mobile user access to enterprise network resources from a wireless mobile device, such as a smart phone or mobile computer, with improved security and access control. Access rules determining accessible resources and associated permitted operations are determined based on membership of an authenticated user to each of one or more groups, each group being associated with a set of permitted accessible resources and operations. For each user, based on membership of a group, or a Boolean evaluation of memberships of two or more groups, a list of accessible resources and permitted operations is generated, and the list is made available for subsequent processes, e.g. presentation to the user on an interface of the mobile device. Access rules may also be defined dependent on other information received from the system, or from the mobile device, such as time or location. Requests for an operation such as read access or write access to a network resource, such as a file, lists, shared calendars et al., may thus be readily controlled by an IT manager for multiple users of an enterprise network. Since the application resides in an application layer between the mobile device and existing security infrastructure, mobile access may be set without overriding internal access policies.

Claims

1. A method for managing user access from a wireless mobile device to a plurality of network resources comprising documents and files within an enterprise network, wherein the enterprise network comprises a security infrastructure for managing internal user access from within the enterprise network according to an internal access policy, and wherein for access from a wireless mobile user device the method comprises the steps of:

determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;

determining access rules for the user based on each group membership of the user;

generating a list of accessible resources and associated operations for the user based on said access rules; and

making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.

2. The method according to claim 1, wherein said network resources comprise network resources of different resources types, and comprising generating said list of accessible resources and operations for the user comprising accessible resources of a plurality of different resource types.

3. The method according to claim 1, further comprising an initial step of receiving from a user credentials comprising a user ID, and authenticating the user.

4. The method according to claim 1, further comprising retrieving directory information associated with said user to obtain attributes of the user associated with said user ID.

5. The method according to claim 4, further comprising:

before retrieving directory information, determining an applicable directory type of a set of possible directory types, and after retrieving said directory information, re-encoding said information to a desired format.

6. The method according to claim 1, further comprising initiating an operation on an accessible resource in accordance with said access rules.

7. The method according to claim 1, further comprising performing a requested operation on a selected accessible resource.

8. The method according to claim 2, further comprising delivery of the list of accessible resources and operations to the wireless mobile device.

9. The method according to claim 8, wherein delivery of the list of accessible resources and operations to the user comprises presenting the list of accessible resources and operations to the user via a user interface of the wireless mobile device.

10. The method according to claim 9, further comprising presenting to the user a list of accessible resource types, and receiving a user selection or validation of a resource type before presenting the list of accessible resource and operations.

11. The method according to claim 9, wherein presenting the list of accessible resources and operations comprises presenting an indication or description of a resource type associated with an accessible resource.

12. The method according to claim 9, wherein presenting comprises graphically displaying said list on the mobile device.

13. The method according claim 1, further comprising validating one or more of an accessible resource, operation, or resource type before subsequent processing thereof.

14. The method according to claim 8, further comprising a step of validating an accessible resource and/or operation in response to a request from a user before subsequent processing thereof.

15. The method according to claim 9, further comprising initiating a process to respond to a request from the user for an operation on an accessible resource in accordance with access rules.

16. The method according to claim 15, further comprising responding to a request from the user for an operation on an accessible resource comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email and download and synchronize.

17. The method according to claim 15, further comprising responding to a request from the user for an operation on a resource by blocking or denying access to said resource.

18. The method according to claim 1, wherein said access rules are determined for a user based on a Boolean evaluation of rules for a plurality of group memberships of the user.

19. The method according to claim 1, further comprising receiving additional data from at least one of the system and the mobile device, and wherein said access rules are determined based on said additional information.

20. The method according to claim 1, wherein said access rules are determined dynamically based on at least one of one of a date and time of day and a location of the mobile device or a combination thereof.

21. The method according to claim 1, wherein each access rule comprises a membership list and a resource and/or operations list.

22. The method according to claim 21, wherein a membership list comprises a high level descriptor defining criteria for who may access associated resources and operations.

23. The method according to claim 21, wherein a resource and/or operations list comprises high level descriptors of resources and/or operations.

24. The method according to claim 1, wherein said access rule comprises a high level descriptor of one or more of a membership group, a resource, and an associated operation.

25. The method according to claim 1, further comprising determining group membership of a user based on a token associated with said user ID.

26. The method according to claim 9, wherein displaying said list of accessible resources and operations comprises displaying said list arranged by containers, each container containing a listing of resources and/or operations associated with a respective group membership.

27. The method according to claim 9, wherein displaying said list of accessible resources and operations comprises displaying said list by arranged by resource type.

28. The method according to claim 6 wherein accessible resources are indexed with an indicator of one or more of resource type, other descriptor and selection criteria, and performing an operation on a list of accessible resources comprises performing an operation selectively on resources indexed with a specific indicator.

29. A client server system for managing access to a plurality of network resources comprising documents and files within an enterprise network from a wireless mobile device, wherein the enterprise network comprises a security infrastructure for managing internal user access according to internal access policies, and the client server system comprises:

a server within the enterprise network for managing wireless mobile access by performing the steps of;

receiving identification from a user of a wireless mobile device;

retrieving from a directory attributes of said user based on a user ID of the user;

determining group membership of the user based on said user ID and said attributes, each group having associated therewith a set of access rules defining accessible resources and associated permitted operations for members of the group;

resolving access rules for the user based on group membership and generating a list of accessible resources and operations for the user based on said access rules; and

making said list available for subsequent processing comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.

30. The client server system according to claim 29, wherein said steps further comprise authentication of the user.

31. The client server system according to claim 29, wherein said steps further comprise delivery of the list of accessible resources and operations to a client in the wireless mobile device.

32. The client server system according to claim 29, further comprising a client in the wireless mobile device for displaying said list of accessible resources and operations.

33. The client server system according to claim 32, wherein said client in the wireless mobile device comprises:

an interface for presenting to a user a list of accessible resources of different resource types.

34. The client server system according to claim 33, wherein said client further comprises an interface for presenting to the user permissible operations associated with each accessible resource.

35. A system comprising an access control layer for an access server managing mobile user access to network resources comprising documents and files within an enterprise network comprising processing means for performing the steps of:

determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;

determining access rules for the user based on each group membership of the user;

generating a list of accessible resources and associated operations for the user based on said access rules; and

making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.

36. The system according to according to claim 35, wherein said network resources comprise network resources of different resources types, and comprising generating said list of accessible resources and operations for the user comprising accessible resources of a plurality of different resource types.

37. The system according to claim 36, further comprising generating a list of accessible resource types, and receiving a user selection or validation of a resource type before generating the list of accessible resources and operations.

38. The system according to claim 36, wherein the list of accessible resources comprises an indication or description of a resource type associated with an accessible resource.

39. A non-transitory computer readable medium comprising executable program instructions for carrying out a method of managing user access to a plurality of network resources comprising documents and files within an enterprise network from a wireless mobile device, by steps comprising:

determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;

determining access rules for the user based on each group membership of the user;

generating a list of accessible resources and associated operations for the user based on said access rules;

making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.

40. The non-transitory computer readable medium according to claim 39, wherein said steps further comprise performing a requested operation on a selected accessible resource.