Security certification and application categorization for mobile device management

• US 10,250,586 B2
• Filed: 12/08/2015
• Issued: 04/02/2019
• Est. Priority Date: 12/08/2015
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Brucker, Achim D., Herzberg, Michael
• Primary Examiner(s): Abedin, Shanto
• Assistant Examiner(s): Wickramasuriya, Sameera
• Application Number:
  US14/962,590
• Publication Number:
  US 20170163631A1
• Time in Patent Office: 1,211 Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/08 Access security

Abstract

Implementations for managing mobile devices associated with enterprise operations include actions of receiving a request to access information regarding a mobile application for download to and installation on a mobile device of a user, the request including an enterprise identifier, receiving a tenant-specific configuration based on the identifier, the tenant-specific configuration including criteria for mobile applications to be available for download to and installation on mobile devices associated with the enterprise, transmitting a request for a list of available mobile applications to an application and certification database, the request including the tenant-specific configuration, receiving the list of available mobile applications, which includes a subset of mobile applications of a superset of mobile applications, the subset of mobile applications being provided based on the tenant-specific configuration, and providing graphical representations of each mobile application in the list of available mobile applications for display to the user.

Claims

1. A computer-implemented method for managing mobile devices associated with enterprise operations, the method being executed using one or more processors and comprising:

receiving, by the one or more processors, a request to access information regarding at least one mobile application for download to and installation on a mobile device of a user, the request comprising an identifier associated with an enterprise, the identifier being unique to the enterprise and distinguishing the enterprise from other enterprises;

receiving, by the one or more processors, a tenant-specific configuration based on the identifier, the tenant-specific configuration comprising a plurality of criteria for mobile applications to be available for download to and installation on mobile devices associated with the enterprise, at least one of the plurality of criteria being associated with vendors of the mobile applications that are independent from the enterprise;

transmitting, by the one or more processors, a request for a list of available mobile applications to an application and certification database, the request comprising the tenant-specific configuration;

receiving, by the one or more processors, the list of available mobile applications, which comprises a subset of mobile applications of a superset of mobile applications, the subset of mobile applications being provided based on the tenant-specific configuration by using automated assessments and integrating an existing certification;

providing, by the one or more processors, graphical representations of each mobile application in the list of available mobile applications for display to the user, the graphical representations being ranked based on at least two different criteria that are selected by the user of the mobile device, the list of available mobile applications further grouped according to the at least two different criteria, at least one of the criteria being a risk of installing each mobile application; and

installing, by the one or more processors and on the mobile device of the user, a mobile application selected from the list of available mobile applications.

2. The method of claim 1, further comprising:

receiving, by the one or more processors, at least one criterion from an administrator of the enterprise, the at least one criterion defining a constraint to mobile applications that can be downloaded to and installed on mobile devices associated with the enterprise; and

providing, by the one or more processors, the tenant-specific configuration for the enterprise, the tenant-specific configuration being stored in a tenant configuration database and indexed to the enterprise based on the identifier.

3. The method of claim 1, wherein the superset of mobile applications comprises mobile applications that are available for download from an application store.

4. The method of claim 1, wherein the subset of mobile applications comprises mobile applications that are included in the superset of mobile applications, and that meet at least one criterion of the tenant-specific configuration.

5. The method of claim 1, further comprising:

receiving, by the one or more processors, a new mobile application from an application developer, the new mobile application to be included in the superset of mobile applications;

requesting, by the one or more processors, at least one certification from a third-party certification service based on the new mobile application;

receiving, by the one or more processors, the certification as a computer-readable file from the third-party certification service; and

storing, by the one or more processors, the new mobile application and the certification in the application and certification database.

6. The method of claim 5, further comprising:

providing, by the one or more processors, the new mobile application to a testing module, the testing module performing one or more of static application security testing (SAST) and dynamic application security testing (DAST) on the new mobile application, and providing test results; and

storing, by the one or more processors, the test results with the new mobile application in the application and certification database.

7. The method of claim 1, further comprising receiving a user selection of the mobile application from the list of mobile applications, and, at least partially in response to:

retrieving an application file of the mobile application from the application and certification database; and

transmitting the application file to the mobile device of the user for installation of the mobile application thereon.

