Policy-based application management

• US 8,799,994 B2
• Filed: 10/03/2013
• Issued: 08/05/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): PEARSON, DAVID J
• Application Number:
  US14/044,928
• Publication Number:
  US 20140033271A1
• Time in Patent Office: 306 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method of managing applications of an enterprise on a mobile device, comprising:

installing a set of managed applications of the enterprise on the mobile device, wherein one or more unmanaged applications are installed on the mobile device that are not part of the set of managed applications;

receiving a set of application policies, wherein each of the set of managed applications is associated with one or more policies of the set of application policies;

selectively allowing a first application of the set of managed applications to provide data to a second application installed on the mobile device, responsive to accessing a policy associated with the first application and reading an indication from the policy of the first application that the second application is a member of the set of managed applications; and

selectively blocking the first application from providing data to a third unmanaged application installed on the mobile device, responsive to accessing the policy of the first application and failing to read an indication from the policy of the first application that the third application is a member of the set of managed applications, wherein the third application is capable of receiving data from the first application,

wherein selectively allowing the first application of the set of managed applications to provide data to a second application installed on the mobile device includes displaying a list of managed applications including the second application and allowing the user to select an application from the list of managed applications, and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application installed on the mobile device includes displaying a list of managed applications excluding the third application, such that the user does not have an option to select the third application.

2. The method of claim 1, wherein the set of managed applications are divided into at least two groups, and wherein each managed application is restricted from sharing data with any application not a member of the same group.

3. The method of claim 1, wherein each of the set of managed applications is constrained to interact with other applications and services on the mobile device through its respective one or more application policies.

4. The method of claim 1,

wherein the mobile device runs an operating system extension that allows users to open a file by selecting from a group of applications compatible with a file type of the file,

wherein selectively allowing the first application of the set of managed applications to provide data to the second application includes displaying, by operation of the operating system extension, those applications that are both compatible with a file type of the file and are also part of the managed set of applications, and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application includes failing to display, by operation of the operating system extension, those applications that are not part of the managed set of applications.

5. The method of claim 4, wherein the operating system extension is Open-In.

6. The method of claim 1, further comprising:

displaying the third application in a list of selectable applications when the device is operating in an unmanaged mode.

7. One or more non-transitory computer readable media storing computer readable instructions that, when executed by an electronic mobile device, cause the device to perform application management by:

installing a set of managed applications of an enterprise on the mobile device;

installing one or more unmanaged applications on the mobile device that are not part of the set of managed applications;

receiving a set of application policies, wherein each of the set of managed applications is associated with one or more policies of the set of application policies;

selectively allowing a first application of the set of managed applications to provide data to a second application installed on the mobile device, responsive to accessing a policy associated with the first application and reading an indication from the policy of the first application that the second application is a member of the set of managed applications; and

selectively blocking the first application from providing data to a third unmanaged application installed on the mobile device, responsive to accessing the policy of the first application and failing to read an indication from the policy of the first application that the third application is a member of the set of managed applications, wherein the third application is capable of receiving data from the first application,

wherein selectively allowing the first application of the set of managed applications to provide data to a second application installed on the mobile device includes displaying a list of managed applications including the second application and allowing the user to select an application from the list of managed applications, and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application installed on the mobile device includes displaying a list of managed applications excluding the third application, such that the user does not have an option to select the third application.

8. The computer readable media of claim 7, wherein the set of managed applications are divided into at least two groups, and wherein each managed application is restricted from sharing data with any application not a member of the same group.

9. The computer readable media of claim 7, wherein each of the set of managed applications is constrained to interact with other applications and services on the mobile device through its respective one or more application policies.

10. The computer readable media of claim 7,

wherein the mobile device runs an operating system extension that allows users to open a file by selecting from a group of applications compatible with a file type of the file,

wherein selectively allowing the first application of the set of managed applications to provide data to the second application includes displaying, by operation of the operating system extension, those applications that are both compatible with a file type of the file and are also part of the managed set of applications, and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application includes failing to display, by operation of the operating system extension, those applications that are not part of the managed set of applications.

11. The computer readable media of claim 10, wherein the operating system extension is Open-In.

12. The computer readable media of claim 7, wherein the instructions further cause the device to display the third application in a list of selectable applications when the device is operating in an unmanaged mode.

13. An electronic mobile device, comprising:

a processor; and

memory storing computer readable instructions that, when executed by the device, cause the device to perform application management by;

installing a set of managed applications of an enterprise on the mobile device;

installing one or more unmanaged applications on the mobile device that are not part of the set of managed applications;

receiving a set of application policies, wherein each of the set of managed applications is associated with one or more policies of the set of application policies;

selectively allowing a first application of the set of managed applications to provide data to a second application installed on the mobile device, responsive to accessing a policy associated with the first application and reading an indication from the policy of the first application that the second application is a member of the set of managed applications; and

selectively blocking the first application from providing data to a third unmanaged application installed on the mobile device, responsive to accessing the policy of the first application and failing to read an indication from the policy of the first application that the third application is a member of the set of managed applications, wherein the third application is capable of receiving data from the first application,

wherein selectively allowing the first application of the set of managed applications to provide data to a second application installed on the mobile device includes displaying a list of managed applications including the second application and allowing the user to select an application from the list of managed applications and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application installed on the mobile device includes displaying a list of managed applications excluding the third application, such that the user does not have an option to select the third application.

14. The device of claim 13, wherein the set of managed applications are divided into at least two groups, and wherein each managed application is restricted from sharing data with any application not a member of the same group.

15. The device of claim 13, wherein each of the set of managed applications is constrained to interact with other applications and services on the mobile device through its respective one or more application policies.

16. The device of claim 13,

wherein the mobile device runs an operating system extension that allows users to open a file by selecting from a group of applications compatible with a file type of the file,

wherein selectively allowing the first application of the set of managed applications to provide data to the second application includes displaying, by operation of the operating system extension, those applications that are both compatible with a file type of the file and are also part of the managed set of applications, and

wherein selectively blocking the first application of the set of managed applications from providing data to the third application includes failing to display, by operation of the operating system extension, those applications that are not part of the managed set of applications.

17. The device of claim 13, wherein the computer readable instructions further cause the device to perform displaying the third application in a list of selectable applications when the device is operating in an unmanaged mode.