Providing mobile device management functionalities

• US 10,742,520 B2
• Filed: 12/31/2013
• Issued: 08/11/2020
• Est. Priority Date: 12/31/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Frost, Simon
• Primary Examiner(s): Parry, Chris
• Assistant Examiner(s): Chiou, Albert
• Application Number:
  US14/144,702
• Publication Number:
  US 20150188777A1
• Time in Patent Office: 2,415 Days
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 41/18 Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Methods, systems, computer-readable media, and apparatuses for providing mobile device management (MDM) functionalities are presented. In some embodiments, a pseudo device representative of a physical end user device may be established within a cloud computing environment. The pseudo device may be provisioned for use with MDM service providers and configured to receive commands from the MDM service providers on behalf of the physical end user device. In some embodiments, multiple pseudo devices each representative of a physical end user device may be established within a cloud computing environment. A first pseudo device may be provisioned for use with a first MDM service provider and configured to receive commands from the first MDM service provider on behalf of the physical end user device. A second pseudo device may be provisioned for use with a second MDM service provider and configured to receive commands from the second MDM service provider.

Claims

1. A method, comprising:

establishing, within a computing environment, a pseudo device representative of a physical end user device;

provisioning the pseudo device for use with a first mobile device management (MDM) service provider by configuring the pseudo device, using a first profile associated with the first MDM service provider, to be remotely managed by the first MDM service provider without the physical end user device storing the first profile, wherein the first profile enables the pseudo device to receive commands from the first MDM service provider on behalf of the physical end user device once provisioned;

receiving, by the pseudo device and from the first MDM service provider, a first command the first command configured to instruct the physical end user device to perform an operation to achieve a particular state at the physical end user device;

determining, by the pseudo device, that the physical end user device has already achieved the particular state associated with the first command received from the first MDM service provider; and

sending, by the pseudo device and in response to receipt of the first command from the first MDM service provider, a response to the first MDM service provider without sending the first command to the physical end user device, wherein the response to the first MDM service provider comprises an indication that the first command was completed and the physical end user device has the particular state.

2. The method of claim 1,

wherein the provisioning the pseudo device for use with the one or more MDM service providers comprises:

sending, by the pseudo device and to the first MDM service provider, a first enrollment request;

receiving, by the pseudo device and from the first MDM service provider, the first profile associated with the first MDM service provider, wherein the first profile comprises a policy to restrict the physical end user device from installing profiles associated with other MDM service providers at the physical end user device while the first profile is installed at the physical end user device;

storing, by the pseudo device, the first profile, the method further comprising;

provisioning the pseudo device for use with a second MDM service provider of the one or more MDM service providers comprising;

sending, by the pseudo device and to the second MDM service provider, a second enrollment request, the second MDM service provider being different from the first MDM service provider;

receiving, by the pseudo device and from the second MDM service provider, a second profile different from the first profile; and

storing, by the pseudo device, the second profile.

3. The method of claim 1, further comprising:

receiving, by the pseudo device and from the first MDM service provider, the first profile associated with the first MDM service provider, wherein the first profile comprises a policy to restrict the physical end user device from installing profiles associated with other MDM service providers at the physical end user device while the first profile is installed at the physical end user device;

establishing, within the computing environment, a different pseudo device representative of the physical end user device; and

receiving, by the different pseudo device and from a second MDM service provider different from the first MDM service provider, a second profile associated with the second MDM service provider, and wherein the different pseudo device is configured to receive one or more commands from the second MDM service provider on behalf of the physical end user device once provisioned.

4. The method of claim 1, wherein the pseudo device impersonates the physical end user device such that the pseudo device appears to be the physical end user device to the first MDM service provider.

5. The method of claim 1, further comprising:

receiving, by the pseudo device and from the first MDM service provider, a second command,

wherein the second command is received during a time period in which a second profile associated with a second MDM service provider of the one or more MDM service providers is active on the physical end user device, the second MDM service provider being different from the first MDM service provider.

6. The method of claim 1, further comprising:

receiving, by the pseudo device, resource data associated with the first MDM service provider;

caching, by the pseudo device, the resource data when a profile associated with the resource data is not currently active on the physical end user device; and

pushing, by the pseudo device and to the physical end user device, the resource data when the profile associated with the resource data is currently active on the physical end user device.

