INTEGRATING POLICIES FROM A PLURALITY OF DISPARATE MANAGEMENT AGENTS

• US 20100154025A1
• Filed: 12/12/2008
• Published: 06/17/2010
• Est. Priority Date: 12/12/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ateeq, Burhan, Esteve Balducci, Juan V., Atwood, John Allen, Tousignant, Patrick, Limont, David Paul, Higashi, Michael K.
• Granted Patent: US 8,931,033 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Described herein are embodiments for managing policies of a mobile device. In embodiments, a mobile device receives policy containers from a plurality of disparate management agents. Each policy container has one or more policies. Each policy corresponds to a particular category that governs various aspects of the device. The policies described herein may be device wide policies corresponding to various features on the device. The policies may also be data specific policies which dictate how data is stored on and transferred to and from the device. Once the policies are received, a determination is made as to which policy in each category is the most secure policy. The most secure policy for each category is merged to create a global policy that is applied to the mobile device.

Claims

1. A method for managing policies of a mobile device, the method comprising:

receiving a plurality of policy containers from a plurality of management agents, wherein each of the plurality of policy containers has one or more policies and wherein each of the one or more policies correspond to a category from a plurality of categories;

for each category of the plurality of categories, determining which of the one or more policies is a most secure policy;

merging the most secure policy from each category of the plurality of categories to create a global policy; and

applying the global policy to the mobile device.

2. The method of claim 1, wherein the one or more policies are device wide policies.

3. The method of claim 1, wherein the one or more policies are data specific policies.

4. The method of claim 1, further comprising automatically updating the global policy when a relationship between the mobile device and at least one of the plurality of management agents is severed.

5. The method of claim 4, wherein automatically updating comprises:

excluding the one or more policies of the one of the plurality of management agents with which the relationship was severed;

determining which of the one or more policies remaining, after the excluding, for each category is the most secure;

merging the most secure policy of the remaining policies from each category to create a new global policy; and

applying the new global policy to the mobile device.

6. The method of claim 1, further comprising automatically updating the global policy when at least one of the one or more policies corresponding to a first category of the plurality of categories is updated.

7. The method of claim 6, wherein automatically updating comprises:

determining which of the one or more policies that correspond to the first category is the most secure;

merging the most secure policy corresponding to the first category with the most secure policies of the plurality of categories that were not updated to create a new global policy; and

applying the new global policy to the mobile device.

8. The method of claim 1, further comprising storing, on the device, data corresponding to which of the plurality management agents provided each of the plurality of policy containers.

9. The method of claim 1, wherein determining the most secure policy comprises evaluating a binary rule, wherein an enablement bit of the binary rule determines whether the policy with the enablement bit set is the most secure policy.

10. The method of claim 1, wherein determining the most secure policy comprises evaluating an integer rule, wherein the integer rule determines the most secure policy based on an enumeration of integer values associated with each of the one or more policies.

11. The method of claim 1, wherein merging the most secure policy from each category of the plurality of categories to create a global policy comprises:

evaluating the one or more policies from each of the plurality of management agents to create a set of allowable actions corresponding to each of the plurality of management agents;

intersecting each set of allowable actions to determine whether one or more specific actions from each set of actions is allowed by each of the plurality of management agents; and

merging the one or more specific actions to create the global policy.

12. The method of claim 1, wherein merging the most secure policy from each category of the plurality of categories to create a global policy comprises:

evaluating the one or more policies from each of the plurality of management agents to create a set of disallowed actions;

combining each set of disallowed actions to determine one or more specific disallowed actions by each of the plurality of management agents; and

merging the one or more specific disallowed actions to create the global policy.

13. A computer storage medium encoding computer readable instructions for executing a method to manage policies of a mobile device, the method comprising:

receiving a plurality of policy containers from a plurality of management agents, each of the policy containers having at least one policy;

associating each policy from each of the plurality of policy containers with one of a plurality of categories;

determining the most secure policy for each of the plurality of categories, wherein the determination is based on a value associated with each policy; and

merging the most secure policy from each of the plurality of categories to create a global policy.

14. The computer storage medium of claim 13 further comprising instructions to automatically update the global policy when a relationship between the mobile device at one of the plurality of management agents has been severed.

15. The computer storage medium of claim 14, wherein instructions to automatically update the global policy includes instructions to:

exclude the policy container and the at least one policy of the one of the plurality of management;

when the most secure policy for at least one of the plurality of categories has been removed as a result of the severed relationship, determine a new most secure policy for the one of the plurality of categories; and

merge the new most secure policy from the one of the plurality of categories with each remaining category of the plurality of categories to create a new global policy.

16. The computer storage medium of claim 13, further comprising instructions for storing, on the mobile device, data corresponding to which of the plurality management agents provided each of the plurality of policy containers.

17. The computer storage medium of claim 13, further comprising instructions to automatically update the global policy when at least one policy in at least one of the plurality of policy containers is updated.

18. The computer storage medium of claim 17, wherein instructions to automatically update the global policy includes instructions to:

determine whether the updated policy is more secure than the most secure policy of the category;

when the updated policy is more secure than the most secure policy of the category, merge the updated policy with the most secure policy from each of plurality of categories to create a new global policy.

19. A system configured to manage policy settings of a mobile device, the system comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer-program instructions executable by the processor for;

receiving a first set of policies from a first management agent, each policy of the first set of policies corresponding to a category;

receiving a second set of policies from a second management agent, each policy of the second set of policies corresponding to a category;

determining, for each category having an associated policy, a most secure policy, wherein the determination is based on a policy value;

merging each most secure policy from each category to create a global policy set, wherein the merging is based on one or more rules from a set of merging rules; and

applying the global policy set to the mobile device when the mobile device connects to the first management agent and applying the policy set to the mobile device when the mobile device connects to the second management agent.

20. The system of claim 19, further comprising identifying each policy in the global policy set that is a data specific policy;

and

for each identified policy;

determining whether the identified policy is to be applied to both the first management agent and the second management agent;

determining whether the identified policy is to be applied to the first management agent only; and

determining whether the identified policy is to be applied to the second management agent only.