Providing secure mobile device access to enterprise resources using application tunnels
View Patent ↗A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.
1. A non-transitory computer-readable medium having stored thereon an agent component that is configured to be installed on a mobile device of a user to provide secure access over a network to an enterprise resource of an enterprise system, the agent component comprising executable code that implements a process that comprises:
intercepting, by the agent component installed on the mobile device, a hypertext transfer protocol (HTTP) request generated by an application installed on the mobile device;
modifying the HTTP request by replacing a hostname of the HTTP request with a hostname of the enterprise resource;
encapsulating, by the agent component installed on the mobile device, a representation of the modified HTTP request according to a tunneling protocol; and
sending, by the agent component installed on the mobile device, the encapsulated representation of the HTTP request from the mobile device over a network to a tunnel mediator that is configured to extract and forward the representation of the HTTP request to a corresponding enterprise resource, wherein the agent component is configured to send the encapsulated representation of the HTTP request using a tunnel definition that is specific to the application installed on the mobile device.
2. The non-transitory computer-readable medium of claim 1 , wherein the agent component is configured to intercept the HTTP request as an HTTP proxy server.
3. The non-transitory computer-readable medium of claim 1 , wherein the agent component is configured to send the encapsulated representation of the HTTP request via an application tunnel that is dedicated to communications between the application installed on the mobile device and the enterprise resource.
4. The non-transitory computer-readable medium of claim 1 , wherein the process comprises multiplexing encapsulated communications from multiple applications installed on the mobile device for transmission to the tunnel mediator over a common connection, such that multiple application tunnels are multiplexed over the common connection.
5. The non-transitory computer-readable medium of claim 1 , wherein the agent component is configured to use a custom SSL (secure sockets layer) library to establish a secure session with the enterprise resource, and to use the secure session to send the encapsulated representation of the HTTP request, the custom SSL library configured to accept a digital certificate returned by the enterprise resource despite a hostname mismatch, such that a hostname matching requirement is disregarded.
6. A computer system comprising:
one or more processors; and
non-transitory computer-readable media storing computer-readable instructions that, when executed by the one or more processors, implement:
a repository of application tunnel definitions, each application tunnel definition defined for a particular mobile device application and indicating a particular server port associated with a particular resource of the computer system; and
a tunneling mediator that is configured to:
receive an application tunnel formation request from an agent installed on a mobile device, the application tunnel formation request identifying one of the application tunnel definitions;
retrieve the identified application tunnel definition from the repository;
determine, from the retrieved application tunnel definition, a server port of a resource of the computer system;
receive at least one agent-generated communication from the agent installed on the mobile device, the agent-generated communication comprising an application-generated communication from an application installed on the mobile device, the retrieved application tunnel definition being defined for the application installed on the mobile device, the application-generated communication being encapsulated by the agent installed on the mobile device within one or more headers of an encapsulation protocol;
extract the application-generated communication from the agent-generated communication;
modifying the application-generated communication by replacing a hostname of the application-generated communication with a hostname of the resource of the computer system; and
send the application-generated communication to the server port via a resource network connection.
7. The computer system of claim 6 , wherein the tunneling mediator is configured to:
receive, from the resource via the resource network connection, a response to the application-generated communication;
encapsulate the response within one or more headers of the encapsulation protocol; and
send the encapsulated response to the agent of the mobile device.
8. The computer system of claim 6 , wherein:
the application comprises a web browser;
the application-generated communication comprises a uniform resource locator (URL) for an information resource available on a network; and
the tunneling mediator is configured to:
apply a policy governing whether access to the URL is permitted by an enterprise associated with the computer system;
respond to a determination that access to the URL is permitted by sending the application-generated communication to the information resource; and
respond to a determination that access to the URL is not permitted by not sending the application-generated communication to the information resource.
9. The computer system of claim 6 , comprising a mobile device manager associated with the tunneling mediator, the mobile device manager configured to deny the request if one or more properties of the mobile device or of a user assigned to the mobile device do not comply with one or more policies associated with the mobile device manager.
10. The computer system of claim 6 , wherein the tunneling mediator is configured to:
receive data from the resource via the resource network connection;
begin sending the data to the mobile device via a mobile device network connection between the tunneling mediator and the mobile device;
respond to a loss of the mobile device network connection by caching at least a portion of the data that has not been sent to the mobile device; and
respond to a regaining of the mobile device network connection by sending the cached data to the mobile device via the regained network connection.
11. The computer system of claim 6 , wherein the tunneling mediator is configured to log information about at least one of: (1) application-generated communications received from the particular application and sent by the tunneling mediator to the resource via the resource network connection; and (2) resource-generated communications received from the resource and sent by the tunneling mediator to the mobile device.
