Systems and methods for controlling email access

• US 8,826,432 B2
• Filed: 12/21/2012
• Issued: 09/02/2014
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Dabbiere, Alan, Stuntebeck, Erich, Brannon, Jonathon Blake
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US13/723,526
• Publication Number:
  US 20140165153A1
• Time in Patent Office: 620 Days
• Field of Search: 726/22, 709/206
• US Class Current: 726/22
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Embodiments of the disclosure relate to proxying at least one email resource in transit to at least one client device from at least one email service, removing at least one URL from the email resources, and adding at least one modified URL to the email resources.

Claims

1. A system, comprising:

an apparatus comprising at least one processor and at least one memory storing program code instructions, the at least one memory and program code instructions being configured to, with the at least one processor, cause the apparatus to at least;

identify at least one resource rule associated with a particular client device, wherein at least one email resource is accessible to the particular client device, wherein the at least one email resource comprises at least one uniform resource locator (URL), and wherein the particular client device may only be authorized to access the at least one email resource in an instance in which at least a threshold of the at least one resource rule is satisfied;

determine whether at least one of the identified at least one resource rule comprises a resource rule specifying that the particular client device is only authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via a particular browser application, the at least one URL being configured to be exclusively accessible via the particular browser application in an instance in which the at least one URL is configured such that the at least one URL cannot be accessed via at least one browser application other than the particular browser application; and

,

in an instance in which it is determined that at least one of the identified at least one resource rule comprises the resource rule specifying that the particular client device may only be authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via the particular browser application;

determine whether the at least one URL is configured to be exclusively accessible via the particular browser application; and

,

in an instance in which it is determined that the at least one URL is not configured to be exclusively accessible via the particular browser application, modify the at least one URL such that the modified at least one URL is configured to be exclusively accessible via the particular browser application.

2. The system of claim 1, wherein the modified at least one URL comprises at least one encrypted URL.

3. The system of claim 1, wherein the apparatus is further caused to at least:

transmit the at least one email resource to the particular client device.

4. The system of claim 1, wherein the apparatus is further caused to at least:

authorize the particular client device to access the at least one email resource.

5. A method, comprising:

identifying, via at least one processor, at least one resource rule associated with a particular client device, wherein at least one email resource is accessible to the particular client device, wherein the at least one email resource comprises at least one uniform resource locator (URL), and wherein the particular client device may only be authorized to access the at least one email resource in an instance in which at least a threshold of the at least one resource rule is satisfied;

determining whether at least one of the identified at least one resource rule comprises a resource rule specifying that the particular client device is only authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via a particular browser application, the at least one URL being configured to be exclusively accessible via the particular browser application in an instance in which the at least one URL is configured such that the at least one URL cannot be accessed via at least one browser application other than the particular browser application; and

,

in an instance in which it is determined that at least one of the identified at least one resource rule comprises the resource rule specifying that the particular client device may only be authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via the particular browser application;

determining whether the at least one URL is configured to be exclusively accessible via the particular browser application; and

,

in an instance in which it is determined that the at least one URL is not configured to be exclusively accessible via the particular browser application, modifying the at least one URL such that the modified at least one URL is configured to be exclusively accessible via the particular browser application.

6. The method of claim 5, wherein the modified at least one URL comprises at least one encrypted URL.

7. The method of claim 5, further comprising:

authorizing the particular client device to access the at least one email resource.

8. A computer program product comprising a non-transitory computer-readable storage medium having program code portions embodied therein, the program code portions being configured to, upon execution by a processor, cause apparatus to at least:

identify at least one resource rule associated with a particular client device, wherein at least one email resource is accessible to the particular client device, wherein the at least one email resource comprises at least one uniform resource locator (URL), and wherein the particular client device may only be authorized to access the at least one email resource in an instance in which at least a threshold of the at least one resource rule is satisfied;

determine whether at least one of the identified at least one resource rule comprises a resource rule specifying that the particular client device is only authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via a particular browser application, the at least one URL being configured to be exclusively accessible via the particular browser application in an instance in which the at least one URL is configured such that the at least one URL cannot be accessed via at least one browser application other than the particular browser application; and

,

in an instance in which it is determined that at least one of the identified at least one resource rule comprises the resource rule specifying that the particular client device may only be authorized to access the at least one email resource in an instance in which the at least one URL is configured to be exclusively accessible via the particular browser application;

determine whether the at least one URL is configured to be exclusively accessible via the particular browser application; and

,

in an instance in which it is determined that the at least one URL is not configured to be exclusively accessible via the particular browser application, modify the at least one URL such that the modified at least one URL is configured to be exclusively accessible via the particular browser application.

9. The computer program product of claim 8, wherein the modified at least one URL comprises at least one encrypted URL.

10. The computer program product of claim 8, wherein the apparatus is further caused to at least:

transmit the at least one email resource to the particular client device.

11. The computer program product of claim 8, wherein the apparatus is further caused to at least:

authorize the particular client device to access the at least one email resource.