Selective management of mobile device data in an enterprise environment

• US 8,695,058 B2
• Filed: 05/20/2009
• Issued: 04/08/2014
• Est. Priority Date: 05/20/2009
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Batchu, Suresh Kumar, Mishra, Ajay Kumar, Rege, Ojas Udayan
• Primary Examiner(s): DWIVEDI, MAHESH H
• Application Number:
  US12/469,612
• Publication Number:
  US 20100299376A1
• Time in Patent Office: 1,784 Days
• Field of Search: 707/999.202, 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 16/24573 using data annotations, e.g. user-defined metadata
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

In various embodiments, a method is described that includes registering a mobile device with an enterprise by storing registration data for the mobile device in a device management database; designating one or more group designations for the mobile device; storing the one or more group designations in the device management database; determining one or more policies for the mobile device based at least in part on the one or more group designations; and selectively taking action on selected data from the mobile device in the device management database based on the one or more policies.

Claims

1. A method comprising:

registering a mobile device with an enterprise by storing registration data for the mobile device in a device management database;

designating, using one or more device management servers, one or more group designations for the mobile device at least in part by designating the mobile device as being employee owned;

storing the one or more group designations in the device management database, including by storing, in a device object comprising a data structure corresponding to the mobile device, data that associates the one or more group designations with the mobile device as represented in the device management database;

determining, by the one or more device management servers, one or more data logging policies for the mobile device based at least in part on the data that associates the one or more group designations with the mobile device as represented in the device management database, and on previously stored data that associates the one or more data logging policies with the one or more group designations;

selectively logging, by the one or more device management servers, selected data from the mobile device in the device management database based on the one or more data logging policies;

designating, based at least in part on input from an employee owner of the mobile device the selected data as personal content data; and

selectively providing access to the personal content data based at least in part on a role associated with an administrative user such that a first group of administrative users is provided less restricted access to the personal content data than a second group of administrative users, wherein the employee owner and the administrative user are associated with the enterprise.

2. The method of claim 1, wherein registering the mobile device with the enterprise by storing registration data for the mobile device in the device management database comprises creating and storing a device object for the mobile device in the device management database, the device object comprising a device object identifier that uniquely identifies the mobile device, and wherein storing the one or more group designations in the device management database comprises associating the one or more group designations with the device object.

3. The method of claim 2, wherein the device management database comprises a plurality of first resources, each first resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein the mobile device comprises a plurality of second resources stored in the mobile device, each second resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein selectively logging selected data comprises:

logging particular second resources stored in the mobile device based on the data logging policies.

4. The method of claim 3, wherein selectively logging comprises:

creating and storing a new first resource in the device management database, the new first resource corresponding to a particular second resource stored in the mobile device; and

generating and storing a resource link in the device management database, the resource link associating the device object with the new first resource.

5. The method of claim 3, wherein selectively logging comprises:

generating and storing one or more resource links in the device management database, each resource link associating the device object with one or more first resources stored in the device management database, the one or more first resources corresponding to one or more second resources stored in the mobile device.

6. The method of claim 3, wherein logging particular second resources comprises one or more of:

logging second resources corresponding to a particular file type, file folder, or file directory based on the data logging policies;

logging second resources stored or modified at the mobile device within a particular period of time based on the data logging policies; and

logging second resources that have been tagged.

7. The method of claim 1, wherein selectively logging selected data comprises:

storing application usage data in the device management database.

8. The method of claim 7, wherein the application usage data comprises activity data, the activity data comprising call usage data, email usage data, text messaging usage data, or internet usage data, and wherein only selected activity data is logged based on the one or more data logging policies.

9. The method of claim 8, wherein the application usage data comprises context data that correlates the activity data based on location data corresponding to the activity data or time data corresponding to the activity data, and wherein only selected context data is logged with corresponding activity data based on the one or more data logging policies.

10. The method of claim 8, wherein the application usage data comprises content usage data, and wherein only selected content data is logged based on the one or more data logging policies.

11. The method of claim 1, wherein designating the one or more group designations for the mobile device comprises designating the mobile device as corresponding to an employee owner of a particular enterprise department or a particular enterprise employee class.

12. The method of claim 1, wherein the one or more data logging policies comprise a data retention policy.

13. The method of claim 1, wherein the data comprises communication records.

14. The method of claim 1, wherein the data comprises application data.

15. The method of claim 1, wherein the data comprises context data.

16. The method of claim 1, wherein the first group of administrative users includes one or more higher-level administrators, and the second group of administrative users includes one or more lower-level administrators.

