On-demand security policy activation

• US 9,787,686 B2
• Filed: 04/12/2013
• Issued: 10/10/2017
• Est. Priority Date: 04/12/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Stuntebeck, Erich, Brannon, Jonathan Blake
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US13/862,218
• Publication Number:
  US 20140310765A1
• Time in Patent Office: 1,642 Days
• Field of Search: 726 1, 726 7
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

On-demand activation of a security policy may be provided. Upon receiving a selection of a link, a profile identified by a security policy associated with the link may be activated and the link may be opened according to the security policy. In some embodiments, opening the link according to the security policy may comprise redirecting the opening of the link from a first application to a second application.

Claims

1. A method comprising:

receiving, using an email application in at least one mobile computing device, a user selection of a resource locator displayed in an email message, wherein the resource locator comprises a reference to a resource;

determining, using the at least one mobile computing device, whether the resource locator selected from the email message is associated with a security policy; and

in response to determining that the resource locator is associated with the security policy;

activating, in the at least one mobile computing device, a profile identified by the security policy, wherein the profile specifies that a secure application is permitted to access the resource referred to by the resource locator; and

accessing the resource referred to by the resource locator using the secure application specified by the profile instead of another application installed on the mobile computing device.

2. The method of claim 1, wherein the security policy comprises a virtual private network (VPN) policy.

3. The method of claim 1, wherein determining whether the resource locator is associated with the security policy comprises determining whether an address for the resource locator is associated with an intranet.

4. The method of claim 1, wherein determining whether the resource locator is associated with the security policy comprises determining whether the resource locator is associated with at least one secure source site.

5. The method of claim 1, further comprising:

in response to determining that the resource locator is associated with the security policy, determining, using the at least one mobile computing device, whether the at least one computing device is in communication with a virtual private network (VPN); and

in response to determining that the at least one mobile computing device is in communication with the VPN, allowing, using the at least one mobile computing device, at least one of a plurality of additional applications in the at least one computing device to access the resource referred to by the resource locator.

6. The method of claim 5, further comprising:

in response to determining that the at least one mobile computing device is not in communication with the VPN, activating a VPN profile in the at least one client device.

7. The method of claim 6, wherein activating the VPN profile comprises connecting the at least one mobile computing device to a secure server.

8. The method of claim 7, further comprising using the secure server as a proxy server for the at least one mobile computing device.

9. The method of claim 1, wherein the resource locator comprises a link to a web page.

18. The method of claim 1, wherein the secure application comprises a secure web browser application.

10. A system comprising:

a memory storage storing program code, wherein the program code comprises an email application and a secure application; and

at least one processor coupled to the memory storage, wherein, upon execution, the program code causes the at least one processor to at least;

render a resource locator for display in a user interface for the email application;

receive, using the email application, a user selection of the resource locator;

determine whether the resource locator selected using the email application refers to a secure file;

in response to determining that the resource locator refers to the secure file, determine whether a security policy is associated with the secure file; and

in response to determining that the security policy is associated with the secure file;

activate a profile associated with the security policy, wherein the profile specifies that a secure application is permitted to access the resource referred to by the resource locator; and

access the resource referred to by the resource locator using the secure application instead of another application.

11. The system of claim 10, wherein the program code causes the at least one processor to access the secure file in accordance with the security policy by at least activating a virtual private network (VPN) prior to accessing the secure file.

12. The system of claim 11, wherein the secure application is operative to execute in a secure portion of the memory storage.

13. The system of claim 12, wherein the program code, upon execution, further causes the at least one processor to at least:

terminate the secure application; and

erase at least the secure portion of the memory storage used for the secure file.

19. The system of claim 10, wherein the secure application comprises a secure file browser application.

14. A non-transitory computer-readable medium that stores a set of instructions that, when executed by at least one processor, performs a method executed by the at least one processor, comprising:

receiving, using an email application, a user selection of a resource locator rendered in a user interface for the email application, wherein the resource locator comprises a reference to a resource;

determining whether the resource selected using the email application is associated with a security policy; and

in response to determining that the resource is associated with the security policy;

activating a profile identified by the security policy, wherein the profile specifies that a secure application is permitted to access the resource referred to by the resource locator; and

accessing the resource referred to by the resource locator using the secure application instead of another application.

15. The non-transitory computer-readable medium of claim 14, wherein the security policy comprises a virtual private network configuration policy.

16. The non-transitory computer-readable medium of claim 15, wherein the virtual private network configuration policy comprises a proxy-auto-configuration (PAC) file.

17. The non-transitory computer-readable medium of claim 14, wherein the secure application comprises a secure browser application.

20. The non-transitory computer-readable medium of claim 14, wherein the method further comprises determining whether to approve a functionality request using an agent application.