Approach For Managing Access To Data On Client Devices

Abstract

A device management system is configured to manage access to electronic documents on client devices using policies. The policies specify one or more download and processing restrictions to be enforced with respect to the particular electronic document at client devices for example, particular hardware and software configurations that are required at client devices before data is permitted to be downloaded to those client devices. The policies may also specify other requirements that must be satisfied before data is permitted to be downloaded to those client devices, for example, user authentication.

1 . One or more non-transitory computer-readable media for managing access to a particular electronic document, the computer-readable medium storing instructions which, when processed by one or more processors, causes:
 a device management system receiving, from a client device, a request to access a particular electronic document;   determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more required configuration attributes that include one or more required hardware configuration attributes;   determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document; and   in response to determining that the client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.   
     
     
         2 . The one or more non-transitory computer-readable media of  claim 1 , wherein determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document includes one or more of examining data that indicates a current hardware configuration and a current software configuration of the client device and querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device. 
     
     
         3 . The one or more non-transitory computer-readable media of  claim 2 , wherein querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device. 
     
     
         4 . The one or more non-transitory computer-readable media of  claim 2 , wherein:
 querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device, and   determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes comparing the data received from the software audit process executing on the client device to stored data maintained by a device management system that indicates the current hardware configuration and the current software configuration of the client device.   
     
     
         5 . The one or more non-transitory computer-readable media of  claim 1 , wherein the one or more of one or more required hardware configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices including one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only a display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document. 
     
     
         6 . The one or more non-transitory computer-readable media of  claim 1 , wherein:
 the one or more policies that apply to the particular electronic document specify that user authentication is required to access the particular electronic document, and   the one or more non-transitory computer-readable media stores additional instructions which, when processed by the one or more processors, cause determining, based upon the one or more policies that apply to the particular electronic document, whether a user of the client device is authorized to access the particular electronic document.   
     
     
         7 . The one or more non-transitory computer-readable media of  claim 1 , wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document. 
     
     
         8 . An apparatus for managing access to a particular electronic document, the apparatus including a memory storing instructions which, when processed by one or more processors, cause:
 a device management system receiving, from a client device, a request to access a particular electronic document;   determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more required configuration attributes that include one or more required hardware configuration attributes;   determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document; and   in response to determining that the client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.   
     
     
         9 . The apparatus of  claim 8 , wherein determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document includes one or more of examining data that indicates a current hardware configuration and a current software configuration of the client device and querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device. 
     
     
         10 . The apparatus of  claim 9 , wherein querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device. 
     
     
         11 . The apparatus of  claim 9 , wherein:
 querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device, and   determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes comparing the data received from the software audit process executing on the client device to stored data maintained by a device management system that indicates the current hardware configuration and the current software configuration of the client device.   
     
     
         12 . The apparatus of  claim 8 , wherein the one or more of one or more required hardware configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices including one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only a display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document. 
     
     
         13 . The apparatus of  claim 8 , wherein:
 the one or more policies that apply to the particular electronic document specify that user authentication is required to access the particular electronic document, and   the memory stores additional instructions which, when processed by the one or more processors, cause determining, based upon the one or more policies that apply to the particular electronic document, whether a user of the client device is authorized to access the particular electronic document.   
     
     
         14 . The apparatus of  claim 8 , wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document. 
     
     
         15 . A computer-implemented method for managing access to a particular electronic document, the computer-implemented method comprising:
 a device management system receiving, from a client device, a request to access a particular electronic document;   determining, from a plurality of policies, one or more policies that apply to the particular electronic document, wherein the one or more policies specify one or more required configuration attributes that include one or more required hardware configuration attributes;   determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document; and   in response to determining that the client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document, then transmitting the particular electronic document to the client device.   
     
     
         16 . The computer-implemented method of  claim 15 , wherein determining whether a client device to which the particular electronic document is to be downloaded currently supports the one or more required configuration attributes that include one or more required hardware configuration attributes specified by the one or more policies that apply to the particular electronic document includes one or more of examining data that indicates a current hardware configuration and a current software configuration of the client device and querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device. 
     
     
         17 . The computer-implemented method of  claim 16 , wherein querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device. 
     
     
         18 . The computer-implemented method of  claim 16 , wherein:
 querying the client device to obtain data that indicates a current hardware configuration and a current software configuration of the client device includes invoking, on the client device, a software audit process that is configured to determine the current hardware configuration and the current software configuration of the client device and provide the data that indicates the current hardware configuration and the current software configuration of the client device, and   determining whether the client device to which the particular electronic document is to be downloaded currently supports the one or more required hardware configuration attributes or one or more required software configuration attributes specified by the one or more policies that apply to the particular electronic document includes comparing the data received from the software audit process executing on the client device to stored data maintained by a device management system that indicates the current hardware configuration and the current software configuration of the client device.   
     
     
         19 . The computer-implemented method of  claim 15 , wherein the one or more required hardware configuration attributes allow one or more processing restrictions to be enforced with respect to the particular electronic document at client devices including one or more of allowing only data of one or more specified formats to be downloaded to the particular client device, allowing only a display of the particular electronic document at the client device, not allowing a copy of the particular electronic document to be stored at the client device, allowing a copy of the particular electronic document to be stored at the client device in accordance with an authorization level, not allowing a copy of the particular electronic document to be forwarded from the client device to another device, allowing a copy of the particular electronic document to be forwarded from the client device to another device in accordance with an authorization level, or deleting the particular electronic device from the client device after display of the particular electronic document. 
     
     
         20 . The computer-implemented method of  claim 15 , wherein determining, from a plurality of policies, one or more policies that apply to the particular electronic document, is performed based on at least one or more of a file type of the particular electronic document or a logical group that corresponds to the particular electronic document.