Data management for an application with multiple operation modes

• US 8,650,303 B1
• Filed: 09/10/2013
• Issued: 02/11/2014
• Est. Priority Date: 03/29/2013
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Lang, Zhongmin, Barton, Gary, Desai, Nitin, Walker, James R.
• Primary Examiner(s): BILGRAMI, ASGHAR H
• Application Number:
  US14/022,845
• Time in Patent Office: 154 Days
• Field of Search: 709/226, 726/11
• US Class Current: 709/226
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A method and system for managing an application with multiple modes are described. A device manager that manages a mobile device may monitor the mobile device. The device manager may detect that a first type of application that runs in a managed mode (or in multiple managed modes) and an unmanaged mode is installed on the mobile device. When the application is executed on the device, the application executes in accordance with the selected application mode, e.g., based on location, user, role, industry presence, or other predefined context.

Claims

1. A method comprising:

running, on a mobile device, an application in a first mode, wherein the first mode is a managed mode and is managed by a device manager in accordance with one or more policy files separate from the application and applicable to a plurality of applications;

running, on the mobile device, the application in a second mode, wherein the second mode is an unmanaged mode, wherein said application is running in the second mode at a mutually exclusive time from when said application is running in the first mode;

receiving a request to store data associated with the application;

storing the data according to a first protocol when the application is running in the managed mode and storing the data according to a second protocol when the application is running in the unmanaged mode;

receiving a signal from the device manager to disable the managed mode of the application;

locating, in response to the received signal, data stored according to the first protocol; and

selectively deleting the located data.

2. The method of claim 1, wherein the first protocol comprises storing data in a first data container and the second protocol comprises storing data in a second data container mutually exclusive from the first data container.

3. The method of claim 2, further comprising restricting the application from accessing the first data container when running in the unmanaged mode.

4. The method of claim 1, wherein the first protocol comprises encrypting data with a first key prior to storing that data and the second protocol comprises at least one of encrypting data with a second key prior to storing the data and storing data unencrypted.

5. The method of claim 1, wherein locating data stored according to the first protocol further comprises:

determining a managed account associated with the application; and

locating the data based on the managed account.

6. The method of claim 1, wherein locating data stored according to the first protocol further comprises locating a container that stores data according to the first protocol.

7. The method of claim 1, wherein locating data stored according to the first protocol further comprises:

determining an encryption key associated with the first protocol; and

locating the data based on the determined encryption key.

8. The method of claim 1, wherein the device manager disables the managed mode in response to identifying a black listed application installed on the mobile device.

9. The method of claim 1, wherein the device manager disables the managed mode in response to detecting that a managed account associated with the application has expired.

10. The method of claim 1, wherein the device manager disables the managed mode in response to detecting that the mobile device has been jailbroken or rooted.

11. A method of claim 1, wherein selectively deleting the located data does not delete personal data associated with the application stored on the mobile device.

12. A computing device comprising:

a processor, wherein the computing device is configured to;

run an application in a first mode, wherein the first mode is a managed mode operating under the control of one or more policy files separate from the application and usable to manage operations of multiple applications executing on the computing device;

run the application in a second mode, wherein said application is running in the second mode at a mutually exclusive time from when said application is running in the first mode;

receive a request to store data associated with the application;

store the data according to a first protocol when the application is running in the first mode and storing the data according to a second protocol when the application is running in the second mode;

receive a signal to disable the first mode of the application;

locate, in response to the received signal, data stored according to the first protocol; and

selectively delete the located data.

13. The computing device of claim 12, wherein the first protocol comprises storing data in a first data container and the second protocol comprises storing data in a second data container different from the first data container.

14. The computing device of claim 13, wherein the computing device is further configured to:

restrict the application from accessing the first data container when running in the second mode.

15. The computing device of claim 12, wherein the first protocol comprises encrypting data with a first key prior to storing that data and the second protocol comprises at least one of encrypting data with a second key prior to storing the data and storing data unencrypted.

16. The computing device of claim 12, wherein the first mode is a first managed mode, and the second mode is a second managed mode managed in accordance with at least one different policy file than the first managed mode.

17. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by one or more processors of a data processing system, configure the system to:

run an application in a first mode, wherein the first mode is a managed mode operating under the control of one or more policy files separate from the application and usable to manage operations of a plurality of applications;

run the application in a second mode, wherein the second mode is an unmanaged mode, wherein said application is running in the second mode at a mutually exclusive time from when said application is running in the first mode;

receive a request to store data associated with the application;

store the data according to a first protocol when the application is running in the managed mode and storing the data according to a second protocol when the application is running in the unmanaged mode;

receive a signal to disable the managed mode of the application;

locate, in response to the received signal, data stored according to the first protocol; and

selectively delete the located data.