Enforcing device settings for mobile devices

• US 8,010,997 B2
• Filed: 06/30/2005
• Issued: 08/30/2011
• Est. Priority Date: 06/30/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yang, Zhidong, Atwood, John Allen, Limont, David P., Aftab, Omar, Tousignant, Patrick, Nalliah, Selvaraj, Ciccotosto, Massimiliano
• Primary Examiner(s): Korzuch; William R
• Assistant Examiner(s): Su; Sarah
• Application Number:
  US11/171,850
• Publication Number:
  US 20070006289A1
• Time in Patent Office: 2,252 Days
• Field of Search: 726/3, 726/6, 726/1, 709/217, 709/220, 709/221, 709/222
• US Class Current: 726/3
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

The present embodiments extend to methods, systems, and computer program products for enforcing device settings for mobile devices. Generally, a computer system enforces appropriate mobile device settings (e.g., policy and/or configuration settings) prior to permitting a mobile device to access maintained data. The computer system receives a request from a mobile device. The computer system determines that current mobile device settings are not appropriate for accessing the maintained data. The computer system sends device settings, representing a new mobile device configuration that is appropriate for accessing the maintained data, to the mobile device. The computer system receives an indication that the mobile device is configured in accordance with the device settings. The computer system permits the mobile device to access the maintained data in response to receiving the indication that the mobile device is configured in accordance with the device settings.

Claims

1. At a computer system that maintains data accessible to mobile devices, a method for enforcing an appropriate mobile device configuration prior to permitting a mobile device to access the maintained data, the method comprising:

receiving at the computer system a sync request from the mobile device, the sync request requesting that the mobile device be permitted to access the data maintained by the computer system in order to sync data between the mobile device and the computer system, the sync request indicating a current mobile device configuration of the mobile device and including a configuration version corresponding to the current mobile device configuration, the data maintained by the computer system comprising electronic mail data;

determining that the current mobile device configuration is not appropriate for accessing the maintained data, wherein the act of determining that the current mobile device configuration is not appropriate for accessing the maintained data comprises comparing the configuration version included in the received sync request to one or more configuration versions stored at the computer system representing appropriate configurations for accessing the maintained data;

sending device configuration settings to the mobile device, the device configuration settings representing a new mobile device configuration that is appropriate for accessing the maintained data;

in response to the mobile device receiving the sent device configuration settings, receiving at the computer system an indication that the mobile device is configured in accordance with the sent device configuration settings; and

in response to receiving the indication that the mobile device is configured in accordance with the sent device configuration settings, permitting the mobile device to access the maintained data using the sync request in order to sync data between the mobile device and the computer system.

2. The method as recited in claim 1, wherein receiving the sync request from the mobile device comprises receiving a request that was sent in accordance with HTTP.

3. The method as recited in claim 1, wherein receiving the request from the mobile device comprises receiving a request for a Web page.

4. The method as recited in claim 1, wherein receiving the sync request from the mobile device comprises receiving a request from a mobile device selected from among a mobile telephone, a PDA, and a watch.

5. The method as recited in claim 1, wherein sending device configuration settings to the mobile device comprises sending configuration settings that are designated to alter the current configuration of one or more of an operating system, an application program, hardware, allocated resources, a network interface, and wireless protocol settings, at the mobile device.

6. The method as recited in claim 1, wherein receiving the indication that the mobile device is configured in accordance with the device configuration settings comprises comparing a received configuration version to one or more configuration versions representing appropriate configurations for accessing the maintained data.

7. The method as recited in claim 1, further comprises:

notifying the mobile device that access to the maintained data has been permitted.

8. At a computer system that maintains data accessible to mobile devices, a method for enforcing mobile device access policies prior to permitting mobile device access to the maintained data, the method comprising:

receiving at the computer system a data command from a mobile device, the data command including a policy version and a sync request to access data maintained at the computer system in order to sync data between the mobile device and the computer system, the policy version representing current policy settings at the mobile device, the data maintained at the computer system comprising electronic mail data;

determining that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system, wherein determining that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system comprises comparing the policy version included in the received data command to one or more policy versions stored at the computer system representing appropriate policy settings for accessing the maintained data;

notifying the mobile device that the current policy settings are not appropriate for accessing the maintained data;

receiving a policy request from the mobile device, the policy request requesting policy settings that are appropriate for accessing the maintained data;

identifying updated policy settings that are appropriate for accessing the maintained data;

sending the updated policy settings along with a corresponding updated policy version to the mobile device, the updated policy version representing the updated policy settings;

in response to the mobile device receiving the sent updated policy settings, receiving at the computer system another sync request along with the updated policy version from the mobile device, the another sync request requesting that the mobile device be permitted to access the maintained data in order to sync data between the mobile device and the computer system, the updated policy version indicating that the mobile device is configured in accordance with the updated policy settings; and

notifying the mobile device that access to the maintained data has been permitted.

9. The method as recited in claim 8, wherein determining that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system comprises determining that the mobile device does not support policy settings.

10. The method as recited in claim 8, wherein determining that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system comprises determining that the mobile device does not support PIN lock.

11. The method as recited in claim 8, wherein receiving the policy request from the mobile device comprises receiving a policy request for policy settings that are appropriate for accessing electronic mail data.

12. The method as recited in claim 8, wherein receiving the policy request from the mobile device comprises receiving a policy request from the mobile device selected from among a mobile telephone, a PDA, and a watch.

13. The method as recited in claim 8, wherein identifying the updated policy settings that are appropriate for accessing the maintained data comprises identifying one or more of PIN lock settings, storage wipe settings, periodic enforcement settings, and policy exceptions.

14. The method as recited in claim 8, wherein sending the updated policy settings along with the corresponding updated policy version to the mobile device comprises sending one or more of PIN lock settings, storage wipe settings, periodic enforcement settings, and policy exceptions.

15. The method as recited in claim 8, wherein receiving the data request along with the updated policy version from the mobile device comprises receiving a policy version indicating that a user of the mobile device is at least temporarily excepted from policy compliance.

16. The method as recited in claim 8, further comprising:

initiating a remote storage wipe of the mobile device.

17. A computer-program product for use at a computer system that maintains data accessible to mobile devices, the computer program product for implementing a method for enforcing mobile device access policies prior to permitting mobile device access to the maintained data, the computer program product comprising one or more computer-readable storage media not consisting of a propagating signal, having stored thereon computer-executable instructions that, when executed by a processor, cause the computer system to perform the following:

receive at the computer system a data command from a mobile device, the data command including a policy version and a sync request to access data maintained at the computer system in order to sync data between the mobile device and the computer system, the policy version representing current policy settings at the mobile device, the data maintained at the computer system comprising electronic mail data;

determine that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system, wherein determining that the current policy settings at the mobile device are not appropriate for accessing the data maintained by the computer system comprises an act of comparing the policy version included in the received data command to one or more policy versions stored at the computer system representing appropriate policy settings for accessing the maintained data;

notify the mobile device that the current policy settings are not appropriate for accessing the maintained data;

receive a policy request from the mobile device, the policy request requesting policy settings that are appropriate for accessing the maintained data;

identify updated policy settings that are appropriate for accessing the maintained data;

send the updated policy settings along with a corresponding updated policy version to the mobile device, the updated policy version representing the updated policy settings;

in response to the mobile device receiving the sent updated policy settings, receive at the computer system another sync request along with the updated policy version from the mobile device, the another sync request requesting that the mobile device be permitted to access the maintained data in order to sync data between the mobile device and the computer system, the updated policy version indicating that the mobile device is configured in accordance with the updated policy settings; and

notify the mobile device that access to the maintained data has been permitted.