Mobile device management

• US 9,027,112 B2
• Filed: 05/08/2013
• Issued: 05/05/2015
• Est. Priority Date: 04/07/2010
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Freedman, Gordie, Rahardja, David
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US13/890,161
• Publication Number:
  US 20130247166A1
• Time in Patent Office: 727 Days
• Field of Search: 726/1, 726/3, 726/10, 380/259, 455/411
• US Class Current: 726/10
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

Methods and apparatuses that enroll a wireless device into an enterprise service with a management server addressed in a management profile are described. The enrollment may grant a control of configurations of the wireless device to the management server via the management profile. In response to receiving a notification from the management server, a trust of the notification may be verified against the management profile. If the trust is verified, a network session may be established with the management server. The network session may be secured via a certificate in the management profile. Management operations may be performed for management commands received over the secure network session to manage the configurations transparently to a user of the wireless device according to the control.

Claims

1. A method for receiving an enterprise service from a management server, the method comprising:

at a mobile device;

providing a control request to the management server for connecting the management server to the mobile device, wherein the control request includes a first identity variable and enables the mobile device to receive push notifications from a push network that connects the management server and the mobile device;

receiving, from the push network, a push notification that includes a second identity variable; and

when the first identity variable and the second identity variable match;

entering a wake mode for initiating a network session between the mobile device and the management server to securely provide the enterprise service to the mobile device during the network session.

2. The method of claim 1, further comprising:

storing a management profile including an address for the management server and a certificate for securing the network session.

3. The method of claim 2, wherein the management profile includes a control limitation defining a scope of management operations that can be performed by the enterprise service during the network session.

4. The method of claim 1, further comprising:

when the enterprise service performs a configuration change at the mobile device;

entering a sleep mode in response to receiving a sleep command from the management server.

5. The method of claim 1, further comprising:

when the first identity variable and the second identity variable do not match;

entering a sleep mode.

6. The method of claim 1, further comprising:

sending a device identifier to the management server for registering the mobile device with the enterprise service.

7. The method of claim 1, further comprising:

securing the network session by presenting, to the management server, a certificate associated with a management profile stored on the mobile device; and

sending a secure polling request for initiating a receipt of configuration commands from the management server.

8. A method for providing an enterprise service to a mobile device, the method comprising:

at a management server;

receiving, from the mobile device, a control request for connecting the management server to the mobile device, wherein the control request includes a first identity variable and enables the mobile device to receive push notifications from a push network that connects the management server and the mobile device;

causing a push notification that includes a second identity variable to be provided from the push network to the mobile device; and

when the first identity variable and the second identity variable match;

causing the mobile device to enter a wake mode for initiating a network session between the mobile device and the management server to securely provide the enterprise service to the mobile device during the network session.

9. The method of claim 8, further comprising:

generating a management profile configured to be stored in the mobile device, wherein the management profile defines a scope of configuration changes that the enterprise service can perform on the mobile device.

10. The method of claim 9, wherein the management profile includes a certificate for registering the mobile device with the enterprise service.

11. The method of claim 8, wherein the network session is separate from the push network.

12. The method of claim 8, further comprising:

when the first identity variable and the second identity variable do not match;

causing the mobile device to enter a sleep mode.

13. The method of claim 8, further comprising:

causing the mobile device to enter a sleep mode during execution of a command from the enterprise service.

14. An apparatus, comprising:

a processor; and

a memory storing instructions that when executed by the processor cause the apparatus to perform the steps of;

providing a control request to a management server for connecting the management server to the apparatus, wherein the control request includes a first identity variable and enables the apparatus to receive push notifications from a push network that connects the management server and the apparatus;

receiving, from the push network, a push notification that includes a second identity variable;

when the first identity variable and the second identity variable match;

entering a wake mode for initiating a network session between the apparatus and the management server to securely provide an enterprise service to the apparatus during the network session.

15. The apparatus of claim 14, further comprising:

validating the apparatus by providing a device identifier to the management server according to a check in protocol, and reporting, to the management server, changes made to the apparatus by the enterprise service.

16. The apparatus of claim 14, further comprising:

when the first identity variable and the second identity variable do not match;

entering a sleep mode.

17. The apparatus of claim 14, wherein the management server hosts the enterprise service, allowing the management server to remotely command changes of a configuration of the apparatus.

18. The apparatus of claim 14, further comprising:

securing the network session by presenting, to the management server, a certificate associated with a management profile stored on the apparatus; and

sending a secure polling request for initiating a receipt of configuration commands from the management server.

19. The apparatus of claim 14, wherein the memory stores a management profile corresponding to a control limitation defining a scope of management operations that can be performed by the enterprise service during the network session.

20. The apparatus of claim 14, further comprising:

exiting a sleep mode based on the push notification and matching the first identity variable and the second identity variable.