Anonymous Application Wrapping

• US 20170026383A1
• Filed: 07/21/2015
• Published: 01/26/2017
• Est. Priority Date: 07/21/2015
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Hayton, Richard, Momchilov, Georgy, Barton, Gary, Innes, Andrew
• Granted Patent: US 9,942,240 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods and systems are disclosed for providing approaches to anonymous application wrapping on a mobile device. The methods and systems may include receiving, by a controller service, a request to associate a first application executing on a client device with the controller service, and obtaining, by the controller service, a first application identifier associated with the first application. The methods and systems may also include receiving, by the controller service from an application service, a request for a first service and a conditional application identifier, and configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application.

Claims

1. A method comprising:

receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system on the client device, wherein each policy file defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system;

obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application;

receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; and

responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application.

2. The method of claim 1, wherein obtaining the first application identifier associated with the first application further comprises generating, by the controller service, the first application identifier associated with the first application.

3. The method of claim 1, wherein obtaining the first application identifier associated with the first application further comprises receiving, by the controller service from the client device, the first application identifier associated with the first application, wherein the first application identifier is generated by the client device.

4. The method of claim 1, further comprising:

receiving, by the controller service from the first application, a request to associate a second application executing on the client device with the controller service, the controller service being configured to control the second application via one or more policy instructions;

obtaining, by the controller service, a second application identifier associated with the second application; and

transmitting, by the controller service to client device, the second application identifier associated with the second application.

5. The method of claim 1, further comprising:

receiving, by the controller service from a second application, a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; and

obtaining, by the controller service, a second application identifier associated with the second application; and

associating, by the controller service, the first application identifier with the second application identifier.

6. The method of claim 5, wherein associating the first application identifier with the second application identifier further comprises determining that the first application and the second application are both executing on the client device.

7. The method of claim 5, wherein the information identifying the first application is encrypted with a key known to the controller service and unknown to the second application.

8. The method of claim 1, further comprising transmitting, by the controller service to the client device, authentication information configured to be used by the application to authenticate to a gateway device associated with the controller service.

9. The method of claim 1, wherein the client device determines a location of the controller based on a level of service associated with the first application.

10. A system, comprising:

at least one processor; and

at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to perform;

receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system on the client device, wherein each policy file defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system;

obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application;

receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; and

responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application.

11. The system of claim 10, wherein obtaining the first application identifier associated with the first application further comprises generating, by the controller service, the first application identifier associated with the first application.

12. The system of claim 10, wherein obtaining the first application identifier associated with the first application further comprises receiving, by the controller service from the client device, the first application identifier associated with the first application, wherein the first application identifier is generated by the client device.

13. The system of claim 10, wherein the computer-readable instructions further cause the system to perform:

receiving, by the controller service from the first application, a request to associate a second application executing on the client device with the controller service, the controller service being configured to control the second application via one or more policy instructions;

obtaining, by the controller service, a second application identifier associated with the second application; and

transmitting, by the controller service to client device, the second application identifier associated with the second application.

14. The system of claim 10, wherein the computer-readable instructions further cause the system to perform:

receiving, by the controller service from a second application, a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; and

obtaining, by the controller service, a second application identifier associated with the second application; and

associating, by the controller service, the first application identifier with the second application identifier.

15. The system of claim 14, wherein associating the first application identifier with the second application identifier further comprises determining that the first application and the second application are both executing on the client device.

16. The system of claim 14, wherein the information identifying the first application is encrypted with a key known to the controller service and unknown to the second application.

17. The system of claim 10, wherein the client device determines a location of the controller based on a level of service associated with the first application.

18. One or more non-transitory computer-readable storage media having computer-readable instructions stored thereon, that when executed by one or more processors, cause the one or more processors to perform:

receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system on the client device, wherein each policy file defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system;

obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application;

receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; and

responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application.

19. The computer-readable storage media of claim 18, wherein the computer-readable instructions further cause the one or more processors to perform:

receiving, by the controller service from the first application, a request to associate a second application executing on the client device with the controller service, the controller service being configured to control the second application via one or more policy instructions;

obtaining, by the controller service, a second application identifier associated with the second application; and

transmitting, by the controller service to client device, the second application identifier associated with the second application.

20. The computer-readable storage media of claim 18, wherein the computer-readable instructions further cause the one or more processors to perform:

receiving, by the controller service from a second application, a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; and

obtaining, by the controller service, a second application identifier associated with the second application; and

associating, by the controller service, the first application identifier with the second application identifier.