Wrapping unmanaged applications on a mobile device

• US 9,971,585 B2
• Filed: 06/26/2015
• Issued: 05/15/2018
• Est. Priority Date: 10/16/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Walker, James, Lang, Zhongmin, Barton, Gary, Aravindakshan, Vipin
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Franco, Christopher J
• Application Number:
  US14/752,132
• Publication Number:
  US 20160378451A1
• Time in Patent Office: 1,054 Days
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/316 Aspect-oriented programming techniques
• CPC Class Codes: G06F 8/34 Graphical or visual programming
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/62 Uninstallation
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 8/72 Code refactoring
• CPC Class Codes: G06F 8/76 Adapting program code to run in a different environment; Porting
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition

Abstract

Methods and systems are disclosed for providing approaches to generating managed applications from unmanaged applications on a mobile device. The methods and systems may include storing, by a mobile device in a memory of the mobile device, one or more unmanaged applications each comprising a corresponding application bundle and decoding, by the mobile device, the retrieved application bundle corresponding to the first unmanaged application. The methods and systems may also include modifying, by the mobile device, the decoded application bundle corresponding to the first unmanaged application by adding a set of one or more policy-based control instructions, compiling, by the mobile device, the modified application bundle to generate a first managed application, the first managed application being configured to operate in accordance with the set of one or more policy-based control instructions, and providing, by the mobile device, the first managed application.

Claims

1. A method comprising:

storing, in a memory, one or more unmanaged applications each comprising a corresponding application bundle;

retrieving metadata associated with the one or more unmanaged applications;

displaying, via a user interface, one or more selectable objects, each of the one or more selectable objects corresponding to an unmanaged application of the one or more unmanaged applications, each displayed selectable object comprising the retrieved metadata associated with the corresponding unmanaged application;

receiving, via the user interface, a selection of a first selectable object of the one or more selectable objects, the first selectable object associated with a first unmanaged application of the one or more unmanaged applications;

retrieving, from the memory and based on the selection of the first selectable object, an application bundle corresponding to the first unmanaged application;

decoding the retrieved application bundle corresponding to the first unmanaged application to generate a decoded application bundle corresponding to the first unmanaged application;

modifying the decoded application bundle corresponding to the first unmanaged application, to generate a modified application bundle, by adding, to the decoded application bundle corresponding to the first unmanaged application;

a set of one or more policy-based control instructions,

a hook configured to call instructions in a library file, and

the library file;

compiling the modified application bundle to generate a first managed application, the first managed application configured to operate in accordance with the set of one or more policy-based control instructions; and

providing the first managed application for installation on a mobile device.

2. The method of claim 1, wherein providing the first managed application further comprises transmitting, by a first device, the first managed application to a second device different than the first device.

3. The method of claim 1, wherein each step of the method is performed by the mobile device.

4. The method of claim 1, comprising:

based on the set of one or more policy-based control instructions, restricting each managed application to only be able to communicate with other managed applications and trusted enterprise resources.

5. The method of claim 1, comprising:

receiving, via the user interface, a selection of an option to operate the first unmanaged application in an unmanaged mode or in a managed mode;

based on the selection of the option to operate the first unmanaged application in the unmanaged mode, starting the first unmanaged application; and

based on the selection of the option to operate the first unmanaged application in the managed mode, starting the first managed application.

6. The method of claim 1, wherein providing the first managed application for installation on a mobile device comprises providing the first managed application for installation on the mobile device via an application store.

7. The method of claim 1, comprising:

based on the set of one or more policy-based control instructions, causing the first managed application to;

pair with a client agent on first launch of the first managed application;

initialize a secure channel between the first managed application and the client agent; and

receive, from the client agent, a policy for the first managed application.

8. The method of claim 1, comprising:

based on the set of one or more policy-based control instructions, causing the first managed application to;

make a vault available only after an online authentication; and

limit offline access to the vault to at most a policy refresh period before the online authentication is again required.

9. The method of claim 1, comprising:

based on the set of one or more policy-based control instructions, causing the first managed application to;

set a hidden property of a key window, the hidden property causing content currently displayed on a screen to be hidden during a screen shot of the screen.

10. The method of claim 1, comprising:

based on the set of one or more policy-based control instructions, causing the first managed application to;

disable an autocorrect feature of a keyboard when entering text into sensitive text fields of the first managed application.

11. The method of claim 1, comprising:

determining which of the one or more unmanaged applications could be wrapped; and

displaying, with each of the one or more selectable objects, whether the corresponding unmanaged application could be wrapped.

12. The method of claim 1, comprising:

sending instructions to an agent application to replace the library file of the first managed application with an updated library file.

13. The method of claim 1, comprising:

determining data associated with the first unmanaged application; and

importing the data associated with the first unmanaged application from the first unmanaged application to the first managed application for use in the first managed application.

