TECHNIQUES TO APPLY AND SHARE REMOTE POLICIES ON MOBILE DEVICES

• US 20130117805A1
• Filed: 11/09/2011
• Published: 05/09/2013
• Est. Priority Date: 11/09/2011
• Status: Active Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hamler, Michael, Seetharaman, Shivakumar, Bolles, Gregory, Kent, Jonathan
• Granted Patent: US 10,291,658 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications

Abstract

Techniques to apply and share remote policies on personal devices are described. In an embodiment, a technique includes contacting an enterprise server from an enterprise application operating on a personal device. The enterprise application may receive policies from the enterprise server. The policies may be applied to the enterprise application. When a second enterprise application on the personal device is launched, the policies may also be applied to the second enterprise application. When a policy is changed on the enterprise server, notification is pushed to the personal device and all related enterprise applications on the personal device may be updated to enforce the policy change. Other embodiments are described and claimed.

Claims

1. A computer-implemented method, comprising:

connecting to an enterprise server with a first enterprise application on a personal device;

receiving a policy from the enterprise server;

applying, by a processor circuit, the policy to the first enterprise application; and

applying, by the processor circuit, the policy to a second enterprise application automatically when the second enterprise application is used.

2. The method of claim 1, wherein the policy comprises at least one of:

a password policy;

an encryption policy;

a data wipe policy;

or

an enterprise data storage policy.

3. The method of claim 2, wherein applying a password policy comprises enforcing at least one of:

receiving a password to use an enterprise application;

a password format;

receiving re-entry of a password after a specified time period of inactivity;

or

disabling an enterprise application password constraint when the personal device has a password that meets or exceeds password constraints in the password policy.

4. The method of claim 2, wherein applying an encryption policy comprises enforcing at least one of:

turning device encryption on when encryption is requested;

detecting whether device encryption is enabled and setting a policy flag reflecting the device encryption enablement status for other enterprise applications to check;

checking if encryption is needed for storing enterprise data on the personal device;

or

preventing enterprise data storage on the personal device when encryption is requested and device encryption is not enabled.

5. The method of claim 2, wherein applying a wipe policy comprises at least one of:

receiving a wipe command from the enterprise server and erasing only enterprise data from the personal device;

detecting when a maximum number of failed password entry attempts has occurred on the personal device, and erasing only enterprise data from the personal device;

or

erasing enterprise data specific to an enterprise account when the personal device is not encryption compliant and encryption is requested.

6. The method of claim 1, further comprising:

receiving a push notification from the enterprise server that a policy has been one of added, changed, or deleted;

receiving an added, changed or deleted policy;

applying the added or changed policy; and

removing a deleted policy.

7. The method of claim 1, further comprising preventing download of enterprise data from the enterprise server until the enterprise application requesting the enterprise data adheres to the policy.

8. The method of claim 1, further comprising:

generating a policy key on the personal device from the policy on the personal device;

providing the policy key to the enterprise server for comparison to the policy on the enterprise server; and

receiving a notification from the enterprise server that the policy on the personal device is up to date or the policy on the personal device needs to be updated.

9. The method of claim 1, wherein each enterprise application on the personal device is linked to a same one enterprise account on the enterprise server.

10. An article of manufacture comprising a computer-readable storage medium containing instructions that when executed cause a system to:

receive a policy from an enterprise server for a first enterprise application;

apply the policy to the first enterprise application; and

apply the policies to a second enterprise application when the second enterprise application is used.

11. The article of claim 10, the computer-readable storage medium further comprising instructions that when executed cause the system to prevent download of enterprise data from the enterprise server until the enterprise application requesting the enterprise data adheres to the policy.

12. The article of claim 10, the computer-readable storage medium further comprising instructions that when executed cause the system to

generate a policy key on the personal device from the policy on the personal device;

provide the policy key to the enterprise server for comparison to the policy on the enterprise server; and

receive a notification from the enterprise server that the policy on the personal device is up to date or the policy on the personal device needs to be updated.

13. The article of claim 10, wherein the policy comprises a password policy, the computer-readable storage medium further comprising instructions that when executed cause the system to enforce at least one of:

receive a password to use an enterprise application;

a password format;

receive re-entry of a password after a specified time period of inactivity; and

disabling an enterprise application password constraint when the personal device has a password that meets or exceeds password constraints in the password policy.

14. The article of claim 10, wherein the policy is an encryption policy, the computer-readable storage medium further comprising instructions that when executed cause the system to enforce at least one of:

turning device encryption on when encryption is requested;

detecting whether device encryption is enabled and setting a policy flag reflecting the device encryption enablement status for other enterprise applications to check;

checking if encryption is needed for storing enterprise data on the personal device;

or

preventing enterprise data storage on the personal device when encryption is needed and device encryption is not enabled.

15. The article of claim 10, wherein the policy is a wipe policy, the computer-readable storage medium further comprising instructions that when executed cause the system to at least one of:

receive a wipe command from the enterprise server and erase only enterprise data from the personal device;

detect when a maximum number of failed password entry attempts has occurred on the personal device, and erase only enterprise data from the personal device;

or

erase enterprise data specific to an enterprise account when the personal device is not encryption compliant and encryption is needed.

16. The article of claim 10, the computer-readable storage medium further comprising instructions that when executed cause the system to connect the first enterprise application to the enterprise server and the second enterprise application to the enterprise server using a same one enterprise account on the enterprise server.

17. An apparatus, comprising:

a memory store to store personal data and enterprise data;

a processing unit coupled to the memory store; and

multiple enterprise applications executable on the processing unit and operative to receive a policy from the enterprise server for a first enterprise application, and automatically apply the policy for the first enterprise application to a second enterprise application.

18. The apparatus of claim 17, comprising:

the first enterprise application operative to connect to the enterprise server, receive the policy from the enterprise server, set a policy flag reflecting a policy condition, and apply the policy to the first enterprise application; and

the second enterprise application operative to check the policy flag, and automatically apply the policy according to the policy flag to the second enterprise application when the policy flag is set.

19. The apparatus of claim 17, the first enterprise application operative to generate a policy key from the policy, provide the policy key to the enterprise server for comparison to the policy on the enterprise server, and receive a notification from the enterprise server that the policy is up to date or needs to be updated.

20. The apparatus of claim 17, wherein the first and second enterprise applications are linked to a same enterprise account on the enterprise server.