Issuing security commands to a client device

Patent metadata

Field	Value
Publication number	US-9298936-B2
Application number	US-201414314610-A
Country	US
Kind code	B2
Filing date	Jun 25, 2014
Priority date	Jun 25, 2014
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

Disclosed are various embodiments for issuing security commands, such as a wipe command, to a client device. An application executed by the client device can include a mail proxy that can act as a proxy to a remote mail server and determine compliance with compliance rules. Should the client device violate a compliance rule, the mail proxy executed by the client device may issue a security command to a mail client executed by the client device.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in a client device, the program, when executed by the client device, being configured to cause the client device to at least:
receive a request to communicate with a mail server, the request originating from a mail client executed by the client device, wherein the mail client is configured to transmit requests associated with a mail account to the mail server, the mail server corresponding to a network address of the client device and the mail server further corresponding to a mail proxy executed by the client device;
determine, in response to receiving the request, whether a limitation on at least one component of the client device has been removed;
in response to determining that the limitation on at least one component of the client device has not been removed, forwarding the request to communicate with the mail server to a remote mail server accessible through a network, the remote mail server corresponding to a network address external to the client device and the remote mail server further corresponding to a remote mail server executed by another computing device, wherein a response to the request to communicate with the mail server is received from the remote mail server and forwarded to the mail client; and
in response to determining that the limitation on at least one component of the client device has been removed, issuing a command from the mail proxy executed by the client device to the mail client executed by the client device to remove data from the client device.

2. The non-transitory computer-readable medium of claim 1 , wherein the command instructs the mail client to erase data stored on the client device.

3. The non-transitory computer-readable medium of claim 2 , wherein the data comprises at least one of: mail data, calendar data or contact data that is accessible to the mail client.

4. The non-transitory computer-readable medium of claim 1 , wherein the program determines whether the limitation of the at least one component of the client device has been removed by determining whether root access to resources of the client device have been granted to a user of the client device.

5. The non-transitory computer-readable medium of claim 1 , wherein the program determines whether the limitation of the at least one of component of the client device has been removed by determining whether at least one of: a subscriber identity module (SIM) card has been removed from the client device or a new SIM card that differs from a previous SIM card has been installed in the client device.

6. The non-transitory computer-readable medium of claim 1 , wherein the program is configured to issue the command from a server process executed by the client device to the mail client executed by the client device to remove data from the client device when external network accessibility of the client device is impaired or disabled.

7. A system, comprising:
a client device;
programming code executable in the client device, the programming code comprising:
logic that receives a communication from an application executed by the client device, the application being configured to identify a network address corresponding to the client device as a server corresponding to the communication;
logic that determines whether the client device complies with at least one compliance rule in response to receiving the communication from the application executed by the client device;
logic that forwards the communication to another server external to the client device in response to determining that the client device complies with the at least one compliance rule; and
logic that issues a security command to the client device in response to determining that the client device violates the at least one compliance rule.

8. The system of claim 7 , wherein the logic that determines whether the client device complies with the at least one compliance rule further comprises:
logic that sends a request to another computing device accessible through a network; and
logic that obtains a response to the request from the another computing device indicating whether the client device complies with the at least one compliance rule.

9. The system of claim 7 , wherein the logic that determines whether the client device complies with the at least one compliance rule further comprises:
logic that sends a request to another application executed by the client device; and
logic that obtains a response to the request from the application executed by the client device indicating whether the client device complies with the at least one compliance rule.

10. The system of claim 7 , wherein the security command further comprises a warning that the client device violates the at least one compliance rule, the warning comprising at least one of a visual alert displayed by the client device or a message transmitted to a user corresponding to the client device.

11. The system of claim 7 , wherein the security command further comprises a wipe command instructing the application to delete data accessible to the client device.

12. The system of claim 11 , wherein the wipe command instructs a mail client to delete at least one of: mail data, calendar data, contact data, or user data associated with the client device.

13. The system of claim 7 , wherein the application executed by the client device further comprises a mail client.

14. The system of claim 13 , wherein the security command further comprises a communication indicating that a mail account associated with the mail client has at least one of: an empty mailbox, an empty calendar or an empty address book.

15. The system of claim 7 , wherein the security command further comprises a command to lock a display associated with the client device.

16. The system of claim 7 , wherein the at least one compliance rule is at least one of: a requirement that an operating system of the client device be in an unaltered state or a requirement that a user account associated with the client device not have root privileges.

17. The system of claim 7 , wherein the at least one compliance rule comprises a requirement that the client device be located within a geographic boundary, wherein a location of the client device is obtained from a positioning system associated with the client device.

18. The system of claim 7 , wherein the at least one compliance rule comprises a requirement that at least one specified application not be installed on the client device.

19. The system of claim 7 , wherein the at least one compliance rule comprises a requirement that at least one specified application be installed on the client device.

20. A method, comprising:
obtaining, within a client device, a request associated with a mail account from a mail client executed by the client device, the request submitted to a mail proxy executed by the client device;
determining, by the client device, whether the client device complies with a compliance rule associated with the mail account; and
issuing, from the client device, a security command in response to determining that the client device fails to comply with the compliance rule, the security command communicated from the mail proxy executed by the client device to the mail client executed by the client device.

21. The method of claim 20 , wherein the security command further comprises a wipe command instructing the mail client to delete data stored on the client device.

Assignees

• Airwatch Llc
• Airwatch Llc

Inventors

• Stuntebeck Erich

Classifications

• H04L51/18

  Commands or executable codes · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L67/42

  Electricity · mapped topic

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W12/08

  Access security · CPC title