# US 12,120,077 B2 · Systems and methods for controlling email access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,077 B2 - Document ID: US12120077B2 - Status: Granted - Kind: B2 - Application number: 16/867,780 - Filed: 2020-05-06 - Published: 2020-08-20 - Granted: 2024-10-15 - Earliest claimed: 2012-12-06 - Assignees: Omnissa, LLC - Applicants: AirWatch LLC - Inventors: Erich Stuntebeck - Web page: https://patentgrep.com/patent/US12120077B2 ## CPC - H04L 51/212: using filtering or selective blocking - G06Q 10/107: Computer-aided management of electronic mailing [e-mailing] - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Embodiments of the disclosure relate to proxying at least one email resource from at least one email service to at least one client device, determining whether the email resources are accessible to the client devices via at least one unauthorized application on the client devices, and modifying the email resources to be inaccessible via the unauthorized applications on the client devices in response to a determination that the email resources are accessible via the unauthorized applications on the client devices. ## Claims ### Claim 1 A method performed by an access control server to manage a client device's access to content associated with email messages provided by an email server, the access control server being configured to execute as a proxy between the email server and the client device for the email messages, the method comprising: obtaining from the email server, an email message for transmission to the client device; determining according to at least one resource rule including an access-type resource rule, to restrict the client device's access to the obtained email message based on a presence of an unauthorized application running on the client device that can access email messages transmitted to the client device; in response to determining to restrict the client device's access, encrypting at least a portion of the obtained email message to generate a modified email message, the at least a portion of the obtained email message comprising a body of the obtained email message, wherein an authorized application on the client device has a cryptographic key for decrypting the modified email message, the cryptographic key being inaccessible to the unauthorized application; and transmitting the modified email message to the client device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: transmitting the cryptographic key to the authorized application to enable the authorized application to decrypt the modified email message. ### Claim 3 (depends on 1) The method of claim 1, wherein the at least one resource rule includes a content-type resource rule, the method further comprising: determining that text specified by the content-type resource rule is included in the obtained email message; and based on determining that the specified text is included, transmitting the modified email message to the client device using a secure transmission protocol. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one resource rule specifies as a credential for accessing the modified email message: a domain, a username, or an email address. ### Claim 5 (depends on 1) The method of claim 1, wherein the at least a portion of the obtained email message further comprises an email attachment, the method further comprising: encrypting the email attachment from the obtained email message to generate a modified attachment; and including the modified attachment as an attachment to the modified email message transmitted to the client device. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one resource rule includes a format-type resource rule specifying an encoding format, and wherein based on the format-type resource rule, the at least a portion of the obtained email message is encrypted according to the encoding format. ### Claim 7 (depends on 1) The method of claim 1, wherein the at least one resource rule includes an attachment-type resource rule, the method further comprising: based on the attachment-type resource rule, stripping an attachment from the obtained email message before generating the modified email message from the obtained email message. ### Claim 8 A non-transitory computer-readable medium comprising a program which, when executed by a processor of an access control server that is configured to execute as a proxy between an email server and a client device that accesses content associated with email messages provided by the email server, causes the processor to at least: obtain from the email server, an email message for transmission to the client device; determine according to at least one resource rule including an access-type resource rule, to restrict the client device's access to the obtained email message based on a presence of an unauthorized application running on the client device that can access email messages transmitted to the client device; in response to determining to restrict the client device's access, encrypt at least a portion of the obtained email message to generate a modified email message, the at least a portion of the obtained email message comprising a body of the obtained email message, wherein an authorized application on the client device has a cryptographic key for decrypting the modified email message, the cryptographic key being inaccessible to the unauthorized application; and transmit the modified email message to the client device. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the program, when executed by the processor, further causes the processor to at least: transmit the cryptographic key to the authorized application to enable the authorized application to decrypt the modified email message. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the at least one resource rule includes a content-type resource rule, and wherein the program, when executed by the processor, further causes the processor to at least: determine that text specified by the content-type resource rule is included in the obtained email message; and based on determining that the specified text is included, transmit the modified email message to the client device using a secure transmission protocol. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the at least one resource rule specifies as a credential for accessing the modified email message: a domain, a username, or an email address. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the at least a portion of the obtained email message further comprises an email attachment, and wherein the program, when executed by the processor, further causes the processor to at least: encrypt the email attachment from the obtained email message to generate a modified attachment; and include the modified attachment as an attachment to the modified email message transmitted to the client device. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the at least one resource rule includes a format-type resource rule specifying an encoding format, and wherein based on the format-type resource rule, the at least a portion of the obtained email message is encrypted according to the encoding format. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the at least one resource rule includes an attachment-type resource rule, and wherein the program, when executed by the processor, further causes the processor to at least: based on the attachment-type resource rule, strip an attachment from the obtained email message before generating the modified email message from the obtained email message. ### Claim 15 An access control server configured to execute as a proxy between an email server and a client device that accesses content associated with email messages provided by the email server, wherein the access control server includes a processor configured to execute instructions from a non-transitory computer-readable medium to at least: obtain from the email server, an email message for transmission to the client device; determine according to at least one resource rule including an access-type resource rule, to restrict the client device's access to the obtained email message based on a presence of an unauthorized application running on the client device that can access email messages transmitted to the client device; in response to determining to restrict the client device's access, encrypt at least a portion of the obtained email message to generate a modified email message, the at least a portion of the obtained email message comprising a body of the obtained email message, wherein an authorized application on the client device has a cryptographic key for decrypting the modified email message, the cryptographic key being inaccessible to the unauthorized application; and transmit the modified email message to the client device. ### Claim 16 (depends on 15) The access control server of claim 15, wherein the processor is further configured to execute the instructions from the non-transitory computer-readable medium to at least: transmit the cryptographic key to the authorized application to enable the authorized application to decrypt the modified email message. ### Claim 17 (depends on 15) The access control server of claim 15, wherein the at least one resource rule includes a content-type resource rule, and wherein the processor is further configured to execute the instructions from the non-transitory computer-readable medium to at least: determine that text specified by the content-type resource rule is included in the obtained email message; and based on determining that the specified text is included, transmit the modified email message to the client device using a secure transmission protocol. ### Claim 18 (depends on 15) The access control server of claim 15, wherein the at least a portion of the obtained email message further comprises an email attachment, and wherein the processor is further configured to execute the instructions from the non-transitory computer-readable medium to at least: encrypt the email attachment from the obtained email message to generate a modified attachment; and include the modified attachment as an attachment to the modified email message transmitted to the client device. ### Claim 19 (depends on 15) The access control server of claim 15, wherein the at least one resource rule includes a format-type resource rule specifying an encoding format, and wherein based on the format-type resource rule, the at least a portion of the obtained email message is encrypted according to the encoding format. ### Claim 20 (depends on 15) The access control server of claim 15, wherein the at least one resource rule includes an attachment-type resource rule, and wherein the processor is further configured to execute the instructions from the non-transitory computer-readable medium to at least: based on the attachment-type resource rule, strip an attachment from the obtained email message before generating the modified email message from the obtained email message.