Provisioning work environments on personal mobile devices

Patent metadata

Field	Value
Publication number	US-10044734-B2
Application number	US-201715401225-A
Country	US
Kind code	B2
Filing date	Jan 9, 2017
Priority date	Nov 22, 2011
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

A virtual business mobile device can be provisioned on a personal mobile device, by binding a mobile application for provisioning the business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the binding enables a software virtualization layer and a management service component of the mobile application to execute in a privileged mode. The mobile application is then able to download a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the software virtualization layer is able to launch a virtual machine for the business mobile device based on the virtual phone image. Once the virtual phone image has been downloaded, the management service component initiates a periodic attempt to establish a connection with the mobile management server to comply with the downloaded security-related policy settings.

First claim

What is claimed is:

1. A method of provisioning mobile device comprising:
binding a mobile application for provisioning a business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the business mobile device comprises a virtual machine running on a software virtualization layer and the binding enables the software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
downloading, through the mobile application, a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the software virtualization layer is configured to launch the virtual machine for the business mobile device based on the virtual phone image; and
removing the virtual phone image of the business mobile device without affecting use of the personal mobile device external to the virtual machine, wherein the management service component is configured to prevent the user of the personal mobile device from terminating the management service component.

2. The method of claim 1 , further comprising initiating a periodic attempt to establish a connection between the management service component of the mobile application and the mobile management server to comply with the security-related policy settings.

3. The method of claim 1 , wherein the binding comprises an authentication of the mobile application with the privileged component.

4. The method of claim 1 , wherein the privileged component facilitates transfer of control between the host operating system of the personal mobile device and the virtual machine of the business mobile device.

5. The method of claim 1 , wherein the mobile application is downloaded to the personal mobile device from a mobile application store.

6. The method of claim 5 , wherein the mobile application is downloaded by a provisioning component of the mobile application.

7. The method of claim 6 , wherein the provisioning component of the mobile application is configured with a network address of the mobile management server.

8. The method of claim 1 , wherein the security-related policy settings comprise at least one of an interval time period to establish communications between the management service component and the mobile management server, an auto-disable time period to temporarily disable the business mobile device and an auto-wipe time period to permanently remove the business mobile device from the personal mobile device.

9. The method of claim 1 , further comprising downloading any updates to the business mobile device from the mobile management service upon successfully establishing a connection between the management service and the mobile management servicer during a periodic attempt.

10. The method of claim 1 , further comprising temporarily disabling access to the business mobile device upon expiration of an auto-disable time period specified in the security-related profile settings.

11. A mobile device configured to support a virtual business mobile device, the mobile device configured to at least:
bind a mobile application for provisioning a business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the business mobile device comprises a virtual machine running on a software virtualization layer and the binding enables the software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
download, through the mobile application, a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the software virtualization layer is configured to launch the virtual machine for the business mobile device based on the virtual phone image; and
remove the virtual phone image of the business mobile device without affecting use of the personal mobile device external to the virtual machine, wherein the management service component is configured to prevent the user of the personal mobile device from terminating the management service component.

12. The mobile device of claim 11 , wherein the mobile device is further configured to initiate a periodic attempt to establish a connection between the management service component of the mobile application and the mobile management server to comply with the security-related policy settings.

13. The mobile device of claim 11 , wherein the mobile device binds by authenticating of the mobile application with the privileged component.

14. The mobile device of claim 11 , wherein the privileged component facilitates transfer of control between the host operating system of the personal mobile device and the virtual machine of the business mobile device.

15. The mobile device of claim 11 , wherein the mobile application is downloaded to the mobile device from a mobile application store.

16. The mobile device of claim 11 , wherein the mobile application is downloaded by a provisioning component of the mobile application.

17. The mobile device of claim 11 , wherein the provisioning component is configured with a network address of the mobile management server.

18. The mobile device of claim 11 , wherein the security-related policy settings comprise at least one of an interval time period to establish communications between the management service component and the mobile management server, an auto-disable time period to temporarily disable the virtual business mobile device and an auto-wipe time period to permanently remove the virtual business mobile device from the mobile device.

19. The mobile device of claim 11 , wherein the mobile device is further configured to download any updates to the virtual business mobile device from the mobile management service upon successfully establishing a connection between the management service and the mobile management servicer during a periodic attempt.

20. The mobile device of claim 11 , wherein the mobile device is further configured to disable access to the virtual business mobile device upon expiration of an auto-disable time period specified in the security-related profile settings.

21. A non-transitory computer readable storage medium including instructions that cause a processor of a mobile device to at least:
bind a mobile application for provisioning a business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the business mobile device comprises a virtual machine running on a software virtualization layer and the binding enables the software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
download, through the mobile application, a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the software virtualization layer is configured to launch the virtual machine for the business mobile device based on the virtual phone image; and
remove the virtual phone image of the business mobile device without affecting use of the personal mobile device external to the virtual machine, wherein the management service component is configured to prevent the user of the personal mobile device from terminating the management service component.

Assignees

• Vmware Inc

Inventors

• Deasy Stephen
• Newell Craig
• Sit Emil
• Wisner Paul
• Furodet David
• Gyuris Viktor
• Meyer Robert
• Strudel Fanny

Classifications

• H04N21/4437 Primary

  Implementing a Virtual Machine [VM] (virtual machines in general G06F9/45533) · CPC title

• H04N21/443

  OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB · CPC title

• G06F9/46

  Multiprogramming arrangements · CPC title

• G06F9/45529

  Embedded in an application, e.g. JavaScript in a Web browser · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title