12. A mobile device comprising a processor and storage, the mobile device comprising:
one or more application tunnel definitions stored in the storage, each application tunnel definition being uniquely associated with a particular mobile device application and indicating a local mobile device port; and
an agent installed on the storage of the mobile device, the agent being associated with a remote computer system and comprising instructions that, when executed by the processor, cause the mobile device to:
receive, by the agent installed on the mobile device, an application-generated communication comprising a hypertext transfer protocol (HTTP) request generated by an application installed on the mobile device, the application configured to communicate with a resource of the remote computer system;
search the storage to retrieve an application tunnel definition of the one or more application tunnel definitions, wherein the retrieved tunnel definition is uniquely associated with the application;
generate, by the agent installed on the mobile device, an application tunnel formation request based on the retrieved application tunnel definition;
modify the HTTP request by replacing a hostname in the HTTP request with a hostname of the resource;
encapsulate at least a portion of the application-generated communication, comprising the modified HTTP request, within one or more headers of an encapsulation protocol; and
send, by the agent installed on the mobile device, the application tunnel formation request and the encapsulated application-generated communication to a tunneling mediator of the remote computer system.
13. The mobile device of claim 12 , wherein the agent installed on the mobile device is configured to operate as a hypertext transfer protocol (HTTP) proxy server for the application.
14. The mobile device of claim 12 , wherein the agent installed on the mobile device is configured to:
receive from the tunneling mediator, via a local mobile device port defined in the retrieved application tunnel definition, a resource-generated response to the application-generated communication, the response being encapsulated within one or more headers of the encapsulation protocol;
extract the resource-generated response from the one or more headers; and
provide the resource-generated response to the first application.
15. The mobile device of claim 14 , wherein the response is generated by the resource and encapsulated by the tunneling mediator.
16. The mobile device of claim 12 , wherein the agent installed on the mobile device is configured to:
respond to a loss of a mobile device connection by caching data not yet sent to the tunneling mediator; and
respond to a regaining of the mobile device connection by sending the cached data to the tunneling mediator via the regained mobile device connection.
17. Non-transitory computer storage storing executable instructions that cause a mobile device to perform a process that comprises:
intercepting, by an agent component installed on the mobile device, a message sent by a mobile application running on the mobile device;
modifying, by the agent component installed on the mobile device, a hostname specified by the message to correspond to a target application server;
encapsulating, by the agent component installed on the mobile device, the modified message according to an application tunneling protocol specified for the mobile application; and
sending, by the agent component installed on the mobile device, the encapsulated, modified message on a wireless network for delivery to the target application server via an application tunnel.
18. The non-transitory computer storage of claim 17 , storing executable instructions that cause the agent component to act as a hypertext transfer protocol (HTTP) proxy server component that implements the process.
19. The non-transitory computer storage of claim 17 , wherein the application tunnel is dedicated to communications between the mobile application and the target application server.
20. A method comprising:
intercepting, by an agent component installed on a mobile device, a hypertext transfer protocol (HTTP) request generated by an application installed on the mobile device;
modifying the HTTP request by replacing a hostname of the HTTP request with a hostname of an enterprise resource;
encapsulating, by the agent component installed on the mobile device, a representation of the modified HTTP request according to a tunneling protocol; and
sending, by the agent component installed on the mobile device, the encapsulated representation of the HTTP request from the mobile device over a network to a tunnel mediator that is configured to extract and forward the representation of the HTTP request to a corresponding enterprise resource, wherein the agent component is configured to send the encapsulated representation of the HTTP request using a tunnel definition that is specific to the application installed on the mobile device.
21. The method of claim 20 , comprising:
multiplexing encapsulated communications from multiple applications installed on the mobile device for transmission to the tunnel mediator over a common connection, such that multiple application tunnels are multiplexed over the common connection.
22. The method of claim 20 , comprising:
using a custom SSL (secure sockets layer) library to establish a secure SSL session with the enterprise resource, and to use the secure SSL session to send the encapsulated representation of the HTTP request, the custom SSL library configured to accept a digital certificate returned by the enterprise resource despite a hostname mismatch, such that a hostname matching requirement is disregarded.
23. The method of claim 22 , comprising:
creating a different secure SSL session with the enterprise resource;
encapsulating a different message from a different application installed on the mobile device; and
sending the encapsulated different message using the different secure SSL session.
24. The method of claim 20 , comprising:
creating an exception on the mobile device to a hostname matching requirement, the exception enabling the mobile device to accept a digital certificate that specifies a localhost hostname used by a proxy server that intercepts messages from the mobile application installed on the mobile device.