Secure mobile browser for protecting enterprise data
View Patent ↗A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.
1. A mobile device comprising a user interface, a memory, and at least one processor configured to run applications stored on the memory, the mobile device comprising:
a web browser installed on the memory of the mobile device, the web browser configured to regulate operation of at least one application in accordance with one or more enterprise policies, the web browser further comprising a secure cache configured to store data received from one or more enterprise resources, and the web browser further configured to:
determine that a connection speed of a network connection of the mobile device is below a threshold;
in response to determining that the connection speed is below the threshold:
prevent the application from detecting that the connection speed is below the threshold; and
store, in the secure cache, data requested to be transmitted over the network connection;
after storing data in the secure cache:
receive, from a computing device, an instruction to remove access to data stored in the secure cache; and
remove, in response to receiving the instruction, access to the data stored in the secure cache; and
an application installed on the memory of the mobile device, the application configured to:
launch the web browser in response to receiving a command to initiate execution; and
after launching the web browser, continue execution within an execution environment provided by the web browser.
2. The mobile device of claim 1 , wherein the web browser is natively configured to route communications from the mobile device to an enterprise resource through at least one computing device configured as a proxy server to enable content filtering in which the web browser blocks the mobile device from accessing a network resource.
3. The mobile device of claim 1 , wherein the web browser is configured to communicate with an enterprise resource of an enterprise computing system via an application tunnel through a tunneling mediator of the enterprise computing system.
4. The mobile device of claim 1 , wherein the web browser is configured to:
receive or intercept a request sent by the application to a network resource;
encapsulate at least a portion of the request within one or more headers of an encapsulation protocol; and
send the encapsulated portion of the request to a tunneling mediator associated with the network resource, to establish a communication tunnel with the tunneling mediator.
5. The mobile device of claim 4 , wherein the application is configured to generate a request to send first data to a network resource, and wherein the web browser is configured to:
compress the first data;
send the compressed first data to the tunneling mediator via the communication tunnel;
decompress second data received from the tunneling mediator via the communication tunnel; and
provide the decompressed second data to the application.
6. The mobile device of claim 1 , wherein one or more enterprise policies are configured to restrict access of the to an enterprise resource stored on a computing device different from the mobile device when the mobile device is located in a defined geographical zone or when access to the enterprise resource is requested during a defined time range.
7. The mobile device of claim 1 , wherein the one or more enterprise policies comprise one or more enterprise access rules defining conditions under which the mobile device is allowed to access an enterprise resource.
8. The mobile device of claim 1 , wherein the application is configured to launch the web browser and after launching the web browser, continue execution within an execution environment provided by the web browser, based on at least one of a temporal condition, a location condition, a mobile device property, and a property of a user profile associated with a user of the mobile device.
9. The mobile device of claim 1 , wherein the web browser is configured to:
receive one or more data values of one or more state metrics associated with the mobile device;
detect an instance of a problem associated with the mobile device, at least in part, by using a machine-readable logic rule to analyze the received one or more data values; and
execute a machine-readable remedial action for countering the detected problem instance.
10. The mobile device of claim 1 , wherein the web browser installed on the memory of the mobile device is further configured to:
determine that the connection speed of the network connection of the mobile device is above the threshold; and
transmit over the network connection, in response to determining that the connection speed is above the threshold, the data stored in the secure cache.
11. The mobile device of claim 1 , wherein determining that the connection speed of the network connection of the mobile device is below a threshold comprises detecting that the mobile device has no network connectivity.
12. The mobile device of claim 1 , wherein the web browser installed on the memory of the mobile device is further configured to:
detect a geographic location of the mobile device; and
determine that the geographic location of the mobile device has poor network connectivity,
wherein determining that the geographic location of the mobile device has poor network connectivity comprises determining that the connection speed is below the threshold.
13. The mobile device of claim 1 , wherein removing access to the data stored in the secure cache comprises deleting the data.
14. The mobile device of claim 1 , wherein the instruction to remove access to the data stored in the secure cache is received based on a group policy enforced by the computing device.
15. The mobile device of claim 1 , wherein the web browser installed on the memory of the mobile device is further configured to:
detect a geographic location of the mobile device; and
prevent access to the application based on the detected geographic location of the mobile device.
16. The mobile device of claim 1 , wherein the web browser installed on the memory of the mobile device is further configured to:
detect a type of the application launching the web browser; and
in response to detecting that a first type of application is launching the web browser, run the application within the web browser without requiring input of user credentials.
17. The mobile device of claim 16 , wherein the web browser installed on the memory of the mobile device is further configured to:
initiate a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that a second type of application different from the first type is launching the web browser.
18. The mobile device of claim 17 , wherein detecting the type of the application launching the web browser comprises detecting that the application does not comprise embedded access credential functionality.
