Provisioning work environments on personal mobile devices

Patent metadata

Field	Value
Publication number	US-9577985-B2
Application number	US-201514929027-A
Country	US
Kind code	B2
Filing date	Oct 30, 2015
Priority date	Nov 22, 2011
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

A virtual business mobile device can be provisioned on a personal mobile device, by binding a mobile application for provisioning the business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the binding enables a software virtualization layer and a management service component of the mobile application to execute in a privileged mode. The mobile application is then able to download a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server, wherein the software virtualization layer is able to launch a virtual machine for the business mobile device based on the virtual phone image. Once the virtual phone image has been downloaded, the management service component initiates a periodic attempt to establish a connection with the mobile management server to comply with the downloaded security-related policy settings.

First claim

What is claimed is:

1. A method of provisioning a business mobile device on a personal mobile device comprising:
binding a mobile application for provisioning the business mobile device to a privileged component of a host operating system of the personal mobile device, wherein the binding enables a software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
downloading, through the mobile application, a virtual phone image for the business mobile device and security-related policy settings relating to use of the business mobile device from a mobile management server managed by an employer of a user of the personal mobile device, wherein the software virtualization layer is able to launch a virtual machine for the business mobile device based on the virtual phone image; and
permanently removing the virtual phone image of the business mobile device without affecting a personal use of the personal mobile device upon expiration of an auto-wipe time period specified in the security-related policy settings, wherein the management service component is configured to prevent the user of the personal mobile device from terminating the management service component.

2. The method of claim 1 , further comprising initiating a periodic attempt to establish a connection between the management service component of the mobile application and the mobile management server to comply with the security-related policy settings.

3. The method of claim 2 , wherein the binding step comprises an authentication of the mobile application to the privileged component.

4. The method of claim 3 , wherein the privileged component facilitates transfer of control between the host operating system of the personal mobile device and the virtual machine of the business mobile device.

5. The method of claim 1 , wherein the mobile application is downloaded by the user to the personal mobile device from a mobile application store.

6. The method of claim 1 , wherein the downloading step is performed by a provisioning component of the mobile application.

7. The method of claim 6 , wherein the user provides the provisioning component of the mobile application with a network address of the mobile management server.

8. The method of claim 1 , wherein the security-related policy settings comprise at least one of an interval time period to establish communications between the management service component and the mobile management server, an auto-disable time period to temporarily disable the business mobile device and the auto-wipe time period to permanently remove the business mobile device from the personal mobile device.

9. The method of claim 1 , wherein the initiating step is performed by the management service component.

10. The method of claim 1 , further comprising downloading any updates to the business mobile device from the mobile management service upon successfully establishing a connection between the management service and the mobile management servicer during a periodic attempt.

11. The method of claim 1 , further comprising temporarily disabling access to the business mobile device upon expiration of an auto-disable time period specified in the security-related profile settings.

12. A mobile device configured to support a virtual business mobile device comprising a processor configured to perform the steps of:
binding a mobile application for provisioning the virtual business mobile device to a privileged component of a host operating system of the mobile device, wherein the binding enables a software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
downloading, through the mobile application, a virtual phone image for the virtual business mobile device and security-related policy settings relating to use of the virtual business mobile device from a mobile management server managed by an employer of a user of the mobile device, wherein the software virtualization layer is able to launch a virtual machine for the virtual business mobile device based on the virtual phone image; and
permanently removing the virtual phone image of the business mobile device without affecting a personal use of the personal mobile device upon expiration of an auto-wipe time period specified in the security-related policy settings, wherein the management service component is configured to prevent the user of the personal mobile device from terminating the management service component.

13. The mobile device of claim 12 , wherein the processor is further configured to perform the step of initiating a periodic attempt to establish a connection between the management service component of the mobile application and the mobile management server to comply with the security-related policy settings.

14. The mobile device of claim 13 , wherein the binding step comprises an authentication of the mobile application to the privileged component.

15. The mobile device of claim 14 , wherein the privileged component facilitates transfer of control between the host operating system of the mobile device and the virtual machine of the virtual business mobile device.

16. The mobile device of claim 12 , wherein the mobile application is downloaded by the user to the mobile device from a mobile application store.

17. The mobile device of claim 12 , wherein the downloading step is performed by a provisioning component of the mobile application.

18. The mobile device of claim 17 , wherein the user provides the provisioning component of the mobile application with a network address of the mobile management server.

19. The mobile device of claim 12 , wherein the security-related policy settings comprise at least one of an interval time period to establish communications between the management service component and the mobile management server, an auto-disable time period to temporarily disable the virtual business mobile device and the auto-wipe time period to permanently remove the virtual business mobile device from the mobile device.

20. The mobile device of claim 12 , wherein the initiating step is performed by the management service component.

21. The mobile device of claim 12 , wherein the processor is further configured to perform the step of downloading any updates to the virtual business mobile device from the mobile management service upon successfully establishing a connection between the management service and the mobile management servicer during a periodic attempt.

22. The mobile device of claim 12 , wherein the processor is further configured to perform the step of temporarily disabling access to the virtual business mobile device upon expiration of an auto-disable time period specified in the security-related profile settings.

23. A non-transitory computer readable storage medium including instructions that cause a processor of a mobile device to provision a virtual business mobile device by perform the steps of:
binding a mobile application for provisioning the virtual business mobile device to a privileged component of a host operating system of the mobile device, wherein the binding enables a software virtualization layer and a management service component of the mobile application to execute in a privileged mode;
downloading, through the mobile application, a virtual phone image for the virtual business mobile device and security-related policy settings relating to use of the virtual business mobile dev

Assignees

• Vmware Inc

Inventors

• Deasy Stephen
• Newell Craig
• Sit Emil
• Wisner Paul
• Furodet David
• Gyuris Viktor
• Meyer Robert
• Strudel Fanny

Classifications

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F9/46

  Multiprogramming arrangements · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• H04N21/443

  OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB · CPC title

• G06F9/45529

  Embedded in an application, e.g. JavaScript in a Web browser · CPC title