# US 10,374,869 B2 · Containerized architecture to manage internet-connected devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,869 B2 - Document ID: US10374869B2 - Status: Granted - Kind: B2 - Application number: 15/270,948 - Filed: 2016-09-20 - Published: 2017-04-06 - Granted: 2019-08-06 - Earliest claimed: 2015-09-22 - Assignees: Mobile Iron, Inc. - Applicants: Mobile Iron, Inc. - Inventors: Sandeep Jain - Web page: https://patentgrep.com/patent/US10374869B2 ## CPC - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A containerized architecture to secure and manage Internet-connected devices, such as “Internet of Things” devices, is disclosed. In various embodiments, one or more containerized applications are run, e.g., on an Internet of Things gateway, subject to management by the management server. At least one of the containerized applications is a management agent configured to participate, subject to control of the management server, in management of one or more other of said containerized applications. ## Claims ### Claim 1 A system, comprising: a communication interface; and a processor coupled to the communication interface and configured to: communicate via the communication interface with a management server; install one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and run the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by: communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to: gather sensor data locally at the IoT gateway, and in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy. ### Claim 2 (depends on 1) The system of claim 1, wherein the sensor driver application functions as an input/output (I/O) multiplexer for a physical interface via which said sensor is connected. ### Claim 3 (depends on 1) The system of claim 1, wherein one or more other of said containerized applications other than the management agent each comprises an Internet-of-Things (IoT) smart application configured to receive and use sensor data generated by said sensor, subject to management by one or both of said management server and said management agent. ### Claim 4 (depends on 3) The system of claim 3, wherein each of said IoT smart applications is configured to communicate via a security proxy with one or more associated backend services. ### Claim 5 (depends on 4) The system of claim 4, wherein said security proxy is configured to enforce one or more policies associated with said communications by said smart application. ### Claim 6 (depends on 5) The system of claim 5, wherein said security proxy is configured to take a responsive action with respect to communications by said smart application based at least in part on a security posture data received from said management server. ### Claim 7 (depends on 6) The system of claim 6, wherein said management server is configured to determine said security posture data based at least in part on data received from the system. ### Claim 8 (depends on 1) The system of claim 1, wherein the system comprises the Internet of Things (IoT) gateway, and further comprising installing said one or more containerized application on the gateway. ### Claim 9 (depends on 1) The system of claim 1, wherein an IoT gateway app store interface and server are used to install said one or more containerized applications. ### Claim 10 (depends on 9) The system of claim 9, wherein said one or more containerized applications are included in a set of containerized applications presented via said IoT gateway app store interface as being available to be installed on said gateway. ### Claim 11 (depends on 10) The system of claim 10, wherein said set of containerized applications are selected to be presented via said IoT gateway app store interface as being available to be installed on said gateway based at least in part on one or both of a policy and a user or other group with which the gateway is determined to be associated. ### Claim 12 A method, comprising: communicating via a communication interface with a management server; installing one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and running the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by: communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to: gather sensor data locally at the IoT gateway, and in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy. ### Claim 13 (depends on 12) The method of claim 12, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application configured by one or both of said management server and said management agent to provide managed access to a sensor associated with a system including said containerized applications. ### Claim 14 (depends on 13) The method of claim 13, wherein one or more other of said containerized applications other than the management agent each comprises an Internet-of-Things (IoT) smart application configured to receive and use sensor data generated by said sensor, subject to management by one or both of said management server and said management agent. ### Claim 15 (depends on 14) The method of claim 14, wherein each of said IoT smart applications is configured to communicate via a security proxy with one or more associated backend services. ### Claim 16 (depends on 15) The method of claim 15, wherein said security proxy is configured to enforce one or more policies associated with said communications by said smart application. ### Claim 17 (depends on 16) The method of claim 16, wherein said security proxy is configured to take a responsive action with respect to communications by said smart application based at least in part on a security posture data received from said management server. ### Claim 18 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: communicating via a communication interface with a management server; installing one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and running the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by: communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to: gather sensor data locally at the IoT gateway, and in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application configured by one or both of said management server and said management agent to provide managed access to a sensor associated with a system including said containerized applications.