7. The method of claim 1, further comprising:

receiving, by the pseudo device and from the first MDM service provider, a second command;

modifying, by the pseudo device, the first command to produce a modified command; and

sending, by the pseudo device and to the physical end user device, the modified command.

8. The method of claim 1, further comprising:

sending, by the pseudo device and to the physical end user device, a selective wipe command,

wherein the selective wipe command is configured to cause at least one of a subset of applications associated with the first MDM service provider and data associated with the subset of applications to be deleted, and

wherein the selective wipe command is configured to cause personal applications, data associated with the personal applications, and the first profile associated with the first MDM service provider to be maintained.

9. The method of claim 1, further comprising:

in response to receiving, by the pseudo device and from the physical end user device, a request initiated based on an indication that the physical end user device is within a first geographic fence defined by the first MDM service provider of the one or more MDM service providers, deploying, by the pseudo device and to the physical end user device, the first profile of the first MDM service provider and application data of the first MDM service provider;

in response to receiving another request initiated based on an indication that the physical end user device is no longer within the first geographic fence, retracting, by the physical end user device and from the physical end user device, the first profile of the first MDM service provider and the application data of the first MDM service provider; and

in response to receiving, by the pseudo device and from the physical end user device, a new request initiated based on an indication that the physical end user device is within a second geographic fence defined by a second MDM service provider of the one or more MDM service providers, deploying, by the pseudo device and to the physical end user device, a second profile of the second MDM service provider and application data of the second MDM service provider.

10. The method of claim 9, further comprising:

identifying a conflict between policies of the first MDM service provider of the one or more MDM service providers and policies of the second MDM service provider of the one or more MDM service providers;

resolving the conflict by performing one of;

applying a solution determined from a knowledge-based system of the computing environment;

sending a warning to the physical end user device, the warning comprising one or more user-selectable commands to resolve the conflict; and

sending a mini-wipe command to the physical end user device, wherein the mini-wipe command is configured to cause at least a subset of data causing the conflict to be deleted.

11. The method of claim 1, wherein determining that the physical end user device has already achieved the particular state comprises:

receiving, by the pseudo device, state information from the physical end user device; and

determining a match between the state information and the particular state.

12. A method, comprising:

establishing, within a computing environment, a first pseudo device representing a physical end user device;

establishing, within the computing environment, a second pseudo device representing the physical end user device, wherein the second pseudo device is different from the first pseudo device;

provisioning the first pseudo device for use with a first mobile device management (MDM) service provider by configuring the first pseudo device, using a first profile associated with the first MDM service provider, to be remotely managed by the first MDM service provider without the physical end user device storing the first profile;

provisioning the second pseudo device for use with a second MDM service provider by configuring the second pseudo device, using a second profile associated with the second MDM service provider, to be remotely managed by the second MDM service provider without the physical end user device storing the second profile, wherein the second MDM service provider is different from the first MDM service provider;

receiving, by the first pseudo device on behalf of the physical end user device and from the first MDM service provider, a first command, the first command configured to instruct the physical end user device to achieve a particular state at the physical end user device;

in response to a determination that the physical end user device has already achieved the particular state associated with the first command received from the first MDM service provider, sending, by the first pseudo device and to the first MDM service provider, a response to the first command without sending the first command to the physical end user device, wherein the response to the first command comprises an indication that the first command was completed and the physical end user device has the particular state; and

receiving, by the second pseudo device on behalf of the physical end user device and from the second MDM service provider, a second command.

13. The method of claim 12, further comprising:

receiving, by the first pseudo device and from the first MDM service provider, a third command;

sending, by the first pseudo device, to the physical end user device, and based on the third command, a fourth command different from the third command;

receiving, by the first pseudo device and from the physical end user device, state information of the physical end user device;

determining, by the first pseudo device and based on the third command, whether the state information of the physical end user device matches desired state information for the physical end user device; and

in response to determining that the state information of the physical end user device does not match the desired state information for the physical end user device, sending, by the pseudo device and to the physical end user device, a fifth command to modify data stored at the physical end user device to achieve the desired state information for the physical end user device.

