Managed domains for remote content and configuration control on mobile information devices
A technique is disclosed for remotely managing isolated domains on mobile devices. A request is received from the mobile device to instantiate a managed domain. A managed domain configuration is determined and comprises a security policy controlling access to content of the managed domain of the subscribing mobile device, a content specification identifying the content to be downloaded by the subscribing mobile device into the managed domain, and a content configuration identifying a configuration of the content on the subscribing mobile device. The managed domain configuration is sent to the subscribing mobile device to instantiate a secure, managed domain whose policy, content and content configuration is remotely controlled. The technique is useful for advertising and brand promotion on mobile devices as it simultaneously enables detailed control over the presentation of content by a curator while ensuring privacy and security protection of the other apps, accounts and data on the mobile device.
1. A method performed on a mobile device for providing an externally managed domain on the mobile device, the mobile device comprising a processor, a memory, a communications interface, and a user interface, the memory storing instructions executable by the processor to perform the method, the method comprising:
operating the user interface on the mobile device to receive a domain installation request comprising domain identification data identifying the externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using the communications interface to send the add domain request to a domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the mobile device; and
creating the externally managed domain based on the managed domain configuration;
wherein the mobile device further comprises a camera, and operating the user interface to receive the domain installation request comprises:
operating the camera to scan a QR code encoding the domain identification data.
2. The method according to claim 1 , wherein the managed domain configuration further comprises a managed domain content specification identifying the managed domain content for download by the mobile device into the externally managed domain and a managed domain content configuration specifying a configuration of the managed domain content on the mobile device, and creating the externally managed domain comprises provisioning the externally managed domain based on the managed domain configuration.
3. The method according to claim 2 , wherein provisioning the externally managed domain comprises storing the managed domain security policy, using the communications interface to download the managed domain content into the externally managed domain based on the managed domain content specification, and configuring the managed domain content in the externally managed domain based on the managed domain content configuration.
4. The method according to claim 3 , further comprising:
controlling access to the managed domain content by local domain processes associated with a local domain on the mobile device different from the externally managed domain based at least in part on the managed domain security policy.
5. The method according to claim 1 , wherein operating the user interface to receive the domain installation request further comprises:
receiving via the user interface a one-time-password (OTP) or token associated with the QR code.
6. The method according to claim 1 , further comprising:
controlling access to local resources on the mobile device associated with an owner isolated domain on the mobile device different from the externally managed domain by managed domain processes associated with the externally managed domain based at least in part on an owner isolated domain security policy associated with the owner isolated domain.
7. The method according to claim 6 , wherein controlling access to the local resources by the managed domain processes comprises preventing access to the local resources by the managed domain processes.
8. The method according to claim 6 , wherein the owner isolated domain security policy comprises local security settings, the method further comprising operating the user interface to receive the local security settings.
9. The method according to claim 8 , wherein the local security settings specify permissions or a level of trust associated with the externally managed domain.
10. The method according to claim 8 , wherein operating the user interface to receive the local settings comprises switching to the owner isolated domain on the mobile device different from the externally managed domain, receiving a selection of the externally managed domain, and receiving the local security settings associated with the externally managed domain.
11. The method according to claim 6 , wherein the local resources comprise a particular resource comprising a contacts store, a calendar store, a data file, or a file directory, and the owner isolated domain security policy identifies the particular resource.
12. The method according to claim 1 , wherein the externally managed domain is a first externally managed domain, the domain installation request is a first domain installation request, the domain identification data is first domain identification data, the add domain request is a first add domain request, the managed domain configuration is a first managed domain configuration, the managed domain security policy is a first managed domain security policy, the managed domain content is first managed domain content, the method further comprising:
operating the user interface on the mobile device to receive a second domain installation request comprising second domain identification data identifying a second externally managed domain different from the first externally managed domain, and responsively:
generating a second add domain request based on the second domain identification data;
using the communications interface to send the second add domain request to the domain management service or a different domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a second managed domain configuration for the second externally managed domain, the second managed domain configuration comprising a second managed domain security policy controlling access to second managed domain content in the second externally managed domain on the mobile device; and
creating the second externally managed domain based on the second managed domain configuration;
controlling access to local resources on the mobile device associated with an owner isolated domain on the mobile device different from the first externally managed domain and the second externally managed domain by either first managed domain processes associated with the first externally managed domain or second managed domain processes associated with the second externally managed domain based at least in part on an owner isolated domain security policy associated with the owner isolated domain.
