System and methods for controlling access to applications using cross-jurisdiction workload control
At design time, cross-jurisdiction workload controls may be presented by a process platform server to a user (e.g., a workload creator or process builder) who is using the process platform to create or update an application having a workload functionality with zero, one, or more applicable regulation controls. If no regulation control is selected, or if there is no exception provided, the process platform server may operate to block the user from proceeding to complete the workload creation process. The application with the workload thus created/updated is delivered to end user(s). Responsive to a user request to open the application on a client device, a server (the process platform server or an application gateway server) may operate to automatically determine whether a target location associated with the user request is permitted in accordance with a cross-jurisdiction workload control associated the workload defined in the application.
1. A method for cross-jurisdictional workload control enforcement, the method comprising:
receiving, by a server computer through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining, by the server computer, whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining, by the server computer, a policy that applies to the application and the user;
determining, by the server computer, whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, by the server computer based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.
2. The method according to claim 1 , wherein the server computer comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.
3. The method according to claim 1 , wherein the server computer is part of the integrated computing platform operating in the computer network environment.
4. The method according to claim 1 , further comprising:
detecting whether the user device has moved from a private address to a public address, wherein the approving or the denying is performed further based on whether the user device has moved from the private network address to the public network address.
5. The method according to claim 1 , wherein the approving further comprises delivering the application with the workload to the user device.
6. The method according to claim 1 , wherein the denying further comprises notifying the user that the location where the user device is located is not supported by the integrated computing platform.
7. The method according to claim 1 , further comprising:
generating an audit entry to log the approving or the denying.
8. A system for cross-jurisdictional workload control enforcement, the system comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
receiving, through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining a policy that applies to the application and the user;
determining whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.
9. The system of claim 8 , wherein the system comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.
10. The system of claim 8 , wherein the system is part of the integrated computing platform operating in the computer network environment.
11. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
detecting whether the user device has moved from a private address to a public address, wherein the approving or the denying is performed further based on whether the user device has moved from the private network address to the public network address.
12. The system of claim 8 , wherein the approving further comprises delivering the application with the workload to the user device.
13. The system of claim 8 , wherein the denying further comprises notifying the user that the location where the user device is located is not supported by the integrated computing platform.
14. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
generating an audit entry to log the approving or the denying.
15. A computer program product for cross-jurisdictional workload control enforcement, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a server computer for:
receiving, through a user device, a request from a user to open an application hosted on an integrated computing platform operating in a computer network environment, the application having a workload functionality through which a workload is assigned to a group of users including the user, the workload having a cross-jurisdictional workload control, the integrated computing platform integrating processes in the computer network environment, the request including geographical information, the geographical information including a location where the user device is located;
responsive to the request to open the application, determining whether the location is permitted in accordance with the cross-jurisdiction workload control associated with the workload;
determining a policy that applies to the application and the user;
determining whether the user is permitted, per the policy, to open the application on the user device at the location; and
approving or denying, based at least on one of the cross-jurisdiction workload control associated with the workload or the policy that applies to the application and the user, the request from the user to open the application on the user device at the location; and
allowing or denying the user access to specifically open the application according to the approving or denying of the request.
16. The computer program product of claim 15 , wherein the server computer comprises an application gateway server and wherein the request is received from the user device through client software of the application gateway server.
17. The computer program product of claim 15 , wherein the server computer is part of the integrated computing platform operating in the computer network environment.
18. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
detecting whether the user device has moved from a private address to a public address, wherein the approving or the denying is performed further based on whether the user device has moved from the private network address to the public network address.
19. The computer program product of claim 15 , wherein the approving further comprises delivering the application with the workload to the user device and wherein the denying further comprises notifying the user that the location where the user device is located is not supported by the integrated computing platform.
20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
generating an audit entry to log the approving or the denying.