System and method for secure management of mobile user access to enterprise network resources

Abstract

A system and method are provided for managing mobile user access to enterprise network resources from a wireless mobile device, such as a smart phone or mobile computer, with improved security and access control. Access rules determining accessible resources and associated permitted operations are determined based on membership of an authenticated user to each of one or more groups, each group being associated with a set of permitted accessible resources and operations. For each user, based on membership of a group, or a Boolean evaluation of memberships of two or more groups, a list of accessible resources and permitted operations is generated, and the list is made available for subsequent processes, e.g. presentation to the user on an interface of the mobile device. Access rules may also be defined dependent on other information received from the system, or from the mobile device, such as time or location. Requests for an operation such as read access or write access to a network resource, such as a file, lists, shared calendars et al., may thus be readily controlled by an IT manager for multiple users of an enterprise network. Since the application resides in an application layer between the mobile device and existing security infrastructure, mobile access may be set without overriding internal access policies.

The invention claimed is: 
     
       1. A method for managing user access from a wireless mobile device to a plurality of network resources comprising documents and files within an enterprise network, wherein the enterprise network comprises a security infrastructure for managing internal user access from within the enterprise network according to an internal access policy, and wherein for access from a wireless mobile user device the method comprises the steps of:
 determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;   determining access rules for the user based on each group membership of the user;   generating a list of accessible resources and associated operations for the user based on said access rules; and   making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.   
     
     
       2. The method according to claim  1  5, wherein said network resources comprise network resources of different resources types, and comprising generating said list of accessible resources and operations for the user comprising accessible resources of a plurality of different resource types. 
     
     
       3. The method according to claim  1  5, further comprising an initial step of receiving from a user credentials comprising a user ID, and authenticating the user. 
     
     
       4. The method according to  claim 1 , further comprising retrieving directory information associated with said user to obtain attributes of the user associated with said user ID. 
     
     
       5. The method according to  claim 4 , further comprising: A method for managing network resource accessibility of user access from a wireless mobile device to securely interoperate with a plurality of network resources comprising documents and files within an enterprise network, wherein the enterprise network comprises a security infrastructure for managing internal user access from within the enterprise network according to an internal access policy, and wherein, for the user access from the wireless mobile user device, the method comprises the steps of:
 determining group membership of the mobile user based on a user ID and attributes of the mobile user, each group having associated therewith a set of resources and associated operations for members of the group; 
 determining filterable access rules for the mobile user based on each group membership of the mobile user; 
 generating a list of accessible resources and of associated operations for the mobile user based on said access rules; 
 making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said accessible resource to the mobile user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations to thereby provide secure interoperation from the mobile device to said accessible resource, and wherein access by the wireless mobile device is direct and real time; 
 retrieving directory information associated with said user to obtain attributes of the user associated with said user ID; and  
 before retrieving the directory information, determining an applicable directory type of a set of possible directory types, and after retrieving said directory information, re-encoding said directory information to a desired format. 
 
     
     
       6. The method according to claim  1  5, further comprising initiating an operation on an accessible resource in accordance with said access rules. 
     
     
       7. The method according to claim  1  5, further comprising performing a requested operation on a selected accessible resource. 
     
     
       8. The method according to  claim 2 , further comprising delivery of the list of accessible resources and operations to the wireless mobile device. 
     
     
       9. The method according to  claim 8 , wherein delivery of the list of accessible resources and operations to the user comprises presenting the list of accessible resources and operations to the user via a user interface of the wireless mobile device. 
     
