System and methods for controlling access to applications using cross-jurisdiction workload control

Patent metadata

Field	Value
Publication number	US-11228650-B2
Application number	US-202016857395-A
Country	US
Kind code	B2
Filing date	Apr 24, 2020
Priority date	Dec 8, 2016
Publication date	Jan 18, 2022
Grant date	Jan 18, 2022

Abstract

At design time, cross-jurisdiction workload controls may be presented by a process platform server to a user (e.g., a workload creator or process builder) who is using the process platform to create or update an application having a workload functionality with zero, one, or more applicable regulation controls. If no regulation control is selected, or if there is no exception provided, the process platform server may operate to block the user from proceeding to complete the workload creation process. The application with the workload thus created/updated is delivered to end user(s). Responsive to a user request to open the application on a client device, a server (the process platform server or an application gateway server) may operate to automatically determine whether a target location associated with the user request is permitted in accordance with a cross-jurisdiction workload control associated the workload defined in the application.

First claim

What is claimed is:

1. A method for cross-jurisdictional workload control enforcement, the method comprising:
receiving, by a server computer through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining, by the server computer, whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining, by the server computer, a policy that applies to the application and the user;
determining, by the server computer, whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, by the server computer based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.

2. The method according to claim 1 , wherein the server computer comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.

3. The method according to claim 1 , wherein the server computer is part of the integrated computing platform operating in the computer network environment.

4. The method according to claim 1 , further comprising:
detecting whether the user device has moved from a private address to a public address, wherein the approving or the denying is performed further based on whether the user device has moved from the private network address to the public network address.

5. The method according to claim 1 , wherein the approving further comprises delivering the application with the workload to the user device.

6. The method according to claim 1 , wherein the denying further comprises notifying the user that the location where the user device is located is not supported by the integrated computing platform.

7. The method according to claim 1 , further comprising:
generating an audit entry to log the approving or the denying.

8. A system for cross-jurisdictional workload control enforcement, the system comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
receiving, through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining a policy that applies to the application and the user;
determining whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.

9. The system of claim 8 , wherein the system comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.

10. The system of claim 8 , wherein the system is part of the integrated computing platform operating in the computer network environment.

11. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
detecting whether the user device has moved from a private address to a public address, wherein the approving or the denying is performed further based on whether the user device has moved from the private network address to the public network address.

12. The system of claim 8 , wherein the approving further comprises delivering the application with the workload to the user device.

13. The system of claim 8 , wherein the denying further comprises notifying the user that the location where the user device is located is not supported by the integrated computing platform.

14. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
generating an audit entry to log the approving or the denying.

15. A computer program product for cross-jurisdictional workload control enforcement, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a server computer for:
receiving, through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining a policy that applies to the application and the user;
determining whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.

16. The computer program product of claim 15 , wherein the server computer comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.

17. The computer program product of claim 15 , wherein the server computer is part of the integrated computing platform operating in the computer network environment.

18. The computer program product of claim 15 , wherein the instructions are further translatable by the processo

Assignees

• Open Text Sa Ulc

Inventors

• Blair Steven C

Classifications

• H04L67/125 Primary

  involving control of end-device applications over a network · CPC title

• G06Q10/06 Primary

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• H04L67/00

  Network arrangements or protocols for supporting network services or applications (user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00) · CPC title

• H04L65/40

  Support for services or applications · CPC title

• G06F9/5055

  considering software capabilities, i.e. software resources associated or available to the machine · CPC title