Application gateway architecture with multi-level security policy and rule promulgations

A method, comprising:

• receiving an application from an application gateway server computer communicatively connected to an application repository, backend systems, and client devices, the application gateway server computer configured for providing the backend systems with a policy-based content control mechanism for managing applications that communicate with the backend systems and content that are managed by the backend systems and that have been downloaded or pushed to managed containers operating on the client devices, the policy-based content control mechanism comprising rules that govern the applications that communicate with the backend systems and the content managed by the backend systems, the receiving performed by a managed container downloaded from a source on the Internet and operating on a client device, the managed container embodied on a non-transitory computer readable medium of the client device, the application gateway server computer and the application repository operating at a layer between the backend systems and the client devices, wherein the application gateway server computer is configured for determining which managed containers operating on the client devices store content that is subject to a policy or rule that has been updated by a backend system of the backend systems and for notifying those managed containers of a change to the policy or rule;
• receiving, by the managed container on the client device, a notice from the application gateway server computer concerning a rule set of the rules that governs an application of the applications that communicate with the backend systems, the application received or downloaded by the managed container from the application gateway server computer and stored in a managed cache of the managed container;
• sending a connection request to the application gateway server computer, the connection request identifying and authenticating the managed container to the application gateway server computer;
• retrieving, by the managed container on the client device, from the backend system of the backend systems via the application gateway server computer over the connection, the rule set that governs the application received or downloaded by the managed container from the application gateway server computer, wherein the rule set includes at least one of:
• a rule controlling storage of data associated with the application,
• a rule controlling access to data associated with the application, or
• a rule controlling update of data associated with the application;
• providing, by the managed container on the client device, a secure shell for the application received or downloaded by the managed container from the application gateway server computer, the application configured for communicating with the backend system of the backend systems through the secure shell provided by the managed container;
• and
• controlling, by the managed container on the client device, the application and any data associated with the application stored in the managed cache of the managed container on the client device the controlling comprising applying the rule set propagated from the backend system to the managed container on the client device through the application gateway server computer such that the application is remotely managed on the client device via the policy-based content control mechanism without having to go through any intermediary entity,
• wherein the managed container performs:
• receiving a notice from the application gateway server computer concerning a new rule, a new policy, or a change to a policy or rule that governs content managed by the backend system of the backend systems and stored in the managed cache of the managed container;
• responsive to the notice, initiating a connection with the application gateway server computer;
• retrieving the new rule, the new policy, or the change to the policy or rule from the application gateway server computer over the connection;
• and
• applying the new rule, the new policy, or the change to the policy or rule to the content managed by the backend system of the backend systems and stored in the managed cache of the managed container on the client device such that the policy-based content control mechanism is extended to the managed container on the client device.

A computer program product comprising a non-transitory computer-readable medium storing instructions, the instructions when translated by a processor of a user device implement a managed container downloaded from a source on the Internet, the managed container having a managed cache and configured for:

• receiving an application from an application gateway server computer communicatively connected to an application repository, backend systems, and user devices, the application gateway server computer configured for providing the backend systems with a policy-based content control mechanism for managing applications that communicate with the backend systems and content that are managed by the backend systems and that have been downloaded or pushed to managed containers operating on the user devices, the policy-based content control mechanism comprising rules that govern the applications that communicate with the backend systems and the content managed by the backend systems, the application gateway server computer and the application repository operating at a layer between the backend systems and the client devices, wherein the application gateway server computer is configured for determining which managed containers operating on the client devices store content that is subject to a policy or rule that has been updated by a backend system of the backend systems and for notifying those managed containers of a change to the policy or rule;
• receiving a notice from the application gateway server computer concerning a rule set of the rules that governs an application of the applications that communicate with the backend systems, the application received or downloaded by the managed container from the application gateway server computer and stored in the managed cache of the managed container;
• sending a connection request to the application gateway server computer, the connection request identifying and authenticating the managed container to the application gateway server computer;
• retrieving, from the backend system of the backend systems via the application gateway server computer over the connection, the rule set that governs the application received or downloaded by the managed container from the application gateway server computer, wherein the rule set includes at least one of:
• a rule controlling storage of data associated with the application,
• a rule controlling access to data associated with the application, or
• a rule controlling update of data associated with the application;
• providing a secure shell for the application received or downloaded by the managed container from the application gateway server computer, the application configured for communicating with the backend system of the backend systems through the secure shell provided by the managed container;
• and
• controlling the application and any data associated with the application stored in the managed cache of the managed container on the user device, the controlling comprising applying the rule set propagated from the backend system to the managed container on the client device through the application gateway server computer such that the application is remotely managed on the client device via the policy-based content control mechanism without having to go through any intermediary entity,
• wherein the managed container performs:
• receiving a notice from the application gateway server computer concerning a new rule, a new policy, or a change to a policy or rule that governs content stored in the managed cache of the managed container;
• responsive to the notice, initiating a connection with the application gateway server computer;
• retrieving the new rule, the new policy, or the change to the policy or rule from the application gateway server computer over the connection;
• and
• applying the new rule, the new policy, or the change to the policy or rule to the content managed by the backend system of the backend systems and stored in the managed cache of the managed container on the client device such that the policy-based content control mechanism is extended to the managed container on the client device.