Providing mobile device management functionalities

• US 9,985,850 B2
• Filed: 09/13/2013
• Issued: 05/29/2018
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed
• Primary Examiner(s): Khan, Mehmood B.
• Assistant Examiner(s): WANG, WILLIAM Y
• Application Number:
  US14/025,898
• Publication Number:
  US 20140295821A1
• Time in Patent Office: 1,719 Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Methods, systems, computer-readable media, and apparatuses for providing mobile device management functionalities are presented. In various embodiments, a mobile device management agent may monitor state information associated with a mobile computing device. The monitored state information may be analyzed on the mobile computing device and/or by one or more policy management servers. In some instances, the one or more policy management servers may provide management information to the mobile computing device, and the management information may include one or more commands (which may, e.g., cause the mobile computing device to enforce one or more policies) and/or one or more policy updates. Subsequently, one or more policies may be enforced on the mobile computing device based on the monitored state information and/or based on the management information.

Claims

1. A method, comprising:

monitoring, by a mobile device management agent executed on a mobile computing device, state information associated with the mobile computing device, wherein monitoring the state information comprises providing at least some of the monitored state information to one or more policy management servers, wherein the one or more policy management servers are configured to receive device state information from the mobile device management agent executed on the mobile computing device, analyze the device state information received from the mobile device management agent executed on the mobile computing device, and return one or more commands to the mobile device management agent executed on the mobile computing device based on analyzing the device state information received from the mobile device management agent executed on the mobile computing device; and

enforcing one or more policies on a wrapped application on the mobile computing device based on the monitored state information,

wherein the wrapped application on the mobile computing device is wrapped using an application management framework that provides an application wrapper for the wrapped application on the mobile computing device,

wherein enforcing the one or more policies on the wrapped application comprises;

receiving management information from the one or more policy management servers; and

executing at least one command included in the received management information,

wherein executing the at least one command included in the received management information comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, the at least one command included in the received management information, causing the application wrapper for the wrapped application on the mobile computing device to execute the at least one command included in the received management information,

wherein the wrapped application on the mobile computing device is a dual-mode application having a managed mode which provides access to enterprise data and in which one or more management policies are enforced on the wrapped application on the mobile computing device, and the wrapped application on the mobile computing device having an unmanaged mode which limits access to the enterprise data and in which the one or more management policies are not enforced on the wrapped application on the mobile computing device, and

wherein the at least one command included in the management information received from the one or more policy management servers directs the mobile device management agent executed on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode, and wherein executing the at least one command included in the received management information causes the application wrapper for the wrapped application on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode.

2. The method of claim 1, wherein monitoring the state information comprises identifying one or more applications that are present on the mobile computing device.

3. The method of claim 1, wherein monitoring the state information comprises identifying one or more network connections that are used by the mobile computing device.

4. The method of claim 1, wherein monitoring the state information comprises determining current location information for the mobile computing device.

5. The method of claim 1, wherein enforcing the one or more policies comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, a command to disable the wrapped application based on the monitored state information.

6. The method of claim 1, wherein enforcing the one or more policies comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, a command to selectively disable one or more functions of the wrapped application based on the monitored state information.

7. The method of claim 1, wherein enforcing the one or more policies comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, a command to make at least one configuration change to the application wrapper for the wrapped application.

8. The method of claim 1, wherein the application wrapper for the wrapped application comprises one or more integrated policies that are executed on the mobile computing device when the wrapped application is executed on the mobile computing device.

9. The method of claim 8, wherein the application wrapper for the wrapped application is configured to obtain and use one or more client certificates to authenticate with one or more protected network resources of an enterprise associated with the one or more policies.

10. The method of claim 1, wherein the unmanaged mode of the wrapped application provides access to unmanaged data different from the enterprise data that is accessible in the managed mode of the wrapped application.

11. The method of claim 10, wherein the unmanaged data comprises personal data of a user of the mobile computing device.

12. The method of claim 10, wherein the enterprise data that is accessible in the managed mode of the wrapped application is stored in a secure data container on the mobile computing device, and the unmanaged data is stored in an unsecured data container on the mobile computing device.

13. The method of claim 10, wherein executing the at least one command included in the received management information comprises selectively wiping the enterprise data that is accessible in the managed mode of the wrapped application from the mobile computing device while leaving the unmanaged data.