14. A system, comprising:

at least one processor; and

at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to perform;

storing, in a memory, one or more unmanaged applications each comprising a corresponding application bundle;

retrieving, from the memory, metadata associated with the one or more unmanaged applications;

displaying, via a user interface, one or more selectable objects, each of the one or more selectable objects corresponding to an unmanaged application of the one or more unmanaged applications, each displayed selectable object comprising the retrieved metadata associated with the corresponding unmanaged application;

receiving, via the user interface, a selection of a first selectable object of the one or more selectable objects, the first selectable object associated with a first unmanaged application of the one or more unmanaged applications;

retrieving, from the memory and based on the selection of the first selectable object, an application bundle corresponding to the first unmanaged application;

decoding the retrieved application bundle corresponding to the first unmanaged application to generate a decoded application bundle corresponding to the first unmanaged application;

modifying the decoded application bundle corresponding to the first unmanaged application, to generate a modified application bundle, by adding, to the decoded application bundle corresponding to the first unmanaged application;

a set of one or more policy-based control instructions,

a hook configured to call instructions in a library file, and

the library file;

compiling the modified application bundle to generate a first managed application, the first managed application configured to operate in accordance with the set of one or more policy-based control instructions; and

providing the first managed application for installation on a mobile device.

15. The system of claim 14, wherein:

the decoding comprises accessing source code of the first unmanaged application, the source code comprising instructions for operating the first unmanaged application; and

the modifying comprises modifying the source code by adding the set of one or more policy-based control instructions to the instructions for operating the first unmanaged application.

16. The system of claim 14, wherein the storing further comprises storing a security certificate configured for the first unmanaged application, the security certificate being required by the first unmanaged application for execution on the mobile device, wherein the computer-readable instructions further cause the system to perform:

configuring the first managed application with the security certificate configured for the first unmanaged application;

installing, on the mobile device, the first managed application without uninstalling the first unmanaged application from the mobile device; and

executing, on the mobile device, the installed first managed application configured with the security certificate configured for the first unmanaged application.

17. The system of claim 14, wherein the storing further comprises storing a first security certificate configured for the first unmanaged application, the first security certificate being required by the first unmanaged application for execution on the mobile device, wherein the computer-readable instructions further cause the system to perform:

configuring the first managed application with a second security certificate, the second security certificate being different than the first security certificate and being required by the first managed application for execution on the mobile device;

uninstalling, from the mobile device, the first unmanaged application;

installing, on the mobile device, the first managed application; and

executing the installed first managed application configured with the second security certificate.

18. The system of claim 14, wherein the system is the mobile device.

19. One or more non-transitory computer-readable storage media having computer-readable instructions stored thereon, that when executed by one or more processors, cause a data processing system to perform:

storing, in a memory of the data processing system, one or more unmanaged applications each comprising a corresponding application bundle;

retrieving, from the memory, metadata associated with the one or more unmanaged applications;

displaying, via a user interface associated with the data processing system, one or more selectable objects, each of the one or more selectable objects corresponding to an unmanaged application of the one or more unmanaged applications, each displayed selectable object comprising the retrieved metadata associated with the corresponding unmanaged application;

receiving, via the user interface, a selection of a first selectable object of the one or more selectable objects, the first selectable object associated with a first unmanaged application of the one or more unmanaged applications;

retrieving, from the memory and based on the selection of the first selectable object, an application bundle corresponding to the first unmanaged application;

decoding the retrieved application bundle corresponding to the first unmanaged application to generate a decoded application bundle corresponding to the first unmanaged application;

modifying the decoded application bundle corresponding to the first unmanaged application, to generate a modified application bundle, by adding, to the decoded application bundle corresponding to the first unmanaged application;

a set of one or more policy-based control instructions,

a hook configured to call instructions in a library file, and

the library file;

compiling the modified application bundle to generate a first managed application, the first managed application configured to operate in accordance with the set of one or more policy-based control instructions; and

providing the first managed application for installation on a mobile device.

20. The computer-readable storage media of claim 19, wherein the storing further comprises storing a security certificate configured for the first unmanaged application, the security certificate being required by the first unmanaged application for execution on the mobile device, wherein the computer-readable instructions further cause the one or more processors to perform:

configuring the first managed application with the security certificate configured for the first unmanaged application;

installing, on the mobile device, the first managed application without uninstalling the first unmanaged application from the mobile device; and

executing, on the mobile device, the installed first managed application configured with the security certificate configured for the first unmanaged application.

21. The computer-readable storage media of claim 19, wherein the storing further comprises storing a first security certificate configured for the first unmanaged application, the first security certificate being required by the first unmanaged application for execution on the mobile device, wherein the computer-readable instructions further cause the one or more processors to perform:

configuring the first managed application with a second security certificate, the second security certificate being different than the first security certificate and being required by the first managed application for execution on the mobile device;

uninstalling, from the mobile device, the first unmanaged application;

installing, on the mobile device, the first managed application; and

executing the installed first managed application configured with the second security certificate.

22. The computer-readable storage media of claim 19, wherein the set of one or more policy-based control instructions comprise enterprise specific instructions for controlling interactions between the first managed application and one or more other components of the mobile device, wherein the enterprise specific instructions instruct the first managed application to operate in a manner different than the first unmanaged application.

23. The computer-readable storage media of claim 19, wherein the data processing system is the mobile device.