Unified enterprise management of wireless devices in a controlled environment

• US 10,205,727 B2
• Filed: 08/03/2017
• Issued: 02/12/2019
• Est. Priority Date: 04/28/2017
• Status: Active Grant

• Current Assignee: Global Tel-Link Corporation
• Original Assignee: Global Tel-Link Corporation
• Inventors: Hodge, Stephen L.
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US15/668,496
• Publication Number:
  US 20180316675A1
• Time in Patent Office: 558 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A wireless device enterprise management system and a method for operating the management system in a controlled environment is disclosed. The enterprise management system includes implementing a container-based file system on wireless devices within the controlled environment. Enterprise management system manages and controls the organization of files into one or more containers on each wireless device. Each container is associated with one or more execution rules that allow or restrict execution of files that are located in the container.

Claims

1. An enterprise management system for managing a wireless device in a controlled environment, comprising:

a memory; and

a processor coupled to the memory, the processor configured to;

transmit a client control subsystem for installation on the wireless device, wherein the client control subsystem is configured to analyze files stored on the wireless device, wherein the files include a first file that is banned by the controlled environment and a second file that is allowed by the controlled environment;

generate configuration information, wherein the configuration information comprises a profile associated with a user in the controlled environment, the first file that is banned by the controlled environment, the second file that is allowed by the controlled environment, a first execution rule associated with a first container, the first execution rule specifying a first condition regarding executing the first file by the wireless device, and a second execution rule associated with a second container, the second execution rule specifying a second condition regarding executing the second file by the wireless device, wherein the profile specifies user content that can be accessed by the user and an access privilege of the user, the user content including at least one the first file and the second file, the access privilege controlling access to the user content by the user; and

transmit the configuration information to the wireless device, wherein the client control subsystem after being installed on the wireless device creates the first container and the second container on the wireless device based on the configuration information.

2. The enterprise management system of claim 1, wherein the processor is further configured to:

receive, from the wireless device, a request to access a network of the controlled environment;

parse the request to identify a container associated with the request, wherein the container is one of the first container or the second container;

identify the execution rule associated with the container, wherein the execution rule is one of the first execution rule or the second execution rule; and

determine whether to allow the request based at least on the execution rule associated with the container.

3. The enterprise management system of claim 1, wherein the execution rule is configured to instruct the wireless device to create a container on the wireless device.

4. The enterprise management system of claim 3, wherein the condition comprises a time-based restriction or a usage-based restriction regarding the execution of a file located within the container on the wireless device.

5. The enterprise management system of claim 1, wherein the configuration information identifies the first file or the second file as being banned from execution by the controlled environment.

6. The enterprise management system of claim 1, wherein the processor is further configured to:

receive a communication from the wireless device, the communication comprising a tag identifying at least one of the first execution rule or the second execution rule; and

perform a verification that the communication complies with the identified first execution rule or the identified second execution rule.

7. The enterprise management system of claim 6, wherein the processor is further configured to:

allow transmission of the communication based on the verification.

8. A method for configuring a wireless device within a controlled environment, comprising:

transmitting a client control subsystem for installation on the wireless device, wherein the client control subsystem is configured to analyze files stored on the wireless device, wherein the files include a first file that is banned by the controlled environment and a second file that is allowed by the controlled environment;

generating configuration information, wherein the configuration information comprises a first file that is banned by the controlled environment, a second file that is allowed by the controlled environment, a first execution rule associated with a first container, the first execution rule specifying a first condition regarding executing the first file by the wireless device, and a second execution rule associated with the first container, the second execution rule specifying a second condition regarding executing the second file by the wireless device, wherein the first execution rule is configured to generate a first file system in the first container, and the second execution rule is configured to generate a second file system in the first container;

transmitting the configuration information to the wireless device, wherein the client control subsystem after being installed on the wireless device creates the first container and the second container on the wireless device based on the configuration information.

9. The method of claim 8, further comprising:

receiving, from the wireless device, a request to access a network of the controlled environment;

parsing the request to identify a container associated with the request, wherein the container is the first container;

identifying the execution rule associated with the container, wherein the execution rule is one of the first execution rule or the second execution rule; and

determining whether to allow the request based at least on the execution rule associated with the container.

10. The method of claim 8, wherein the execution rule is configured to instruct the wireless device to create a container on the wireless device.

11. The method of claim 10, wherein the condition comprises a time-based restriction or a usage-based restriction regarding the execution of a file located within the container on the wireless device.

12. The method of claim 8, wherein the configuration information identifies the first file or the second file as being banned from execution by the controlled environment.

13. The method of claim 8, further comprising:

receiving a communication from the wireless device, the communication comprising a tag identifying at least one of the first execution rule or the second execution rule; and

verifying that the communication complies with the identified first execution rule or the identified second execution rule.

14. The method of claim 13, further comprising:

allowing transmission of the communication based on the verification.

15. A non-transitory computer-readable medium having instructions stored therein, which when executed by a processor in an electronic device cause the processor to perform operations, the operations comprising:

transmitting a client control subsystem for installation on the wireless device, wherein the client control subsystem is configured to analyze files stored on the wireless device, wherein the files include a first file that is banned by the controlled environment and a second file that is allowed by the controlled environment;

generating configuration information, wherein the configuration information comprises a profile associated with a user in the controlled environment, a first file that is banned by the controlled environment, a second file that is allowed by the controlled environment, a first execution rule associated with a first container, the first execution rule specifying a first condition regarding executing the first file by the wireless device, and a second execution rule associated with a second container, the second execution rule specifying a second condition regarding executing the second file by the wireless device, wherein the profile specifies user content that can be accessed by the user and an access privilege of the user, the user content including at least one the first file and the second file, the access privilege controlling access to the user content by the user; and

transmitting the configuration information to the wireless device, wherein the client control subsystem after being installed on the wireless device creates the first container and the second container on the wireless device based on the configuration information.

16. The non-transitory computer-readable medium of claim 15, the operations further comprising:

receiving, from the wireless device, a request to access a network of the controlled environment;

parsing the request to identify a container associated with the request, wherein the container is one of the first container or the second container;

identifying the execution rule associated with the container, wherein the execution rule is one of the first execution rule or the second execution rule; and

determining whether to allow the request based at least on the execution rule associated with the container.

17. The non-transitory computer-readable medium of claim 15, wherein the execution rule is configured to instruct the wireless device to create a container on the wireless device.

18. The non-transitory computer-readable medium of claim 17, wherein the condition comprises a time-based restriction or a usage-based restriction regarding the execution of any file located within the container on the wireless device.

19. The non-transitory computer-readable medium of claim 15, wherein the configuration information identifies the first file or the second file as being banned from execution by the controlled environment.

20. The non-transitory computer-readable medium of claim 15, the operations further comprising:

receiving a communication from the wireless device, the communication comprising a tag identifying at least one of the first execution rule or the second execution rule; and

verifying that the communication complies with the identified first execution rule or the identified second execution rule.