Mobile posture-based policy, remediation and access control for enterprise resources

• US 10,171,648 B2
• Filed: 09/11/2014
• Issued: 01/01/2019
• Est. Priority Date: 11/19/2010
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Broch, Joshua Glenn, Singamsetty, Ratnarekha, Lindeman, Jesse Wagner, Batchu, Suresh Kumar
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Malinowski, Walter J
• Application Number:
  US14/484,159
• Publication Number:
  US 20150133082A1
• Time in Patent Office: 1,573 Days
• Field of Search: 726 4, 726 30, 709225, 709223
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04M 1/72463 to restrict the functionality of the device
• CPC Class Codes: H04M 1/724631 by limiting the access to the user interface, e.g. locking a touch-screen or a keypad
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

A mobile device management system that monitors the security state of one or more mobile devices and sets indicators related to such security state. Enterprise network applications, such as an email application, can access the security state information when making access control decisions with respect to a given mobile device.

Claims

1. A computer-implemented method, comprising:

receiving at a remote management device, from a control agent installed on a mobile device, information indicating that a new application has been installed on the mobile device;

determining at the remote management device, at least in part by applying one or more policies, that the new application is not a recognized application; and

responsive to the determination that the new application is not a recognized application, setting a security state of the mobile device in a table, wherein the table is stored at the remote management device,

consulting, by an intermediate node, the table to determine the security state of the mobile device;

denying, by the intermediate node, access of the mobile device to a network application service based on the security state of the mobile device in the table; and

permitting mobile device traffic that identifies a port that corresponds to an authorized application;

accepting or rejecting, by an enterprise application of the mobile device, requests of the mobile device based on the security state of the mobile device in the table, in response to the enterprise application of the mobile device accessing the security state of the mobile device in the table;

causing, by the intermediate node, the new application to be blocked from launching on the mobile device; and

updating a security state information of the mobile device in the table based on the determination that the new application is not a recognized application when access is denied.

2. The method of claim 1, further comprising transmitting a command to the control agent installed on the mobile device, the command operative to cause the control agent to delete one or more files on the mobile device.

3. The method of claim 1, further comprising transmitting one or more notifications if the new application is not recognized.

4. The method of claim 1, further comprising updating a security state table based at least in part on the determination that the new application is not a recognized application.

5. The method of claim 1, wherein the intermediate node is configured to block traffic from the mobile device to the network application service based on the updated security state information.

6. The method of claim 1, wherein the intermediate node is configured to consult the security state information of the mobile device to determine a current security state of the mobile device, and to filter traffic associated with the mobile device based at least in part on the current security state of the mobile device.

7. The method of claim 6, wherein the network application service to which access is blocked comprises a first network application service, and the intermediate node is configured to allow access by the mobile device to a second network application service.

8. A mobile device management system, comprising:

a communication interface; and

a hardware processor coupled to the communication interface and configured to;

receive via the communication interface, from a control agent installed on a mobile device, information indicating that a new application has been installed on the mobile device;

determine, at least in part by applying one or more policies, that the new application is not a recognized application; and

responsive to the determination that the new application is not a recognized application, setting a security state of the mobile device in a table, wherein the table is stored at a remote management device,

consult, by an intermediate node, the table to determine the security state of the mobile device;

deny, by the intermediate node, access of the mobile device to a network application service based on the security state of the mobile device in the table; and

permit mobile device traffic that identifies a port that corresponds to an authorized application;

cause, by the intermediate node, the new application to be blocked from launching on the mobile device; and

update a security state information of the mobile device in the table based on the determination that the new application is not a recognized application when access is denied

wherein in response to an enterprise application of the mobile device accessing the security state of the mobile device in the table, the enterprise application of the mobile device is configured to accept or reject requests of the mobile device based on the security state of the mobile device in the table.

9. The system of claim 8, wherein the hardware processor is further configured to transmit a command to the control agent installed on the mobile device, the command operative to cause the control agent to delete one or more files on the mobile device.

10. The system of claim 8, wherein the hardware processor is further configured to transmit one or more notifications if the new application is not recognized.

11. The system of claim 8, wherein the hardware processor is further configured to update the security state in the table based at least in part on the determination that the new application is not a recognized application.

12. The system of claim 8, wherein the intermediate node is configured to block traffic from the mobile device to the network application service based on the updated security state information.

13. The system of claim 8, wherein the intermediate node is configured to consult the security state information of the mobile device to determine a current security state of the mobile device, and to filter traffic associated with the mobile device based at least in part on the current security state of the mobile device.

14. A computer program product to manage mobile devices,

the computer program product being embodied in a tangible, non-transitory computer readable storage medium, and comprising computer instructions for:

receiving, from a control agent installed on a mobile device, information indicating that a new application has been installed on the mobile device;

determining, at least in part by applying one or more policies, that the new application is not a recognized application; and

responsive to the determination that the new application is not a recognized application, setting a security state of the mobile device in a table, wherein the table is stored at a remote management device,

consulting, by an intermediate node, the table to determine the security state of the mobile device;

denying, by the intermediate node, access of the mobile device to a network application service based on the security state of the mobile device in the table; and

permitting mobile device traffic that identifies a port that corresponds to an authorized application;

accepting or rejecting, by an enterprise application of the mobile device, requests of the mobile device based on the security state of the mobile device in the table, in response to the enterprise application of the mobile device accessing the security state of the mobile device in the table;

causing, by the intermediate node, the new application to be blocked from launching on the mobile device; and

updating a security state information of the mobile device in the table based on the determination that the new application is not a recognized application when access is denied.