FIELD OF THE DISCLOSURE

The present application generally relates to management of applications, including but not limited to systems and methods for using an embedded browser to manage and monitor web and software-as-a-service (SaaS) applications.

BACKGROUND

As the workforce of an enterprise becomes more mobile and work under various conditions, an individual can use one or more client devices, including personal devices, to access network resources such as web applications. Due to differences between the client devices and the manner in which network resources can be accessed, there are significant challenges to the enterprise in managing access to network resources and monitoring for potential misuse of resources.

In many implementations of Software-as-a-Service (SaaS) applications, client devices must be continuously connected to application servers to allow users to interact with the SaaS application, preventing the user from being able to work offline, such as when travelling or with poor or intermittent connectivity. Even in implementations in which some or all of the network application may be cached locally to provide offline use, users may be limited to specific portions of the application or functions, or may be limited in the data they may access. Furthermore, caching of data for offline use may represent a significant security vulnerability. While the user may initially provide authentication credentials and achieve authenticated access to the network application or data, once offline, the user typically has unimpeded access to the cached data. A malicious actor that obtains access to the client device, either locally or via a network, may be able to access the cached data.

BRIEF SUMMARY

The present disclosure provides methods for storing, accessing, and synchronizing data from a SaaS application, enabling SaaS data to be interacted with, regardless of connectivity, while providing secure authentication when offline. During a first time period when online, a user may perform an authentication procedure and provide credentials to an application server, which may provide an authentication token for access to secure data or applications. In some implementations, the authentication token may comprise a shared encryption key or other cryptographic key for decrypting provided data. The authentication token and user credentials may be cached locally. During a second time period when offline or when experiencing intermittent connectivity, a client application on the client device comprising an embedded browser for accessing the network application may act as a local authentication server: the user may provide authentication credentials to the network application. If the credentials match the previously provided and cached credentials, then the client application may retrieve the cached authentication token and allow the embedded browser to resume utilizing the network application and/or data; while if the new credentials do not match the previously provided and cached credentials, access may be denied. To prevent brute-force attacks, the locally cached credentials and/or token may be expired or deleted after a predetermined time period.

The embedded browser and cached version of the network application may continue to operate normally in such implementations. For example, the embedded browser may display a typical log-in window in which the user may provide credentials, and may attempt to transmit the credentials to an authentication server or application server. While online, the client application may allow the transmission to proceed and/or may forward the transmission to the application server or authentication server. While offline, the client application may intercept the transmission and perform the comparison to locally cached credentials. Thus, the embedded browser may perform authentication agnostic to whether the device is online or offline at that time, requiring no changes to the browser or network application.

In one aspect, this disclosure is directed to a method for providing authenticated access to an offline application. The method includes transmitting authentication credentials of a user to a network application executed by one or more application servers, by an embedded browser of a client application executed by a client device. The method also includes receiving, by the client application from the one or more application servers, an authentication token responsive to authorization of the client device by the network application based on the authentication credentials. The method also includes storing the authentication credentials in a memory of the client device, by the client application. The method also includes storing the authentication token in the memory of the client device, by the client application. The method also includes accessing data of the network application provided by the one or more application servers, by the embedded browser, using the authentication token. The method also includes storing the accessed data of the network application in the memory of the client device, by the client application. The method also includes, during a subsequent time period during which the client device is not in communication with the one or more application servers: intercepting a transmission by the embedded browser of second authentication credentials, by the client application, responsive to a determination that the client device is not in communication with the one or more application servers; determining, by the client application, that the second authentication credentials correspond to the authentication credentials stored in the memory of the client device; and retrieving, from the memory of the client device, by the client application, the authentication token, responsive to the determination that the second authentication credentials correspond to the authentication credentials stored in the memory of the client device. The method also includes accessing the data of the network application stored in the memory of the client device, by the embedded browser, using the authentication token.

In some implementations, the method includes determining, by the client application, that a token validity time of the authentication token stored in the memory of the client device has not expired; and retrieving the authentication token, by the client application, responsive to the determination that the token validity time has not expired. In a further implementation, the method includes receiving a token validity time for the authentication token, from the one or more application servers; and initiating a timer corresponding to the token validity time, by the client application. In another further implementation, the method includes determining, by the client application, that the token validity time of the authentication token stored in the memory of the client device has expired; and removing the authentication token from the memory of the client device, by the client application, responsive to the determination that the token validity time has expired.