17. The method of claim 1, wherein selectively providing access comprises selectively providing access to the personal content data based at least in part on the role associated with the administrative user and the group designations for the mobile device.

18. One or more computer-readable non-transitory tangible storage media encoding software that is operable when executed to:

register a mobile device with an enterprise by storing registration data for the mobile device in a device management database;

designate one or more group designations for the mobile device at least in part by designating the mobile device as being employee owned;

store the one or more group designations in the device management database, including by storing, in a device object comprising a data structure corresponding to the mobile device, data that associates the one or more group designations with the mobile device as represented in the device management database;

determine one or more data logging policies for the mobile device based at least in part on the data that associates the one or more group designations with the mobile device as represented in the device management database, and on previously stored data that associates the one or more data logging policies with the one or more group designations; and

selectively log selected data from the mobile device in the device management database based on the one or more data logging policies;

designate, based at least in part on input from an employee owner of the mobile device the selected data as personal content data; and

selectively provide access to the personal content data based at least in part on a role associated with an administrative user such that a first group of administrative users is provided less restricted access to the personal content data than a second group of administrative users, wherein the employee owner and the administrative user are associated with the enterprise.

19. The media of claim 18, wherein the software operable when executed to register the mobile device with the enterprise by storing registration data for the mobile device in the device management database comprises software operable when executed to create and store a device object for the mobile device in the device management database, the device object comprising a device object identifier that uniquely identifies the mobile device, and wherein the software operable when executed to store the one or more group designations in the device management database comprises software operable when executed to associate the one or more group designations with the device object.

20. The media of claim 19, wherein the device management database comprises a plurality of first resources, each first resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein the mobile device comprises a plurality of second resources stored in the mobile device, each second resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein the software operable when executed to selectively log selected data comprises software operable when executed to:

log particular second resources stored in the mobile device based on the data logging policies.

21. The media of claim 20, wherein the software operable when executed to log particular second resources comprises software operable when executed to log one or more of:

second resources corresponding to a particular file type, file folder, or file directory based on the data logging policies;

second resources stored or modified at the mobile device within a particular period of time based on the data logging policies; and

second resources that have been tagged.

22. The media of claim 18, wherein the software operable when executed to selectively log selected data comprises software operable when executed to:

store application usage data in the device management database.

23. An apparatus comprising:

one or more processors; and

a memory coupled to the processors and tangibly storing one or more instructions, the processors operable when executing the instructions to;

register a mobile device with an enterprise by storing registration data for the mobile device in a device management database;

designate one or more group designations for the mobile device at least in part by designating the mobile device as being employee owned;

store the one or more group designations in the device management database, including by storing, in a device object comprising a data structure corresponding to the mobile device, data that associates the one or more group designations with the mobile device as represented in the device management database;

determine one or more data logging policies for the mobile device based at least in part on the data that associates the one or more group designations with the mobile device as represented in the device management database, and on previously stored data that associates the one or more data logging policies with the one or more group designations;

selectively log selected data from the mobile device in the device management database based on the one or more data logging policies;

designate, based at least in part on input from an employee owner of the mobile device the selected data as personal content data; and

selectively provide access to the personal content data based at least in part on a role associated with an administrative user such that a first group of administrative users is provided less restricted access to the personal content data than a second group of administrative users, wherein the employee owner and the administrative user are associated with the enterprise.

24. The apparatus of claim 23, wherein the processors operable when executing the instructions to register the mobile device with the enterprise by storing registration data for the mobile device in the device management database comprise processors operable when executing the instructions to create and store a device object for the mobile device in the device management database, the device object comprising a device object identifier that uniquely identifies the mobile device, and wherein the processors operable when executing the instructions to store the one or more group designations in the device management database comprise processors operable when executing the instructions to associate the one or more group designations with the device object.

25. The apparatus of claim 24, wherein the device management database comprises a plurality of first resources, each first resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein the mobile device comprises a plurality of second resources stored in the mobile device, each second resource comprising a file or other data structure and metadata associated with the file or other data structure, and wherein the processors operable when executing the instructions to selectively log selected data comprise processors operable when executing the instructions to:

log particular second resources stored in the mobile device based on the data logging policies.

26. The apparatus of claim 25, wherein the processors operable when executing the instructions to log particular second resources comprise processors operable when executing the instructions to log one or more of:

second resources corresponding to a particular file type, file folder, or file directory based on the data logging policies;

second resources stored or modified at the mobile device within a particular period of time based on the data logging policies; and

second resources that have been tagged.

27. The apparatus of claim 24, wherein the processors operable when executing the instructions to selectively log selected data comprise processors operable when executing the instructions to:

store application usage data in the device management database.