19. The mobile device of claim 1 , wherein the web browser installed on the memory of the mobile device is further configured to:
determine that a current time of day is within a range; and
initiate a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that the current time of day is within the range.
20. A method comprising:
determining, by a web browser installed on a memory of a mobile device, that a connection speed of a network connection of the mobile device is below a threshold, wherein the mobile device comprises a user interface, the memory, and at least one processor configured to run applications stored on the memory, and wherein the web browser is configured to regulate operation of at least one application in accordance with one or more enterprise policies, the web browser comprising a secure cache configured to store data received from one or more enterprise resources;
in response to determining that the connection speed is below the threshold:
preventing, by the web browser, the application from detecting that the connection speed is below the threshold; and
storing, by the web browser, in the secure cache, data requested to be transmitted over the network connection; and
after storing data in the secure cache:
receiving, by the web browser, from a computing device, an instruction to remove access to data stored in the secure cache; and
removing, by the web browser, in response to receiving the instruction, access to the data stored in the secure cache,
wherein an application is installed on the memory of the mobile device, and the application is configured to:
launch the web browser in response to receiving a command to initiate execution; and
after launching the web browser, continue execution within an execution environment provided by the web browser.
21. The method of claim 20 , wherein the web browser is natively configured to route communications from the mobile device to an enterprise resource through at least one computing device configured as a proxy server to enable content filtering in which the web browser blocks the mobile device from accessing a network resource.
22. The method of claim 20 , wherein the web browser is configured to communicate with an enterprise resource of an enterprise computing system via an application tunnel through a tunneling mediator of the enterprise computing system.
23. The method of claim 20 , comprising:
receiving or intercepting, by the web browser, a request sent by the application to a network resource;
encapsulating, by the web browser, at least a portion of the request within one or more headers of an encapsulation protocol; and
sending, by the web browser, the encapsulated portion of the request to a tunneling mediator associated with the network resource, to establish a communication tunnel with the tunneling mediator.
24. The method of claim 23 , comprising:
generating, by the application, a request to send first data to a network resource;
compressing, by the web browser, the first data;
sending, by the web browser, the compressed first data to the tunneling mediator via the communication tunnel;
decompressing, by the web browser, second data received from the tunneling mediator via the communication tunnel; and
providing, by the web browser, the decompressed second data to the application.
25. The method of claim 20 , wherein one or more enterprise policies are configured to restrict access of the application to an enterprise resource stored on a computing device different from the mobile device when the mobile device is located in a defined geographical zone or when access to the enterprise resource is requested during a defined time range.
26. The method of claim 20 , wherein the one or more enterprise policies comprise one or more enterprise access rules defining conditions under which the mobile device is allowed to access an enterprise resource.
27. The method of claim 20 , wherein the application is configured to launch the web browser and after launching the web browser, continue execution within an execution environment provided by the web browser, based on at least one of a temporal condition, a location condition, a mobile device property, and a property of a user profile associated with a user of the mobile device.
28. The method of claim 20 , comprising:
receiving, by the web browser, one or more data values of one or more state metrics associated with the mobile device;
detecting, by the web browser, an instance of a problem associated with the mobile device, at least in part, by using a machine-readable logic rule to analyze the received one or more data values; and
executing, by the web browser, a machine-readable remedial action for countering the detected instance of the problem.
29. The method of claim 20 , comprising:
determining, by the web browser, that the connection speed of the network connection of the mobile device is above the threshold; and
transmitting, by the web browser, over the network connection, in response to determining that the connection speed is above the threshold, the data stored in the secure cache.
30. The method of claim 20 , wherein determining that the connection speed of the network connection of the mobile device is below a threshold comprises detecting that the mobile device has no network connectivity.
31. The method of claim 20 , comprising:
detecting, by the web browser, a geographic location of the mobile device; and
determining, by the web browser, that the geographic location of the mobile device has poor network connectivity,
wherein determining that the geographic location of the mobile device has poor network connectivity comprises determining that the connection speed is below the threshold.
32. The method of claim 20 , wherein removing access to the data stored in the secure cache comprises deleting the data.
33. The method of claim 20 , wherein the instruction to remove access to the data stored in the secure cache is received based on a group policy enforced by the computing device.
34. The method of claim 20 , comprising:
detecting, by the web browser, a geographic location of the mobile device; and
preventing, by the web browser, access to the application based on the detected geographic location of the mobile device.
35. The method of claim 20 , comprising:
detecting, by the web browser, a type of the application launching the web browser; and
in response to detecting that a first type of application is launching the web browser, running, by the web browser, the application within the web browser without requiring input of user credentials.
36. The method of claim 35 , comprising:
initiating, by the web browser, a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that a second type of application different from the first type is launching the web browser.
37. The method of claim 36 , wherein detecting the type of the application launching the web browser comprises detecting that the application does not comprise embedded access credential functionality.
