Device policy manager

• US 9,848,330 B2
• Filed: 02/09/2015
• Issued: 12/19/2017
• Est. Priority Date: 04/09/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Kaufman, Peter J., Zhu, Yuhang, Spaith, John Chadwell, Hou, Justin, Prabhu, Sonia
• Primary Examiner(s): Siddiqui, Kashif
• Application Number:
  US14/617,447
• Publication Number:
  US 20150296368A1
• Time in Patent Office: 1,044 Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 41/0873 Checking configuration conflicts between network elements
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Various technologies described herein pertain to policy management on a mobile device. The mobile device includes a device policy manager system that includes a unified interface component and a policy handler component. The unified interface component is configured to receive policy configuration requests from multiple policy sources, including at least an internal policy source component executed by the mobile device and a device management server external to the mobile device. The policy configuration requests include at least a first policy configuration request (a first policy value for a policy) from a first policy source and a second policy configuration request (a second policy value for the policy) from a second policy source. The policy handler component is configured to resolve the conflict between the first and second policy values based on a conflict resolution technique to set a current policy value for the policy that controls the mobile device.

Claims

1. A mobile device, comprising:

at least one processor; and

computer-readable storage that comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including;

receiving policy configuration requests from multiple policy sources, the policy configuration requests comprising at least;

a first policy configuration request from a first policy source, the first policy configuration request comprising a first policy value for a policy; and

a second policy configuration request from a second policy source, the second policy configuration request comprising a second policy value for the policy, the first policy source differing from the second policy source, and the first policy value conflicting with the second policy value; and

resolving the conflict between the first policy value and the second policy value for the policy based on a conflict resolution technique to set a current policy value for the policy that controls the mobile device, the conflict between the first policy value and the second policy value for the policy being resolved without trust between the first policy source and the second policy source being established on the mobile device.

2. The mobile device of claim 1, wherein:

the first policy configuration request further comprises an identifier of the first policy source and an indicator that specifies the policy;

the second policy configuration request further comprises an identifier of the second policy source and the indicator that specifies the policy; and

the identifier of the first policy source differs from the identifier of the second policy source.

3. The mobile device of claim 1, the conflict resolution technique specifying respective authority levels for policy source types, and the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

using the conflict resolution technique to set the current policy value for the policy based on a first authority level of the first policy source and a second authority level of the second policy source.

4. The mobile device of claim 3, the conflict resolution technique specifying the respective authority levels for the policy source types for a group of policies, the group of policies comprising the policy, and the conflict resolution technique specifying differing respective authority levels for the policy source types for a differing group of policies that lacks the policy.

5. The mobile device of claim 1, the first policy source being an enterprise device management server having a given authority level, the conflict resolution technique specifying a prohibition of policy sources having the given authority level from setting the current policy value of the policy, the first policy configuration request being a signed policy configuration request signed by a trusted policy source of the mobile device, and the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

overriding the prohibition specified by the confliction resolution technique based on the signed policy configuration request.

6. The mobile device of claim 1, the computer-readable storage further comprising a policy manager metabase store;

and

the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including;

writing the first policy value for the policy to a first source policy store of the policy manager metabase store, the first source policy store corresponding to the first policy source;

writing the second policy value for the policy to a second source policy store of the policy manager metabase store, the second source policy store corresponding to the second policy source;

determining the current policy value for the policy using the conflict resolution technique based at least on the first policy value from the first source policy store and the second policy value from the second source policy store; and

writing the current policy value for the policy to a current policy store of the policy manager metabase store.

7. The mobile device of claim 1, the computer-readable storage further comprising a policy manager metabase store, the policy manager metabase store comprising respective policy stores for the multiple policy sources;

and

the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including;

permitting the first policy source to access a first source policy store for the first policy source;

permitting the second policy source to access a second source policy store for the second policy source;

restricting the first policy source from access to the second source policy store; and

restricting the second policy source from access to the first source policy store.

8. The mobile device of claim 1, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

controlling the conflict resolution technique used by the mobile device for the policy based on a conflict resolution handling setting received from a particular policy source and an authority level of the particular policy source.