8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for managing mobile devices associated with enterprise operations, the operations comprising:

receiving a request to access information regarding at least one mobile application for download to and installation on a mobile device of a user, the request comprising an identifier associated with an enterprise, the identifier being unique to the enterprise and distinguishing the enterprise from other enterprises;

receiving a tenant-specific configuration based on the identifier, the tenant-specific configuration comprising a plurality of criteria for mobile applications to be available for download to and installation on mobile devices associated with the enterprise, at least one of the plurality of criteria being associated with vendors of the mobile applications that are independent from the enterprise;

transmitting a request for a list of available mobile applications to an application and certification database, the request comprising the tenant-specific configuration;

receiving the list of available mobile applications, which comprises a subset of mobile applications of a superset of mobile applications, the subset of mobile applications being provided based on the tenant-specific configuration by using automated assessments and integrating an existing certification;

providing graphical representations of each mobile application in the list of available mobile applications for display to the user, the graphical representations being ranked based on at least two different criteria that are selected by the user of the mobile device, the list of available mobile applications further grouped according to the at least two different criteria, at least one of the criteria being a risk of installing each mobile application; and

installing, on the mobile device of the user, a mobile application selected from the list of available mobile applications.

9. The computer-readable storage medium of claim 8, wherein operations further comprise:

receiving at least one criterion from an administrator of the enterprise, the at least one criterion defining a constraint to mobile applications that can be downloaded to and installed on mobile devices associated with the enterprise; and

providing the tenant-specific configuration for the enterprise, the tenant-specific configuration being stored in a tenant configuration database and indexed to the enterprise based on the identifier.

10. The computer-readable storage medium of claim 8, wherein the superset of mobile applications comprises mobile applications that are available for download from an application store.

11. The computer-readable storage medium of claim 8, wherein the subset of mobile applications comprises mobile applications that are included in the superset of mobile applications, and that meet at least one criterion of the tenant-specific configuration.

12. The computer-readable storage medium of claim 8, wherein operations further comprise:

receiving a new mobile application from an application developer, the new mobile application to be included in the superset of mobile applications;

requesting at least one certification from a third-party certification service based on the new mobile application;

receiving the certification as a computer-readable file from the third-party certification service; and

storing the new mobile application and the certification in the application and certification database.

13. The computer-readable storage medium of claim 12, wherein operations further comprise:

providing the new mobile application to a testing module, the testing module performing one or more of static application security testing (SAST) and dynamic application security testing (DAST) on the new mobile application, and providing test results; and

storing the test results with the new mobile application in the application and certification database.

14. The computer-readable storage medium of claim 8, wherein operations further comprise receiving a user selection of the mobile application from the list of mobile applications, and, at least partially in response to:

retrieving an application file of the mobile application from the application and certification database; and

transmitting the application file to the mobile device of the user for installation of the mobile application thereon.

15. A system, comprising:

a computing device; and

a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for managing mobile devices associated with enterprise operations, the operations comprising;

receiving a request to access information regarding at least one mobile application for download to and installation on a mobile device of a user, the request comprising an identifier associated with an enterprise, the identifier being unique to the enterprise and distinguishing the enterprise from other enterprises;

receiving a tenant-specific configuration based on the identifier, the tenant-specific configuration comprising a plurality of criteria for mobile applications to be available for download to and installation on mobile devices associated with the enterprise, at least one of the plurality of criteria being associated with vendors of the mobile applications that are independent from the enterprise;

transmitting a request for a list of available mobile applications to an application and certification database, the request comprising the tenant-specific configuration;

receiving the list of available mobile applications, which comprises a subset of mobile applications of a superset of mobile applications, the subset of mobile applications being provided based on the tenant-specific configuration by using automated assessments and integrating an existing certification;

providing graphical representations of each mobile application in the list of available mobile applications for display to the user, the graphical representations being ranked based on at least two different criteria that are selected by the user of the mobile device, the list of available mobile applications further grouped according to the at least two different criteria, at least one of the criteria being a risk of installing each mobile application; and

installing, on the mobile device of the user, a mobile application selected from the list of available mobile applications.

16. The system of claim 15, wherein operations further comprise:

receiving at least one criterion from an administrator of the enterprise, the at least one criterion defining a constraint to mobile applications that can be downloaded to and installed on mobile devices associated with the enterprise; and

providing the tenant-specific configuration for the enterprise, the tenant-specific configuration being stored in a tenant configuration database and indexed to the enterprise based on the identifier.

17. The system of claim 15, wherein the superset of mobile applications comprises mobile applications that are available for download from an application store.

18. The system of claim 15, wherein the subset of mobile applications comprises mobile applications that are included in the superset of mobile applications, and that meet at least one criterion of the tenant-specific configuration.

19. The system of claim 15, wherein operations further comprise:

receiving a new mobile application from an application developer, the new mobile application to be included in the superset of mobile applications;

requesting at least one certification from a third-party certification service based on the new mobile application;

receiving the certification as a computer-readable file from the third-party certification service; and

storing the new mobile application and the certification in the application and certification database.

20. The system of claim 19, wherein operations further comprise:

providing the new mobile application to a testing module, the testing module performing one or more of static application security testing (SAST) and dynamic application security testing (DAST) on the new mobile application, and providing test results; and

storing the test results with the new mobile application in the application and certification database.