Patent Application
20080082646
Embodiments of the present matter will be described, by way of example only, with reference to the attached figures, wherein:
For convenience, like numerals in the description refer to like structures in the drawings.
An advantage of the present matter is that it provides a method for simplifying control of access to applications available to mobile users for download in a domain. A further advantage of the present matter is that it provides a centralized location for controlling access to content by domain administrators.
A further advantage of the present matter is that it provides a fully transparent and scalable infrastructure that does not require access to the domain's database of user credentials every time a user requests download of an application.
In accordance with an embodiment of the present matter there is provided a method for controlling access to content on a network, the method comprising the steps of: associating access credentials with content to be published for download; receiving a content download request from a mobile device, the content download request including access information; matching the received access information with the published content access credentials to permit access to the published content; and allowing the permitted content to be downloaded by the mobile device.
In accordance with a further embodiment of the present matter there is provided a system for controlling access by a mobile device to content on a network, comprising: a content registry for publishing content for download from the network, the content having access credentials associated therewith; a provisioning system for pushing access information to the users device; and a discovery service for receiving a content download request from the mobile device, the content download request including the access information; and matching the received access information with the published content access credentials to permit access to the published content.
In a further embodiment, the access information includes data identifying one or more roles assigned to the user of the device within a corporate network.
In a still further embodiment the access information includes access data identifying access rights to one or more service providers within a public network.
In a still further embodiment, there is provided a provisioning service which is configured to allow the permitted content to be downloaded by the mobile device.
Referring to
The enterprise server 106 may incorporate a mobile data server (MDS) 116 for extending the functionality of the enterprise server 106 to provide a mobile workforce with access to a wide range of corporate data and applications, typically via an application gateway 117.
The application gateway 117 comprises a gateway server 118 a provisioning server 120 and a discovery server 122. The gateway server 118 acts as a message broker between a runtime environment on the wireless devices 102 and backend servers 108. The gateway server 118 is in communication with both the provisioning server 120 and the discovery server 122. The gateway server 118 is further in communication with a plurality of the backend servers 108, such as Web services 108a, database services 108b, as well as other enterprise services 108c, via a suitable link. For example, the gateway server 118 is connected with the Web services 108a and database services 108b via Simple Object Access Protocol (SOAP) and Java Database Connectivity (JDBC) respectively. Other types of backend servers 108 and their corresponding links will be apparent to a person of ordinary skill in the art.
A provisioning service 121 and a discovery service 123 are provided by the provisioning server 120 and discovery server 122, respectively.
The system 100 also includes a content repository 128 which is the repository of all the applications that are available for download and a content registry 130, which is a repository of the associated application descriptors to be published. Content management software associated with the discovery service 123 manages the repository, typically a database, and supports content versioning. Access to the repository is typically password protected. More specifically, the discovery server 122 wraps the application registry 130 with the discovery Web service 123 and allows users to search the registry 130 for applications (or application upgrades) that are available for download. Users can select these applications and deploy them to their devices 102 as will be described below. Generally, an application developer will access the application repository 128 from his or her workstation 136 to deploy new wireless applications therein. Wireless applications can be developed and deployed both internally and externally to the corporate network 107.
A domain administrator can access the application repository via the administrator workstation 134 and assign roles or access credentials to the application (based on policies). These credentials are included with the application descriptor which is stored and published in the registry 130. The registry can be part of the mobile data services on the enterprise server 106. In the corporate environment 107, users (i.e. devices) are assigned roles within the domain. The domain administrator also associates with each new application a list of roles, such that at a later stage only those applications with roles corresponding to users with the same roles will be available for download to those users.
The mobile devices 102 are typically personal digital assistants (PDAs), such as a BlackBerry™ by Research in Motion for example, but may include other devices. Each of the mobile devices 102 includes a runtime environment capable of hosting a plurality of applications, a software module or agent 104, termed a discovery application (DA), that allows the user to locate applications at a particular provisioning portal or download server on the network and to choose which applications to download. The DA may be browser-based or a native application, as long as it shares a common provisioning protocol with the download server; for example, HTTP. In addition the mobile devices 102 include secure storage for storing data, which is not visible or editable by the user. Typically this data is stored in an encrypted form.