In some implementations, the method includes decrypting the data, using the authentication token, by the client application. In some implementations, the method includes accessing data of the network application associated with the user, by the embedded browser. In a further implementation, the embedded browser decrypts the data associated with the user via the authentication token.

In another aspect, the present disclosure is directed to a method for synchronizing an offline and online version of a Software as a Service application. The method includes providing data of a network application in a first state, by one or more application servers to an embedded browser of a client application executed by a client computing device. The method also includes receiving a subsequent recorded sequence of user interactions with a cached version of the network application provided via the embedded browser and stored in a memory of the client computing device, by the one or more application servers from the client computing device, upon reestablishment of a communication session with the client computing device after loss of communications with the client computing device, the sequence of user interactions recorded by the client application during the period of lost communications, the sequence of user interactions modifying data of the cached version of the network application from the first state to a second state. The method also includes executing the recorded sequence of user interactions, by the one or more application servers transparently to the client computing device, to modify data of the network application stored in a storage device of the one or more servers from the first state to the second state; and providing updated data of the network application in the second state to the embedded browser of the client application, by the one or more application servers.

In some implementations, the method includes providing a first item of data of the network application requested by the embedded browser, and providing a second item of data of the network application, not requested by the embedded browser, to the client application for storage in the memory of the client computing device. In a further implementation, the second item of data is provided responsive to receipt of a request from the client application, by the one or more application servers, for the second item of data, the client application selecting the second item of data without user intervention. In another further implementation, the first item of data comprises a first page of a web application and the second item of data comprises a second page of the web application linked from the first page. In still another further implementation, the method includes receiving an authentication credential of a user, from the embedded browser, by one or more application servers; and the second item of data is selected from a subset of data of the network application associated with the authentication credential of the user. In some implementations, the method includes executing the recorded sequence, by the one or more application servers, faster than real time and without providing visual output to the embedded browser of the client application.

In another aspect, the present disclosure is directed to a method for providing synchronized offline and online access to a web application. The method includes receiving data of a network application in a first state, by an embedded browser of a client application executed by a client computing device from one or more application servers. The method also includes storing, by the client application in a memory of the client computing device, the received data of the network application the first state. The method also includes subsequently determining, by the client application, that the client computing device is not in communication with the one or more application servers. The method also includes, responsive to the determination that the client computing device is not in communication with the one or more application servers, for each of at least one user interaction with the network application provided via the embedded browser modifying the data of the network application from the first state to a second state: intercepting, by the client application, the user interaction with the network application provided via the embedded browser; redirecting the user interaction to the stored data of the network application in the memory of the client computing device; and aggregating the user interaction into a recorded sequence of user interactions, by the client application. The method also includes subsequently determining, by the client application, that communications have been reestablished with the one or more application servers; and responsive to the determination that communications have been reestablished with the one or more application servers, providing the recorded sequence of user interactions to the one or more application servers, by the client application, receipt of the recorded sequence of user interactions causing the one or more application servers to execute the recorded sequence of user interactions to modify data of the network application stored in a storage device of the one or more servers from the first state to the second state.

In some implementations, the method includes requesting a first item of data of the network application, by the embedded browser from the one or more application servers; and receiving a second item of data of the network application not requested by the embedded browser, by the client application from the one or more application servers.

In a further implementation, the method includes requesting the second item of data, by the client application without user intervention, responsive to requesting the first item of data by the embedded browser. In a still further implementation, the method includes selecting the second item of data from a set of data previously requested by the embedded browser, by the client application. In another still further implementation, the first item of data comprises a first page of a web application, the second item of data comprises a second page linked from the first page of the web application, and the method further includes: iteratively storing a number of additional pages of the web application, linked from a previously stored page of the web application, the number of iterations determined by the client application from a history of requests for data of the network application by the embedded browser. In another further implementation, the method includes identifying, by the client application from a history of requests for data of the network application by the embedded browser, an amount of data likely to be accessed while offline; and requesting the second item of data responsive to determining that an amount of data of the network application stored in the memory of the client computing device is less than the identified amount of data likely to be accessed while offline.

In some implementations, the method includes providing an authentication credential of a user, by the embedded browser, to the one or more application servers; receiving an authentication token, by the embedded browser from the one or more application servers, responsive to successful authentication, the authentication token used to access the data of the network application; and storing the authentication token, by the client application; and redirecting each user interaction of the at least one user interaction to the stored data of the network application in the memory of the client computing device further comprises using the authentication token stored by the client application to access the stored data of the network application.

