Method and system for administering multiple domain management authorities on a mobile device

1. A method for administering multiple management agents on a mobile device comprising two or more domains, the method comprising:

receiving, at a policy manager on the mobile device, a policy from each of the multiple management agents on the mobile device, the policies controlling at least one of: access to shared services on the mobile device; security on the mobile device; or permissions for functionality of the mobile device;

establishing, by the policy manager, a hierarchy of trust designating, for each management agent, a respective level of trust of the management agent, the respective level of trust of the management agent being a function of a vendor that provided the management agent, wherein the is known to the policy manager and is associated with a level of trust;

determining which one or more of the domains are currently active;

consolidating, by the policy manager on the device, the policies based on rules within the policy manager and as a function of which one or more of the domains are currently active and the hierarchy of trust, thereby generating a consolidated policy; and

applying the consolidated policy on the mobile device, thereby controlling at least one of: access to shared services on the mobile device; security on the mobile device; or permissions for functionality of the mobile device;

wherein each of the management agents is an entity on the mobile device which receives policies from a corresponding external management authority.

2. The method of claim 1 , wherein the consolidating comprises creating an aggregate restriction set based on restriction sets in the policies of each of the multiple management agents.

3. The method of claim 2 , wherein the aggregated restriction set controls the access to shared services on the mobile device, the security on the mobile device, and the permissions for functionality of the mobile device.

4. The method of claim 2 , further comprising updating the aggregated restriction set responsive to one of the two or more domains becoming active.

5. The method of claim 4 , wherein the consolidating the policies is further based on at least one of: time of day, location of the mobile device, the network serving the mobile device, or regulation changes for the mobile device.

6. The method of claim 1 , wherein consolidating the policies allows a management agent full control of a domain it is associated with, but limited control of the shared services or functionality outside of the domain the management agent is associated with.

7. The method of claim 1 , wherein a policy for a management agent applies both to a domain associated with the management agent, as well as to other domains.

8. The method of claim 1 , further comprising updating the consolidated policy upon addition of a new management agent.

9. A mobile device having a plurality of domains, the domains comprising concurrently operative operating systems, the mobile device comprising:

a processor; and

memory,

wherein the mobile device is configured to:

receive, at a policy manager on the mobile device, a policy from each of multiple management agents on the mobile device, the policies controlling at least one of: access to shared services on the mobile device; security on the mobile device; or permissions for functionality of the mobile device;

establish, by the policy manager, a hierarchy of trust designating, for each management agent, a respective level of trust of the management agent, the respective level of trust of the management agent being a function of a vendor that provided the management agent, wherein the vendor is known to the policy manager and is associated with a level of trust;

determine which one or more of the domains are currently active;

consolidate, by the policy manager, the policies based on rules within the policy manager and as a function of which one or more of the domains are currently active and the hierarchy of trust, thereby generating a consolidated policy; and

apply the consolidated policy on the mobile device;

wherein each of the management agents is an entity on the mobile device which receives policies from a corresponding external management authority.

10. The mobile device of claim 9 , wherein the mobile device is configured to consolidate by creating an aggregate restriction set based on restriction sets in the policies of each of the multiple management agents.

11. The mobile device of claim 10 , wherein the aggregated restriction set controls the access to shared services on the mobile device, the security on the mobile device, and the permissions for functionality of the mobile device.

12. The mobile device of claim 10 , wherein the mobile device is further configured to update the aggregated restriction set responsive to one of the two or more domains becoming active.

13. The mobile device of claim 12 , wherein the consolidating the policies is further based on at least one of: time of day, location of the mobile device, the network serving the mobile device, or regulation changes for the mobile device.

14. The mobile device of claim 9 , wherein consolidating the policies allows a management agent full control of a domain it is associated with, but limited control of the shared services or functionality outside of the domain the management agent is associated with.

15. The mobile device of claim 9 , wherein a policy for a management agent applies both to a domain associated with the management agent, as well as to other domains.

16. The mobile device of claim 9 , wherein the mobile device is further configured to update the consolidated policy upon addition of a new management agent.

17. A non-transitory computer readable medium having processor executable instructions stored thereon that, when executed by a processor of a mobile device having a plurality of domains, the domains comprising concurrently operative operating systems, cause the mobile device to:

receive, at a policy manager on the mobile device, a policy from each of multiple management agents on the mobile device, the policies controlling at least one of: access to shared services on the mobile device; security on the mobile device; or permissions for functionality of the mobile device;

establish, by the policy manager, a hierarchy of trust designating, for each management agent, a respective level of trust of the management agent, the respective level of trust of the management agent being a function of a vendor that provided the management agent, wherein the vendor is known to the policy manager and is associated with a level of trust;

determine which one or more of the domains are currently active;

consolidate, by the policy manager, the policies based on rules within the policy manager and as a function of which one or more of the domains are currently active and the hierarchy of trust, thereby generating a consolidated policy; and

apply the consolidated policy on the mobile device;

wherein each of the management agents is an entity on the mobile device which receives policies from a corresponding external management authority.

18. The method of claim 1 , Wherein consolidating the policies as a function of the hierarchy of trust comprises:

detecting a conflict between the policies of first and second management agents of the multiple management agents, the level of trust of the first management agent being higher than the level of trust of the second management agent; and

as a result of detecting the conflict, removing the policies of the second management agent.

19. The mobile device of claim 9 , wherein consolidating policies as a function of the hierarchy of trust comprises:

detecting a conflict between the policies of first and second management agents of the multiple management agents, the level of trust of the first management agent being higher than the level of trust of the second management agent; and

as a result of detecting the conflict, removing the policies of the second management agent.

20. The non-transitory computer readable medium of claim 17 , wherein consolidating the policies as a function of the hierarchy of trust comprises:

detecting a conflict between the policies of first and second management agents of the multiple management agents, the level of trust of the first management agent being higher than the level of trust of the second management agent; and

as a result of detecting the conflict, removing the policies of the second management agent.