Resource watermarking and management

• US 9,584,437 B2
• Filed: 06/02/2013
• Issued: 02/28/2017
• Est. Priority Date: 06/02/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Marshall, John, DeWeese, William
• Primary Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US13/907,930
• Publication Number:
  US 20130275600A1
• Time in Patent Office: 1,367 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

A method, system and non-transitory computer-readable medium product are provided for resource watermarking and management. In the context of a method, a method is provided that includes identifying resources associated with a device and identifying a watermark template. The method further includes associating the watermark template with the resources, and authorizing the device to perform actions on the resources.

Claims

1. A method comprising:

enrolling a user device with a management system that manages the user device for an enterprise;

generating, using the user device, a device profile that comprises first descriptive data describing the user device at a first instance in time;

obtaining, in the user device, a configuration profile that causes the user device to at least obtain at least one watermark template from the management system, wherein the configuration profile further causes the user device to at least comply with at least one compliance rule;

identifying, using the user device, a request to access at least one resource;

determining, using the user device, whether the at least one compliance rule specifies that the at least one resource is required to be associated with at least one watermark template in order for the user device to be authorized to access the at least one resource;

determining, using the user device, whether the at least one watermark template is associated with the at least one resource;

associating, using the user device, the at least one watermark template with the at least one resource in response to determining that the at least one watermark template is not associated with the at least one resource; and

adding, using the user device, the first descriptive data from the device profile to the at least one watermark template associated with the at least one resource;

updating, using the user device, the device profile with second descriptive data describing the user device at a second instance in time; and

adding, using the user device, the second descriptive data from the device profile to the at least one watermark template associated with the at least one resource.

2. The method of claim 1, further comprising:

causing, using the user device, at least one event log to be created, the at least one event log describing an association of the at least one watermark template to the at least one resource.

3. The method of claim 2, further comprising:

causing, using the user device, the at least one event log to be transmitted to at least one management service communicatively coupled to the user device.

4. The method of claim 1, further comprising:

causing, using the user device, the request to access the at least one resource to be authorized when the at least one compliance rule is satisfied.

5. The method of claim 4, further comprising:

causing, using the user device, at least one event log to be created, the at least one event log describing an authorization of the request to access the at least one resource.

6. The method of claim 5, further comprising:

causing, using the user device, the at least one event log to be transmitted to at least one management service communicatively coupled to the user device.

7. The method of claim 1, further comprising:

causing, using the user device, the request to access the at least one resource to be denied when the at least one compliance rule is not satisfied.

8. The method of claim 1, wherein at least a portion of the first descriptive data describing the user device is acquired from an application executed by the user device.

9. The method of claim 1, wherein at least a portion of the first descriptive data describing the user device is acquired from a management service communicatively coupled to the user device.

10. The method of claim 1, wherein the at least one resource is stored by a resource server communicatively coupled to the user device.

11. The method of claim 1, wherein the at least one watermark template is stored by a watermark template server communicatively coupled to the user device.

12. The method of claim 1, further comprising:

performing a compliance audit of the user device; and

transmitting a report of the compliance audit to the management system.

13. An apparatus comprising:

at least one processor; and

at least one memory accessible to the at least one processor, the at least one memory storing a plurality of compliance rules used to enforce a plurality of security requirements, the at least one memory further storing a plurality of program code instructions that, when executed by the at least one processor, direct the at least one processor to at least;

enroll a user device with a management system that manages the user device for an enterprise;

generate a device profile file that comprises first descriptive data describing the user device at a first instance in time;

obtain a configuration profile that causes the user device to at least obtain at least one watermark template from the management system, wherein the configuration profile further causes the user device to at least comply with at least one compliance rule;

identify a request to access at least one resource;

determine whether at least one of the compliance rules specifies that the at least one resource is required to be associated with at least one watermark template in order for the at least one processor to be authorized to access the at least one resource;

determine whether the at least one watermark template is associated with the at least one resource;

associate the at least one watermark template with the at least one resource in response to determining that the at least one watermark template is not associated with the at least one resource; and

add the first descriptive data from the device profile to the at least one watermark template associated with the at least one resource;

update the device profile with second descriptive data describing the user device at a second instance in time; and

add the second descriptive data from the device profile to the at least one watermark template associated with the at least one resource.

14. The apparatus of claim 13, wherein the at least one of the compliance rules further specifies that the at least one processor is required to be located within a predefined geographic location in order for the at least one processor to be authorized to access the at least one resource.

15. The apparatus of claim 13, wherein the at least one of the compliance rules further specifies that the at least one processor is required to be communicatively coupled to a predefined access point in order for the at least one processor to be authorized to access the at least one resource.

16. The apparatus of claim 13, wherein the at least one of the compliance rules further specifies that a plurality of conditions are required to be satisfied in order for the at least one processor to be authorized to access the at least one resource.

17. The apparatus of claim 13, wherein the plurality of program code instructions further direct the at least one processor to at least:

perform a compliance audit of the user device; and

transmit a report of the compliance audit to the management system.

18. A computer program product comprising a non-transitory computer-readable storage medium having a plurality of program code portions embodied therein, the program code portions being configured to, upon execution, direct at least one computing device to at least:

enroll a user device with a management system that manages the user device for an enterprise;

generate a device profile that comprises first descriptive data describing the user device at a first instance in time;

obtain a configuration profile that causes the user device to at least obtain at least one watermark template from the management system, wherein the configuration profile further causes the user device to at least comply with the at least one compliance rule;

identify a request to access at least one resource;

determine whether at least one compliance rule specifies that the at least one resource is required to be associated with at least one watermark template in order for the at least one resource to be accessible;

determine whether the at least one watermark template is associated with the at least one resource;

associate the at least one watermark template with the at least one resource in response to determining that the at least one watermark template is not associated with the at least one resource; and

add the first descriptive data from the device profile to the at least one watermark template associated with the at least one resource;

update the device profile with second descriptive data describing the user device at a second instance in time; and

add the second descriptive data from the device profile to the at least one watermark template associated with the at least one resource.

19. The computer program product of claim 18, wherein the program code portions further direct the at least one computing device to at least:

perform a compliance audit of the user device; and

transmit a report of the compliance audit to the management system.