Managing dynamic policies and settings in an orchestration framework for connected devices

• US 8,726,343 B1
• Filed: 08/09/2013
• Issued: 05/13/2014
• Est. Priority Date: 10/12/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Borzycki, Andrew, Deva, Mallikharjuna Reddy, Gajendar, Uday Nandigam, Roychoudhry, Anil
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US13/963,794
• Time in Patent Office: 277 Days
• Field of Search: 726/1, 726/3, 726/5
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/543 User-generated data transfer, e.g. clipboards, dynamic data exchange [DDE], object linking and embedding [OLE]
• CPC Class Codes: H04L 1/0025 Transmission of mode-switching indication
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/567 Integrating service provisioning from a plurality of service providers
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Aspects described herein allow multiple devices to function as a coherent whole, allowing each device to take on distinct functions that are complementary to one another. Aspects described herein also allow the devices function as a coherent whole when interconnected devices and their respective applications are configured to operate in various operation modes, when management policies are employed to control the operation of the interconnected devices and their respective applications, when transferring content between the interconnected devices and storing the content at those devices, when obtaining access credentials for the interconnected devices that enable the devices to access enterprise resources, when a policy agent applies management policies to control operation of and interaction between the interconnected devices, and when the interconnected devices are used to access an enterprise application store.

Claims

1. A method comprising:

interconnecting at least a first computing device and a second computing device through an orchestration framework that coordinates operation of a computing activity across at least the first computing device and a second computing device;

maintaining a management policy that governs interaction between at least the first computing device and the second computing device;

receiving, via the orchestration framework, a request from the first computing device to perform at least a portion of the computing activity at the second computing device, wherein the request is associated with a process for transferring content associated with the computing activity from the first computing device to the second computing device;

identifying an application capable of presenting the content;

determining whether the management policy permits the application to be launched at the second computing device;

initiating launch of the application at the second computing device responsive to a determination that the management policy permits the application to be launched at the second computing device; and

blocking launch of the application at the second computing device responsive to a determination that the management policy does not permit the application to be launched at the second computing device.

2. The method of claim 1 further comprising:

permitting the interaction responsive to a determination that the management policy indicates the interaction between the first computing device and the second computing device is permitted; and

blocking the interaction responsive to a determination that the management policy indicates the interaction between the first computing device and the second computing device is not permitted.

3. The method of claim 2 wherein the management policy indicates whether an enterprise resource is permitted to be accessed based on device type and further comprising:

identifying a first device type of the first computing device;

determining whether the management policy permits computing devices of the first device type to access the enterprise resource;

permitting the first computing device to access the enterprise resource responsive to a determination that the management policy permits computing devices of the first device type to access the enterprise resource; and

blocking the first computing device from accessing the enterprise resource responsive to a determination that the management policy does not permit computing devices of the first device type to access the enterprise resource.

4. The method of claim 3 wherein the management policy indicates whether the enterprise resource is permitted to be shared based on device type and further comprising:

identifying a second device type of the second computing device;

determining whether the management policy permits the enterprise resource to be shared with computing devices of the second device type;

permitting the first computing device to share the enterprise resource with the second computing device responsive to a determination that the management policy permits sharing of the enterprise resource with computing devices of the second device type; and

blocking the first computing device from sharing the enterprise resource with the second computing device responsive to a determination that the management policy does not permit sharing of the enterprise resource with computing devices of the second device type.

5. The method of claim 2 wherein the management policy indicates whether content is permitted to be transferred between the plurality of computing devices and further comprising:

permitting the first computing device to transfer the content to the second computing device responsive to a determination that the management policy permits the first computing device to transfer the content to the second computing device; and

blocking the first computing device from transferring the content to the second computing device responsive to a determination that the management policy does not permit the first computing device to transfer the content to, the second computing device.

6. The method of claim 5 wherein the management policy indicates whether the content is permitted to be transferred between at least the first computing device and the second computing device based on a content type of the content.

7. The method of claim 1 wherein the management policy indicates whether the application is permitted to be launched at at least the second computing device based on a respective application class associated with the application.

