Application gateway architecture with multi-level security policy and rule promulgations

Patent metadata

Field	Value
Publication number	US-9979751-B2
Application number	US-201414491386-A
Country	US
Kind code	B2
Filing date	Sep 19, 2014
Priority date	Sep 20, 2013
Publication date	May 22, 2018
Grant date	May 22, 2018

Abstract

Embodiments of an application gateway architecture may include an application gateway server computer communicatively connected to backend systems and client devices operating on different platforms. The application gateway server computer may include application programming interfaces and services configured for communicating with the backend systems and managed containers operating on the client devices. The application gateway server computer may provide applications that can be centrally managed and may extend the capabilities of the client devices, including the ability to authenticate across backend systems. A managed container may include a managed cache and may provide a secure shell for applications received from the application gateway server computer. The managed container may store the applications in the managed cache and control access to the managed cache according to rules propagated from at least one of the backend systems via the application gateway server computer.

First claim

What is claimed is:

1. A system, comprising:
an application gateway server computer communicatively connected to backend systems, to an application repository, and to client devices,
the application gateway server computer and the application repository residing on a content management layer between the backend systems running in an enterprise computing environment and the client devices,
the backend systems residing behind a firewall of the enterprise computing environment,
the application gateway server computer residing in the enterprise computing environment outside of the firewall of the enterprise computing environment and comprising application programming interfaces and services configured for communicating with the backend systems and with managed containers operating on the client devices,
the services provided by the application gateway server computer comprising an application service, a device management service, and an authentication service;
wherein the application gateway server computer communicates with the backend systems through the firewall of the enterprise computing environment; and
a client device comprising a managed container embodied on a non-transitory computer readable medium,
the managed container written in a programming language native to the client device and downloaded by the client device from a network source,
the managed container having a managed cache and an application framework with an execution engine that provides a runtime environment for running applications on the client device, the applications associated with the backend systems running in the enterprise computing environment,

the managed container configured for:
communicating with the application service of the application gateway server computer;
receiving, from the application gateway server computer via the application service of the application gateway server computer, one or more applications stored in the application repository, the one or more applications written in a cross-platform language and hosted by at least one backend system of the backend systems;
storing the one or more applications received from the application gateway server computer and data associated with the one or more applications in the managed cache of the managed container running on the client device;
providing a secure runtime shell within which the one or more applications received from the application gateway server computer and hosted by the at least one backend system of the backend systems are run on the client device;
communicating with the authentication service of the application gateway server computer, the authentication service providing the managed container with a common authentication mechanism to the backend systems such that, once authenticated by the authentication service at the application gateway server computer, the managed container has access to the backend systems through the common authentication mechanism; and
controlling the one or more applications received from the application gateway server computer and the data associated with the one or more applications stored in the managed cache of the managed container running on the client device in accordance with a set of rules, the set of rules propagated from the at least one backend system of the backend systems to the managed container via the device management service of the application gateway server computer;

wherein the application gateway server computer is further configured for:
managing the managed cache on the client device, wherein the managed cache includes a content cache for storing data associated with managed applications received from the application gateway server computer, a settings cache for storing application settings information, and a state cache for saving application state information on the client device; and
controlling the data associated with the managed applications stored in the content cache based on a rule generated on a backend system.

2. The system of claim 1 , wherein the one or more applications and the data associated with the one or more applications stored in the managed cache are under control of the managed container in accordance with the set of rules propagated from the at least one backend system regardless of network connectivity of the client device.

3. The system of claim 1 , wherein the secure runtime shell includes a secure data encryption shell that encrypts the data associated with the one or more applications to limit or prevent access to the data by the client device operating system and other applications that reside on the client device but that were not received from the application gateway server computer.

4. The system of claim 3 , wherein at least one rule of the set of rules determines encryption parameters for encrypting the data, the secure data encryption shell encrypting the data based on the encryption parameters.

5. The system of claim 4 , wherein the encryption parameters are shared between the managed container and one or more of the backend systems, via the application gateway server computer, to enable shared secure access to data between and among applications received from the application gateway server computer and the one or more backend systems.

6. The system of claim 1 , wherein at least a portion of the set of rules resides on the client device, the backend systems, the application gateway server computer, or a combination thereof.

7. The system of claim 6 , wherein the set of rules includes at least one of: a rule controlling storage of data associated with applications received from the application gateway server computer, a rule controlling access to data associated with applications received from the application gateway server computer, or a rule controlling update of data associated with applications received from the application gateway server computer.

8. The system of claim 6 , wherein the set of rules is stored on the client device, the managed container using the stored set of rules to control or protect data associated with applications received from the application gateway server computer.

9. The system of claim 8 , wherein an update to one of the rules is propagated from at least one of the backend systems to the managed container via the application gateway server computer, the managed container executing, based on the updated rule, an update to data associated with at least one of the applications received from the application gateway server computer.

10. The system of claim 1 , wherein the set of rules includes an application rule to control at least one application received from the application gateway server computer.

11. The system of claim 10 , wherein the application rule is stored on the client device, the managed container using the stored application rule to control the at least one application received from the application gateway server computer.

12. The system of claim 11 , wherein an update to the application rule is propagated from at least one of the backend systems to the managed container via the application gateway server computer, the managed container executing, based on the updated application rule, an update to the at least one application received from the application gateway server computer.

13. The system of claim 1 , wherein the services provided by the application gateway server computer further include one or more of:
a notification service for selectively sending messages to one or more of the managed containers on the client devices, a specific managed application or managed applications contained in the one or more of the managed containers, one or more of

Assignees

• Open Text Sa Ulc

Inventors

• Beckman Gregory
• Laird Robert
• Gagne Alain

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F21/16

  Program or content traceability, e.g. by watermarking · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title