Granted Patent B2

US 9,736,259 · App. 14/755,377 · Granted Aug 15, 2017

Abstract

Claims (64)

1. A system configured to control access to a plurality of resources located remotely from a plurality of geographically distributed users, the system comprising:

a first storage device configured to store user management information associated with the plurality of geographically distributed users, the user management information including role information indicating roles assigned to the plurality of geographically distributed users, subordinate user information indicating subordinate users assigned to the plurality of geographically distributed users, and access authorization information indicating resources to which the plurality of geographically distributed users have access;

a proxy including a processor and a memory device, the proxy coupled via at least one communications network to the first storage device and to a server configured to provide directory information, the directory information including a global list of authorized network users;

the proxy configured to:

obtain at least a portion of the directory information from the server;

receive an access request associated with a requesting user of the plurality of geographically distributed users, the access request including a request to access at least one resource;

determine whether the requesting user is an authorized network users based, at least in part, on the at least a portion of the directory information; and

conditionally route the access request to a device hosting the at least one resource based, at least in part, on whether it is determined that the requesting user is an authorized network user, and based at least in part on the user management information associated with the requesting user.

2. The system of claim 1 , wherein:

the management information of a first user is seeded with information indicating that the first user is assigned a first non-administrator role, that a second user is designated as a subordinate user of the first user, and that the first user is authorized to access a first application;

the management information of the second user is seeded with information indicating that the second user is not authorized to access the first application; and

the management information of the second user is updated by the first user, based on the role of the first user as a first non-administrator, to indicate that the second user is authorized to access to the first application.

3. The system of claim 1 , further comprising:

the proxy configured to control access to the at least on resource at both an application level and a request level.

4. The system of claim 1 , further comprising a processing system configured to store the plurality of resources in a Hypertext Transport Protocol (HTTP) database accessible via a set of application programming interfaces (APIs).

5. The system of claim 4 , wherein the APIs are file-type agnostic.

6. The system of claim 4 , wherein the processing system is further configured to implement a resource versioning system, the resource versioning system configured to allow one or more resources to be designated within the resource versioning system as a working copy, wherein the resource versioning system does not maintain different versions of resources designated as working copies.

7. The system of claim 1 , wherein the proxy is further configured to:

receive, from the device hosting the at least one resource, a file in response to the access request;

dynamically generate a transformed file by transforming the file using pipeline language parameters included in a URL associated with the access request to create a set of functions to be applied in series; and

transmit the transformed file to the requesting user.

8. A method of controlling access to a plurality of resources located remotely from a plurality of geographically distributed users, the method comprising:

storing, at a first storage device, user management information associated with the plurality of geographically distributed users, the user management information including role information indicating roles assigned to the plurality of geographically distributed users, subordinate user information indicating subordinate users assigned to the plurality of geographically distributed users, and access authorization information indicating resources to which the plurality of geographically distributed users have been granted access;

obtaining, by a proxy device, directory information from a directory server, the directory information including a global list of authorized network users used to determine whether the requesting user is an authorized network user;

receiving, by the proxy device, an access request associated with a requesting user of the plurality of geographically distributed users, the access request including a request to access at least one resource;

using the proxy to interrogate the first storage device for the user management information associated with the requesting user; and

conditionally routing the access request to a device hosting the at least one resource based, at least in part, on both the directory information and the user management information associated with the requesting user.

9. The method of claim 8 , further comprising:

seeding the management information of a first user with role information indicating that the first user is assigned a first non-administrator role, subordinate user information indicating that a second user is designated as a subordinate user of the first user, and access authorization information indicating that the first user is authorized to access a first application;

seeding the management information of the second user with access authorization information indicating that the second user is not authorized to access the first application; and

permitting the first user to update the management information of the second user to grant the second user access to the first application, without requiring the first user to be assigned to an administrator role.

10. The method of claim 8 , further comprising:

controlling access to the at least on resource via the proxy at both an application level and a request level.

11. The method of claim 8 , further comprising storing the resources in a Hypertext Transport Protocol (HTTP) database accessible via a set of application programming interfaces (APIs).

12. The method of claim 11 , wherein the APIs are file-type agnostic.

13. The method of claim 11 , further comprising storing the resources using a versioning system, the versioning system configured to allow one or more resources to be designated within the versioning system as a working copy.

14. The method of claim 8 , further comprising:

receiving, at the proxy device, a file in response to the access request from the device hosting the at least one resource;

dynamically generate a transformed file by transforming the file using pipeline language parameters included in a URL associated with the access request to create a set of functions to be applied in series; and

transmit the transformed file to the requesting user.

15. A proxy for use in a system configured to control access to a plurality of resources located remotely from a plurality of geographically distributed users, the proxy comprising:

a processor;

a network interface coupled to the processor, the network interface configured to communicate via a communications network with:

a directory server storing directory information, the directory information including a global list of authorized network users;

a first storage device storing user management information associated with the plurality of geographically distributed users, the user management information including role information indicating roles assigned to the plurality of geographically distributed users, subordinate user information indicating subordinate users assigned to the plurality of geographically distributed users, and access authorization information indicating resources to which the plurality of geographically distributed users have access;

a computing device used by at least one of the plurality of geographically distributed users;

a memory coupled to the processor;

a program of instructions configured to be stored in the memory and executed by the processor, the program of instructions including:

at least one instruction to obtain at least a portion of the directory information from the directory server;

at least one instruction to receive an access request associated with a requesting user of the plurality of geographically distributed users, the access request including a request to access at least one resource;

at least one instruction to determine whether the requesting user is an authorized network users based, at least in part, on the at least a portion of the directory information; and

at least one instruction to conditionally route the access request to a device hosting the at least one resource based, at least in part, on whether it is determined that the requesting user is an authorized network user, and based at least in part on the user management information associated with the requesting user.

16. The proxy of claim 15 , wherein:

the management information of a first user is seeded with information indicating that the first user is assigned a first non-administrator role, that a second user is designated as a subordinate user of the first user, and that the first user is authorized to access a first application;

the management information of the second user is seeded with information indicating that the second user is not authorized to access the first application; and

the management information of the second user is updated by the first user, based on the role of the first user as a first non-administrator, to indicate that the second user is authorized to access to the first application.

17. The proxy of claim 15 , further comprising:

the proxy configured to control access to the at least on resource at both an application level and a request level.

18. The proxy of claim 15 , further comprising a processing system configured to store the plurality of resources in a Hypertext Transport Protocol (HTTP) database accessible via a set of application programming interfaces (APIs).

19. The proxy of claim 18 , wherein the processing system is further configured to implement a resource versioning system, the resource versioning system configured to allow one or more resources to be designated within the resource versioning system as a working copy, wherein the resource versioning system does not maintain different versions of resources designated as working copies.

20. The proxy of claim 15 , wherein the proxy is further configured to:

receive, from the device hosting the at least one resource, a file in response to the access request;

dynamically generate a transformed file by transforming the file using pipeline language parameters included in a URL associated with the access request to create a set of functions to be applied in series; and

transmit the transformed file to the requesting user.

Assignments (16)