Mobile application management systems and methods thereof

• US 9,405,723 B2
• Filed: 05/02/2012
• Issued: 08/02/2016
• Est. Priority Date: 05/02/2012
• Status: Active Grant

• Current Assignee: Kony, Inc. (Temenos AG)
• Original Assignee: Kony, Inc. (Temenos AG)
• Inventors: Koneru, Raj Kumar, Iyer, Vivek, Perumal, Aravind, Vagvala, Vamsi Krishna, Dasari, Pattabhi Rama Rao, Deshpande, Prajakt, Komandur, Rajendra, Ramanathan, Sriram, Terry, Matthew, Vennapusala, Sathyanarayana
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): MURPHY, JOSEPH B
• Application Number:
  US13/462,354
• Publication Number:
  US 20130298185A1
• Time in Patent Office: 1,553 Days
• Field of Search: 726/1, 709/223
• US Class Current: 1/1
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

A mobile application management through policy inclusion using centralized enforcement libraries is disclosed. The method includes storing independently developed mobile applications on at least one server. The method further includes storing independently developed policies associated with each of the independently developed mobile applications on the at least one server. The method further includes associating a policy of the stored independently developed policies with any of the mobile applications of the independently developed mobile applications. The method further includes providing the associated policy and mobile application to a mobile device where the enforcement libraries restrict the app as instructed by the policy.

Claims

1. A method comprising:

storing independently developed mobile applications on at least one server;

storing independently developed policies on the at least one server, wherein the independently developed policies are developed independent of content of the independently developed mobile applications, such that the independently developed mobile applications are developed without knowledge of the independently developed policies, and each independently developed policy includes a reusable library of application policy enforcements that are combinable with each of the independently developed mobile applications;

associating a policy of the stored independently developed policies with any of the mobile applications of the independently developed mobile applications; and

providing the associated policy and mobile application to a mobile device.

2. The method of claim 1, wherein:

the independently developed policies combined with any enterprise mobile application of the independently developed mobile applications, and

the independently developed mobile applications continue to use existing application program interfaces (API) of an operating system of the mobile device.

3. The method of claim 2, wherein:

the independently developed policies are a security layer between runtime code of the independently developed mobile applications and the operating system of the mobile device; and

the policy runs on the API of the operating system of the mobile device and independent of the mobile application.

4. The method of claim 3, wherein the policy running on the API of the operating system of the mobile device provides instructions to the operating system, prior to running the associated mobile application.

5. The method of claim 2, wherein:

the policy is updated at run time of the mobile application; and

the policy is updated by one of a pull operation and push operation from the at least one server and is combined with any of the independently developed mobile applications based on predetermined factors.

6. The method of claim 5, wherein the predetermined factors include at least one of application ID, device platform, specific DeviceID, specific userid, device characteristics and user group information.

7. The method of claim 2, further comprising:

receiving a query for an updated policy;

determining that the updated policy exists; and

providing the updated policy to the mobile device.

8. The method of claim 7, further providing a time stamp of a last update of the policy.

9. The method of claim 1, further comprising providing a unique policy for a userID and/or DeviceID to wipe and lock each mobile application that contains the unique policy.

10. A computer program product comprising computer readable program instructions stored on a non-transitory computer readable storage medium, the computer readable program instructions causing a computing device to:

retrieve independently developed mobile applications, which run on existing APIs of a mobile device;

retrieve one or more independently developed policies, which run through existing APIs of an operating system of the mobile device, wherein the independently developed policies are developed independent of content of the independently developed mobile applications and each independently developed policy includes a reusable library of application policy enforcements that are combinable with each of the independently developed mobile applications; and

provide a policy of the one or more independently developed policies and a mobile application to be independently executed on a mobile device, by having the policy run on the existing API of the operating system of the mobile device and independent of the mobile application, wherein the policy defines restrictions of application commands that are enforced while the mobile application is running on the mobile device,

wherein one of;

(i) each time the mobile application is started on the mobile device, the application policy enforcements of the policy are configured to be sent to specific APIs of the existing APIs of the operating system to set the restrictions for an application session, and (ii) while the mobile application is running on the mobile device, the application policy enforcements of the policy are configured to validate each API call from the mobile application to the operating system based on the restrictions.

