Policy-based application management

• US 9,043,480 B2
• Filed: 10/03/2013
• Issued: 05/26/2015
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): Tran, Jimmy H
• Application Number:
  US14/045,014
• Publication Number:
  US 20140032759A1
• Time in Patent Office: 600 Days
• Field of Search: 709/202, 709/208, 709/211, 709/217, 709/218, 726/1
• US Class Current: 709/229
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. An electronic mobile device, comprising:

a processor; and

memory storing computer readable instructions that, when executed, cause the device to manage applications executing on the device by;

configuring the device to execute one or more managed applications in accordance with one or more policy files, wherein the one or more policy files are stored on the device separately from any managed applications on the electronic mobile device;

receiving user input requesting execution of a first managed application on the device;

when a predefined condition is met, executing the first managed application in a local mode according to the one or more policy files; and

when the predefined condition is not met, executing the first managed application in a virtualization mode according to the one or more policy files, wherein the virtualization mode causes the first managed application to execute on a remote device whose graphical output is presented on the electronic mobile device,

wherein the one or more policy files act to permit execution of a feature of the first managed application in one of the local mode and the virtualization mode, and act to restrict execution of the feature in the other one of the local mode and the virtualization mode.

2. The device of claim 1, wherein the one or more policy files restrict cutting and pasting between applications executing in local mode with applications executing in the virtualization mode.

3. The device of claim 1, wherein the virtualization mode is a remote access mode provided by the client agent application.

4. The device of claim 3, wherein the one or more policy files include a first temporal restriction restricting times when the remote access mode is usable to access the first managed application in the virtualization mode, and a second temporal restriction, different from the first temporal restriction, restricting times when the remote access mode is usable to access a second managed application in the virtualization mode.

5. The device of claim 3, wherein the one or more policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access the first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.

6. The device of claim 1, wherein the predefined condition is either always met or never met on a per user basis.

7. The device of claim 1, wherein the predefined condition is either always met or never met on a per application basis.

8. One or more non-transitory computer readable media comprising computer readable instructions that, when executed, cause a data processing device to manage applications executing on the device by:

configuring the device to execute one or more managed applications in accordance with one or more policy files, wherein the one or more policy files are stored on the device separately from any managed applications on the device;

receiving user input requesting execution of a first managed application on the device;

when a predefined condition is met, executing the first managed application in a local mode according to the one or more policy files; and

when the predefined condition is not met, executing the first managed application in a virtualization mode according to the one or more policy files, wherein the virtualization mode causes the first managed application to execute on a remote device whose graphical output is presented on the device,

wherein the one or more policy files act to permit execution of a feature of the first managed application in one of the local mode and the virtualization mode, and act to restrict execution of the feature in the other one of the local mode and the virtualization mode.

9. The computer readable media of claim 8, wherein the one or more policy files restrict cutting and pasting between applications executing in local mode with applications executing in the virtualization mode.

10. The computer readable media of claim 8, wherein the virtualization mode is a remote access mode provided by the client agent application.

11. The computer readable media of claim 10, wherein the one or more policy files include a first temporal restriction restricting times when the remote access mode is usable to access the first managed application in the virtualization mode, and a second temporal restriction, different from the first temporal restriction, restricting times when the remote access mode is usable to access a second managed application in the virtualization mode.

12. The computer readable media of claim 10, wherein the one or more policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access the first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.

13. The computer readable media of claim 8, wherein the predefined condition is either always met or never met on a per user basis.

14. The computer readable media of claim 8, wherein the predefined condition is either always met or never met on a per application basis.

15. A method, comprising:

configuring a mobile device to execute one or more managed applications in accordance with one or more policy files, wherein the one or more policy files are stored on the device separately from any managed applications on the device;

receiving user input requesting execution of a first managed application on the device;

when a predefined condition is met, executing the first managed application in a local mode according to the one or more policy files; and

when the predefined condition is not met, executing the first managed application in a virtualization mode according to the one or more policy files, wherein the virtualization mode causes the first managed application to execute on a remote device whose graphical output is presented on the device,

wherein the one or more policy files act to permit execution of a feature of the first managed application in one of the local mode and the virtualization mode, and act to restrict execution of the feature in the other one of the local mode and the virtualization mode.

16. The computer readable media of claim 15, wherein the one or more policy files restrict cutting and pasting between applications executing in local mode with applications executing in the virtualization mode.

17. The computer readable media of claim 15, wherein the virtualization mode is a remote access mode provided by the client agent application.

18. The computer readable media of claim 17, wherein the one or more policy files include a first temporal restriction restricting times when the remote access mode is usable to access the first managed application in the virtualization mode, and a second temporal restriction, different from the first temporal restriction, restricting times when the remote access mode is usable to access a second managed application in the virtualization mode.

19. The computer readable media of claim 17, wherein the one or more policy files include a first geographic restriction restricting a geographic location from where the remote access mode is usable on the device to access the first managed application in the virtualization mode, and a second geographic restriction, different from the first geographic restriction, restricting a geographic location from where the remote access mode is usable to access a second managed application in the virtualization mode.

20. The computer readable media of claim 15, wherein the predefined condition is either always met or never met on a per user basis.

21. The computer readable media of claim 15, wherein the predefined condition is either always met or never met on a per application basis.