38. The method of claim 20 , comprising:
determining, by the web browser, that a current time of day is within a range; and
initiating, by the web browser, a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that the current time of day is within the range.
39. One or more non-transitory computer-readable media having instructions stored thereon that, when executed, cause a mobile device to:
determine, by a web browser installed on the non-transitory computer-readable media, that a connection speed of a network connection of the mobile device is below a threshold, wherein the mobile device comprises a user interface and at least one processor configured to run applications stored on the non-transitory computer-readable media, and wherein the web browser is configured to regulate operation of at least one application in accordance with one or more enterprise policies, the web browser comprising a secure cache configured to store data received from one or more enterprise resources;
in response to determining that the connection speed is below the threshold:
prevent, by the web browser, the application from detecting that the connection speed is below the threshold; and
store, by the web browser, in the secure cache, data requested to be transmitted over the network connection; and
after storing data in the secure cache:
receive, by the web browser, from a computing device, an instruction to remove access to data stored in the secure cache; and
remove, by the web browser, in response to receiving the instruction, access to the data stored in the secure cache,
wherein an application is installed on the non-transitory computer-readable media, and the application is configured to:
launch the web browser in response to receiving a command to initiate execution; and
after launching the web browser, continue execution within an execution environment provided by the web browser.
40. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is natively configured to route communications from the mobile device to an enterprise resource through at least one computing device configured as a proxy server to enable content filtering in which the web browser blocks the mobile device from accessing a network resource.
41. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to communicate with an enterprise resource of an enterprise computing system via an application tunnel through a tunneling mediator of the enterprise computing system.
42. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
receive or intercept a request sent by the application to a network resource;
encapsulate at least a portion of the request within one or more headers of an encapsulation protocol; and
send the encapsulated portion of the request to a tunneling mediator associated with the network resource, to establish a communication tunnel with the tunneling mediator.
43. The one or more non-transitory computer-readable media of claim 42 , wherein the application is configured to generate a request to send first data to a network resource, and wherein the web browser is configured to:
compress the first data;
send the compressed first data to the tunneling mediator via the communication tunnel;
decompress second data received from the tunneling mediator via the communication tunnel; and
provide the decompressed second data to the application.
44. The one or more non-transitory computer-readable media of claim 39 , wherein one or more enterprise policies are configured to restrict access of the application to an enterprise resource stored on a computing device different from the mobile device when the mobile device is located in a defined geographical zone or when access to the enterprise resource is requested during a defined time range.
45. The one or more non-transitory computer-readable media of claim 39 , wherein the one or more enterprise policies comprise one or more enterprise access rules defining conditions under which the mobile device is allowed to access an enterprise resource.
46. The one or more non-transitory computer-readable media of claim 39 , wherein the application is configured to launch the web browser and after launching the web browser, continue execution within an execution environment provided by the web browser, based on at least one of a temporal condition, a location condition, a mobile device property, and a property of a user profile associated with a user of the mobile device.
47. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
receive one or more data values of one or more state metrics associated with the mobile device;
detect an instance of a problem associated with the mobile device, at least in part, by using a machine-readable logic rule to analyze the received one or more data values; and
execute a machine-readable remedial action for countering the detected problem instance.
48. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
determine that the connection speed of the network connection of the mobile device is above the threshold; and
transmit over the network connection, in response to determining that the connection speed is above the threshold, the data stored in the secure cache.
49. The one or more non-transitory computer-readable media of claim 39 , wherein determining that the connection speed of the network connection of the mobile device is below a threshold comprises detecting that the mobile device has no network connectivity.
50. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
detect a geographic location of the mobile device; and
determine that the geographic location of the mobile device has poor network connectivity,
wherein determining that the geographic location of the mobile device has poor network connectivity comprises determining that the connection speed is below the threshold.
51. The one or more non-transitory computer-readable media of claim 39 , wherein removing access to the data stored in the secure cache comprises deleting the data.
52. The one or more non-transitory computer-readable media of claim 39 , wherein the instruction to remove access to the data stored in the secure cache is received based on a group policy enforced by the computing device.
53. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
detect a geographic location of the mobile device; and
prevent access to the application based on the detected geographic location of the mobile device.
54. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
detect a type of the application launching the web browser; and
in response to detecting that a first type of application is launching the web browser, run the application within the web browser without requiring input of user credentials.
55. The one or more non-transitory computer-readable media of claim 54 , wherein the web browser is configured to:
initiate a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that a second type of application different from the first type is launching the web browser.
56. The one or more non-transitory computer-readable media of claim 55 , wherein detecting the type of the application launching the web browser comprises detecting that the application does not comprise embedded access credential functionality.
57. The one or more non-transitory computer-readable media of claim 39 , wherein the web browser is configured to:
determine that a current time of day is within a range; and
initiate a prompt requiring input of user credentials before running the application within the web browser, in response to detecting that the current time of day is within the range.