14. The method of claim 1, comprising:

prior to enforcing the one or more policies on the wrapped application on the mobile computing device, receiving, by the mobile computing device, the wrapped application from an enterprise application store.

15. A mobile computing device, comprising:

at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the mobile computing device to;

monitor, via a mobile device management agent executed on the mobile computing device, state information associated with the mobile computing device, wherein monitoring the state information comprises providing at least some of the monitored state information to one or more policy management servers, wherein the one or more policy management servers are configured to receive device state information from the mobile device management agent executed on the mobile computing device, analyze the device state information received from the mobile device management agent executed on the mobile computing device, and return one or more commands to the mobile device management agent executed on the mobile computing device based on analyzing the device state information received from the mobile device management agent executed on the mobile computing device; and

enforce one or more policies on a wrapped application on the mobile computing device based on the monitored state information,

wherein the wrapped application on the mobile computing device is wrapped using an application management framework that provides an application wrapper for the wrapped application on the mobile computing device,

wherein enforcing the one or more policies on the wrapped application comprises;

receiving management information from the one or more policy management servers; and

executing at least one command included in the received management information,

wherein executing the at least one command included in the received management information comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, the at least one command included in the received management information, causing the application wrapper for the wrapped application on the mobile computing device to execute the at least one command included in the received management information,

wherein the wrapped application on the mobile computing device is a dual-mode application having a managed mode which provides access to enterprise data and in which one or more management policies are enforced on the wrapped application on the mobile computing device, and the wrapped application on the mobile computing device having an unmanaged mode which limits access to the enterprise data and in which the one or more management policies are not enforced on the wrapped application on the mobile computing device, and

wherein the at least one command included in the management information received from the one or more policy management servers directs the mobile device management agent executed on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode, and wherein executing the at least one command included in the received management information causes the application wrapper for the wrapped application on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode.

16. The mobile computing device of claim 15, wherein monitoring the state information comprises identifying one or more applications that are present on the mobile computing device.

17. The mobile computing device of claim 15, wherein monitoring the state information comprises identifying one or more network connections that are used by the mobile computing device.

18. The mobile computing device of claim 15, wherein monitoring the state information comprises determining current location information for the mobile computing device.

19. The mobile computing device of claim 15, wherein enforcing the one or more policies comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, a command to disable the wrapped application based on the monitored state information.

20. One or more non-transitory computer-readable media having instructions stored thereon that, when executed, cause a mobile computing device to:

monitor, via a mobile device management agent executed on the mobile computing device, state information associated with the mobile computing device, wherein monitoring the state information comprises providing at least some of the monitored state information to one or more policy management servers, wherein the one or more policy management servers are configured to receive device state information from the mobile device management agent executed on the mobile computing device, analyze the device state information received from the mobile device management agent executed on the mobile computing device, and return one or more commands to the mobile device management agent executed on the mobile computing device based on analyzing the device state information received from the mobile device management agent executed on the mobile computing device; and

enforce one or more policies on a wrapped application on the mobile computing device based on the monitored state information,

wherein the wrapped application on the mobile computing device is wrapped using an application management framework that provides an application wrapper for the wrapped application on the mobile computing device,

wherein enforcing the one or more policies on the wrapped application comprises;

receiving management information from the one or more policy management servers; and

executing at least one command included in the received management information,

wherein executing the at least one command included in the received management information comprises communicating, by the mobile device management agent, to the application wrapper for the wrapped application on the mobile computing device, the at least one command included in the received management information, causing the application wrapper for the wrapped application on the mobile computing device to execute the at least one command included in the received management information,

wherein the wrapped application on the mobile computing device is a dual-mode application having a managed mode which provides access to enterprise data and in which one or more management policies are enforced on the wrapped application on the mobile computing device, and the wrapped application on the mobile computing device having an unmanaged mode which limits access to the enterprise data and in which the one or more management policies are not enforced on the wrapped application on the mobile computing device, and

wherein the at least one command included in the management information received from the one or more policy management servers directs the mobile device management agent executed on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode, and wherein executing the at least one command included in the received management information causes the application wrapper for the wrapped application on the mobile computing device to selectively disable the managed mode of the wrapped application and change the wrapped application to the unmanaged mode.