14. The method of claim 12,

wherein the provisioning the first pseudo device for use with the first MDM service provider comprises:

sending, by the first pseudo device and to the first MDM service provider, a first enrollment request;

receiving, by the first pseudo device and from the first MDM service provider, the first profile associated with the first MDM service provider, wherein the first profile comprises a policy to restrict the physical end user device from installing profiles associated with other MDM service providers at the physical end user device while the first profile is installed at the physical end user device;

storing, by the first pseudo device, the first profile,

wherein provisioning the second pseudo device for use with the second MDM service provider comprises;

sending, by the second pseudo device and to the second MDM service provider, a second enrollment request;

receiving, by the second pseudo device and from the second MDM service provider, the second profile; and

storing, by the second pseudo device, the second profile.

15. The method of claim 12, further comprising:

receiving, by the first pseudo device, resource data associated with the first MDM service provider;

caching, by the first pseudo device, the resource data when a profile associated with the resource data is not currently active on the physical end user device; and

pushing, by the first pseudo device and to the physical end user device, the resource data when the profile is currently active on the physical end user device.

16. A non-transitory storage medium storing machine-executable instructions that, when executed, cause a computing device to:

establish, within a computing environment including the computing device, a first pseudo device representative of a physical end user device;

establish, within the computing environment, a second pseudo device representative of the physical end user device, wherein the second pseudo device is different from the first pseudo device;

provision the first pseudo device for use with a first mobile device management (MDM) service provider by configuring the first pseudo device, using a first profile associated with the first MDM service provider, to be remotely managed by the first MDM service provider without the physical end user device storing the first profile;

receive, by the first pseudo device on behalf of the physical end user device once provisioned and from the first MDM service provider, a first command, the first command configured to instruct the physical end user device to achieve a particular state at the physical end user device;

in response to a determination that the physical end user device has already achieved the particular state associated with the first command received from the first MDM service provider, send, by the first pseudo device and to the first MDM service provider, a response to the first command without sending the first command to the physical end user device, wherein the response to the first command comprises an indication that the first command was completed and the physical end user device has the particular state; and

provision the second pseudo device for use with a second MDM service provider by configuring the second pseudo device, using a second profile associated with the second MDM service provider, to be remotely managed by the second MDM service provider without the physical end user device storing the second profile, wherein the second pseudo device is configured to receive one or more commands from the second MDM service provider on behalf of the physical end user device once provisioned, and wherein the second MDM service provider is different from the first MDM service provider.

17. The non-transitory storage medium of claim 16, wherein the machine-executable instructions, when executed, cause the computing device to:

receive, by the first pseudo device and from the first MDM service provider, a second command;

send, by the first pseudo device, to the physical end user device, and based on the second command, a third command different from the second command;

receive, by the first pseudo device and from the physical end user device, state information of the physical end user device;

determine, by the first pseudo device and based on the second command, whether the state information of the physical end user device matches desired state information for the physical end user device; and

in response to determining that the state information of the physical end user device does not match the desired state information for the physical end user device, send, by the first pseudo device and to the physical end user device, a fourth command to modify data stored at the physical end user device to achieve the desired state information for the physical end user device.

18. The non-transitory storage medium of claim 16, wherein:

the machine-executable instructions that, when executed, cause the computing device to provision the first pseudo device for use with the first MDM service provider further cause the computing device to;

send, by the first pseudo device and to the first MDM service provider, a first enrollment request;

receive, by the first pseudo device and from the first MDM service provider, the first profile associated with the first MDM service provider, wherein the first profile comprises a policy to restrict the physical end user device from installing profiles associated with other MDM service providers at the physical end user device while the first profile is installed at the physical end user device;

store, by the first pseudo device, the first profile,

wherein the machine-executable instructions that, when executed, cause the computing device to provision the second pseudo device for use with the second MDM service provider further cause the computing device to;

send, by the second pseudo device and to the second MDM service provider, a second enrollment request;

receive, by the second pseudo device and from the second MDM service provider, the second profile; and

store, by the second pseudo device, the second profile.

19. The non-transitory storage medium of claim 16, wherein the physical end user device is a first physical end user device associated with a user,

wherein the machine-executable instructions, when executed, further cause the computing device to:

establish, within the computing environment including the computing device, a third pseudo device representative of a second physical end user device associated with the user.