Defining and implementing policies on managed object-enabled mobile devices

• US 8,375,136 B2
• Filed: 08/08/2008
• Issued: 02/12/2013
• Est. Priority Date: 08/08/2007
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: InnoPath Software, Inc. (Qualcomm, Inc.)
• Inventors: Roman, Manuel, Buzzard, Gregory D., Shoaib, Shahid, Krivopaltsev, Eugene, Diener, Michael
• Primary Examiner(s): STRANGE, AARON N
• Application Number:
  US12/188,874
• Publication Number:
  US 20090049166A1
• Time in Patent Office: 1,649 Days
• Field of Search: 709/223, 709/200, 709/220, 709/229, 719/321, 370/395.2
• US Class Current: 709/229
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Embodiments of a system configured to manage policies, including decision policies and active policies, on an Open Mobile Alliance Device Management (OMA DM) enabled mobile client devices is described. The system is configured to manage policies, including decision policies and active policies, on mobile devices. The system includes a device policy repository, a policy decision point, a decision policy enforcer, and an active policy enforcer. The system includes a server-side process configured to allow creation, modification and transmission of defined policies to the mobile client device, and a client-side process executed on the mobile client device and configured store the defined policies in an OMA DM management tree in the mobile client device as management objects, wherein each policy of the defined policies is represented as a subnode of the management tree.

Claims

1. A system to define and enforce policies on an Open Mobile Alliance Device Management (OMA DM) enabled mobile client device coupled to a server computer over a computer network, comprising:

a mobile client device comprising a processor and a non-transitory memory;

a server-side process configured to allow creation, modification and transmission of defined policies including decision policies and active policies to the mobile client device, wherein the decision policies control access to mobile client device resources using one or more of a role of a user requesting access and a circumstance of the request, wherein the active policies associate one or more operations of the client device with an occurrence; and

a client-side process executed on the mobile client device and configured to store the defined policies in an OMA DM management tree in the memory of the mobile client device as management objects, wherein each policy of the defined policies is represented as a subnode of the management tree, wherein a policy conflict module determines a set of the defined policies relating to at least one of the occurrence and the one or more of a role of a user and a circumstance of the request, identifies conflicts between defined polices of the set before application of any defined policy of the set, and resolves the conflicts using a priority.

2. The system of claim 1 wherein the management tree comprises a root node defining a policy group that has one or more policy instance subnodes.

3. The system of claim 2 wherein each policy represents a subtree within the management tree, and wherein each policy subtree has a policy condition subnode, a policy action subnode, and a policy triggers subnode.

4. The system of claim 3 wherein the client-side process includes a module to monitor the execution environment of the mobile device and automatically trigger one or more defined policies upon an occurrence of an event, and wherein the policies consist of one or more action rule sets, each action rule set comprising:

trigger events denoting a change in state of a variable of interest to an action rule of the action rule sets;

conditions comprising a yes or no value associated with the variable of interest; and

actions comprising a task to be executed by the mobile device when a corresponding condition is true.

5. The system of claim 4 wherein data objects related to each of the trigger events, conditions, and actions are specified within a corresponding subnode of the policy subtree.

6. The system of claim 5 wherein the policies are stored on the mobile device as subtrees within the management tree.

7. The system of claim 6 wherein the policies are created by the server as nodes directly on the mobile device.

8. The system of claim 7 wherein the mobile client device comprises a smartphone coupled to the server computer over one or more wireless networks.

9. A method of defining and enforcing policies on an Open Mobile Alliance Device Management (OMA DM) enabled mobile client device coupled to a server computer over a computer network, comprising:

executing a server-side process that is operable to allow creation, modification and transmission by a system administrator of defined policies including decision policies and active policies to the mobile client device, wherein the decision policies control access to mobile client device resources using one or more of a role of a user requesting access and a circumstance of the request, wherein the active policies associate one or more operations of the client device with an occurrence; and

executing a client-side process on the mobile client device that is operable to store the defined policies in an OMA DM management tree in the mobile client device as management objects, wherein each policy of the defined policies is represented as a subnode of the management tree, and further wherein the management tree comprises a root node defining a policy group that has one or more policy instance subnodes, wherein a policy conflict module determines a set of the defined policies relating to at least one of the occurrence and the one or more of a role of a user and a circumstance of the request, identifies conflicts between defined polices of the set before application of any defined policy of the set, and resolves the conflicts using a priority.

10. The method of claim 9 further comprising organizing the management tree under a policy group root node including at least one policy instance subnode.

11. The method of claim 10 further comprising parsing the management tree into a first subtree for policy conditions of the policy instance, a second subtree for policy actions of the policy instance, a third subtree for policy triggers of the policy instance.

12. The method of claim 11 further comprising monitoring the execution environment of the mobile device and automatically triggering the policy instance upon an occurrence of an event.

13. The method of claim 12 wherein the policies consist of one or more action rule sets, each action rule set comprising:

trigger events denoting a change in state of a variable of interest to an action rule of the action rule sets;

conditions comprising a yes or no value associated with the variable of interest; and

actions comprising a task to be executed by the mobile device when a corresponding condition is true.

14. The method of claim 13 further comprising storing data objects related to each of the trigger events, conditions, and actions within a corresponding subnode of the policy instance subtree.

15. The method of claim 14 further comprising storing the policies on the mobile device as subtrees within the management tree.

16. The method of claim 15 further comprising creating the required nodes directly on the mobile device.