     
       10. The method according to  claim 9 , further comprising presenting to the user a list of accessible resource types, and A method for providing secure user access from a wireless mobile device to interoperate with discrete ones of a plurality of network resources comprising documents and files within an enterprise network, wherein the enterprise network comprises a security infrastructure for managing internal user access from within the enterprise network according to an internal access policy, and wherein for access from a wireless mobile user device the method comprises the steps of:
 determining group membership of the mobile user based on a user ID and attributes of the mobile user, each group having associated therewith a set of resources and associated operations for members of the group; 
 determining filterable access rules for the mobile user based on each group membership of the mobile user; 
 generating a list of accessible ones of the plurality of resources and of associated operations for the mobile user based on said access rules; 
 making said list available to a subsequent process for performing an operation on the accessible ones of the plurality of resources in accordance with said access rules comprising one or more of displaying and otherwise interfacing said accessible resource to the mobile user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations, and wherein access by the wireless mobile device is direct and real time; 
 wherein the plurality of network resources network comprise network resources of different resources types, generating said list of accessible resources and operations for the user comprising the accessible resources from the plurality of different resource types; 
 delivering the list of the accessible resources and operations to the wireless mobile device, wherein delivery of the list of accessible resources and operations to the user comprises presenting the list of accessible resources and operations to the user via a user interface of the wireless mobile device; and  
 receiving a user selection or validation of a the resource type before presenting the list of accessible resource and operations. 
 
     
     
       11. The method according to  claim 9 , wherein presenting the list of accessible resources and operations comprises presenting an indication or description of a resource type associated with an accessible resource. 
     
     
       12. The method according to  claim 9 , wherein presenting comprises graphically displaying said list on the mobile device. 
     
     
       13. The method according claim  1  5, further comprising validating one or more of an accessible resource, operation, or resource type before subsequent processing thereof. 
     
     
       14. The method according to  claim 8 , further comprising a step of validating an accessible resource and/or operation in response to a request from a user before subsequent processing thereof. 
     
     
       15. The method according to  claim 9 , further comprising initiating a process to respond to a request from the user for an operation on an accessible resource in accordance with access rules. 
     
     
       16. The method according to  claim 15 , further comprising responding to a request from the user for an operation on an accessible resource comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email and download and synchronize. 
     
     
       17. The method according to  claim 15 , further comprising responding to a request from the user for an operation on a resource by blocking or denying access to said resource. 
     
     
       18. The method according to claim  1  5, wherein said access rules are determined for a user based on a Boolean evaluation of rules for a plurality of group memberships of the user. 
     
     
       19. The method according to claim  1  5, further comprising receiving additional data from at least one of the system enterprise network and the mobile device, and wherein said access rules are determined based on said additional information. 
     
     
       20. The method according to claim  1  5, wherein said access rules are determined dynamically based on at least one of one of a date and time of day and a location of the mobile device or a combination thereof. 
     
     
       21. The method according to claim  1  5, wherein each access rule comprises a membership list and a resource and/or operations list. 
     
     
       22. The method according to  claim 21 , wherein a membership list comprises a high level descriptor defining criteria for who may access associated resources and operations. 
     
     
       23. The method according to  claim 21 , wherein a resource and/or operations list comprises high level descriptors of resources and/or operations. 
     
     
       24. The method according to claim  1  5, wherein said access rule comprises a high level descriptor of one or more of a membership group, a resource, and an associated operation. 
     
     
       25. The method according to claim  1  5, further comprising determining group membership of a user based on a token associated with said user ID. 
     
     
       26. The method according to  claim 9 , wherein displaying said list of accessible resources and operations comprises displaying said list arranged by containers, each container containing a listing of resources and/or operations associated with a respective group membership. 
     
     
       27. The method according to  claim 9 , wherein displaying said list of accessible resources and operations comprises displaying said list by arranged by resource type. 
     
     
       28. The method according to  claim 6  A method for securely managing user access from a wireless mobile device to interoperate with ones from among a plurality of network resources comprising documents and files within an enterprise network, wherein the enterprise network comprises a security infrastructure for managing internal user access from within the enterprise network according to an internal access policy, and wherein, for access from the wireless mobile user device, the method comprises the steps of:
 determining group membership of the mobile user based on a user ID and attributes of the mobile user, each group having associated therewith a set of resources and associated operations for members of the group; 
 determining filterable access rules for the mobile user based on each group membership of the mobile user; 
 generating a list of accessible resources to the mobile user from among the plurality of network resources and of associated operations for the mobile user based on said access rules; 
 making said list available to a subsequent process for performing an operation on the accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said accessible resource to the mobile user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations, and wherein access by the wireless mobile device is direct and real time; 
 initiating an operation on the accessible resource in accordance with said access rules; and  
 wherein the accessible resources are indexed with an indicator of one or more of resource type, other descriptor and selection criteria, and performing an operation on a the list of accessible resources comprises performing an operation selectively on resources indexed with a specific indicator. 
 