13. A method performed on a mobile device for providing an externally managed domain on the mobile device, the mobile device comprising a processor, a memory, a communications interface, and a user interface, the memory storing instructions executable by the processor to perform the method, the method comprising:
operating the user interface on the mobile device to receive a domain installation request comprising domain identification data identifying the externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using the communications interface to send the add domain request to a domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the mobile device; and
creating the externally managed domain based on the managed domain configuration;
wherein operating the user interface to receive the domain installation request comprises:
receiving via the user interface a selection in an app store identifying the externally managed domain.
14. The method according to claim 13 , further comprising:
controlling access to local resources on the mobile device associated with an owner isolated domain on the mobile device different from the externally managed domain by managed domain processes associated with the externally managed domain based at least in part on an owner isolated domain security policy associated with the owner isolated domain.
15. The method according to claim 14 , wherein controlling access to the local resources by the managed domain processes comprises preventing access to the local resources by the managed domain processes.
16. A method performed on a mobile device for providing an externally managed domain on the mobile device, the mobile device comprising a processor, a memory, a communications interface, and a user interface, the memory storing instructions executable by the processor to perform the method, the method comprising:
operating the user interface on the mobile device to receive a domain installation request comprising domain identification data identifying the externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using the communications interface to send the add domain request to a domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the mobile device; and
creating the externally managed domain based on the managed domain configuration;
controlling access to local resources on the mobile device associated with an owner isolated domain on the mobile device different from the externally managed domain by managed domain processes associated with the externally managed domain based at least in part on an owner isolated domain security policy associated with the owner isolated domain;
wherein controlling access by the managed domain processes to the local resources comprises controlling access by the managed domain processes to the local resources based in part on the managed domain security policy.
17. The method according to claim 16 , wherein operating the user interface to receive the domain installation request comprises:
receiving via the user interface a selection of a link in a web browser running on the mobile device.
18. The method according to claim 16 , wherein controlling access to the local resources by the managed domain processes comprises preventing access to the local resources by the managed domain processes.
19. A method performed on a mobile device for providing an externally managed domain on the mobile device, the mobile device comprising a processor, a memory, a communications interface, and a user interface, the memory storing instructions executable by the processor to perform the method, the method comprising:
operating the user interface on the mobile device to receive a domain installation request comprising domain identification data identifying the externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using the communications interface to send the add domain request to a domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the mobile device; and
creating the externally managed domain based on the managed domain configuration;
controlling access to local resources on the mobile device associated with an owner isolated domain on the mobile device different from the externally managed domain by managed domain processes associated with the externally managed domain based at least in part on an owner isolated domain security policy associated with the owner isolated domain;
wherein the controlling access by the managed domain processes to the local resources on the mobile device associated with the owner isolated domain is performed at least in part by a first service operating within a kernel of an operating system of the mobile device and at least in part by a second service operating in a middleware of the operating system outside of the kernel.
20. A tangible non-transitory computer-readable medium comprising instructions stored thereon that, when executed by a computer, perform the following:
operating a user interface on the computer to receive a domain installation request comprising domain identification data identifying an externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using a communications interface to send the add domain request to a domain management service remote to the computer;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the computer; and
creating the externally managed domain based on the managed domain configuration;
wherein operating the user interface to receive the domain installation request comprises:
operating a camera to scan a QR code encoding the domain identification data.
21. A mobile device comprising a processor, a memory, a communications interface, and a user interface, the memory storing instructions executable by the processor to perform the following:
operating the user interface to receive a domain installation request comprising domain identification data identifying an externally managed domain, and responsively:
generating an add domain request based on the domain identification data;
using the communications interface to send the add domain request to a domain management service remote to the mobile device;
using the communications interface to receive from the domain management service a managed domain configuration for the externally managed domain, the managed domain configuration comprising a managed domain security policy controlling access to managed domain content in the externally managed domain on the mobile device; and
creating the externally managed domain based on the managed domain configuration;
wherein the mobile device further comprises a camera, and operating the user interface to receive the domain installation request comprises:
operating the camera to scan a QR code encoding the domain identification data.