Secure access client
View Patent ↗A secure access client can be employed to enforce limitations on a user's access to a file while also allowing the user to access the file using an application of choice. To provide this functionality, the secure access client can implement an RDP client that is configured to create an RDP session with an RDP service executing on the same computing device. The RDP service can allow the secure access client to display the user interface of an application employed to open a file. The secure access client can be configured to selectively apply access limitations on a per file basis. This selective enforcement can be accomplished by only implementing a virtual channel extension to provide a particular type of access to the file when the file's access limitations would allow such access.
1. A method for applying access limitations on a per file basis, the method comprising:
executing a remote display protocol (RDP) service that is configured to establish RDP sessions with RDP clients;
executing, within a browser sandbox on a computing device, a secure access client that implements an RDP client;
establishing an RDP session between the RDP service and the secure access client;
opening a file via the RDP session including displaying, by the secure access client, contents of the file to a user of the computing device;
in conjunction with opening the file, identifying, by the secure access client, one or more access limitations defined for the file, the one or more access limitations comprising a copy limitation;
while the file is open, identifying, by the secure access client, that the user has provided input to the computing device that has initiated an action that if completed would violate the one or more access limitations defined for the file; and
preventing, by the secure access client, the action from being completed by selectively failing to implement functionality of a virtual channel extension of the RDP session thereby ensuring that the one or more access limitations defined for the file are not violated;
wherein selectively failing to implement functionality of the virtual channel extension of the RDP session comprises failing to synchronize contents of a clipboard in an RDP session environment to a clipboard of the computing device.
2. The method of claim 1 , further comprising:
opening a second file via the RDP session;
in conjunction with opening the second file, identifying, by the secure access client, that one or more access limitations defined for the second file do not include a copy limitation;
while the file is open, identifying, by the secure access client, that a user has provided input that has initiated a copy action; and
implementing, by the secure access client, the copy action by implementing functionality of the virtual channel extension of the RDP session to cause synchronization of contents of the clipboard in the RDP session environment to the clipboard of the computing device.
3. The method of claim 2 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: Clipboard Virtual Channel Extension such that the secure access client selectively implements the RDP: Clipboard Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
4. The method of claim 1 , wherein the one or more access limitations also comprise a save limitation and selectively failing to implement functionality of the virtual channel extension of the RDP session comprises failing to save the file to a location outside an RDP session environment.
5. The method of claim 4 , further comprising:
opening a second file via the RDP session;
in conjunction with opening the second file, identifying, by the secure access client, that one or more access limitations defined for the second file do not include a save limitation;
while the file is open, identifying, by the secure access client, that a user has provided input that has initiated a save action; and
implementing, by the secure access client, the save action by implementing functionality of the virtual channel extension of the RDP session to cause the file to be saved outside the RDP session environment.
6. The method of claim 5 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: File System Virtual Channel Extension such that the secure access client selectively implements the RDP: File System Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
7. The method of claim 1 , wherein the one or more access limitations also comprise a print limitation and selectively failing to implement functionality of the virtual channel extension of the RDP session comprises failing to print the file to a printer accessible outside an RDP session environment.
8. The method of claim 7 , further comprising:
opening a second file via the RDP session;
in conjunction with opening the second file, identifying, by the secure access client, that one or more access limitations defined for the second file do not include a print limitation;
while the file is open, identifying, by the secure access client, that a user has provided input that has initiated a print action; and
implementing, by the secure access client, the print action by implementing functionality of the virtual channel extension of the RDP session to cause the file to be printed to a printer accessible outside the RDP session environment.
9. The method of claim 8 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: Print Virtual Channel Extension such that the secure access client selectively implements the RDP: Print Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
10. The method of claim 1 , wherein the RDP service is executed on the computing device such that the RDP session is established via localhost.
11. The method of claim 1 , further comprising:
establishing an RDP session between the RDP service and an administer device;
receiving, from the administrator device and via the RDP session, updates to access limitations defined for one or more files; and
modifying the access limitations defined for the one or more files in accordance with the received updates.
12. The method of claim 1 , wherein the access limitations are stored as one or more of:
one or more headers to the file to which the access limitations pertain;
one or more files associated with the file to which the access limitations pertain; or
one or more data structures maintained by the RDP service for defining the access limitations for the files to which the RDP service provides access.
13. One or more computer storage media storing computer executable instructions which when executed by one or more processors implement a method comprising:
executing, within a browser sandbox on a computing device, a secure access client that implements a remote display protocol (RDP) client;
establishing an RDP session between the secure access client and an RDP service;
opening a file via the RDP session including displaying, by the secure access client, contents of the file to a user of the computing device;
in conjunction with opening the file, identifying, by the secure access client, one or more access limitations defined for the file, the one or more access limitations comprising a copy limitation;
while the file is open, identifying, by the secure access client, that the user has provided input to the computing device that has initiated an action that if completed would violate the one or more access limitations defined for the file; and
preventing, by the secure access client, the action from being completed by selectively failing to implement functionality of a virtual channel extension of the RDP session thereby ensuring that the one or more access limitations defined for the file are not violated;
wherein selectively failing to implement functionality of the virtual channel extension of the RDP session comprises failing to synchronize contents of a clipboard in an RDP session environment to a clipboard of the computing device.
14. The computer storage media of claim 13 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: Clipboard Virtual Channel Extension such that the secure access client selectively implements the RDP: Clipboard Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
15. The computer storage media of claim 13 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: File System Virtual Channel Extension such that the secure access client selectively implements the RDP: File System Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
16. The computer storage media of claim 13 , wherein implementing functionality of the virtual channel extension of the RDP session comprises implementing the RDP: Print Virtual Channel Extension such that the secure access client selectively implements the RDP: Print Virtual Channel Extension on a per file basis depending on the access limitations defined for the particular file.
17. A system comprising:
one or more processors; and
computer storage media storing computer executable instructions which when executed by the one or more processors implement a method for applying access limitations on a per file basis, the method comprising:
executing, within a browser sandbox on a computing device, a secure access client that implements a remote display protocol (RDP) client;
establishing an RDP session between the secure access client and an RDP service;
opening a file via the RDP session including displaying, by the secure access client, contents of the file to a user of the computing device;
in conjunction with opening the file, identifying, by the secure access client, one or more access limitations defined for the file, the one or more access limitations comprising a copy limitation;
while the file is open, identifying, by the secure access client, that the user has provided input to the computing device that has initiated an action that if completed would violate the one or more access limitations defined for the file; and
preventing, by the secure access client, the action from being completed by selectively failing to implement functionality of a virtual channel extension of the RDP session thereby ensuring that the one or more access limitations defined for the file are not violated;
wherein selectively failing to implement functionality of the virtual channel extension of the RDP session comprises failing to synchronize contents of a clipboard in an RDP session environment to a clipboard of the computing device.
18. The system of claim 17 , wherein the access limitations that are selectively enforced also include one or more of save access or print access.
19. The system of claim 17 , wherein the virtual channel extension comprises one of:
the RDP: Clipboard Virtual Channel Extension;
the RDP: Print Virtual Channel Extension; or
the RDP: File System Virtual Channel Extension.