     
     
       29. A client server system for managing access to a plurality of network resources comprising documents and files within an enterprise network from a wireless mobile device, wherein the enterprise network comprises a security infrastructure for managing internal user access according to internal access policies, and the client server system comprises:
 a server within the enterprise network for managing wireless mobile access by performing the steps of:   receiving identification from a user of a wireless mobile device;   retrieving from a directory attributes of said user based on a user ID of the user;   determining group membership of the user based on said user ID and said attributes, each group having associated therewith a set of access rules defining accessible resources and associated permitted operations for members of the group;   resolving access rules for the user based on group membership and generating a list of accessible resources and operations for the user based on said access rules; and   making said list available for subsequent processing comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.   
     
     
       30. The client server system according to  claim 29 , wherein said steps further comprise authentication of the user. 
     
     
       31. The client server system according to  claim 29 , wherein said steps further comprise delivery of the list of accessible resources and operations to a client in the wireless mobile device. 
     
     
       32. The client server system according to  claim 29 , further comprising a client in the wireless mobile device for displaying said list of accessible resources and operations. 
     
     
       33. The client server system according to  claim 32 , wherein said client in the wireless mobile device comprises:
 an interface for presenting to a user a list of accessible resources of different resource types.   
     
     
       34. The client server system according to  claim 33 , wherein said client further comprises an interface for presenting to the user permissible operations associated with each accessible resource. 
     
     
       35. A system comprising an access control layer for an access server managing mobile user access to network resources comprising documents and files within an enterprise network comprising processing means for performing the steps of:
 determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;   determining access rules for the user based on each group membership of the user;   generating a list of accessible resources and associated operations for the user based on said access rules; and   making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.   
     
     
       36. The system according to according to  claim 35 , wherein said network resources comprise network resources of different resources types, and comprising generating said list of accessible resources and operations for the user comprising accessible resources of a plurality of different resource types. 
     
     
       37. The system according to  claim 36 , further comprising A system comprising an access control layer for an access server managing secure mobile user access from a mobile device to interoperate with network resources comprising documents and files within an enterprise network, comprising processing means for processing non-transitory computing code for performing the steps of:
 determining group membership of the mobile user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group; 
 determining filterable and modifiable access rules for the user based on each group membership of the user; 
 generating a list of real time accessible resources and associated operations for the user based on said access rules; 
 making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations; 
 wherein said network resources comprise network resources of different resources types, generating said list of accessible resources and operations for the user comprising accessible resources of a plurality of different resource types;  
 generating a list of types of the accessible resource types, resources; and 
 receiving a user selection or validation of a resource type before generating the list of accessible resources and operations. 
 
     
     
       38. The system according to  claim 36 , wherein the list of accessible resources comprises an indication or description of a resource type associated with an accessible resource. 
     
     
       39. A non-transitory computer readable medium comprising executable program instructions for carrying out a method of managing user access to a plurality of network resources comprising documents and files within an enterprise network from a wireless mobile device, by steps comprising:
 determining group membership of a user based on a user ID and attributes of the user, each group having associated therewith a set of resources and associated operations for members of the group;   determining access rules for the user based on each group membership of the user;   generating a list of accessible resources and associated operations for the user based on said access rules;   making said list available to a subsequent process for performing an operation on an accessible resource in accordance with said access rules comprising one or more of displaying and otherwise interfacing said resource to the user for one or more of read, write, execute, modify, delete, email, download, and synchronize operations.   
     
     
       40. The non-transitory computer readable medium according to  claim 39 , wherein said steps further comprise performing a requested operation on a selected accessible resource.