Integrated application scanning and mobile enterprise computing management system

• US 9,917,862 B2
• Filed: 04/14/2016
• Issued: 03/13/2018
• Est. Priority Date: 04/14/2016
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Phanse, Shruti, Kumar, Bhavesh Krishna
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US15/098,582
• Publication Number:
  US 20170302701A1
• Time in Patent Office: 698 Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/71 Hardware identity

Abstract

Disclosed are various approaches for integrating application scanning into a mobile enterprise computing management system. A management service can add a first command to a command queue associated with a client device, wherein the first command instructs the client device to provide a unique device identifier associated with the client device to the management service and the unique device identifier uniquely identifies the client device with respect to at least one other client device. Then, the management service can receive a first request from the client device for the first command stored in the command queue. Later, the management service sends the first command to the client device. When the management service receives the unique device identifier from the client device, the management service sends the unique device identifier to a scanning service and a policy linked with the unique device identifier to the scanning service. The policy comprises an identifier of a client application prohibited on the client device. The management service then receives a notification from the scanning service. The notification comprises the unique device identifier and an indication that the client application is present on the client device. Later, the management service adds a second command to the command queue, wherein the second command instructs the client device to perform a remedial action specified by the policy. When the management service receives a second request from the client device for the second command stored in the command queue, the management service sends the second command to the client device.

Claims

1. A system, comprising:

a server comprising a server processor and a server memory;

a client device in data communication with the server, the client device comprising a client processor and a client memory;

a management service stored in the server memory that, when executed by the server processor, causes the server to at least;

add a first command to a command queue associated with the client device, wherein the first command instructs the client device to provide a unique device identifier associated with the client device to the management service, wherein the unique device identifier uniquely identifies the client device with respect to at least one other client device;

receive a first request from the client device for the first command stored in the command queue;

send the first command to the client device;

identify the unique device identifier associated with the client device;

send the unique device identifier to a scanning service;

send a policy linked with the unique device identifier to the scanning service, the policy comprising an identifier of a client application prohibited on the client device;

receive a notification from the scanning service, the notification comprising the unique device identifier and an indication that the client application is present on the client device;

add a second command to the command queue, wherein the second command instructs the client device to perform a remedial action specified by the policy;

receive a second request from the client device for the second command stored in the command queue; and

send the second command to the client device.

2. The system of claim 1, wherein the remedial action comprises causing the client device to uninstall the client application.

3. The system of claim 1, wherein the remedial action comprises causing the client device to upgrade the client application.

4. The system of claim 1, wherein the remedial action comprises causing the client device to modify a permission assigned to the client application.

5. The system of claim 1, wherein the remedial action comprises causing the client device to modify a setting of the client application.

6. The system of claim 1, wherein the client application comprises a first client application stored in the client memory and the remedial action comprises causing the client device to uninstall a second client application stored in the client memory.

7. The system of claim 1, wherein the remedial action comprises resetting the client device to an initial state.

8. A method, comprising:

adding a first command to a command queue associated with a client device that comprises a processor and a memory, wherein the first command instructs the client device to provide a unique device identifier associated with the client device, wherein the unique device identifier uniquely identifies the client device with respect to at least one other client device;

receive a first request from the client device for the first command stored in the command queue;

send the first command to the client device;

identify the unique device identifier associated with the client device;

send the unique device identifier to a scanning service;

send a policy linked with the unique device identifier to the scanning service, the policy comprising an identifier of a client application prohibited on the client device;

receive a notification from the scanning service, the notification comprising the unique device identifier and an indication that the client application is present on the client device;

add a second command to the command queue, wherein the second command instructs the client device to perform a remedial action specified by the policy;

receive a second request from the client device for the second command stored in the command queue; and

send the second command to the client device.

9. The method of claim 8, wherein the remedial action comprises causing the client device to uninstall the client application.

10. The method of claim 8, wherein the remedial action comprises causing the client device to upgrade the client application.

11. The method of claim 8, wherein the remedial action comprises causing the client device to modify a permission assigned to the client application.

12. The method of claim 8, wherein the remedial action comprises causing the client device to modify a setting of the client application.

13. The method of claim 8, wherein the client application comprises a first client application and the remedial action comprises causing the client device to uninstall a second client application from the client device.

14. The method of claim 8, wherein the remedial action comprises resetting the client device to an initial state.

15. A non-transitory computer readable medium comprising machine readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:

add a first command to a command queue associated with a client device, wherein the first command instructs the client device to provide a unique device identifier associated with the client device to the management service, wherein the unique device identifier uniquely identifies the client device with respect to at least one other client device;

receive a first request from the client device for the first command stored in the command queue;

send the first command to the client device;

identify the unique device identifier associated with the client device;

send the unique device identifier to a scanning service;

send a policy linked with the unique device identifier to the scanning service, the policy comprising an identifier of a client application prohibited on the client device;

receive a notification from the scanning service, the notification comprising the unique device identifier and an indication that the client application is present on the client device;

add a second command to the command queue, wherein the second command instructs the client device to perform a remedial action specified by the policy;

receive a second request from the client device for the second command stored in the command queue; and

send the second command to the client device.

16. The non-transitory computer readable medium of claim 15, the remedial action comprises causing the computing device to uninstall the client application.

17. The non-transitory computer readable medium of claim 15, wherein the remedial action comprises causing the computing device to upgrade the client application.

18. The non-transitory computer readable medium of claim 15, wherein the remedial action comprises causing the computing device to modify a permission assigned to the client application.

19. The non-transitory computer readable medium of claim 15, wherein the remedial action comprises causing the computing device to modify a setting of the client application.

20. The non-transitory computer readable medium of claim 15, the client application comprises a first client application and the remedial action comprises causing the computing device to uninstall a second client application from the computing device.