Each mobile device 102 is initially provisioned by a device provisioning system 137 with a service book (not shown) establishing various protocols and settings, including connectivity information for the enterprise server 106 and/or the mobile data server 116. These parameters may include a Uniform Resource Locator (URL) for the application gateway server 118 as well as its encryption key. Alternatively, if the mobile device 102 is not initially provisioned with the URL and encryption key, they may be pushed to the wireless device 102 via the mobile data server 116. The mobile device 102 can then connect with the application gateway 106 via the URL of the application gateway server 118. The application gateway server 118 serves as a message broker between the runtime environment and the discovery service. Typically, the runtime environment communicates with the discovery service 123 through a search interface (not shown).
Referring to
In step 1506, the runtime environment sends a registration message to the URL specified in the service book to register itself with the application gateway 117. The registration message includes wireless device identification information and system information, such as the runtime environment version, and the like. The application gateway 117 registers the device by recording pertinent information in a lifecycle subsystem and an administration service, and acknowledges the registration message.
In step 1508, the application gateway 117 transmits a user administration profile and default component application administration profile to the runtime environment, and in step 1510 the profiles are stored by the runtime environment. The user administration profile defines end user privileges as well as user roles and domain-related settings for the wireless device 102. Once the wireless device 102 is registered with the application gateway 117, it can begin to request provisioning of applications.
In summary, the device provisioning subsystem (public/retail space) 137 or corporate mobile server (enterprise) assigns role(s) to the device user and sends/pushes this information OTA to the device as a part of “service books”. The “service books” should be pushed again when any of the user roles changes.
Referring to
In step 306 the user issues a search request including search criteria to the device 102. It is assumed that the device 102 has been previously provisioned by the device provisioning system 137 with a service book defining the appropriate roles or access rights. The discovery application on the wireless device 102 retrieves the roles or access rights, in step 308, previously stored in the device 102 and accesses the application registry 130 either directly or via the mobile proxy 112 and sends, in step 310, the search criteria including the list of roles or access rights assigned to device user at provisioning. The roles or access rights are typically not visible to and editable by the device user and retrieved directly from the secured (encrypted or signed) storage on the device. In step 312 the discovery Web service that wraps the application registry 130 matches' user roles to application access credentials and returns, in step 314, only the applications that are allowed to be accessed or provisioned to the roles assigned to the device user.
Once the wireless device 102 has received the descriptor for the application to be provisioned, the wireless device 102 can proceed to retrieve the application. Accordingly, in step 316 the device user selects one of the applications (or multiple applications if multi-install mode is supported by the device). In step 318 the device sends the selected application to the provisioning service, which loads, in step 320, the application from the application repository 128 and sends it OTA, in step 322, to the user device where the application is installed.
Referring now to
In summary, it may be seen that the present matter provides a centralized point of access control by the domain administrator in either the corporate domain or public domain. In the corporate domain, the user is assigned roles, and in the public domain, the user is assigned access rights by a specific service provider. Once the mechanism for assigning roles/access rights to the applications and pushing data defining these roles/access rights to the devices is implemented (i.e. once the device provisioning system sets up the device), the device provisioning system does not have to know how those roles or access rights are used in the future. The remaining infrastructure is fully transparent and scalable as it does not require access to user credentials each time a request for content is made by the user. The system relies on the discovery service to filter out all the applications that the user is not supposed to be able to install. Furthermore the provisioning service need simply accept the list of selected applications received from the device without having to verify the user's credentials (i.e. the provisioning service enables application installation but does not have a role in controlling what the device can install). Typically, the user roles and credentials need only be accessed by the administrator when a new or updated application is saved into the repository or when an application is removed or when user roles within a corporate network or rights associated with a specific service provider change, thus reducing administrative burden. It may be noted that the present matter is described in the context of wireless applications; however it may be appreciated that the present matter may be equally well applied to any downloadable content.
While certain features of the matter have been illustrated as described herein, many modifications, substitutions, changes and equivalents will now occur to those skilled in the art. It is, therefore, to be understood that the appended claims are intended to cover all such embodiments and changes as fall within the true spirit of the matter.