8. The method of claim 1 further comprising, responsive to a determination that the management policy does not permit the application to be launched at the second computing device:

initiating launch of a client agent at the second computing device; and

configuring the client agent to include a virtual application that is capable of presenting the content.

9. The method of claim 1 further comprising, responsive to a determination that the management policy does not permit the application to be launched at the second computing device:

locating a third computing device that the management policy permits to be launched the application; and

initiating launch of the application at the third computing device.

10. An apparatus comprising:

at least one processor;

one or more memories storing a management policy and computer-readable instructions that, when executed by the at least one processor, cause the apparatus to;

interconnect at least a first computing device and a second computing device through an orchestration framework that coordinates operation of a computing activity across at least the first computing device and a second computing device,

manage interaction at least the first computing device and the second computing device based on the management policy,

receive, via the orchestration framework, a request from the first computing device to perform at least a portion of the computing activity at the second computing device, wherein the request is associated with the transfer of content associated with the computing activity from the first computing device to the second computing device,

identify an application capable of presenting the content,

determine whether the management policy permits the application to be launched at the second computing device,

initiate launch of the application at the second computing device responsive to a determination that the management policy permits the application to be launched at the second computing device, and

block launch of the application at the second computing device responsive to a determination that the management policy does not permit the application to be launched at the second computing device; and

wherein the management policy governs the interaction between at least the first computing device and the second computing device.

11. The apparatus of claim 10 wherein the instructions, when executed by the at least one processor, further cause the apparatus to provide a management interface comprising at least one control that allows an administrative user to configure the management policy.

12. The apparatus of claim 10 wherein:

the management policy indicates whether content is permitted to be shared between at least the first computing device and the second computing device based on a content type of the content; and

the content type includes at least one of document-based content, image-based content, video-based content, web-based content; and

combinations thereof.

13. The apparatus of claim 10 wherein:

the management policy indicates whether an application is permitted to be launched at of the second computing device based on an application class of the application; and

the application class includes at least one of;

a first application class comprising one or more applications capable of presenting document-based content transferred between at least the first computing device and the second computing device,

a second application class comprising one or more applications capable of presenting image-based content transferred between at least the first computing device and the second computing device,

a third application class comprising one or more applications capable of presenting video-based content transferred between at least the first computing device and the second computing device,

a fourth application class comprising one or more applications capable of presenting audio-based content transferred between at least the first computing device and the second computing device;

a fifth application class comprising one or more applications capable of presenting web-based content transferred between at least the first computing device and the second computing device, and

combinations thereof.

14. The apparatus of claim 10 wherein the management policy indicates a maximum number of computing devices a user is permitted to connect via the orchestration framework.

15. The apparatus of claim 10 wherein the management policy indicates whether a user is permitted to connect a computing device via the orchestration framework based on a device type of the computing device.

16. The apparatus of claim 10 wherein the management policy indicates whether a computing device is permitted to transfer content and whether the computing device is permitted to receive transferred content.

17. The apparatus of claim 10 wherein the management policy indicates whether computing devices that are located at a common location are permitted to interact and whether computing devices that are not located at a common location are permitted to interact.

18. The apparatus of claim 10 wherein the management policy indicates whether a first computing device is permitted to transfer content to a second computing device based on a first user role of a first user associated with the first computing device and a second user role of a second user associated with the second computing device.

19. One or more non-transitory computer-readable media having instructions that, when executed, cause at least one computing device to:

connect to one or more computing devices through an orchestration framework that coordinates operation of a computing activity across the computing device and the one or more computing devices in a peer-to-peer fashion;

obtain a management policy from a policy manager, wherein the management policy coordinates the operation of the computin activity across the computingdevice and the one or more computing devices; and

manage peer-to-peer communications between the computing device and individual computing devices of the one or more computing devices based on the management policy, wherein the peer-to-peer communications includes a transfer of content associated with the computing activity from the computing device to the one or more computing devices based on a determination whether the management policy permits an application capable of presenting the content to be launched at the one or more computing devices.