Secure execution of enterprise applications on mobile devices
View Patent ↗A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.
1. A method comprising:
generating, by an enterprise agent executing on a client device, a secure container in a first portion of a computer-readable storage of the client device, the secure container being encrypted and comprising a file system, wherein the first portion of the computer-readable storage is separate from a second portion of the computer-readable storage;
verifying, by the enterprise agent, a user of the client device based on one or more enterprise credentials associated with the user;
establishing, by the enterprise agent, a secure tunnel between the enterprise agent and a server associated with an enterprise;
receiving, by the enterprise agent, enterprise data from the server, the enterprise data received via the secure tunnel; and
storing, by the enterprise agent, the enterprise data in the secure container in accordance with one or more data policies of the enterprise,
wherein the secure container is only accessible by a verified user and by one or more applications associated with the enterprise, and
wherein access to the second portion of the computer-readable storage is provided independently of the one or more data policies of the enterprise.
2. The method of claim 1 , wherein private data associated with the user is stored in the second portion of the computer-readable storage, the private data associated with activity of the user that is outside of a role of the user in the enterprise, the second portion of the computer-readable storage being inaccessible to the enterprise agent.
3. The method of claim 1 , comprising:
deleting, by the enterprise agent, the enterprise data in the secure container in accordance with the one or more data policies of the enterprise,
wherein, after the deleting, the second portion of the computer-readable storage is unmodified.
4. The method of claim 3 , wherein deleting the enterprise data in the secure container in accordance with the one or more data policies of the enterprise comprises deleting the enterprise data based on at least one of: an expiration of a period of time, a time at which access to the secure container is requested, a geographic location of the client device, an indication that the client device is compromised, a configuration setting of the client device, detected behavior of the user, an indication that the user no longer has associated valid enterprise credentials, a number of times the one or more enterprise credentials associated with the user cannot be verified, or receiving a command from the enterprise to wipe the secure container.
5. The method of claim 1 , comprising:
restricting access, by the enterprise agent, to the secure container based on a geographic location of the client device.
6. The method of claim 1 , comprising:
preventing, by the enterprise agent, enterprise data in the secure container from being copied and stored in the second portion of the computer-readable storage.
7. The method of claim 1 , wherein at least one of the one or more applications associated with the enterprise is downloaded to the client device from the server associated with the enterprise.
8. The method of claim 1 , wherein at least one of the one or more applications associated with the enterprise is a remote application executing on the server associated with the enterprise.
9. The method of claim 1 , wherein the secure tunnel employs protocol encapsulation to send data over a network, and
wherein storing the enterprise data in the secure container is based, at least in part, on detecting, by the enterprise agent, that the enterprise data was received via the secure tunnel.
10. The method of claim 1 , comprising:
executing the one or more applications associated with the enterprise in one or more secure virtual machines of the client device, each of the one or more secure virtual machines separate from a virtual machine executing an operating system of the client device.
11. The method of claim 1 , wherein the enterprise data stored in the secure container comprises applications downloaded to the client device from the server associated with the enterprise.
12. The method of claim 1 , wherein the enterprise data stored in the secure container comprises one or more of: one or more data files associated with the enterprise, one or more credentials associated with the user, one or more certificates associated with the enterprise, or one or more encryption keys.
13. The method of claim 1 , comprising:
establishing, by the enterprise agent, one or more secure connections to the server associated with the enterprise; and
communicating over the one or more secure connections to maintain user authentication for access to the secure container.
14. The method of claim 1 , comprising:
establishing, by the enterprise agent, a connection from the client device to a secure application store associated with the enterprise; and
downloading, to the client device and from the secure application store, the one or more applications associated with the enterprise.
15. The method of claim 1 , wherein the secure container is inaccessible to one or more applications not associated with the enterprise.
16. A method comprising:
generating a secure container in a first portion of a computer-readable storage of a client device, the secure container being encrypted and comprising a file system, and being separate from a second portion of the computer-readable storage;
verifying a user of the client device based on one or more enterprise credentials associated with the user;
establishing a secure tunnel between the client device and a server associated with an enterprise; and
storing enterprise data in the secure container in accordance with one or more data policies of the enterprise, the enterprise data received from the server via the secure tunnel,
wherein the secure container is only accessible by a verified user and by one or more applications associated with the enterprise,
wherein access to the second portion of the computer-readable storage is provided independently of the one or more data policies of the enterprise,
wherein private data associated with the user is stored in the second portion of the computer-readable storage, the private data associated with activity of the user outside of a role of the user in the enterprise, and
wherein the second portion of the computer-readable storage is inaccessible to the one or more applications associated with the enterprise.
17. The method of claim 16 , comprising:
deleting the enterprise data in the secure container in accordance with the one or more data policies of the enterprise, wherein, after the deleting, the second portion of the computer-readable storage is unmodified.
18. The method of claim 16 , comprising:
preventing enterprise data in the secure container from being copied and stored in the second portion of the computer-readable storage.
19. The method of claim 16 , comprising:
executing the one or more applications associated with the enterprise in one or more secure virtual machines of the client device, each of the one or more secure virtual machines separate from a virtual machine executing an operating system of the client device.
20. The method of claim 16 , comprising:
establishing a connection from the client device to a secure application store associated with the enterprise; and
downloading, to the secure container of the client device and from the secure application store, the one or more applications associated with the enterprise.
21. A method comprising:
establishing a secure tunnel between a client device and a server associated with an enterprise, wherein the secure tunnel is established for a verified user of the client device based on one or more enterprise credentials associated with the verified user;
determining one or more applications associated with the enterprise;
transmitting enterprise data from the server to the client device via the secure tunnel, wherein the enterprise data is stored in a secure container of the client device in accordance with one or more data policies of the enterprise, the secure container being encrypted and comprising a file system, wherein the secure container is located in a first portion of a computer-readable storage of the client device, wherein the first portion of the computer-readable storage is separate from a second portion of the computer-readable storage, and wherein the secure container is only accessible by the verified user and by the one or more applications associated with the enterprise; and
preventing the enterprise data stored in the secure container from being copied and stored in the second portion of the computer-readable storage.