Policy-Based Application Management

• US 20140032759A1
• Filed: 10/03/2013
• Published: 01/30/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Granted Patent: US 9,043,480 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method of managing an application executing on an electronic mobile device, comprising:

receiving, by an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the device, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application directly on the mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein the set of one or more policy files, when applied by the electronic mobile device, cause the managed application to operate using a second set of one or more policy files when the managed application is running in a virtualization mode on the electronic mobile device.

2. The method of claim 1, wherein the second set of policy files automatically configure the managed application to run in the virtualization mode.

3. The method of claim 1, wherein the second set of policy files restrict cutting and pasting between applications executing directly on the device with applications executing in the virtualization mode.

4. The method of claim 1, wherein the managed application comprises a client agent application capable of executing a plurality of enterprise approved applications in the virtualization mode on the electronic mobile device.

5. The method of claim 4, wherein the virtualization mode is a remote access mode provided by the client agent application.

6. The method of claim 5, wherein the second set of policy files include a first temporal restriction restricting times when the remote access mode is usable to access a first managed application in the virtualization mode, and a second temporal restriction, different from the first temporal restriction, restricting times when the remote access mode is usable to access a second managed application in the virtualization mode.

7. The method of claim 5, wherein the second set of policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access a first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.

8. The method of claim 1, wherein the second set of one or more policy files restrict an application specific function allowed by the first set of one or more policy files.

9. One or more non-transitory computer readable media storing computer instructions that, when executed, cause a device to manage an application executing on an electronic mobile device by:

receiving, by an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the device, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application directly on the mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein the set of one or more policy files, when applied by the electronic mobile device, cause the managed application to operate using a second set of one or more policy files when the managed application is running in a virtualization mode on the electronic mobile device.

10. The computer readable media of claim 9, wherein the second set of policy files automatically configure the managed application to run in the virtualization mode.

11. The computer readable media of claim 9, wherein the second set of policy files restrict cutting and pasting between applications executing directly on the device with applications executing in the virtualization mode.

12. The computer readable media of claim 9, wherein the managed application is a client agent application capable of executing a plurality of enterprise approved applications in the virtualization mode on the electronic mobile device.

13. The computer readable media of claim 12, wherein the virtualization mode is a remote access mode provided by the client agent application.

14. The computer readable media of claim 13, wherein the second set of policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access a first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.

15. An electronic mobile device, comprising:

a processor; and

memory storing computer readable instructions that, when executed, cause the device to manage an application executing on the device by;

receiving, by the device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the device, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application directly on the mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein the set of one or more policy files, when applied by the electronic mobile device, cause the managed application to operate using a second set of one or more policy files when the managed application is running in a virtualization mode on the electronic mobile device.

16. The device of claim 15, wherein the second set of policy files restrict cutting and pasting between applications executing directly on the device with applications executing in the virtualization mode.

17. The device of claim 15, wherein the managed application comprises a client agent application capable of executing a plurality of enterprise approved applications in the virtualization mode on the electronic mobile device.

18. The device of claim 17, wherein the virtualization mode is a remote access mode provided by the client agent application.

19. The device of claim 18, wherein the second set of policy files include a first temporal restriction restricting times when the remote access mode is usable to access a first managed application in the virtualization mode, and a second temporal restriction, different from the first temporal restriction, restricting times when the remote access mode is usable to access a second managed application in the virtualization mode.

20. The device of claim 18, wherein the second set of policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access a first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.