11. A system implementing policies on a mobile device and associated with at least one mobile application, comprising:

a mobile application management server, comprising;

a portal for receiving independently developed mobile applications and one or more policies;

a repository for storing the independently developed mobile applications;

a repository for storing the one or more policies, wherein the one or more policies are developed independent of content of the independently developed mobile applications, such that the independently developed mobile applications are developed without knowledge of the independently developed polices, and each policy includes a reusable library of application policy enforcements that are combinable with each of the independently developed mobile applications; and

a service component to provide a policy of the stored policies and an associated mobile application of the mobile applications to a mobile device.

12. The system of claim 11, wherein the mobile application management server updates the policy and any subsequent updated policies by one of a pull operation and push operation at run time of the mobile application.

13. The system of claim 11, further comprising a component operable to:

receive a query for an updated policy;

determine that the updated policy exists;

block the mobile application from running on the mobile device based on the updated policy having not been downloaded and updated locally on the mobile device.

14. The system of claim 13, wherein the updated policy is based on at least one of application ID, device platform, specific DeviceID, specific userid, device characteristics and user group information.

15. The system of claim 11, wherein the mobile application management server provides a unique policy for at least one of a userID and DeviceID to wipe and lock each mobile application that contains the unique policy.

16. The system of claim 11, wherein:

the one or more policies combined with any enterprise mobile application of the independently developed mobile applications; and

the policy is appended to the mobile application such that both the policy and the mobile application are downloaded to the mobile device as combined components.

17. The system of claim 16, wherein:

the one or more policies are provided in a policy enforcement layer between an operating system of the mobile device and the independently developed mobile applications; and

the policy enforcement layer runs on an application program interface of the mobile device and independent of the mobile application.

18. The system of claim 11, wherein the mobile application management server is a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions.

19. A computer system for sending and receiving policies and mobile applications, the system comprising:

a CPU, a computer readable memory and a computer readable storage media;

first program instructions to retrieve independently developed mobile applications, which run on existing APIs of a mobile device;

second program instructions to retrieve one or more independently developed policies, which run through existing APIs of an operating system of the mobile device, wherein the one or more independently developed policies are created and updated regardless of content and underlying binary code of the independently developed mobile applications and each policy includes a reusable library of application policy enforcements that are combinable with each of the independently developed mobile applications; and

third program instructions to provide a policy of the one or more independently developed policies and a mobile application to be independently executed on a mobile device, by having the policy run on the existing API of the operating system of the mobile device and independent of the mobile application, wherein the policy defines restrictions of application commands that are enforced while the mobile application is running on the mobile device,

wherein the first, second and third program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.

20. The computer system of claim 19, further comprising fourth program instructions to send a push notification to update the policy to the mobile device, wherein the push notification, based on a failure to immediately update the policy, closes the mobile application until the policy is updated.

21. The computer system of claim 19, further comprising fourth program instructions to wipe and lock a mobile application residing on the mobile device.

22. The computer system of claim 19, further comprising fourth program instructions to receive a request for an updated policy, determine there is an updated policy for the mobile application or the mobile device and sending the updated policy to the mobile device.

23. The computer system of claim 19, further comprising fourth program instructions to request an updated policy, receive the updated policy from a server and execute the updated policy on the mobile device.

24. The computer system of claim 19, wherein:

the independently developed policies combined with any enterprise mobile application of the independently developed mobile applications;

the independently developed policies provide a policy enforcement application layer between the operating system of the mobile device and the independently developed mobile applications when running on the mobile device;

the policy runs on the API of an operating system of the mobile device and independent of the mobile application; and

one of;

(i) while the mobile application is running on the mobile device, the operating system will not execute any application command that violates a restriction communicated by the policy enforcement application layer, and (ii) while the mobile application is running on the mobile device, the policy enforcement application layer validates an API call from the mobile application and passes valid API calls to the operating system and blocks invalid API calls.

25. A method, comprising:

receiving and storing a mobile application at a mobile device;

receiving and storing a policy at the mobile device, wherein the policy is associated with the mobile application; and

executing the policy through an application program interface (API) of an operating system of the mobile application, prior to the mobile application, wherein;

the mobile application is received from a mobile application management server comprising a plurality of mobile applications;

the policy is developed independent of content of the mobile application and is received from a reusable library of application policy enforcements that are combinable with each of the plurality of mobile applications including the received mobile application;

the policy provides a security layer between the mobile application and an operating system of the mobile device;

the policy runs independent of the mobile application;

the policy runs through the operating system of the mobile device, prior to the mobile application, to apply enforcement rules for the mobile application; and

the executing the policy comprises running the policy on the mobile device without connection to a policy resource that is external to the mobile device.