Location and time based mobile app policies

Patent metadata

Field	Value
Publication number	US-9727747-B1
Application number	US-201314137758-A
Country	US
Kind code	B1
Filing date	Dec 20, 2013
Priority date	Dec 21, 2012
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

Location, time, and other contextual mobile application policies are disclosed. Access state information associated with a managed set of applications may be determined based at least in part on environmental context data associated with a mobile device and one or more contextual policies associated with the managed set of applications. The access state information may be provided to at least one application included in the managed set of applications, wherein at least one application in the managed set of applications is configured to use the access state information to regulate use of the application in a manner required by the one or more contextual policies.

First claim

What is claimed is:

1. A method, comprising:
determining, at a management agent on a mobile device, access state information associated with a managed subset of two or more applications based at least in part on environmental context data associated with the mobile device and one or more contextual policies associated with the managed subset of applications, the contextual policies determined at a security management platform to be associated with the managed subset of applications; and
providing the access state information from the management agent to a library associated with a managed application included in the managed subset of applications, wherein the library associated with the managed application is configured to use the access state information to regulate use of the managed application in a manner required by the one or more contextual policies, wherein the library is configured to use a previously-shared key to decrypt the access state information.

2. The method of claim 1 , further comprising:
receiving, at the management agent, the contextual policies associated with the managed subset of applications.

3. The method of claim 1 , wherein the contextual policies are determined based at least in part on mobile device user information in an enterprise directory.

4. The method of claim 1 , wherein the contextual policies comprise one or more of at least one temporal policy, at least one location policy, and at least one connection policy.

5. The method of claim 1 , further comprising:
retrieving, by the management agent, the environmental context data associated with the mobile device.

6. The method of claim 5 , wherein the environmental context data is retrieved from one or more of an operating system and an application associated with the mobile device.

7. The method of claim 1 , further comprising:
retrieving, by the library associated with the managed application, the access state information associated with the managed subset of applications; and
executing at least one access control restriction associated with the managed application based at least in part on the retrieved access state information.

8. The method of claim 7 , wherein:
retrieving the access state information comprises retrieving, by the library associated with the managed application, the access state information from a secure application connection bus; and
executing the at least one access control restriction includes executing, by the library, the at least one access control restriction associated with the managed application.

9. The method of claim 7 , further comprising:
providing an output including an indication that access is restricted.

10. The method of claim 1 , wherein determining the access state information associated with the managed subset of applications includes:
determining that the environmental context data does not satisfy at least one of the contextual policies associated with the managed subset of applications; and
generating access state information including an access control restriction based at least in part on the determination.

11. The method of claim 10 , wherein the access control restriction includes one or more of a command to block access to the managed subset of applications and a command to restrict access to the managed subset of applications.

12. The method of claim 10 , further comprising:
determining that updated environmental context data satisfies at least one of the contextual policies; and
generating access state information including a command to allow access to the managed subset of applications.

13. The method of claim 1 , wherein determining the access state information associated with the managed subset of applications includes:
determining that the environmental context data satisfies at least one of the contextual policies associated with the managed subset of applications; and
generating access state information including a command to allow access to the managed subset of applications.

14. A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
determine, at a management agent on a mobile device, access state information associated with a managed subset of two or more applications based at least in part on environmental context data associated with the mobile device and one or more contextual policies associated with the managed subset of applications, the contextual policies determined at a security management platform to be associated with associated with the managed subset of applications; and
provide the access state information from the management agent to a library associated with a managed application included in the managed subset of applications, wherein the library associated with the managed application is configured to use the access state information to regulate use of the managed application in a manner required by the one or more contextual policies, wherein the library is configured to use a previously-shared key to decrypt the access state information.

15. The system recited in claim 14 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
retrieve, by the library associated with the managed application, the access state information associated with the managed subset of applications; and
execute at least one access control restriction associated with the managed application based at least in part on the retrieved access state information.

16. The system recited in claim 14 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:
determine that the environmental context data does not satisfy at least one of the contextual policies associated with the managed subset of applications; and
generate access state information including an access control restriction based at least in part on the determination.

17. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
determining, at a management agent on a mobile device, access state information associated with a managed subset of two or more applications based at least in part on environmental context data associated with a mobile device and one or more contextual policies associated with the managed subset of applications, the contextual policies determined at a security management platform to be associated with the managed subset of applications; and
providing the access state information from the management agent to a library associated with a managed application included in the managed subset of applications, wherein the library associated with the managed application is configured to use the access state information to regulate use of the managed application in a manner required by the one or more contextual policies, wherein the library is configured to use a previously-shared key to decrypt the access state information.

18. The computer program product recited in claim 17 , further comprising computer instructions for:
determining that the environmental context data does not satisfy at least one of the contextual policies associated with the managed subset of applications; and
generating access state information including an access control restriction based at least in part on the determination.

19

Assignees

• Mobile Iron Inc

Inventors

• Kim Mansu
• Sirota Joshua
• Batchu Suresh Kumar

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W4/02

  Services making use of location information · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title