# US 11,122,090 B2 · Dynamic application-level compliance enforcement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,090 B2 - Document ID: US11122090B2 - Status: Granted - Kind: B2 - Application number: 16/294,962 - Filed: 2019-03-07 - Published: 2020-07-09 - Granted: 2021-09-14 - Earliest claimed: 2019-01-03 - Assignees: VMware, Inc. - Applicants: Vmware, Inc. - Inventors: Gaurav Verma; Manjunath Subramani; Suchit Shivashankar; Karthikeyan Palanisamy - Web page: https://patentgrep.com/patent/US11122090B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 21/44: Program or device authentication - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/629: {to features or functions of an application} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Examples herein describe systems and methods for application-specific compliance enforcement. An example method can include receiving, at a user device, profiles containing application-specific restrictions. When a first application is opened, a management agent compares the corresponding application-specific restrictions with current device settings. This can be done with a checksum comparison where the checksums are created based on a hash with an application- or profile-specific identifier. If they differ, the management agent stores the current device settings and prompts for, or automatically changes, the device settings to new compliant values before allowing the first application to operate in the foreground of the user device screen. If the first application is closed or minimized, the stored device settings can be restored. The management agent can compare those against application-specific restrictions of the second application before allowing the second application to run in the foreground. ## Claims ### Claim 1 A method for compliance enforcement, comprising: receiving, at a user device from a management server, a profile including first compliance settings for a first application that are different than second compliance settings for a second application; detecting launch of the first application; storing current device settings that correspond to the first compliance settings, including storing a first checksum representing the current device settings; determining whether the current device settings meet the first compliance settings, including comparing the first checksum to a second checksum for the first compliance settings; when the first and second checksums differ, prompting the user regarding which of the current device settings change; changing the current device settings to modified settings; storing a third checksum for the modified settings; and executing the first application in a foreground when the modified settings meet the first compliance settings, based on the second and third checksums matching. ### Claim 2 (depends on 1) The method of claim 1, wherein the first application executes in the foreground when the first and second checksums match. ### Claim 3 (depends on 1) The method of claim 1, wherein a launcher application on the user device provides access to the first and second applications and launches the first application, wherein an agent detects the launch of the first application and determines whether the first and second checksums match. ### Claim 4 (depends on 1) The method of claim 1, further comprising: during execution of the first application, detecting a change to the device settings; comparing the second checksum against a fourth checksum for the changed device settings; and based on the comparison, blocking execution of the first application. ### Claim 5 (depends on 1) The method of claim 1, further comprising: detecting that the first application is closed or minimized; and restoring the device settings based on the stored current device settings. ### Claim 6 (depends on 1) The method of claim 1, wherein the first and second applications are executed by a launcher application, and wherein the launcher application provides access to the first and second applications, both of which are identified by the profile. ### Claim 7 (depends on 1) The method of claim 1, wherein the first and second compliance settings have different network connectivity requirements from one another, and wherein switching between applications causes the user device to change the current device settings. ### Claim 8 A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a user device, perform stages for performing compliance enforcement, the stages comprising: receiving, at the user device from a management server, a profile including first compliance settings for a first application that are different than second compliance settings for a second application; detecting launch of the first application; storing current device settings that correspond to the first compliance settings, including storing a first checksum representing the current device settings; determining whether the current device settings meet the first compliance settings, including comparing the first checksum to a second checksum for the first compliance settings; when the first and second checksums differ, prompting the user regarding which of the current device settings change; changing the current device settings to modified settings; storing a third checksum for the modified settings; and executing the first application in a foreground when the modified settings meet the first compliance settings, based on the second and third checksums matching. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the first application executes in the foreground when the first and second checksums match. ### Claim 10 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein a launcher application on the user device provides access to the first and second applications and launches the first application, wherein an agent detects the launch of the first application and determines whether the first and second checksums match. ### Claim 11 (depends on 8) The non-transitory, computer-readable medium of claim 8, the stages further comprising: during execution of the first application, detecting a change to the device settings; comparing the second checksum against a fourth checksum for the changed device settings; and based on the comparison, blocking execution of the first application. ### Claim 12 (depends on 8) The non-transitory, computer-readable medium of claim 8, the stages further comprising: detecting that the first application is closed or minimized; and restoring the device settings based on the stored current device settings. ### Claim 13 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the first and second applications are executed by a launcher application, and wherein the launcher application provides access to the first and second applications, both of which are identified by the profile. ### Claim 14 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the first and second compliance settings have different network connectivity requirements from one another, and wherein switching between applications causes the user device to change the current device settings. ### Claim 15 A system for performing compliance enforcement, comprising: a user device having a processor and memory storage; wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising: receiving, at the user device from a management server, a profile including first compliance settings for a first application that are different than second compliance settings for a second application; detecting launch of the first application; storing current device settings that correspond to the first compliance settings, including storing a first checksum representing the current device settings; determining whether the current device settings meet the first compliance settings, including comparing the first checksum to a second checksum for the first compliance settings; when the first and second checksums differ, prompting the user regarding which of the current device settings change; changing the current device settings to modified settings; storing a third checksum for the modified settings; and executing the first application in a foreground when the modified settings meet the first compliance settings, based on the second and third checksums matching. ### Claim 16 (depends on 15) The system of claim 15, wherein the first application executes in the foreground when the first and second checksums match. ### Claim 17 (depends on 16) The system of claim 16, wherein a launcher application on the first user device provides access to the first and second applications and launches the first application, wherein an agent detects the launch of the first application and determines whether the first and second checksums match. ### Claim 18 (depends on 15) The system of claim 15, the stages further comprising: during execution of the first application, detecting a change to the device settings; comparing the second checksum against a fourth checksum for the changed device settings; and based on the comparison, blocking execution of the first application. ### Claim 19 (depends on 15) The system of claim 15, the stages further comprising: detecting that the first application is closed or minimized; and restoring the device settings based on the stored current device settings. ### Claim 20 (depends on 15) The system of claim 15, wherein the first and second compliance settings have different network connectivity requirements from one another, and wherein switching between applications causes the user device to change the current device settings.