Policy-based application management
View Patent ↗Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user's own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things.
1. A method comprising:
configuring a first managed application installed on an electronic mobile device to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when the managed application is executing on the electronic mobile device;
receiving, by processing circuitry of the electronic mobile device, a copy command;
encrypting, by the processing circuitry and in response to the copy command, original data from the first managed application to form encrypted data, wherein the encrypting is performed based on encryption information identified in the one or more policy files; and
writing, by the processing circuitry and in response to the copy command, the encrypted data to a secure clipboard residing in memory of the electronic mobile device to enable a second managed application to subsequently read and decrypt the encrypted data from the secure clipboard, the secure clipboard residing at a location of the memory which is different than that of a general clipboard residing in the memory, the general clipboard being accessible by a set of unmanaged applications running on the electronic mobile device, and the secure clipboard being accessible only to a set of one or more managed applications identified by the one or more policy files, wherein the set of one or more managed applications comprises the first and second managed applications.
2. A method as in claim 1 , further comprising:
receiving, by the processing circuitry, a paste command which directs pasting contents of the secure clipboard to a third managed application;
in response to the paste command, reading the encrypted data from the secure clipboard, decrypting the encrypted data to form decrypted data, and providing the decrypted data to the third managed application only when the third managed application is identified by the one or more policy files.
3. A method as in claim 1 , further comprising:
configuring each managed application to write information only to the secure clipboard in response to copy commands to restrict that managed application from writing information to the general clipboard.
4. A method as in claim 1 wherein configuring each managed application includes:
modifying an initial binary version of the managed application to form a modified binary version of the managed application, and
deploying the modified binary version of the managed application on the electronic mobile device, the initial binary version being un-configured, and the modified binary version being configured to write information only to the secure clipboard.
5. A method as in claim 4 wherein configuring each managed application further includes:
providing, via the one or more policy files, a memory address of the secure clipboard and a set of cryptographic keys to each managed application.
6. A method as in claim 4 wherein configuring each managed application further includes:
(i) providing a first memory address of the secure clipboard and a first set of cryptographic keys to a first group of managed applications, and (ii) providing a second memory address to another secure clipboard and a second set of cryptographic keys to a second group of managed applications, to configure multiple groups of managed applications to utilize different secure clipboards.
7. A method as in claim 1 , further comprising:
detecting a copy event in which unencrypted new data is copied to the general clipboard from an unmanaged application; and
in response to the copy event, automatically encrypting the unencrypted new data to form encrypted new data and writing the encrypted new data to the secure clipboard.
8. One or more non-transitory computer readable media storing computer readable instructions that, when executed by an electronic mobile device having a memory, cause the device to perform:
configuring a first managed application installed on the electronic mobile device to operate in accordance with a set of one or more policy files defined independent of the managed application, wherein each policy file defines one or more access controls enforced by a mobile device management system on the electronic mobile device when any managed application is executing on the electronic mobile device;
receiving, by the processing circuitry, a copy command;
encrypting, by the processing circuitry and in response to the copy command, original data from the first managed application to form encrypted data, wherein the encrypting is performed based on encryption information identified in the one or more policy files; and
writing, by the processing circuitry and in response to the copy command, the encrypted data to a secure clipboard residing in the memory to enable a second managed application to subsequently read and decrypt the encrypted data from the secure clipboard, the secure clipboard residing at a location of the memory which is different than that of a general clipboard residing in the memory, the general clipboard being accessible by a set of unmanaged applications running on the electronic mobile device, and the secure clipboard being accessible only to a set of one or more managed applications identified by the one or more policy files, wherein the set of one or more managed applications comprises the first and second managed applications.
9. The computer readable media of claim 8 , said instructions further comprising:
receiving, by the processing circuitry, a paste command which directs pasting contents of the secure clipboard to a third managed application;
in response to the paste command, reading the encrypted data from the secure clipboard, decrypting the encrypted data to form decrypted data, and providing the decrypted data to the third managed application only when the third managed application is identified by the one or more policy files.
10. The computer readable media of claim 8 , said instructions further comprising:
configuring each managed application to write information only to the secure clipboard in response to copy commands to restrict each managed application from writing information to the general clipboard.
11. A method as in claim 8 wherein configuring each managed application includes:
modifying an initial binary version of the managed application to form a modified binary version of the managed application, and
deploying the modified binary version of the managed application on the electronic mobile device, the initial binary version being un-configured, and the modified binary version being configured to write information only to the secure clipboard.
12. A method as in claim 11 wherein configuring each managed application further includes:
providing a memory address of the secure clipboard and a set of cryptographic keys to each managed application.
13. A method as in claim 11 wherein configuring each managed application further includes:
(i) providing a first memory address of the secure clipboard and a first set of cryptographic keys to a first group of managed applications, and (ii) providing a second memory address to another secure clipboard and a second set of cryptographic keys to a second group of managed applications, to configure multiple groups of managed applications to utilize different secure clipboards.