Systems and methods for group-based mobile device management

• US 10,848,500 B2
• Filed: 09/17/2019
• Issued: 11/24/2020
• Est. Priority Date: 10/24/2018
• Status: Active Grant

• Current Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Original Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Inventors: Bhattacharya, Aryik, Dassow, John, Devins, Michael, Maxim, Aaron, Schmidt, Jamison
• Primary Examiner(s): Wright, Bryan F
• Application Number:
  US16/573,104
• Publication Number:
  US 20200137070A1
• Time in Patent Office: 434 Days
• Field of Search: 726 4
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04M 1/72469 for operating the device by selecting functions from two or more displayed items, e.g. menus or icons
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/55 involving three or more devices, e.g. group pairing
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

A method includes sending, from a mobile device management (MDM) server, a group list to a mobile device, the group list indicating a plurality of MDM groups that are available to the mobile device for enrollment. The method also includes receiving, at the MDM server, a join group request from the mobile device. The join group request indicates a group of the plurality of MDM groups. The method also includes, in response to receiving the join group request, updating, at the MDM server, group membership data to indicate that the mobile device is added to the group. The method further includes identifying, based on the group membership data at the MDM server, an action associated with the group. The method also includes sending a command from the MDM server to the mobile device to perform the action.

Claims

1. A method comprising:

sending, from a mobile device management (MDM) server, a group list to a mobile device, the group list indicating a plurality of MDM groups that are available to the mobile device for enrollment, each group of the plurality of MDM groups associated with different member criteria;

receiving, at the MDM server, a join group request from the mobile device, the join group request indicating a particular group of the plurality of MDM groups, the particular group associated with particular member criteria;

in response to receiving the join group request, updating, at the MDM server, group membership data to indicate that the mobile device is added to the particular group;

identifying, based on the group membership data at the MDM server, an action to be performed by the mobile device, the action associated with the particular member criteria of the particular group;

sending a command from the MDM server to the mobile device to perform the action;

receiving a reset request from the mobile device at the MDM server;

in response to receiving the reset request, sending a notification request to a push notification service to initiate sending of a push notification from the push notification service to the mobile device;

receiving a check-in message from the mobile device responsive to the push notification; and

in response to receiving the check-in message, sending a remote reset command to the mobile device to initiate a reset of the mobile device from the MDM server, wherein the remote reset command indicates that user notifications are to be suppressed during the reset of the mobile device.

2. The method of claim 1, further comprising identifying a first set of applications that the particular group is authorized to access, wherein the action includes downloading the first set of applications to the mobile device.

3. The method of claim 1, further comprising identifying a first set of configuration settings for the particular group, wherein the action includes downloading the first set of configuration settings to the mobile device.

4. The method of claim 1, further comprising identifying, based on the group membership data, that the particular group is authorized to access a first set of applications, wherein the action includes showing, at a display of the mobile device, a first set of icons of the first set of applications.

5. The method of claim 1, further comprising identifying, based on the group membership data, that the particular group is restricted from accessing a second set of applications, wherein the action includes hiding, at a display of the mobile device, a second set of icons of the second set of applications.

6. The method of claim 1, further comprising, in response to receiving the join group request from the mobile device:

determining, based on the group membership data, that the particular group includes a second computing device; and

sending a second command to the second computing device to perform a second action.

7. The method of claim 6, wherein the second action includes updating application data at the second computing device to indicate that the mobile device is added to the particular group.

8. The method of claim 6, further comprising:

sending a second notification request from the MDM server to the push notification service to initiate sending of a second push notification to the second computing device; and

receiving, at the MDM server, a second check-in request from the second computing device responsive to the second push notification, wherein the second command is sent from the MDM server to the second computing device in response to receiving the second check-in request.

9. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

sending, from a mobile device management (MDM) server, a group list to a mobile device, the group list indicating a plurality of MDM groups that are available to the mobile device for enrollment, each group of the plurality of MDM groups associated with different member criteria;

receiving, at the MDM server, a join group request from the mobile device, the join group request indicating a particular group of the plurality of MDM groups, the particular group associated with particular member criteria;

in response to receiving the join group request, updating, at the MDM server, group membership data to indicate that the mobile device is added to the particular group;

identifying, based on the group membership data at the MDM server, an action to be performed by the mobile device, the action associated with the particular member criteria of the particular group;

sending a command from the MDM server to the mobile device to perform the action;

receiving a reset request from the mobile device at the MDM server;

in response to receiving the reset request, sending a notification request to a push notification service to initiate sending of a push notification from the push notification service to the mobile device;

receiving a check-in message from the mobile device responsive to the push notification; and

in response to receiving the check-in message, sending a remote reset command from the MDM server to the mobile device to initiate a reset of the mobile device from the MDM server, wherein the remote reset command indicates that user notifications are to be suppressed during the reset of the mobile device.

10. The computer-readable storage device of claim 9, wherein a first value of a suppress notification parameter of the remote reset command indicates that the user notifications are to be suppressed during the reset of the mobile device.

11. The computer-readable storage device of claim 9, wherein the remote reset command indicates that an activation lock is to be bypassed at the mobile device during the reset of the mobile device.

12. A computer system comprising:

a mobile device configured to;

receive a group list from a mobile device management (MDM) server, the group list indicating a plurality of MDM groups that are available to the mobile device for enrollment, each group of the plurality of MDM groups associated with different member criteria;

receive a first user input indicating a selection of a particular group of the plurality of MDM groups; and

send a join group request to a mobile device management (MDM) server indicating the particular group;

the MDM server configured to, in response to receiving the join group request from the mobile device;

update group membership data to indicate that the mobile device is added to the particular group;

identify, based on the group membership data, an action to be performed by the mobile device, the action associated with the particular member criteria of the group; and

send a command to the mobile device to perform the action; and

the MDM server further configured to;

in response to receiving a reset request from the mobile device, send a notification request to a push notification service to initiate sending of a push notification from the push notification service to the mobile device; and

receive a check-in message from the mobile device responsive to the push notification; and

in response to receiving the check-in message, send a remote reset command to the mobile device to initiate a reset of the mobile device from the MDM server, wherein the remote reset command indicates that user notifications are to be suppressed during the reset of the mobile device.

13. The computer system of claim 12, further comprising a second computing device configured to:

receive a second push notification from the push notification service responsive to a second notification request, wherein the MDM server is configured to, in response to receiving the join group request from the mobile device, send the second notification request to the push notification service;

in response to receiving the second push notification, send a check-in request to the MDM server;

receive a second command to perform a second action; and

perform the second action.

14. The computer system of claim 13, wherein the second action includes updating application data to indicate that the particular group includes the mobile device.

15. The computer system of claim 12, wherein the MDM server is further configured to identify a set of applications that the group is authorized to access, wherein the action includes downloading the set of applications to the mobile device.

16. The computer system of claim 12, wherein the remote reset command includes a factory reset command.

17. The computer system of claim 12, wherein the mobile device is configured to, in response to determining that the remote reset command indicates that user notifications are to be suppressed during the reset of the mobile device, suppress user notifications during the reset of the mobile device.

18. The computer system of claim 12, wherein the mobile device is configured to, in response to determining that an activation bypass parameter of the remote reset command has a first value, remove an activation lock during reset of the mobile device.