Policy Enforcement in Mobile Devices

• US 20090265754A1
• Filed: 04/17/2008
• Published: 10/22/2009
• Est. Priority Date: 04/17/2008
• Status: Active Grant

• Current Assignee: iAnywhere Solutions Incorporated (SAP SE)
• Original Assignee: Sybase Incorporated (SAP SE)
• Inventors: HINDS, Donald W.
• Granted Patent: US 8,935,741 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems, methods and computer program products for enabling enforcement of an administrative policy on one or more mobile devices are described herein. In an embodiment, an administrator uses a policy server to create and provide an enforcement policy to a mobile device. An enforcement policy may include information on mobile device resources which may be controlled by an administrator. An enforcement policy also includes information on how mobile device features will be set, configured or disabled. An enforcement device driver and an enforcement monitor on a mobile device use the enforcement policy to control access to resources associated with the mobile device regardless of whether the mobile device is “online” and connected to a network or “offline” and disconnected from a network.

Claims

1. A method of controlling access to resources in a mobile device, comprising:

intercepting a request to access one or more resources of said mobile device;

authorizing said request based on an enforcement policy; and

controlling access to said resources based on said authorizing step.

2. The method of claim 1, wherein said authorizing step comprises:

applying said enforcement policy.

3. The method of claim 2, wherein said enforcement policy is encrypted.

4. The method of claim 2, wherein said applying step comprises:

decrypting said enforcement policy to obtain a decrypted enforcement policy;

storing said decrypted enforcement policy in memory; and

using said decrypted enforcement policy to control access to said resources;

wherein said decrypted enforcement policy is removed from memory after said using step is completed.

5. A method of maintaining a desired state on a mobile device, comprising:

monitoring one or more settings associated with a plurality of user applications or device resources;

detecting a change in said settings; and

restoring said settings to a desired state wherein said desired state is based on an enforcement policy.

6. A system for controlling access to resources in a mobile device, comprising:

an enforcement policy that includes one or more settings to control access to resources associated with said mobile device;

an enforcement device driver that intercepts requests to access said resources; and

an enforcement monitor that monitors said settings,

wherein said enforcement monitor returns said settings to a desired state if said settings have been changed in a manner that is not authorized.

7. The system of claim 6, wherein said mobile device is offline.

8. The system of claim 6, wherein said enforcement policy is encrypted.

9. The system of claim 6, wherein said desired state is determined by an administrator.

10. The system of claim 6, wherein said enforcement monitor monitors a plurality of user applications.

11. A computer program product having control logic stored therein, said control logic enabling a processor to control access to resources in a mobile device, said control logic comprising;

intercepting means for enabling a processor to intercept a request to access one or more resources associated with said mobile device;

authorizing means for enabling a processor to authorize said request based on an enforcement policy; and

controlling means for enabling a processor to control access to said resources.