Management of unmanaged user accounts and tasks in a multi-account mobile application

• US 10,713,087 B2
• Filed: 11/21/2016
• Issued: 07/14/2020
• Est. Priority Date: 01/10/2014
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): Wu, Benjamin C
• Application Number:
  US15/357,363
• Publication Number:
  US 20170068568A1
• Time in Patent Office: 1,331 Days
• Field of Search: None
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/48 Program initiating; Program switching, e.g. by interrupt
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods, systems, computer-readable media, and apparatuses for providing mobile application management (MAM) functionalities are presented. In some embodiments, a mobile device may initialize a partially managed application associated with a first managed user account and an unmanaged user account. The mobile device may execute first managed tasks associated with the first managed user account in accordance with a first set of MAM policies provided by a first MAM service provider. The mobile device may execute unmanaged tasks associated with the unmanaged account independent of the first set of MAM policies. In some embodiments, the mobile device may initialize the multi-account managed application associated with a second managed user account.

Claims

1. A method comprising:

executing, by a mobile device, a partially managed application associated with a first managed user account and an unmanaged user account,

wherein the partially managed application is configured to perform a plurality of tasks for the unmanaged user account, and

wherein the partially managed application is configured to perform a first subset of the plurality of tasks for the first managed user account in accordance with a first set of managed policies, wherein the first set of managed policies specifies the first subset of the plurality of tasks;

monitoring, by the mobile device, state information of the mobile device;

determining, based on a change in the state information of the mobile device and based on the first set of managed policies, whether the first managed user account or the unmanaged user account should be in focus; and

in response to determining that the first managed user account should be in focus,

moving a task for the unmanaged user account from a foreground context and to a background context for continued execution; and

moving a task for the first managed user account from the background context and to the foreground context for continued execution.

2. The method of claim 1, wherein the determining that the first managed user account should be in focus is in response to the mobile device entering a geofence specified by the first set of managed policies.

3. The method of claim 2, further comprising:

in response to determining that the mobile device has exited the geofence specified by the first set of managed policies,

moving the task for the unmanaged user account from the background context and to the foreground context for continued execution; and

moving the task for the first managed user account from the foreground context and to the background context for continued execution.

4. The method of claim 1, wherein the determining that the first managed user account should be in focus is in response to the mobile device establishing a connection with a network specified by the first set of managed policies.

5. The method of claim 4, further comprising:

in response to determining that the mobile device no longer has the connection with the network specified by the first set of managed policies,

moving the task for the unmanaged user account from the background context and to the foreground context for continued execution; and

moving the task for the first managed user account from the foreground context and to the background context for continued execution.

6. The method of claim 1, further comprising:

permitting execution of a particular task, of the plurality of tasks, for the unmanaged user account; and

preventing execution of the particular task for the first managed user account based on the first set of managed policies.

7. The method of claim 6, wherein the particular task is a copy operation, a content-editing operation, an external communication operation, an internal communication operation, a request to access a camera of the mobile device, a request to access an external resource, or a request to activate a communication function.

8. The method of claim 1, wherein the partially managed application has a second managed user account that is managed according to a second set of managed policies, wherein the second managed user account is different from the first managed user account, and wherein the second set of managed policies is different from the first set of managed policies.

9. The method of claim 8, wherein the first set of managed policies is set by a first mobile application management provider and the second set of managed policies is set by a second mobile application management provider, wherein the second mobile application management provider is different from the first mobile application management provider.

10. A non-transitory storage medium storing machine-executable instructions that, when executed, cause a mobile device to:

execute a multi-account managed application having a first managed user account and a second managed user account,

wherein the multi-account managed application is configured to perform a first subset of a plurality of tasks for the first managed user account in a foreground context in accordance with a first set of managed policies, wherein the first set of managed policies specifies the first subset of the plurality of tasks, and

wherein the multi-account managed application is configured to perform a second subset of the plurality of tasks for the second managed user account in a background context in accordance with a second set of managed policies, wherein the second set of managed policies specifies the second subset of the plurality of tasks;

monitor state information of the mobile device;

determine, based on a change in the state information of the mobile device, and based on the first set of managed policies; and

the second set of managed policies, whether the first managed user account or the second managed user account should be in focus; and

in response to a determination that the second managed user account should be in focus,

move a task for the first managed user account from the foreground context and to the background context for continued execution; and

move a task for the second managed user account from the background context and to the foreground context for continued execution.

11. The non-transitory storage medium of claim 10, wherein the determination that the second managed user account should be in focus is in response to the mobile device entering a geofence specified by the second set of managed policies.

12. The non-transitory storage medium of claim 10, wherein the determination that the second managed user account should be in focus is in response to the mobile device establishing a connection with a network specified by the second set of managed policies.

13. The non-transitory storage medium of claim 10, wherein the machine-executable instructions, when executed, further cause the mobile device to:

permit execution of a particular task for the first managed user account based on the first set of managed policies; and

prevent execution of the particular task for the second managed user account based on the second set of managed policies,

wherein the particular task is part of the first subset but not part of the second subset.

14. The non-transitory storage medium of claim 13, wherein the particular task is a copy operation, a content-editing operation, an external communication operation, an internal communication operation, a request to access a camera of the mobile device, a request to access an external resource, or a request to activate a communication function.

15. The non-transitory storage medium of claim 10, wherein the multi-account managed application has an unmanaged user account.

16. An apparatus comprising:

a processor; and

a memory storing machine-executable instructions that, when executed by the processor, cause the apparatus to;

execute a multi-account managed application having a first managed user account, a second managed user account, and an unmanaged user account;

wherein the multi-account managed application is configured to perform a plurality of tasks for the unmanaged user account in a foreground context,

wherein the multi-account managed application is configured to perform a first subset of the plurality of tasks for the first managed user account in a background context in accordance with a first set of managed policies, wherein the first set of managed policies specifies the first subset of the plurality of tasks, and

wherein the multi-account managed application is configured to perform a second subset of the plurality of tasks for the second managed user account in the background context in accordance with a second set of managed policies, wherein the second set of managed policies specifies the second subset of the plurality of tasks;

monitor state information of the apparatus;

determine, based on a change in the state information of the apparatus, and based on the first set of managed policies; and

the second set of managed policies, whether the unmanaged user account, the first managed user account, or the second managed user account should be in focus; and

in response to a determination that the first managed user account should be in focus,

move a task for the unmanaged user account from the foreground context and to the background context for continued execution; and

move a task for the first managed user account from the background context and to the foreground context for continued execution.

17. The apparatus of claim 16, wherein the determination that the first managed user account should be in focus is in response to the apparatus entering a geofence specified by the first set of managed policies.

18. The apparatus of claim 16, wherein the determination that the first managed user account should be in focus is in response to the apparatus establishing a connection with a network specified by the first set of managed policies.

19. The apparatus of claim 16, wherein the machine-executable instructions, when executed, further cause the apparatus to:

permit execution of a particular task, of the plurality of tasks, for the unmanaged user account;

permit execution of the particular task for the first managed user account based on the first set of managed policies; and

prevent execution of the particular task for the second managed user account based on the second set of managed policies,

wherein the particular task is part of the first subset but not part of the second subset.

20. The apparatus of claim 19, wherein the particular task is a copy operation, a content-editing operation, an external communication operation, an internal communication operation, a request to access a camera of the apparatus, a request to access an external resource, or a request to activate a communication function.