Unified enterprise management of wireless devices in a controlled environment

• US 10,354,053 B2
• Filed: 08/03/2017
• Issued: 07/16/2019
• Est. Priority Date: 04/28/2017
• Status: Active Grant

• Current Assignee: Global Tel-Link Corporation
• Original Assignee: Global Tel-Link Corporation
• Inventors: Hodge, Stephen L.
• Primary Examiner(s): Bechtel, Kevin
• Application Number:
  US15/668,504
• Publication Number:
  US 20190171754A1
• Time in Patent Office: 712 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A wireless device enterprise management system and a method for operating the management system in a controlled environment is disclosed. The enterprise management system includes implementing a container-based file system on wireless devices within the controlled environment. Enterprise management system manages and controls the organization of files into one or more containers on each wireless device. Each container is associated with one or more execution rules that allow or restrict execution of files that are located in the container.

Claims

1. A method for configuring a wireless device within a controlled environment, comprising:

installing a client control subsystem on the wireless device;

receiving configuration information from an enterprise management server associated with the controlled environment;

performing, by the client control subsystem, an analysis of a file system of the wireless device, wherein the analysis comprises;

identifying a file located in the file system of the wireless device; and

comparing the file to the configuration information;

creating, by the client control subsystem, a container in the file system of the wireless device based on the configuration information, wherein the container is associated with an execution rule, the execution rule specifying a condition regarding execution of files that are located within the container;

allocating, by the client control subsystem, the file to the container based on the comparing;

receiving, by the client control subsystem, a request to execute the allocated file;

transmitting, by the client control subsystem, the request and associated data to the enterprise management server; and

receiving a signal from the enterprise management server, wherein the signal comprises an instruction allowing or denying execution of the allocated file.

2. The method of claim 1, wherein the container is created based on the execution rule.

3. The method of claim 1, further comprising receiving the execution rule from the enterprise management server.

4. The method of claim 1, wherein the condition includes at least one of a time-based restriction and a usage-based restriction regarding the execution of the container file.

5. The method of claim 1, wherein the configuration information identifies the file as being banned from execution by the controlled environment.

6. The method of claim 1, further comprising:

determining, by the client control subsystem, the execution rule associated with the container, wherein the configuration information comprises the execution rule.

7. The method of claim 1, further comprising:

identifying, by the client control subsystem, a second file located in the file system of the wireless device;

comparing, by the client control subsystem, the second file to the configuration information;

creating, by the client control subsystem, a second container in the file system based at least on the configuration information;

allocating, by the client control subsystem, a second file to the second container based at least on the comparing.

8. A non-transitory computer-readable medium having instructions stored therein, which when executed by a processor in a wireless device cause the processor to perform operations, the operations comprising:

installing a client control subsystem on the wireless device;

receiving configuration information from an enterprise management server associated with the controlled environment;

performing, by the client control subsystem, an analysis of a file system of the wireless device, wherein the analysis comprises;

identifying a file located in the file system of the wireless device; and

comparing the file to the configuration information;

creating, by the client control subsystem, a container in the file system of the wireless device based at least on the configuration information, wherein the container is associated with an execution rule, the execution rule specifying a condition regarding execution of files that are located within the container;

allocating, by the client control subsystem, the file to the container based on the comparing;

receiving, by the client control subsystem, a request to execute the allocated file;

transmitting, by the client control subsystem, the request and associated data to the enterprise management server; and

receiving a signal from the enterprise management server, wherein the signal comprises an instruction allowing or denying execution of the allocated file.

9. The non-transitory computer-readable medium of claim 8, wherein the container is created based on the execution rule.

10. The non-transitory computer-readable medium of claim 8, the operations further comprising:

receiving the execution rule from the enterprise management server.

11. The non-transitory computer-readable medium of claim 8, wherein the condition includes at least one of a time-based restriction or a usage-based restriction regarding the execution of the container file.

12. The non-transitory computer-readable medium of claim 8, wherein the configuration information identifies the file as being banned from execution by the controlled environment.

13. The non-transitory computer-readable medium of claim 8, wherein the configuration information identifies the file as being approved for execution by the controlled environment.

14. The non-transitory computer-readable medium of claim 8, the operations further comprising:

identifying, by the client control subsystem, a second file located in the file system of the wireless device;

comparing, by the client control subsystem, the second file to the configuration information;

creating, by the client control subsystem, a second container in the file system based at least on the configuration information;

allocating, by the client control subsystem, a second file to the second container based at least on the comparing.

15. The non-transitory computer-readable medium of claim 8, the operations further comprising:

determining, by the client control subsystem, the execution rule associated with the container, wherein the configuration information comprises the execution rule.

16. A wireless device in a controlled environment, comprising:

a non-transitory memory; and

a processor coupled to the memory, the processor configured to;

install a client control subsystem on the wireless device;

receive configuration information from an enterprise management server associated with the controlled environment;

perform, by the client control subsystem, an analysis of a file system of the wireless device, wherein the analysis comprises;

identify a file located in the file system of the wireless device; and

compare the file to the configuration information;

create, by the client control subsystem, a container in the file system of the wireless device based at least on the configuration information, wherein the container is associated with an execution rule, the execution rule specifying a condition regarding execution of files that are located within the container;

allocate, by the client control subsystem, the file to the container based on the comparing;

receive, by the client control subsystem, a request to execute the allocated file;

transmit, by the client control subsystem, the request and associated data to the enterprise management server; and

receive a signal from the enterprise management server, wherein the signal comprises an instruction allowing or denying execution of the allocated file.

17. The wireless device of claim 16, wherein the container is created based on the execution rule.

18. The wireless device of claim 16, wherein the processor is further configured to:

receive the execution rule from the enterprise management server.

19. The wireless device of claim 16, wherein the processor is further configured to:

determine, by the client control subsystem, the execution rule associated with the container, wherein the configuration information comprises the execution rule.

20. The wireless device of claim 16, wherein the processor is further configured to:

identify, by the client control subsystem, a second file located in the file system of the wireless device;

compare, by the client control subsystem, the second file to the configuration information;

create, by the client control subsystem, a second container in the file system based at least on the configuration information;

allocate, by the client control subsystem, a second file to the second container based at least on the comparing.