Method and system for assigning access control levels in providing access to networked content files

• US 9,311,502 B2
• Filed: 01/07/2013
• Issued: 04/12/2016
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Braddy, Ricky Gene, Simmons, Timothy Ernest, Cockerill, Aaron David
• Primary Examiner(s): Winder, Patrice
• Application Number:
  US13/735,550
• Publication Number:
  US 20130124732A1
• Time in Patent Office: 1,191 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/88 Mark-up to mark-up conversion conversion for visualization in web browsing G06F16/9577
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/18 Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

A method and system for assigning access control levels when granting access to resources includes a client node, a collection agent, and a policy engine. The client node requests access to a resource. The collection agent gathers information about the client node. The policy engine receives the gathered information and assigns one of a plurality of levels of access responsive to application of a policy to the received information and transmits the information.

Claims

1. A system of granting access to resources, comprising:

a policy engine to detect a first request from a first mobile device for access to a resource and a second request from a second mobile device for access to the resource;

a first collection agent to gather information about the first mobile device responsive to the request to access the resource made by the first mobile device, wherein the policy engine transmits the first collection agent to the first mobile device;

a second collection agent to gather information about the second mobile device responsive to the request to access the resource made by the second mobile device, wherein the policy engine transmits the second collection agent to the second mobile device; and

the policy engine in communication with the first collection agent and the second collection agent, to grant to the first mobile device a first level of access to the resource responsive to application of a policy to the information gathered about the first mobile device and to grant to the second mobile device a second level of access to the resource responsive to application of a policy to the information gathered about the second mobile device;

a transformation server in communication with the policy engine to modify the resource from a first format for the first level of access to a second format for the second level of access;

wherein the first level of access is selected from a plurality of levels of access and wherein the second level of access is selected from the plurality of levels of access and is different from the first level of access.

2. The system of claim 1 wherein the policy engine further comprises a database storing configurable policies.

3. The system of claim 1 wherein the policy engine comprises a plurality of policies to provide a level of access control rights to at least one of the first and second mobile devices.

4. The system of claim 1 wherein the policy engine transmits instructions to at least one of the first and second collection agents for determining the type of information the respective collection agent gathers.

5. The system of claim 1 wherein the policy engine further comprises a logon agent.

6. The logon agent of claim 5 wherein the logon agent receives the gathered information from at least one of the first and second collection agents.

7. The logon agent of claim 5 wherein the logon agent identifies, for the policy engine, authentication information received from at least one of the first and second collection agents.

8. The system of claim 1 wherein the policy engine further comprises a plurality of logon agents.

9. The system of claim 8 wherein at least one of the plurality of logon agents resides on each network domain from which a mobile device may transmit a resource request.

10. The system of claim 9 wherein the mobile device transmits the resource request to a particular logon agent.

11. The system of claim 10 wherein the logon agent identifies for the policy engine the network domain from which the mobile device transmits the resource request.

12. The system of claim 1 wherein at least one of the first and second collection agents executes on at least one of the first and second mobile devices.

13. The system of claim 1 wherein at least one of the first and second collection agents comprises at least one script.

14. The system of claim 1 wherein at least one of the first and second collection agents comprises bytecode.

15. A system of granting access to resources comprising:

a policy engine to detect a first request from a first mobile device for access to a resource and a second request from a second mobile device for access to the resource;

a first collection agent to gather information about the first mobile device responsive to the request to access the resource made by the first mobile device;

a second collection agent to gather information about the second mobile device responsive to the request to access the resource made by the second mobile device;

the policy engine in communication with the first collection agent and the second collection agent, to grant to the first mobile device a first level of access to the resource responsive to application of a policy to the information gathered about the first mobile device and to grant to the second mobile device a second level of access to the resource responsive to application of a policy to the information gathered about the second mobile device; and

a transformation server in communication with the policy engine to modify the resource from a first format for the first level of access to a second format for the second level of access;

wherein the first level of access is selected from a plurality of levels of access and wherein the second level of access is selected from the plurality of levels of access and is different from the first level of access.

16. The system of claim 15 wherein the policy engine comprises a logon agent.

17. The system of claim 15 wherein the policy engine transmits at least one of the first and second collection agents to the mobile device.

18. The system of claim 15 wherein at least one of the first and second collection agents gathers the information by running at least one script on the mobile device.

19. The system of claim 18 wherein at least one of the first and second collection agents gathers information comprising HTTP headers.

20. The system of claim 18 wherein at least one of the first and second collection agents gathers information comprising the network zone of at least one of the first and second mobile devices.

21. The system of claim 18 wherein at least one of the first and second collection agents gathers information comprising a method of authentication used by at least one of the first and second mobile devices.