Policy-Based Application Management

• US 20140040978A1
• Filed: 10/03/2013
• Published: 02/06/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Granted Patent: US 8,881,229 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method of managing a virtual private network (VPN) connection, comprising:

receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein one of the policy files defines a policy determining whether the managed application is permitted to create an application-specific VPN connection with an enterprise server, wherein said application specific VPN is available to the managed application, but is not usable by an unmanaged application executing on the electronic mobile device.

2. The method of claim 1, further comprising:

receiving user authentication information from a user to initially authenticate the user; and

verifying the user is associated with permissions allowing the user to use the managed application; and

permitting the mobile device to launch the managed application only when the user is permitted to use the managed application.

3. The method of claim 2, further comprising;

determining whether the user is permitted to remotely access, using the managed application, an enterprise resource hosted remotely from the mobile device; and

instructing the managed application to create the application-specific VPN responsive to affirmatively determining that the user is permitted to remotely access the enterprise resource using the managed application.

4. The method of claim 3, further comprising:

automatically authenticating the user to the enterprise resource based on the initial authentication; and

accessing the enterprise resource via the application-specific VPN.

5. The method of claim 3, further comprising:

receiving an authentication challenge from the enterprise resource;

determining one or more security certificates the user is permitted to use based on the initial authentication of the user; and

responding to the authentication challenge using one of the one or more security certificates.

6. The method of claim 5, wherein the security certificates are stored in a secure container on the electronic mobile device, accessible by the managed application only when defined by a policy file applicable to the electronic mobile device.

7. The method of claim 5, wherein the certificate challenge is one of a Kerberos authentication and an SSL authentication.

8. One or more non-transitory computer readable media storing computer instructions that, when executed, cause an electronic mobile device to manage a virtual private network (VPN) connection by:

receiving, the electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the electronic mobile device, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the electronic mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein one of the policy files defines a policy determining whether the managed application is permitted to create an application-specific VPN connection with an enterprise server, wherein said application specific VPN is available to the managed application, but is not usable by an unmanaged application executing on the electronic mobile device.

9. The computer readable media of claim 8, said instructions further comprising:

receiving user authentication information from a user to initially authenticate the user; and

verifying the user is associated with permissions allowing the user to use the managed application; and

permitting the mobile device to launch the managed application only when the user is permitted to use the managed application.

10. The computer readable media of claim 9, said instructions further comprising;

determining whether the user is permitted to remotely access, using the managed application, an enterprise resource hosted remotely from the mobile device; and

instructing the managed application to create the application-specific VPN responsive to affirmatively determining that the user is permitted to remote access the enterprise resource using the managed application.

11. The computer readable media of claim 10, said instructions further comprising:

automatically authenticating the user to the enterprise resource based on the initial authentication; and

accessing the enterprise resource via the application-specific VPN.

12. The computer readable media of claim 10, said instructions further comprising:

receiving an authentication challenge from the enterprise resource;

determining one or more security certificates the user is permitted to use based on the initial authentication of the user; and

responding to the authentication challenge using one of the one or more security certificates.

13. The computer readable media of claim 12, wherein the security certificates are stored in a secure container on the electronic mobile device, accessible by the managed application only when defined by a policy file applicable to the electronic mobile device.

14. The computer readable media of claim 12, wherein the certificate challenge is one of a Kerberos authentication and an SSL authentication.

15. An electronic mobile device, comprising:

a processor; and

memory storing computer readable instructions that, when executed by the processor, cause the device to manage a virtual private network (VPN) connection by;

receiving, the electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files;

receiving, by the electronic mobile device, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the electronic mobile device, the managed application operating in accordance with the set of one or more policy files,

wherein one of the policy files defines a policy determining whether the managed application is permitted to create an application-specific VPN connection with an enterprise server, wherein said application specific VPN is available to the managed application, but is not usable by an unmanaged application executing on the electronic mobile device.

16. The device of claim 15, said instructions further comprising:

receiving user authentication information from a user to initially authenticate the user; and

verifying the user is associated with permissions allowing the user to use the managed application; and

permitting the mobile device to launch the managed application only when the user is permitted to use the managed application.

17. The device of claim 16, said instructions further comprising;

determining whether the user is permitted to remotely access, using the managed application, an enterprise resource hosted remotely from the mobile device; and

instructing the managed application to create the application-specific VPN responsive to affirmatively determining that the user is permitted to remote access the enterprise resource using the managed application.

18. The device of claim 17, said instructions further comprising:

automatically authenticating the user to the enterprise resource based on the initial authentication; and

accessing the enterprise resource via the application-specific VPN.

19. The device of claim 17, said instructions further comprising:

receiving an authentication challenge from the enterprise resource;

determining one or more security certificates the user is permitted to use based on the initial authentication of the user; and

responding to the authentication challenge using one of the one or more security certificates.

20. The device of claim 19, wherein the security certificates are stored in a secure container on the electronic mobile device, accessible by the managed application only when defined by a policy file applicable to the electronic mobile device.