Mobile device management as a simplified online software service

• US 9,083,752 B2
• Filed: 10/01/2013
• Issued: 07/14/2015
• Est. Priority Date: 10/01/2013
• Status: Active Grant

• Current Assignee: Codeproof Technologies, Inc.
• Original Assignee: Codeproof Technologies, Inc.
• Inventors: Shetty, Satish Kumar
• Primary Examiner(s): Hao, Dao
• Application Number:
  US14/043,796
• Publication Number:
  US 20150095970A1
• Time in Patent Office: 651 Days
• Field of Search: 726/6, 726/30, 713/156
• US Class Current: 1/1
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

Technology is disclosed for implementing a mobile device management service. The technology includes a first computing device behind a first firewall, for providing device management as a software as a service that is configured to (a) receive one or more policies from an entity, the entity managing a second server computing device that is behind a second firewall, wherein the first firewall and the second firewall are different firewalls, further wherein at least one of the received policies is indicated to pertain to a group of mobile computing devices; and (b) upon receiving a communication from a mobile computing device belonging to the group of mobile computing devices, transmit to the mobile computing device the received policy pertaining to the group of mobile computing devices, wherein the received policy specifies a condition for future communications between the mobile computing device and the second server computing device.

Claims

1. A method, performed by a first server computing device implementing a mobile device management device, the first server computing device behind a first firewall, for providing device management as a software as a service, comprising the steps of:

communicating with a middle tier via a web services component to retrieve one or more policies from an entity, the entity managing a second server computing device that is behind a second firewall, wherein the first firewall and the second firewall are different firewalls, further wherein at least one of the received policies is indicated to pertain to a group of mobile computing devices;

upon receiving a communication from a mobile computing device belonging to the group of mobile computing devices, transmitting to the mobile computing device the received policy pertaining to the group of mobile computing devices, wherein the received policy specifies a condition for future communications between the mobile computing device and the second server computing device, further wherein the first server computing device has a digital certificate relating to the mobile device management service and the second server computing device does not have a digital certificate relating to the mobile device management service;

enforcing the received policy via a plugin component that communicates with the middle tier via the web services component, wherein the plugin component is installed in the second server computing device;

receiving one or more policies from a second entity, the second entity managing a third server that is behind a third firewall, wherein the first firewall, the second firewall, and the third firewall are different firewalls, further wherein at least one of the received policies is indicated to pertain to a second group of mobile computing devices, and the third server does not have a digital certificate relating to the mobile device management device; and

permitting or disallowing actions when the mobile device is within a specified geographical area.

2. The method of claim 1, further comprising the steps of:

providing an expandable user interface to enable an administrator to select the group of mobile computing devices and configure the policy pertaining to the group of mobile computing devices.

3. The method of claim 1, further comprising the steps of:

providing a mobile device management application programmatic interface (API), wherein software executing at a mobile computing device can employ the API to communicate with the first server computing device.

4. The method of claim 1, wherein the second server computing device is an electronic mail server that receives information from the first server computing device and determines whether to enable electronic mail communications between mobile computing device and the electronic mail server.

5. The method of claim 1, wherein the policy pertaining to the group of mobile computing device inherits aspects of a policy from a different policy pertaining to a group of mobile computing devices.

6. A non-transitory computer-readable recording medium comprising:

instructions for communicating with a middle tier via a web services component to receive one or more policies from an entity, the entity managing a second server computing device that is behind a second firewall, wherein at least one of the received policies is indicated to pertain to a group of mobile computing devices;

instructions for transmitting, upon receiving a communication from a mobile computing device belonging to the group of mobile computing devices, to the mobile computing device the received policy pertaining to the group of mobile computing devices, wherein the received policy specifies a condition for future communications between the mobile computing devices and the second server computing device, further wherein the second server computing device does not have a digital certificate relating to the mobile device management service;

instructions for enforcing the received policy via a plugin component that communicates with the middle tier via the web services component, wherein the plugin component is installed in the second server computing device;

instructions for receiving one or more policies from a second entity, the second entity managing a third server that is behind a third firewall, wherein the second firewall and the third firewall are different firewalls, further wherein at least one of the received policies is indicated to pertain to a second group of mobile computing devices, and the third server does not have a digital certificate relating to the mobile device management device; and

instructions for permitting actions when the mobile computing device is located in an unrestricted area and disallowing actions when the mobile computing device is located in a restricted area.

7. The non-transitory computer-readable recording medium of claim 6, further comprising instructions for providing an expandable user interface to enable an administrator to select the group of mobile computing devices and configure the policy pertaining to the group of mobile computing devices.

8. The non-transitory computer-readable recording medium of claim 6, further comprising instructions for providing a mobile device management application programmatic interface (API), wherein software executing at a mobile computing device can employ the API to communicate with a first server computing device, wherein the first server computing device has a digital certificate relating to the mobile device management service.

9. The non-transitory computer-readable recording medium of claim 6, further comprising instructions defining a component, operating in association with an electronic mail server operating behind the second firewall, that receives information from a first server computing device and determines whether to enable electronic mail communications between mobile computing device and electronic mail server, wherein the first server computing device has a digital certificate relating to the mobile device management service.

10. The non-transitory computer-readable recording medium of claim 6, wherein the policy pertaining to the group of mobile computing device inherits aspects of a policy from a different policy pertaining to a different group of mobile computing devices.

11. A system comprising:

a group of mobile computing devices;

a first server computing device implementing a mobile device management service for providing device management as a software as a service, the first server computing device behind a first firewall, wherein upon receiving an enrollment request from a mobile computing device belonging to the group of mobile computing devices, transmits a document to the mobile computing device to enforce at least one policy, further wherein the first server computing device has a digital certificate relating to the mobile device management service;

the first server computer device communicating with a middle tier via a web services component to retrieve the policy from an entity, the entity managing a second server computing device that is behind a second firewall, wherein the first firewall and the second firewall are different firewalls, wherein the second server computing device transmits the document to the first server computing device, wherein second server computing device behind the second firewall exchanges information with the mobile computing device only if the mobile computing device complies with the policy, further wherein the second server computing device does not have a digital certificate relating to the mobile device management service;

the second server computing device having a plugin component that communicates with the middle tier via the web services component to enforce the policy, wherein the policy specifies permitted or disallowed actions when the mobile computing device is located within a specified geographical area; and

the first server computer device communicating with the middle tier via the web services component to retrieve the policy from a second entity, the second entity managing a third server computing device that is behind a third firewall, wherein the first firewall, the second firewall, and the third firewall are different firewalls, wherein the third server computing device transmits the document to the first server computing device, wherein third server computing device behind the third firewall exchanges information with the mobile computing device only if the mobile computing device complies with the policy, further wherein the third server computing device does not have a digital certificate relating to the mobile device management service.

12. The system of claim 11, further comprising an administrator console configured to enable an administrator to configure the policy.

13. The system of claim 11, further comprising an application programmatic interface (API) service associated with the first server computing device.

14. The system of claim 11, wherein data on at least one mobile computing device belonging to the group of mobile computing devices is deleted upon receiving a command from the first server computing device.

15. The system of claim 11, wherein data on at least one mobile computing device belonging to the group of mobile computing devices is unable to exchange data with the second server computing device because it does not comply with a password policy.

16. The system of claim 11, wherein the policy specifies a whitelist or blacklist, wherein the whitelist specifies the only applications that the mobile computing device is permitted to execute and the blacklist specifies the applications that the mobile computing device is not permitted to execute.