# US 9,521,147 B2 · Policy based application management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,147 B2 - Document ID: US9521147B2 - Status: Granted - Kind: B2 - Application number: 14/340,096 - Filed: 2014-07-24 - Published: 2014-11-13 - Granted: 2016-12-13 - Earliest claimed: 2012-10-15 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Gary Barton; James Robert Walker; Nitin Desai; Zhongmin Lang - Web page: https://patentgrep.com/patent/US9521147B2 ## CPC - H04W 12/30: Security of mobile devices; Security of mobile applications - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/54: by adding security routines or objects to programs - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/629: {to features or functions of an application} - G06F 21/72: in cryptographic circuits - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 51/08: Annexed information, e.g. attachments - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2137: Time limited access, e.g. to a computer or data - G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen - H04L 41/34: Signalling channels for network management communication - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/63: Location-dependent; Proximity-dependent - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Improved techniques for managing enterprise applications on mobile devices are described herein. Each enterprise mobile application running on the mobile device has an associated policy through which it interacts with its environment. The policy selectively blocks or allows activities involving the enterprise application in accordance with rules established by the enterprise. Together, the enterprise applications running on the mobile device form a set of managed applications. Managed applications are typically allowed to exchange data with other managed applications, but are blocked from exchanging data with other applications, such as the user's own personal applications. Policies may be defined to manage data sharing, mobile resource management, application specific information, networking and data access solutions, device cloud and transfer, dual mode application software, enterprise app store access, and virtualized application and resources, among other things. ## Claims ### Claim 1 A method of managing applications on a mobile device, comprising: executing, on the mobile device, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user or device mobile information, as defined in the one or more policy files. ### Claim 2 (depends on 1) The method of claim 1, wherein the client agent is configured to facilitate the one or more remote applications by: receiving input from a user intended for a particular remote application; passing the user input to the particular remote application; receiving data from the particular remote application responsive to the user input; and presenting the data by the client agent application on the display of the mobile device. ### Claim 3 (depends on 2) The method of claim 2, wherein receiving data from the particular remote application comprises receiving the data via a remote presentation protocol, and wherein the received data comprises output from the remote application to update a graphical user interface presented by the client agent on the display of the mobile device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device. ### Claim 5 (depends on 1) The method of claim 1, further comprising automatically determining, by the client agent application, whether to initiate execution of a user-requested application locally or remotely, based on one or more policy files identifying whether or not each of one or more applications comprising the user-requested application is permitted to run locally on the mobile device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving first user input requesting execution of a first application on the mobile device, wherein the first application is a local application; executing, responsive to the first user input, the first application according to a first set of policy files; receiving second user input requesting execution of a second application on the mobile device, wherein the second application is a local application; executing, responsive to the second user input, the second application according to a second set of policy files; receiving third user input requesting execution of a third application on the mobile device, wherein the third application is a remote application; responsive to the third user input, initiating remote execution of the third application on the remote computing device according to a third set of policy files. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving one or more updated policy files replacing a corresponding one or more existing policy files stored on the mobile device; and updating the access controls enforced by the mobile device management system according to the one or more updated policy files. ### Claim 8 (depends on 7) The method of claim 7, wherein updating the access controls comprises automatically removing from the mobile device a local application. ### Claim 9 (depends on 7) The method of claim 7, wherein updating the access controls comprises automatically deleting user data associated with the removed local application. ### Claim 10 A mobile device comprising a processor configured to execute, based on instructions stored in a memory, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user or device mobile information, as defined in the one or more policy files. ### Claim 11 (depends on 10) The mobile device of claim 10, wherein the instructions further cause the mobile device to manage applications by: applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device. ### Claim 12 One or more non-transitory computer readable media storing computer executable instructions that, when executed, cause a system to manage applications on a mobile device by: executing, on the mobile device, a client agent application configured to enforce one or more policy files of a mobile device management system, wherein each policy file defines one or more access controls enforced by the mobile device management system when one or more applications are executing locally on the mobile device, and wherein the client agent application is further configured to wirelessly communicate with one or more applications executing on a remote computing device and presented on a display of the mobile device, wherein the client agent application is further configured to facilitate one or more remote applications executing on the remote computing device and presented on the mobile device using an application specific virtual private network (VPN), wherein the application specific VPN permits access based on one or more attributes associated with each application, user and/or device mobile information, as defined in the one or more policy files. ### Claim 13 (depends on 12) The computer readable media of claim 12, wherein the client agent is configured to facilitate the one or more remote applications by: receiving input from a user intended for a particular remote application; passing the user input to the particular remote application; receiving data from the particular remote application responsive to the user input; and presenting the data for display by the client agent application. ### Claim 14 (depends on 13) The computer readable media of claim 13, wherein receiving data from the particular remote application comprises receiving the data via a remote presentation protocol, and wherein the received data comprises output from the remote application to update a graphical user interface presented by the client agent on the display of the mobile device. ### Claim 15 (depends on 12) The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by: applying, by the client agent application, a first set of one or more policy files when an application is executing locally on the mobile device; and applying, by the client agent application, a second set of one or more policy files when a remote application is presented on the mobile device. ### Claim 16 (depends on 12) The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by automatically determining, by the client agent application, whether to initiate execution of a user-requested application locally or remotely, on an application by application basis, based on one or more policy files identifying whether or not each of one or more applications comprising the user-requested application is permitted to run locally on the mobile device. ### Claim 17 (depends on 12) The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by: receiving first user input requesting execution of a first application on the mobile device, wherein the first application is a local application; executing, responsive to the first user input, the first application according to a first set of policy files; receiving second user input requesting execution of a second application on the mobile device, wherein the second application is a local application; executing, responsive to the second user input, the second application according to a second set of policy files; receiving third user input requesting execution of a third application on the mobile device, wherein the third application is a remote application; responsive to the third user input, initiating remote execution of the third application on the remote computing device according to a third set of policy files. ### Claim 18 (depends on 12) The computer readable media of claim 12, wherein the instructions further cause the system to manage applications on a mobile device by: receiving one or more updated policy files replacing a corresponding one or more existing policy files stored on the mobile device; and updating the access controls enforced by the mobile device management system according to the one or more updated policy files. ### Claim 19 (depends on 18) The computer readable media of claim 18, wherein updating the access controls comprises automatically removing from the mobile device a local application. ### Claim 20 (depends on 18) The computer readable media of claim 18, wherein updating the access controls comprises automatically deleting user data associated with the removed local application.