Enterprise mobility management and verification of a managed application by a content provider

• US 9,602,514 B2
• Filed: 06/12/2015
• Issued: 03/21/2017
• Est. Priority Date: 06/16/2014
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Narayanan, Sowmiya Chocka, Carpel, Tom, Still, David
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): DE JESUS LASSALA, CARLOS MANUEL
• Application Number:
  US14/738,331
• Publication Number:
  US 20150365416A1
• Time in Patent Office: 648 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A non-SDK based scalable technology for integrating multiple mobile device management (MDM) service providers into a content provider platform (or server) is described herein. More specifically, the technology described herein facilitates enterprise mobility management through verification of a managed application associated with an enterprise via the content provider platform. In some embodiments, the content provider platform comprises a cloud-based collaboration and/or storage environment (“cloud-based platform server”) that prevents an unmanaged application from gaining access to the cloud-based collaboration and/or storage server.

Claims

1. A method of verifying a managed application associated with an enterprise via a content server, the method comprising:

receiving, by one or more processors of the content server, a verification request initiated by the managed application on a mobile device,

wherein the verification request includes a verification payload;

extracting, by the one or more processors of the content server, a first portion and a second portion of the verification payload,

wherein the first portion of the verification payload identifies a first mobile management configuration entry;

accessing, by the one or more processors of the content server, the first mobile management configuration entry to identify the enterprise and mobile device management (MDM) information corresponding to the enterprise,

wherein the MDM information indicates a first MDM configuration for the enterprise; and

generating, by the one or more processors of the content server, a compliance query based on the MDM information associated with the enterprise to verify the managed application associated with the enterprise,

wherein the compliance query includes the second portion of the verification payload.

2. The method of claim 1, further comprising:

verifying, by the one or more processors of the content server, that a user of the managed application belongs to the enterprise.

3. The method of claim 2, wherein verifying that the user belongs to the enterprise comprises:

cross-referencing an enterprise indicated by received user credentials with the enterprise indicated by the first mobile management configuration entry; and

disallowing the managed application to access the content server if the enterprise indicated by the user credentials does not match the enterprise indicated by the first mobile management configuration entry.

4. The method of claim 1, wherein the verification request is initiated periodically by the managed application on the mobile device.

5. The method of claim 1, further comprising:

receiving, by the one or more processors of the content server, an authentication request initiated by the managed application on the mobile device,

wherein the authentication request includes user credentials associated with the user of the managed application and the verification payload; and

authenticating the user with the content server using the user credentials.

6. The method of claim 5, further comprising:

sending the compliance query for delivery to an MDM server associated with an MDM provider,

wherein the information corresponding to the enterprise identifies the MDM server and the MDM provider.

7. The method of claim 1, further comprising:

receiving, by the one or more processors of the content server, a compliance response initiated by the MDM server, the compliance response indicating that the enterprise compliance requirements have been satisfied; and

allowing the managed application to access the content server.

8. The method of claim 1, further comprising:

receiving, by the one or more processors of the content server, a compliance response initiated by the MDM server indicating that the enterprise compliance requirements have not been satisfied; and

disallowing the managed application to access the content server.

9. The method of claim 1, wherein the verification payload is in the form of multiple key-value pairs.

10. The method of claim 9, wherein the first portion of the verification payload comprises a public identifier (ID) and the second portion of the verification payload comprises a management ID.

11. The method of claim 10, wherein the management ID uniquely identifies the user for verification that the user is a managed user or uniquely identifies the device for verification that the device is valid.

12. The method of claim 1, wherein the MDM information indicates the first of multiple MDM configurations for the enterprise.

13. The method of claim 1, wherein the content server belongs to a cloud-based collaboration platform and the managed application comprises a cloud-based collaboration application.

14. A method of verifying a managed application associated with an enterprise via a content server, the method comprising:

receiving, by the one or more processors of the content server, an authentication request initiated by the managed application on the mobile device,

wherein the authentication request includes user credentials associated with a user of the managed application and the verification payload;

authenticating the user with the content server using the user credentials;

extracting, by the or more processors of the content server, a first portion and a second portion of a verification payload,

wherein the first portion of the verification payload identifies a first mobile management configuration entry on the content server;

accessing, by the one or more processors of the content server, the first mobile management configuration entry to identify the enterprise and mobile device management (MDM) information corresponding to the enterprise,

wherein the MDM information indicates a first MDM configuration for the enterprise;

verifying, by the one or more processors of the content server, that the user belongs to the enterprise;

generating, by the one or more processors of the content server, a compliance query based on the MDM information associated with the enterprise to verify the managed application associated with the enterprise,

wherein the compliance query includes the second portion of the verification payload; and

sending the compliance query for delivery to an MDM server associated with an MDM provider,

wherein the information corresponding to the enterprise identifies the MDM server and the MDM provider.

15. The method of claim 14, wherein verifying that the user belongs to the enterprise comprises:

identifying an enterprise using the user credentials associated with the user of the managed application;

comparing the enterprise identified using the user credentials with the enterprise indicated by the first mobile management configuration entry and

disallowing the managed application to access the content server if the enterprise indicated by the user credentials does not match the enterprise indicated by the first mobile management configuration entry.

16. The method of claim 14, further comprising:

receiving, via a console of the content server, the MDM information corresponding to the first MDM configuration for the enterprise; and

populating the first mobile management configuration entry for the enterprise with the MDM information.

17. The method of claim 14, wherein the MDM information comprises one or more of an MDM server address, MDM authentication information, MDM type information, MDM tier information, or MDM communication information.

18. A system for verifying a managed application associated with an enterprise, the system comprising:

a repository configured to store enterprise mobile management entries identifying one or more mobile device management (MDM) configurations for each of multiple enterprises;

a content server communicatively coupled to the repository, the content server including;

one or more processors;

an application program interface (API) configured to receive a request initiated by a user of the managed application on a mobile device, the request including a verification payload;

a verification engine configured to;

extract a first portion and a second portion of the verification payload, the first portion of the verification payload identifying a first mobile management configuration entry in the repository;

access the first mobile management configuration entry to identify an enterprise and MDM information corresponding to the enterprise; and

an MDM query engine configured to generate a compliance query based on the MDM information corresponding to the enterprise to verify the managed application associated with the enterprise, the compliance query including the second portion of the verification payload.

19. The system of claim 18, wherein the request comprises an authentication request further including user credentials associated with the user of the managed application, wherein the verification engine is further configured to:

verify that the user belongs to the enterprise by;

identifying an enterprise indicated by the user credentials associated with the user of the managed application;

cross-referencing the enterprise indicated by user credentials with the enterprise indicated by the first mobile management configuration entry; and

disallow access to the content server by the managed application if the enterprise indicated by the user credentials does not match the enterprise indicated by the first mobile management configuration entry.

20. A machine-readable storage device having instructions stored thereon, which when executed by one or more processors of a computer system, cause the computer system to:

process a verification request initiated by a user of the managed application on a mobile device, the verification request including a verification payload;

extract a first portion and a second portion of the verification payload, wherein the first mobile management configuration entry identifies a first mobile management configuration entry associated with the content server;

access the first mobile management configuration entry to identify the enterprise and mobile device management (MDM) information corresponding to the enterprise, the MDM information indicating a first MDM configuration for the enterprise; and

generate a compliance query based on the MDM information associated with the enterprise to verify the managed application associated with the enterprise, the compliance query including the second portion of the verification payload.