Policy-Based Application Management

• US 20140032758A1
• Filed: 10/03/2013
• Published: 01/30/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Granted Patent: US 8,769,063 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/30 : Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method for managing applications having at least two execution modes, comprising:

receiving, by an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a first set of one or more policy files;

receiving, by the device, the first set of one or more policy files from the application server during a second communication which is different than the first communication, the first set of one or more policy files being stored on the electronic mobile device separately from the managed application;

running, by the processor, the managed application on the mobile device in a first execution mode, the managed application operating in accordance with the first set of one or more policy files in the first execution mode; and

running, by the processor, the managed application on the mobile device in a second execution mode different from said first execution mode, the managed application operating in accordance with a second set of zero or more policy files in the second execution mode, wherein the second set of policy files is different from the first set policy files.

2. The method of claim 1, further comprising running, by the processor, the managed application on the mobile device in a third execution mode different from said first and second execution modes, the managed application operating in accordance with a third set of one or more policy files in the third execution mode, wherein the third set of policy files is different from the first and second sets of policy files.

3. The method of claim 1, wherein the second set of policy files consists of zero policy files, and wherein the second execution mode is an unmanaged execution mode.

4. The method of claim 1, wherein the first execution mode is associated with a first industry;

and the second execution mode is associated with a second industry.

5. The method of claim 1, wherein the first execution mode is associated with a first geographic location;

and the second execution mode is associated with a second geographic location.

6. The method of claim 1,

wherein the managed application comprises a personal information management (PIM) application, and wherein the first set of policy files restrict the PIM application from accessing any non-enterprise resources, and

wherein the second set of policy files consist of zero policy files, thereby allowing the PIM application to access a non-enterprise email account associated with a user of the device.

7. The method of claim 1, wherein the managed application is an Internet web browser, and wherein the first set of policy files restrict the browser from accessing all non-enterprise pre-approved URLs, wherein the set of pre-approved URLs are defined in the first set of policy files, and

wherein the second set of policy files consist of zero policy files, thereby allowing the browser to access URLs that are not enterprise pre-approved URLs.

8. One or more non-transitory computer readable media storing computer instructions that, when executed, cause a device to manage applications having at least two execution modes by:

receiving, by an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a first set of one or more policy files;

receiving, by the device, the first set of one or more policy files from the application server during a second communication which is different than the first communication, the first set of one or more policy files being stored on the electronic mobile device separately from the managed application;

running, by the processor, the managed application on the mobile device in a first execution mode, the managed application operating in accordance with the first set of one or more policy files in the first execution mode; and

running, by the processor, the managed application on the mobile device in a second execution mode different from said first execution mode, the managed application operating in accordance with a second set of zero or more policy files in the second execution mode, wherein the second set of policy files is different from the first set policy files.

9. The computer readable media of claim 8, said instructions further comprising running, by the processor, the managed application on the mobile device in a third execution mode different from said first and second execution modes, the managed application operating in accordance with a third set of one or more policy files in the third execution mode, wherein the third set of policy files is different from the first and second sets of policy files.

10. The computer readable media of claim 8, wherein the second set of policy files consists of zero policy files, and wherein the second execution mode is an unmanaged execution mode.

11. The computer readable media of claim 8, wherein the first execution mode is associated with a first industry;

and the second execution mode is associated with a second industry.

12. The computer readable media of claim 8, wherein the first execution mode is associated with a first geographic location;

and the second execution mode is associated with a second geographic location.

13. The computer readable media of claim 8,

wherein the managed application comprises a personal information management (PIM) application, and wherein the first set of policy files restrict the PIM application from accessing any non-enterprise resources, and

wherein the second set of policy files consist of zero policy files, thereby allowing the PIM application to access a non-enterprise email account associated with a user of the device.

14. The computer readable media of claim 8, wherein the managed application is an Internet web browser, and wherein the first set of policy files restrict the browser from accessing all non-enterprise pre-approved URLs, wherein the set of pre-approved URLs are defined in the first set of policy files, and

wherein the second set of policy files consist of zero policy files, thereby allowing the browser to access URLs that are not enterprise pre-approved URLs.

15. An electronic mobile device comprising:

a processor; and

memory storing computer readable instructions that, when executed by the processor, cause the device to manage applications having at least two execution modes by;

receiving, by the device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a first set of one or more policy files;

receiving, by the device, the first set of one or more policy files from the application server during a second communication which is different than the first communication, the first set of one or more policy files being stored on the electronic mobile device separately from the managed application;

running, by the processor, the managed application on the mobile device in a first execution mode, the managed application operating in accordance with the first set of one or more policy files in the first execution mode; and

running, by the processor, the managed application on the mobile device in a second execution mode different from said first execution mode, the managed application operating in accordance with a second set of zero or more policy files in the second execution mode, wherein the second set of policy files is different from the first set policy files.

16. The device of claim 15, said instructions further comprising running, by the processor, the managed application on the mobile device in a third execution mode different from said first and second execution modes, the managed application operating in accordance with a third set of one or more policy files in the third execution mode, wherein the third set of policy files is different from the first and second sets of policy files.

17. The device of claim 15, wherein the second set of policy files consists of zero policy files, and wherein the second execution mode is an unmanaged execution mode.

18. The device of claim 15, wherein the managed application comprises a personal information management (PIM) application, and wherein the first set of policy files restrict the PIM application from accessing any non-enterprise resources.

19. The device of claim 18 wherein the second set of policy files consist of zero policy files, thereby allowing the PIM application to access a non-enterprise email account associated with a user of the device.

20. The device of claim 15, wherein the managed application is an Internet web browser, and wherein the first set of policy files restrict the browser from accessing all non-enterprise pre-approved URLs, wherein the set of pre-approved URLs are defined in the first set of policy files, and

wherein the second set of policy files consist of zero policy files, thereby allowing the browser to access URLs that are not enterprise pre-approved URLs.