Policy-based application management

• US 8,806,570 B2
• Filed: 10/03/2013
• Issued: 08/12/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US14/044,901
• Publication Number:
  US 20140040977A1
• Time in Patent Office: 313 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method comprising:

receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;

receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the mobile device, the managed application limited by the access controls defined in the set of policy files and enforced by the mobile device management system,

wherein the set of one or more policy files, when applied to the managed application, cause the managed application to restrict a data sharing feature available to one or more unmanaged applications executing on the electronic mobile device.

2. The method of claim 1, wherein the data sharing feature comprises an unrestricted cut and paste feature exposed by an operating system of the electronic mobile device.

3. The method of claim 1, wherein the data sharing feature comprises a URL dispatch feature, and wherein the set of one or more policy files act to prevent the managed application from performing a URL dispatch.

4. The method of claim 1, wherein the data sharing feature comprises a dictation feature, and wherein the set of one or more policy files act to prevent the managed application from permitting a user to use the dictation feature from within the managed application.

5. The method of claim 1, wherein the data sharing feature comprises a content provider API, and wherein the set of one or more policy files act to prevent the managed application from calling the content provider API.

6. The method of claim 1, wherein the data sharing feature comprises a remote procedure call, and wherein the set of one or more policy files act to prevent the managed application from calling the remote procedure call.

7. The method of claim 1, wherein the data sharing feature comprises a memory sharing feature, and wherein the set of one or more policy files act to prevent the managed application from writing data to memory shared with an unmanaged application.

8. Non-transitory computer readable media storing

instructions that, when executed, cause a system to perform:

receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;

receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the mobile device, the managed application limited by the access controls defined in the set of policy files and enforced by the mobile device management system,

wherein the set of one or more policy files, when applied to the managed application, cause the managed application to restrict a data sharing feature available to one or more unmanaged applications executing on the electronic mobile device.

9. The computer readable media of claim 8, wherein the data sharing feature comprises an unrestricted cut and paste feature exposed by an operating system of the electronic mobile device.

10. The computer readable media of claim 8, wherein the data sharing feature comprises a URL dispatch feature, and wherein the set of one or more policy files act to prevent the managed application from performing a URL dispatch.

11. The computer readable media of claim 8, wherein the data sharing feature comprises a dictation feature, and wherein the set of one or more policy files act to prevent the managed application from permitting a user to use the dictation feature from within the managed application.

12. The computer readable media of claim 8, wherein the data sharing feature comprises a content provider API, and wherein the set of one or more policy files act to prevent the managed application from calling the content provider API.

13. The computer readable media of claim 8, wherein the data sharing feature comprises a remote procedure call, and wherein the set of one or more policy files act to prevent the managed application from calling the remote procedure call.

14. The computer readable media of claim 8, wherein the data sharing feature comprises a memory sharing feature, and wherein the set of one or more policy files act to prevent the managed application from writing data to memory shared with an unmanaged application.

15. An apparatus comprising:

a processor; and

memory storing computer readable instructions that, when executed by the processor, cause the apparatus to perform;

receiving, by a processor of an electronic mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;

receiving, by the processor, the set of one or more policy files from the application server during a second communication which is different than the first communication, the set of one or more policy files being stored on the electronic mobile device separately from the managed application; and

running, by the processor, the managed application on the mobile device, the managed application limited by the access controls defined in the set of policy files and enforced by the mobile device management system,

wherein the set of one or more policy files, when applied to the managed application, cause the managed application to restrict a data sharing feature available to one or more unmanaged applications executing on the electronic mobile device.

16. The apparatus of claim 15, wherein the data sharing feature comprises an unrestricted cut and paste feature exposed by an operating system of the electronic mobile device.

17. The apparatus of claim 15, wherein the data sharing feature comprises a URL dispatch feature, and wherein the set of one or more policy files act to prevent the managed application from performing a URL dispatch.

18. The apparatus of claim 15, wherein the data sharing feature comprises a dictation feature, and wherein the set of one or more policy files act to prevent the managed application from permitting a user to use the dictation feature from within the managed application.

19. The apparatus of claim 15, wherein the data sharing feature comprises a content provider API, and wherein the set of one or more policy files act to prevent the managed application from calling the content provider API.

20. The apparatus of claim 15, wherein the data sharing feature comprises a remote procedure call, and wherein the set of one or more policy files act to prevent the managed application from calling the remote procedure call.