Management of unmanaged user accounts and tasks in a multi-account mobile application

• US 9,501,315 B2
• Filed: 01/10/2014
• Issued: 11/22/2016
• Est. Priority Date: 01/10/2014
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): WU, BENJAMIN C
• Application Number:
  US14/151,972
• Publication Number:
  US 20150199213A1
• Time in Patent Office: 1,047 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/48 Program initiating; Program switching, e.g. by interrupt
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods, systems, computer-readable media, and apparatuses for providing mobile application management (MAM) functionalities are presented. In some embodiments, a mobile device may initialize a partially managed application associated with a first managed user account and an unmanaged user account. The mobile device may execute first managed tasks associated with the first managed user account in accordance with a first set of MAM policies provided by a first MAM service provider. The mobile device may execute unmanaged tasks associated with the unmanaged account independent of the first set of MAM policies. In some embodiments, the mobile device may initialize the multi-account managed application associated with a second managed user account.

Claims

1. A method comprising:

initializing, at a mobile device, a partially managed application associated with a first managed user account of the partially managed application and an unmanaged user account of the partially managed application;

executing one or more first managed tasks associated with the first managed user account in accordance with a first set of mobile application management (MAM) policies provided by a first MAM service provider, wherein the executing the one or more first managed tasks includes communicating with a device external to the mobile device in a background context using an encryption protocol mandated by the first set of MAM policies; and

executing one or more unmanaged tasks associated with the unmanaged user account independent of the first set of MAM policies provided by the first MAM service provider wherein the executing the one or more unmanaged tasks includes communicating with a different device external to the mobile device in the background context without using the encryption protocol mandated by the first set of MAM policies.

2. The method of claim 1, further comprising:

executing a particular unmanaged task of the one or more unmanaged tasks; and

preventing a particular first managed task associated with the first managed user account from being executed when the particular first managed task if executed would violate the first set of MAM policies, wherein the particular first managed task is semantically equivalent to the particular unmanaged task.

3. The method of claim 1, further comprising:

after the executing the one or more unmanaged tasks has begun in a foreground context,

moving the one or more unmanaged tasks from the foreground context to the background context;

moving the one or more first managed tasks to the foreground context;

displaying managed information associated with the first managed user account when the one or more first managed tasks is within the foreground context; and

during the displaying, continuing execution of the one or more unmanaged tasks in the background context independent of the first set of MAM policies.

4. The method of claim 3, further comprising:

initiating the moving the one or more first managed tasks to the foreground context in response to a determination that the first managed user account is currently in focus based on one of a user input requesting the first managed user account, an indication that the mobile device is within a geofence of the first MAM service provider, an indication that the mobile device has established a network connection with the first MAM service provider, and a command received by the mobile device requesting the mobile device to move the one or more first managed tasks to the foreground context.

5. The method of claim 1, further comprising:

moving the one or more first managed tasks from a foreground context to the background context in response to a determination that the unmanaged user account is currently in focus;

moving the one or more unmanaged tasks from the background context to the foreground context;

blocking enforcement of the first set of MAM policies on continued execution of the one or more unmanaged tasks in the foreground context; and

during the blocking, continuing execution of the one or more first managed tasks in the background context in accordance with the first set of MAM policies.

6. The method of claim 5, wherein the blocking enforcement of the first set of MAM policies on continued execution of the one or more unmanaged tasks in the foreground context further comprises:

overriding the first set of MAM policies as applied to the one or more unmanaged tasks.

7. The method of claim 1, wherein the executing the one or more first managed tasks is independent of a second set of MAM policies provided by a second MAM service provider, the second set of MAM policies being different from the first set of MAM policies, the second MAM service provider being different from the first MAM service provider, the method further comprising:

executing one or more second managed tasks associated with a second managed user account of the partially managed application in accordance with the second set of MAM policies provided by the second MAM service provider and independent the first set of MAM policies provided by the first MAM service provider,

wherein the one or more second managed tasks are different from the one or more first managed tasks and the second managed user account is different from the first managed user account.

8. A method comprising:

initializing, at a mobile device, a multi-account managed application associated with a first managed user account of the multi-account managed application and a second managed user account of the multi-account managed application different from the first managed user account;

executing one or more first managed tasks associated with the first managed user account in accordance with a first set of mobile application management (MAM) policies provided by a first MAM service provider and independent of a second set of MAM policies provided by a second MAM service provider, wherein the second set of MAM policies is different from the first set of MAM policies and the second MAM service provider is different from the first MAM service provider;

executing one or more second managed tasks associated with the second managed user account in accordance with the second set of MAM policies provided by the second MAM service provider and independent of the first set of MAM policies provided by the first MAM service provider;

after the executing the one or more first managed tasks has begun in a foreground context,

moving the one or more first managed tasks from the foreground context to a background context;

moving the one or more second managed tasks to the foreground context;

displaying managed information associated with the second managed user account when the one or more second managed tasks is within the foreground context; and

during the displaying, continuing execution of the one or more first managed tasks in the background context independent of the second set of MAM policies.