9. The mobile device of claim 1, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

arbitrating between conflict resolution handling settings received from two or more of the multiple policy sources based on respective authority levels of the two or more of the multiple policy sources to choose a selected conflict resolution handling setting; and

controlling the conflict resolution technique used by the mobile device for the policy based on the selected conflict resolution handling setting.

10. The mobile device of claim 1, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

receiving a conflict resolution handling setting from a particular policy source;

detecting an established trust between the particular policy source and a trusted policy source of the mobile device; and

responsive to detection of the established trust, controlling the conflict resolution technique used by the mobile device for the policy based on the conflict resolution handling setting.

11. The mobile device of claim 1, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

detecting whether a given conflict resolution technique used by the mobile device to resolve the conflict for the policy causes an undesirable state of the mobile device; and

controlling the conflict resolution technique used by the mobile device for the policy based on whether the given conflict resolution technique causes the undesirable state, controlling the conflict resolution technique used by the mobile device for the policy further comprises;

maintaining the given conflict resolution technique as the conflict resolution technique based on detecting that the given conflict resolution technique does not cause the undesirable state; and

modifying the given conflict resolution technique to be the conflict resolution technique based on detecting that the given conflict resolution technique causes the undesirable state.

12. The mobile device of claim 1, the multiple policy sources further comprising a mobile operator management server, a messaging server, and a mobile device management server.

13. The mobile device of claim 1, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

reevaluating the current policy value for the policy responsive to the mobile device un-enrolling from the first policy source.

19. The mobile device of claim 1, the multiple policy sources comprising at least an internal policy source configured to be executed by the at least one processor of the mobile device and a device management server external to the mobile device.

20. The mobile device of claim 19, the internal policy source comprising at least one of an application executed by the at least one processor of the mobile device or a device user interface of the mobile device.

14. A mobile device, comprising:

at least one processor; and

computer-readable storage that comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including;

receiving a conflict resolution handling setting from a particular policy source, the conflict resolution handling setting specifies a conflict resolution technique for a policy;

controlling the mobile device to use the conflict resolution technique for the policy based on the conflict resolution handling setting from the particular policy source and an authority level of the particular policy source;

receiving configuration requests from multiple policy sources, the configuration requests being separate from the conflict resolution handling setting, the configuration requests comprise differing policy configuration requests provided by differing policy sources that specify differing policy values for the policy; and

resolving a conflict between the differing policy values for the policy specified in the differing policy configuration requests provided by the differing policy sources based on the conflict resolution technique used by the mobile device for the policy to set a current policy value for the policy that controls the mobile device.

15. The mobile device of claim 14, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

arbitrating between the conflict resolution handling setting from the particular policy source and at least one disparate conflict resolution handling setting from at least one disparate policy source based on respective authority levels to choose a selected conflict resolution handling setting used to control the conflict resolution technique for the policy.

16. The mobile device of claim 14, the computer-readable storage further comprises computer-executable instructions that, when executed by the at least one processor, cause the at least one processor to perform acts including:

detecting an established trust between the particular policy source and a trusted policy source of the mobile device, wherein the particular policy source is prohibited from controlling the conflict resolution technique used by the mobile device for the policy based on the authority level of the particular policy source in absence of the established trust; and

responsive to detection of the established trust, controlling the conflict resolution technique used by the mobile device for the policy based on the conflict resolution handling setting.

17. A method of managing policies on a mobile device, comprising:

receiving policy configuration requests from multiple policy sources, the multiple policy sources comprising at least an internal policy source executed by the mobile device and a device management server external to the mobile device, the policy configuration requests comprising at least;

a first policy configuration request from a first policy source, the first policy configuration request comprising a first policy value for a policy; and

a second policy configuration request from a second policy source, the second policy configuration request comprising a second policy value for the policy, the first policy source differing from the second policy source, and the first policy value conflicting with the second policy value;

resolving the conflict between the first policy value and the second policy value for the policy based on a conflict resolution technique without trust between the first policy source and the second policy source being established on the mobile device; and

responsive to resolving the conflict, setting a current policy value for the policy that controls the mobile device.

18. The method of claim 17, further comprising controlling the conflict resolution technique used to resolve the conflict for the policy.