Policy based application management

• US 9,521,147 B2
• Filed: 07/24/2014
• Issued: 12/13/2016
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Walker, James Robert, Desai, Nitin, Lang, Zhongmin
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US14/340,096
• Publication Number:
  US 20140337528A1
• Time in Patent Office: 873 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/30 : Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent

Abstract

Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user'"'"'s own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.

Claims

1. A method of managing applications on a mobile device, comprising:

executing, on the mobile device, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device

wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user or device mobile information, as defined in the one or more policy files.

2. The method of claim 1, wherein the client agent is configured to facilitate the one or more remote applications by:

receiving input from a user intended for a particular remote application;

passing the user input to the particular remote application;

receiving data from the particular remote application responsive to the user input; and

presenting the data by the client agent application on the display of the mobile device.

3. The method of claim 2, wherein receiving data from the particular remote application comprises receiving the data via a remote presentation protocol, and wherein the received data comprises output from the remote application to update a graphical user interface presented by the client agent on the display of the mobile device.

4. The method of claim 1, further comprising:

applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and

applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device.

5. The method of claim 1, further comprising automatically determining, by the client agent application, whether to initiate execution of a user-requested application locally or remotely, based on one or more policy files identifying whether or not each of one or more applications comprising the user-requested application is permitted to run locally on the mobile device.

6. The method of claim 1, further comprising:

receiving first user input requesting execution of a first application on the mobile device, wherein the first application is a local application;

executing, responsive to the first user input, the first application according to a first set of policy files;

receiving second user input requesting execution of a second application on the mobile device, wherein the second application is a local application;

executing, responsive to the second user input, the second application according to a second set of policy files;

receiving third user input requesting execution of a third application on the mobile device, wherein the third application is a remote application;

responsive to the third user input, initiating remote execution of the third application on the remote computing device according to a third set of policy files.

7. The method of claim 1, further comprising:

receiving one or more updated policy files replacing a corresponding one or more existing policy files stored on the mobile device; and

updating the access controls enforced by the mobile device management system according to the one or more updated policy files.

8. The method of claim 7, wherein updating the access controls comprises automatically removing from the mobile device a local application.

9. The method of claim 7, wherein updating the access controls comprises automatically deleting user data associated with the removed local application.

10. A mobile device comprising a processor configured to execute, based on instructions stored in a memory, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device

wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user or device mobile information, as defined in the one or more policy files.

11. The mobile device of claim 10, wherein the instructions further cause the mobile device to manage applications by:

applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and

applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device.

12. One or more non-transitory computer readable media storing computer executable instructions that, when executed, cause a system to manage applications on a mobile device by:

executing, on the mobile device, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device,

wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user and/or device mobile information, as defined in the one or more policy files.

13. The computer readable media of claim 12, wherein the client agent is configured to facilitate the one or more remote applications by:

receiving input from a user intended for a particular remote application;

passing the user input to the particular remote application;

receiving data from the particular remote application responsive to the user input; and

presenting the data for display by the client agent application.

14. The computer readable media of claim 13, wherein receiving data from the particular remote application comprises receiving the data via a remote presentation protocol, and wherein the received data comprises output from the remote application to update a graphical user interface presented by the client agent on the display of the mobile device.

15. The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by:

applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and

applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device.

16. The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by automatically determining, by the client agent application, whether to initiate execution of a user-requested application locally or remotely, on an application by application basis, based on one or more policy files identifying whether or not each of one or more applications comprising the user-requested application is permitted to run locally on the mobile device.

17. The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by:

receiving first user input requesting execution of a first application on the mobile device, wherein the first application is a local application;

executing, responsive to the first user input, the first application according to a first set of policy files;

receiving second user input requesting execution of a second application on the mobile device, wherein the second application is a local application;

executing, responsive to the second user input, the second application according to a second set of policy files;

receiving third user input requesting execution of a third application on the mobile device, wherein the third application is a remote application;

responsive to the third user input, initiating remote execution of the third application on the remote computing device according to a third set of policy files.

18. The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by:

receiving one or more updated policy files replacing a corresponding one or more existing policy files stored on the mobile device; and

updating the access controls enforced by the mobile device management system according to the one or more updated policy files.

19. The computer readable media of claim 18, wherein updating the access controls comprises automatically removing from the mobile device a local application.

20. The computer readable media of claim 18, wherein updating the access controls comprises automatically deleting user data associated with the removed local application.