9. The method of claim 8, further comprising:

executing a particular first managed task of the one or more first managed tasks; and

preventing a particular second managed task associated with the second managed user account from being executed when the particular second managed task if executed would violated the second set of MAM policies, wherein the particular first managed task is semantically equivalent to the particular second managed task.

10. The method of claim 8, further comprising:

initiating the moving the one or more second managed tasks to the foreground context in response to a determination that the second managed user account is currently in focus based on one of a user input requesting the second managed user account, an indication that the mobile device is within a geofence of the second MAM service provider, an indication that the mobile device has established a network connection with the second MAM service provider, and a command received by the mobile device requesting the mobile device to move the one or more second managed tasks to the foreground context.

11. The method of claim 8, further comprising:

moving the one or more second managed tasks from the foreground context to the background context in response to a determination that the first managed user account is currently in focus;

moving the one or more first managed tasks from the background context to the foreground context;

blocking enforcement of the second set of MAM policies on continued execution of the one or more first managed tasks in the foreground context in accordance with the first set of MAM policies and independent of the second set of MAM policies; and

during the blocking, continuing execution of the one or more second managed tasks in the background context in accordance with the second set of MAM policies and independent of the first set of MAM policies.

12. The method of claim 8,

wherein the executing the one or more first managed tasks associated with the first managed user account of the multi-account managed application in accordance with the first set of MAM policies provided by the first MAM service provider includes communicating with a device outside of the mobile device in the background context using a first encryption protocol mandated by the first set of MAM policies;

and

wherein the executing the one or more second managed tasks associated with the second managed user account of the multi-account managed application in accordance with the second set of MAM policies of the second MAM service provider includes communicating with a different device outside of the mobile device in the background context using a second encryption protocol mandated by the second set of MAM policies, wherein the second encryption protocol is different from the first encryption protocol.

13. The method of claim 8, further comprising:

executing one or more unmanaged tasks associated with an unmanaged user account of the multi-account managed application independent of the first set of MAM policies provided by the first MAM service provider and independent of the second set of MAM policies provided by the second MAM service provider.

14. A non-transitory storage medium storing machine-executable instructions that, when executed, cause a mobile device to:

initialize a partially managed application associated with a first managed user account of the partially managed application and an unmanaged user account of the partially managed application;

execute one or more first managed tasks associated with the first managed user account in accordance with a first set of mobile application management (MAM) policies provided by a first MAM service provider;

execute one or more unmanaged tasks associated with the unmanaged user account independent of the first set of MAM policies provided by the first MAM service provider;

move the one or more first managed tasks from a foreground context to a background context in response to a determination that the unmanaged user account is currently in focus;

move the one or more unmanaged tasks from the background context to the foreground context;

block enforcement of the first set of MAM policies on continued execution of the one or more unmanaged tasks in the foreground context independent of the first set of MAM policies; and

during blocked enforcement of the first set of MAM policies, continue execution of the one or more first managed tasks in the background context in accordance with the first set of MAM policies.

15. The non-transitory storage medium of claim 14, wherein the machine-executable instructions, when executed, further cause the mobile device to:

execute a particular unmanaged task of the one or more unmanaged tasks; and

prevent a particular first managed task associated with the first managed user account from being executed when the particular first managed task if executed would violate the first set of MAM policies, wherein the particular first managed task is semantically equivalent to the particular unmanaged task.

16. The non-transitory storage medium of claim 14, wherein the machine-executable instructions, when executed, further cause the mobile device to:

after execution of the one or more unmanaged tasks has begun in the foreground context,

move the one or more unmanaged tasks from the foreground context to the background context;

move the one or more first managed tasks to the foreground context;

display managed information associated with the first managed user account when the one or more first managed tasks is within the foreground context; and

during the display of the managed information, continue execution of the one or more unmanaged tasks in the background context independent of the first set of MAM policies.

17. The non-transitory storage medium of claim 16, wherein the machine-executable instructions, when executed, further cause the mobile device to:

initiate the moving the one or more first managed tasks to the foreground context in response to a determination that the first managed user account is currently in focus based on one of a user input requesting the first managed user account, an indication that the mobile device is within a geofence of the first MAM service provider, an indication that the mobile device has established a network connection with the first MAM service provider, and a command received by the mobile device requesting the mobile device to move the one or more first managed tasks to the foreground context.

18. The non-transitory storage medium of claim 14, wherein the machine-executable instructions, when executed, further cause the mobile device to:

execute one or more second managed tasks associated with a second managed user account of the partially managed application in accordance with a second set of MAM policies provided by a second MAM service provider and independent the first set of MAM policies,

wherein the one or more second managed tasks are different from the one or more first managed tasks, the second managed user account is different from the first managed user account, the second set of MAM policies is different from the first set of MAM policies, and the second MAM service provider is different from the first MAM service provider.