Integrating policies from a plurality of disparate management agents

• US 8,931,033 B2
• Filed: 12/12/2008
• Issued: 01/06/2015
• Est. Priority Date: 12/12/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Esteve Balducci, Juan V., Higashi, Michael K., Limont, David Paul, Atwood, John Allen, Ateeq, Burhan, Tousignant, Patrick
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US12/334,232
• Publication Number:
  US 20100154025A1
• Time in Patent Office: 2,216 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Described herein are embodiments for managing policies of a mobile device. In embodiments, a mobile device receives policy containers from a plurality of disparate management agents. Each policy container has one or more policies. Each policy corresponds to a particular category that governs various aspects of the device. The policies described herein may be device wide policies corresponding to various features on the device. The policies may also be data specific policies which dictate how data is stored on and transferred to and from the device. Once the policies are received, a determination is made as to which policy in each category is the most secure policy. The most secure policy for each category is merged to create a global policy that is applied to the mobile device.

Claims

1. A method for managing policies of a mobile device, the method comprising:

receiving a plurality of policy containers from a plurality of management agents, wherein each of the plurality of policy containers has one or more policies and wherein each of the one or more policies corresponds to a category from a plurality of categories;

for each category of the plurality of categories, determining which of the one or more policies is a most secure policy;

merging the most secure policy from each category of the plurality of categories to create a global policy;

applying the global policy to the mobile device; and

automatically updating the global policy when at least one of the one or more policies corresponding to a first category of the plurality of categories is updated, further comprising;

rolling back each of the one or more policies, recalculating a security rating for each of the one or more policies, determining which of the one or more policies is the most secure, merging the most secure policy corresponding to the first category with the most secure policies of the plurality of categories that were not updated to create a new global policy, and applying the new global policy to the mobile device.

2. The method of claim 1, wherein the one or more policies are device wide policies.

3. The method of claim 1, wherein the one or more policies are data specific policies.

4. The method of claim 1, further comprising automatically updating the global policy when a relationship between the mobile device and at least one of the plurality of management agents is severed.

5. The method of claim 4, wherein automatically updating comprises:

excluding the one or more policies of the one of the plurality of management agents with which the relationship was severed;

determining which of the one or more policies remaining, after the excluding, for each category is the most secure;

merging the most secure policy of the remaining policies from each category to create a new global policy; and

applying the new global policy to the mobile device.

6. The method of claim 1, further comprising storing, on the device, data corresponding to which of the plurality management agents provided each of the plurality of policy containers.

7. The method of claim 1, wherein determining the most secure policy comprises evaluating a binary rule, wherein an enablement bit of the binary rule determines whether the policy with the enablement bit set is the most secure policy.

8. The method of claim 1, wherein determining the most secure policy comprises evaluating an integer rule, wherein the integer rule determines the most secure policy based on an enumeration of integer values associated with each of the one or more policies.

9. The method of claim 1, wherein merging the most secure policy from each category of the plurality of categories to create a global policy comprises:

evaluating the one or more policies from each of the plurality of management agents to create a set of allowable actions corresponding to each of the plurality of management agents;

intersecting each set of allowable actions to determine whether one or more specific actions from each set of actions is allowed by each of the plurality of management agents; and

merging the one or more specific actions to create the global policy.

10. The method of claim 1, wherein merging the most secure policy from each category of the plurality of categories to create a global policy comprises:

evaluating the one or more policies from each of the plurality of management agents to create a set of disallowed actions;

combining each set of disallowed actions to determine one or more specific disallowed actions by each of the plurality of management agents; and

merging the one or more specific disallowed actions to create the global policy.

11. A computer-readable storage device encoding computer readable instructions for executing a method to manage policies of a mobile device, the method comprising:

receiving a plurality of policy containers from a plurality of management agents, each of the policy containers having at least one policy;

associating each policy from each of the plurality of policy containers with one of a plurality of categories;

determining the most secure policy for each of the plurality of categories, wherein the determination is based on a value associated with each policy;

merging the most secure policy from each of the plurality of categories to create a global policy; and

automatically updating the global policy when at least one policy in at least one of the plurality of policy containers and corresponding to a first category of the plurality of categories is updated, further comprising;

rolling back each of one or more policies corresponding to the first category, recalculating a security rating for each of the one or more policies, determining which of the one or more policies is the most secure, merging the most secure policy corresponding to the first category with the most secure policies of the plurality of categories that were not updated to create a new global policy, and applying the new global policy to the mobile device.

12. The computer-readable storage device of claim 11 further comprising instructions to automatically update the global policy when a relationship between the mobile device and one of the plurality of management agents has been severed.

13. The computer-readable storage device of claim 12, wherein instructions to automatically update the global policy includes instructions to:

exclude the policy container and the at least one policy of the one of the plurality of management agents with which the relationship was severed;

when the most secure policy for at least one of the plurality of categories has been removed as a result of the severed relationship, determine a new most secure policy for the one of the plurality of categories; and

merge the new most secure policy from the one of the plurality of categories with each remaining category of the plurality of categories to create a new global policy.

14. The computer-readable storage device of claim 11, further comprising instructions for storing, on the mobile device, data corresponding to which of the plurality management agents provided each of the plurality of policy containers.

15. The computer-readable storage device of claim 11, wherein the one or more policies are device wide policies.

16. The computer-readable storage device of claim 11, wherein the one or more policies are data specific policies.

17. The computer-readable storage device of claim 11, wherein determining the most secure policy comprises evaluating a binary rule, wherein an enablement bit of the binary rule determines whether the policy with the enablement bit set is the most secure policy.

18. A system configured to manage policy settings of a mobile device, the system comprising:

a processor; and

a memory coupled to the processor, the memory comprising computer-program instructions executable by the processor for;

receiving a first set of policies from a first management agent, each policy of the first set of policies corresponding to a category;

receiving a second set of policies from a second management agent, each policy of the second set of policies corresponding to a category;

determining, for each category having one or more associated policies, a most secure policy, wherein the determination is based on a policy value determined by comparing each policy in each category with all other policies in the same category, wherein the comparison is performed on each policy of each category regardless of which of the plurality of management agents provided the policy;

merging each most secure policy from each category to create a global policy set, wherein the merging is based on one or more rules from a set of merging rules;

applying the global policy set to the mobile device when the mobile device connects to the first management agent and applying the global policy set to the mobile device when the mobile device connects to the second management agent; and

automatically updating the global policy when at least one policy in at least one of the plurality of policy containers and corresponding to a first category of the plurality of categories is removed, further comprising;

rolling back each of the one or more remaining policies corresponding to the first category, recalculating a security rating for each of the one or more remaining policies, determining which of the one or more remaining policies is the most secure, merging the most secure policy of the one or more remaining policies with the most secure policies of the categories that were not updated to create a new global policy, and applying the new global policy to the mobile device.

19. The system of claim 18, further comprising identifying each policy in the global policy set that is a data specific policy;

and

for each identified policy;

determining whether the identified policy is to be applied to the mobile device when the mobile device connects to both the first management agent and the second management agent;

determining whether the identified policy is to be applied to the mobile device when the mobile device connects to the first management agent only; and

determining whether the identified policy is to be applied to the mobile device when the mobile device connects to the second management agent only.