Delegated profile and policy management

• US 10,362,485 B2
• Filed: 03/01/2018
• Issued: 07/23/2019
• Est. Priority Date: 08/14/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Guday, Shai, Bruner, John David, Choe, Calvin C.
• Primary Examiner(s): Siddiqui, Kashif
• Application Number:
  US15/909,827
• Publication Number:
  US 20180206123A1
• Time in Patent Office: 509 Days
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

Identities of mobile communications devices and subscription credentials are maintained by an enterprise server. The subscription credentials are operative to enable access to subscription services of a mobile network operator. Control of the subscription credentials is delegated from the mobile network operator to the enterprise server. The enterprise server determines which of the mobile communications devices are to be provisioned by the subscription credentials. Policies for use of the subscription credentials by the determined mobile communications devices are identified. The subscription credentials and policies are applied to the mobile communications devices.

Claims

1. A method for controlling a plurality of mobile communications devices by an enterprise operating an enterprise server, the mobile communications devices configured to communicate on a mobile communications network operated by a mobile network operator, the method comprising:

maintaining, by the enterprise server, identities of a plurality of mobile communications devices;

determining, by the enterprise server, which of the plurality of mobile communications devices are to be provisioned by subscription credentials that are operative to enable access to subscription services of the mobile network operator by the plurality of mobile communications devices via the mobile communications network, wherein control of the subscription credentials is delegated from the mobile network operator to the enterprise server;

for the determined mobile communications devices, identifying, by the enterprise server, policies for use of the subscription credentials by the determined mobile communications devices;

applying one or more of the subscription credentials to the determined mobile communications devices; and

applying, by the enterprise server, one or more of the policies to the determined mobile communications devices.

2. The method of claim 1, wherein the policies are enforced at least in part by a device agent executing on the mobile communications devices.

3. The method of claim 2, wherein the policies are further enforced at least in part by a credential device configured to interact with the device agent to enforce the policies.

4. The method of claim 1, wherein the policies include policies for activation of alternate provisioned profiles associated with other mobile network operators.

5. The method of claim 1, wherein the subscription credentials are associated with subscriptions from a plurality of mobile network operators and the policies comprise conditions under which the subscriptions are to be activated.

6. The method of claim 1, wherein:

said control of the subscription credentials comprises allowing the enterprise server to create credentials on mobile network operator servers and sending the credentials from the mobile network operator servers to the enterprise server; and

a selected mobile communications device is provisioned by sending selected credentials from the enterprise server to a credential device of the selected mobile communications device.

7. The method of claim 1, wherein:

the subscription credentials are generated on mobile network operator servers; and

a selected mobile communications device is provisioned by sending selected subscription credentials from the mobile network operator servers to a credential device of the selected mobile communications device.

8. The method of claim 1, wherein said control of the subscription credentials includes selection, by the enterprise server, of the subscription credentials and receiving, from the mobile network operator by the enterprise server, the subscription credentials.

9. A method performed by a computing device comprising storage hardware, processing hardware, and a network interface, the computing device configured to communicate on a mobile communications network operated by a mobile network operator, the method comprising:

receiving, via the network interface, one or more subscription credentials that are operative to enable access to subscription services of the mobile network operator via the mobile communications network, and storing the subscription credentials in the storage hardware;

receiving, via the network interface, from an enterprise server, one or more policies for use of the one or more subscription credentials, and storing the one or more policies in the storage hardware, wherein control of the subscription credentials is delegated from the mobile network operator to the enterprise server; and

applying, by the processing hardware, a selected subscription credential and associated ones of the policies to communicate on the mobile communications network.

10. A method according to claim 9, further comprising selecting and applying the subscription credentials and policies based at least in part on local device information.

11. A method according to claim 10, wherein the local device information comprises one or more of available networks, time of day, location, and a selected user profile.

12. A method according to claim 9, further comprising exposing an interface comprising one or more configurable settings that can be controlled during a device management session.

13. A method according to claim 9, further comprising allowing a user to select a personal subscription or an enterprise subscription enabled by the received subscription credential and the one or more of the policies.

14. A method according to claim 9, further comprising executing an agent operable to manage a plurality of profiles on the mobile communications device and enable one of the profiles based on the policies and local information.

15. A method according to claim 14, further comprising providing a rules engine for implementing the policies.

16. A method according to claim 14, further comprising receiving, by the agent, a request to change an active subscription and evaluate the request according to an applicable policy.

17. A system configured to manage a plurality of mobile communications devices, the mobile communications devices configured to communicate on a mobile communications network operated by a mobile network operator, the system comprising:

a memory storing thereon instructions that when executed by a processor of the system, cause the system to;

maintain identities of a plurality of mobile communications devices;

determine which of the plurality of mobile communications devices are to be provisioned by the subscription credentials that are operative to enable access to subscription services of the mobile network operator by the plurality of mobile communications devices via the mobile communications network, wherein control of the subscription credentials is delegated from the mobile network operator;

for the determined mobile communications devices, identify policies for use of the subscription credentials by the determined mobile communications devices;

cause application of one or more of the subscription credentials to the determined mobile communications devices; and

apply one or more of the policies to the determined mobile communications devices.

18. The system of claim 17, wherein said control of the subscription credentials comprises creation of credentials.

19. The system of claim 17, wherein said control of the subscription credentials includes selection of subscription credentials and receiving the selected subscription credentials.

20. The system of claim 17, further comprising instructions that when executed by the processor of the system, cause the system to select one or more configurable settings during a device management session with the determined mobile communications devices.