Creating multiple workspaces in a device

• US 10,339,302 B2
• Filed: 05/21/2015
• Issued: 07/02/2019
• Est. Priority Date: 05/21/2015
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Xuan, Chaoting, Stuntebeck, Erich
• Primary Examiner(s): Abedin, Shanto
• Application Number:
  US14/718,733
• Publication Number:
  US 20160342802A1
• Time in Patent Office: 1,503 Days
• Field of Search: 726 1, 726 7, 726 22
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments relate to a system that includes a managed application and a workspace manager that are executable by a computing device. The workspace manager obtains a component invocation message from the managed application and determines whether the component invocation message is intended to invoke a public component in a workspace managed by the workspace manger. The workspace manager provides an instruction to the managed application in response to determining whether the component invocation message is intended to invoke the public component in the workspace managed by the workspace manager.

Claims

1. A system, comprising:

a computing device;

a managed application executable by the computing device, wherein the managed application operates in a workspace managed by a workspace manager, and the managed application comprises a translator that, when executed by the computing device, is configured to cause the computing device to at least;

intercept a message from a target application executed in the computing device to a system service of the computing device;

generate a modified version of the message;

provide the modified version of the message to the system service; and

the workspace manager executable by the computing device, wherein the workspace manager, when executed by the computing device, is configured to cause the computing device to at least;

obtain a component invocation message from the managed application;

determine whether the component invocation message is intended to invoke a public component in the workspace; and

provide an instruction to the managed application in response to determining whether the component invocation message is intended to invoke the public component.

2. The system of claim 1, wherein the instruction instructs the managed application to discard the component invocation message, and wherein the workspace manager is further configured to provide the instruction to the managed application upon determining that the component invocation message is intended to invoke the public component.

3. The system of claim 1, wherein the instruction instructs the managed application to forward the component invocation message to a target application, and wherein the workspace manager is further configured to provide the instruction to the managed application upon determining that the component invocation message is not intended to invoke the public component.

4. The system of claim 1, wherein the translator, when executed by the computing device, is further configured to cause the computing device to at least:

intercept a second message from the system service to the target application;

generate a modified version of the second message; and

provide the modified version of the second message to the target application.

5. The system of claim 1, wherein the translator, when executed by the computing device, is further configured to cause the computing device to at least:

intercept a request for the target application to store data in removable storage in the computing device;

generate an encrypted version of the data; and

store the encrypted version of the data in the removable storage.

6. The system of claim 1, wherein the translator, when executed by the computing device, is further configured to cause the computing device to at least:

intercept a request for the target application to retrieve data from removable storage in the computing device;

obtain the data;

generate a decrypted version of the data; and

provide the decrypted version of the data to the target application.

7. A method, comprising:

intercepting, by a translator in a managed application executed in a managed device, a message from a target application executed in the managed device to a system service of the managed device, wherein the managed application operates in a workspace managed by a workspace manager;

generating, by the translator, a modified version of the message;

providing the modified version of the message to the system service;

obtaining a component invocation message from the managed application;

determining whether the component invocation message is intended to invoke a public component in the workspace managed by the workspace manager; and

providing an instruction to the managed application in response to determining whether the component invocation message is intended to invoke the public component.

8. The method of claim 7, wherein the modified version of the message is generated in response to determining, by the translator, that the message comprises a package name.

9. The method of claim 7, wherein the modified version of the message is generated in response to determining, by the translator, that the message identifies an authority of a content provider.

10. The method of claim 7, wherein the modified version of the message is generated in response to determining, by the translator, that the message identifies a security permission defined by the target application.

11. The method of claim 7, further comprising:

intercepting, by the translator, an additional message from the system service to the target application;

generating, by the translator, a modified message based on the additional message; and

providing the modified message to the target application.

12. The method of claim 11, wherein the modified message is generated in response to determining, by the translator, that the message identifies an account type.

13. The method of claim 7, wherein the modified message is generated in response to determining, by the translator, that the message identifies a non-system intent action.

14. The method of claim 7, wherein the instruction instructs the managed application to discard the component invocation message.

15. A non-transitory computer-readable medium storing a plurality of computer instructions executable by a computing device, the plurality of computer instructions being configured to cause the computing device to at least:

cause a managed application to initiate execution of a target application;

intercept a request for the target application to retrieve data from removable storage in the computing device;

obtain the data;

generate a decrypted version of the data;

provide the decrypted version of the data to the target application;

obtain a component invocation message from the managed application;

determine whether the component invocation message is intended to invoke a public component in a workspace managed by a workspace manager; and

provide an instruction to the managed application in response to determining whether the component invocation message is intended to invoke the public component.

16. The non-transitory computer-readable medium of claim 15, wherein the plurality of computer instructions are further configured to cause the computing device to at least:

intercept a request for the target application to store data in the removable storage;

obtain the data from the target application;

generate encrypted data based on the data from the target application; and

store the encrypted data in the removable storage.

17. The non-transitory computer-readable medium of claim 15, wherein the plurality of computer instructions are further configured to cause the computing device to at least:

intercept a message from the target application to a clipboard service requesting clipboard content; and

provide content provided by the workspace manager to the target application in response to the message.

18. The non-transitory computer-readable medium of claim 15, wherein the plurality of computer instructions are further configured to cause the computing device to at least:

intercept a message from the target application to a clipboard service requesting to store clipboard content; and

provide the clipboard content to the workspace manager.

19. The non-transitory computer-readable medium of claim 15, wherein the plurality of computer instructions are further configured to cause the computing device to at least:

intercept a message from the target application to a system service;

generate a modified version of the message; and

provide the modified version of the message to the system service.

20. The non-transitory computer-readable medium of claim 15, wherein the plurality of computer instructions are further configured to cause the computing device to at least:

intercept a message from a system service to the target application;

generate a modified version of the message; and

provide the modified version of the message to the target application.