Mobile device management

• US 9,807,600 B2
• Filed: 05/04/2015
• Issued: 10/31/2017
• Est. Priority Date: 04/07/2010
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Freedman, Gordie, Rahardja, David
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): Lakhia, Viral
• Application Number:
  US14/703,834
• Publication Number:
  US 20150237498A1
• Time in Patent Office: 911 Days
• Field of Search: 726 3, 726 10, 726 4, 713169, 713170, 455411, 709203
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

Methods and apparatuses that enroll a wireless device into an enterprise service with a management server addressed in a management profile are described. The enrollment may grant a control of configurations of the wireless device to the management server via the management profile. In response to receiving a notification from the management server, a trust of the notification may be verified against the management profile. If the trust is verified, a network session may be established with the management server. The network session may be secured via a certificate in the management profile. Management operations may be performed for management commands received over the secure network session to manage the configurations transparently to a user of the wireless device according to the control.

Claims

1. A management server configured to provide an enterprise service to a mobile device, the management server comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the management server to;

receive, from the mobile device, a control request for connecting the management server to the mobile device, wherein the control request includes a first identity variable and enables the mobile device to receive push notifications from a push network that connects the management server and the mobile device;

cause a push notification that includes a second identity variable to be provided from the push network to the mobile device; and

when the first identity variable and the second identity variable match;

cause the mobile device to enter a wake mode for initiating a network session between the mobile device and the management server to securely provide the enterprise service to the mobile device during the network session.

2. The management server of claim 1, wherein the at least one processor further causes the management server to:

generate a management profile configured to be stored in the mobile device, wherein the management profile defines a scope of configuration changes that the enterprise service can perform on the mobile device.

3. The management server of claim 2, wherein the management profile includes a certificate for registering the mobile device with the enterprise service.

4. The management server of claim 1, wherein the network session is separate from the push network.

5. The management server of claim 1, wherein the at least one processor further causes the management server to, when the first identity variable and the second identity variable do not match:

cause the mobile device to enter a sleep mode.

6. The management server of claim 1, wherein the at least one processor further causes the management server to:

cause the mobile device to enter a sleep mode during execution of a command from the enterprise service.

7. A non-transitory computer readable storage medium configured to store instructions that, when executed by at least one processor included in a management server, cause the management server to provide an enterprise service to a mobile device, by carrying out steps that include:

receiving, from the mobile device, a control request for connecting the management server to the mobile device, wherein the control request includes a first identity variable and enables the mobile device to receive push notifications from a push network that connects the management server and the mobile device;

causing a push notification that includes a second identity variable to be provided from the push network to the mobile device; and

when the first identity variable and the second identity variable match;

causing the mobile device to enter a wake mode for initiating a network session between the mobile device and the management server to securely provide the enterprise service to the mobile device during the network session.

8. The non-transitory computer readable storage medium of claim 7, wherein the steps further include:

generating a management profile configured to be stored in the mobile device, wherein the management profile defines a scope of configuration changes that the enterprise service can perform on the mobile device.

9. The non-transitory computer readable storage medium of claim 8, wherein the management profile includes a certificate for registering the mobile device with the enterprise service.

10. The non-transitory computer readable storage medium of claim 7, wherein the steps further include:

when the first identity variable and the second identity variable do not match, causing the mobile device to enter a sleep mode.

11. The non-transitory computer readable storage medium of claim 7, wherein the steps further include:

causing the mobile device to enter a sleep mode during execution of a command from the enterprise service.