Enforcing policies for unmanaged applications

Disclosed are various approaches for enforcing policies for unmanaged applications. A user supplied script can be evaluated to determine whether an application is installed on a computing device. In response to a determination that the application is installed on the computing device, a request can be sent to a management service for at least one policy applicable to the application. The policy can be evaluated to determine whether the application complies with the policy.

BACKGROUND

Enterprise mobility management (EMM) systems provide organizations with the ability to manage mobile devices used by members of the organization. For example, EMM systems can be used to enforce compliance with various policies set by an enterprise. These policies can specify which applications are installed on a managed device, which versions of an approved application can be installed on a manage device, updating or upgrading an installed application, or other restrictions or requirements.

However, some devices allow for users to install applications independently of the EMM system. For example, some mobile devices allow for applications to be installed outside of an approved application store, which is often referred to as “side-loading” an application. Likewise, PC operating systems often allow for users to install or execute arbitrary applications from any source, so long as the user has access to an installer for the application. Because these applications can be installed independently of the EMM system, the EMM system is often limited in its ability to manage the application or its compliance

DETAILED DESCRIPTION

Disclosed are various examples for allowing EMM systems to enforce policies or otherwise assume management of unmanaged applications installed on a computing device. An application may be considered to be unmanaged if it is installed or installable independently of an EMM system. Because such applications can be installed independently of the EMM system, the EMM system may not be aware of the presence of the application or the requirements for managing the application. Moreover, the presence of independently installed applications allows for users to bypass security and policy restrictions enforced for applications managed by the EMM system. Therefore, various implementations of this disclosure allow for EMM systems to assume management of these unmanaged applications.

Beginning withFIG. 1, shown is an example of a networked environment100. The networked environment100includes a computing environment103and a client device106, which are in data communication with each other across a network109. The network109includes wide area networks (WANs) and local area networks (LANs). These networks can include wired or wireless components or a combination thereof. Wired networks can include Ethernet networks, cable networks, fiber optic networks, and telephone networks, such as dial-up, digital subscriber line (DSL), and integrated services digital network (ISDN) networks. Wireless networks can include cellular networks, satellite networks, Institute of Electrical and Electronic Engineers (IEEE) 802.11 wireless networks (e.g., WI-FI®), BLUETOOTH® networks, microwave transmission networks, as well as other networks relying on radio broadcasts. The network109can also include a combination of two or more networks109. Examples of networks109can include the Internet, intranets, extranets, virtual private networks (VPNs), and similar networks.

The computing environment103can include, for example, a server computer or any other system providing computing capability. Alternatively, the computing environment103can employ a plurality of computing devices that can be arranged, for example, in one or more server banks or computer banks or other arrangements. These computing devices can be located in a single installation or can be distributed among many different geographical locations. For example, the computing environment103can include a plurality of computing devices that together can include a hosted computing resource, a grid computing resource or any other distributed computing arrangement. In some cases, the computing environment103can correspond to an elastic computing resource where the allotted capacity of processing, network, storage, or other computing-related resources can vary over time.

Various applications or other functionality can be executed in the computing environment103according to various examples. The components executed in the computing environment103, for example, can include a management console113and a management service116. Other components or applications may also be executed in the computer environment (e.g., hypervisors managing one or more virtual machines that host the management console113or the management service116) in various embodiments of the present disclosure.

Also, various data is stored in a data store119that is accessible to the computing environment103. The data store119can be representative of a plurality of data stores, which can include relational databases, object-oriented databases, hierarchical databases, hash tables or similar key-value data stores, as well as other data storage applications or data structures. The data stored in the managed data store119is associated with the operation of the management console113, the management service116, as well as potentially other applications or functional entities described later. This data can include one or more command queues123, compliance policies126, installers129, user supplied scripts133, and potentially other data.

The management console113can provide an administrative interface for configuring the operation of the management service116and the configuration of client devices106that are administered by the management service116. Accordingly, the management console113can correspond to a web page or web application provided by a web server hosted in the computing environment103. For example, the management console113can provide an interface for an administrative user to select compliance policies126to be applied to individual client devices106, create compliance policies126, upload or specify the location for installers129or user supplied scripts133, as well as various other actions related to the operation of various implementations.

The management service116can administer the operation of client devices106registered or otherwise enrolled with the management service116. To this end, the management service116can also provide mechanisms for a client device106to enroll or otherwise register with the management service116. The management service116can also enforce the use of various compliance policies126, for example, by creating a command124in a command queue123associated with a client device106that specifies that a particular compliance policy126should be applied to the client device106.

The command queue123can represent a queue where one or more commands124to be executed by a client device106can be stored. For example, the management service116may issue one or more commands124to be performed by the client device106or an application executed on the client device106. The commands124can be stored in the command queue123until the commands124are requested by the client device106, as described later. In some instances, a separate command queue123can be created for each client device106. In these instances, each command queue123can include a device identifier125that links the command queue123to a respective client device106.

The device identifier125can include any identifier that uniquely identifies a client device106enrolled with the management service116with respect to another client device106enrolled with the management service116. For example, a device identifier125can include device serial numbers, media access control (MAC) addresses of network interfaces, international mobile equipment identity (IMEI) numbers for the client device106, unique identification numbers assigned by the management service116(e.g., globally unique identifiers (GUIDs), universally unique identifiers (UUIDs), etc.), or other types of identifiers.

The compliance policies126specify various configuration details for a client device106. For example, a compliance policy126could specify that a particular application or version of the application be installed on the client device106. As another example, a compliance policy126could specify that certain versions of an application (e.g., a version with a known security defect) are not authorized to be installed on the client device106. In some instances, the compliance policy126could also specify that particular features of an application must be installed on the client device106or that specific features of an application are not to be installed on the client device106. Similarly, the compliance policy126may specify that an application installed on the client device106can only be made available for specified users or groups of users.

A compliance policy126can also specify a remedial action to be performed in the event of a violation of the compliance policy126. For example, the compliance policy126could specify as a remedial action that an unauthorized or prohibited version of an application should be removed from the client device106or updated to an approved version of the application. Similarly, the compliance policy126could specify that an unauthorized feature of the application be uninstalled from the client device106or otherwise disabled.

The installer packages129provide a software component that includes installation information for a corresponding application to be installed by the installer package129and, optionally, the files for the application itself. For example, an installer package129could include information regarding the file path in which to install an application, any necessary dependencies (e.g., libraries or library versions) for installation of the corresponding application, and information regarding optional features, components, or libraries of the corresponding application that may be installed. Likewise, the installer package129can specify where installation files can be retrieved (e.g., a network address from which files can be downloaded) or the installer package129can include the installation files themselves. In addition, the installer package129can allow for customization of the installation of the corresponding application (e.g., on a per-user basis, for all users of the computing device, etc.). Examples of installer packages129include Windows Installer Packages for MICROSOFT WINDOWS® systems, Redhat Package Manager (RPM) packages for various Linux based distributions, and similar installer packages129for other systems.

The user supplied scripts133are user supplied instructions that can be evaluated to determine whether an application is installed on a client device106. In some instances, a user supplied script133could include executable code that can perform the necessary operations to determine whether an application is installed on the client device106. In other instances, the user supplied script133could provide a checklist of items to evaluate in order to determine whether an application is installed on the client device106. For example, the user supplied script133could include executable code to check for the presence of a particular file and file version at a specific file path location, or the user supplied script133could specify the name of a file and a file path which another application could check in order to determine whether or not an application is installed. The user supplied script133could similarly specify a WINDOWS Registry key to check, or include executable instructions that check, for the presence of a WINDOW Registry key associated with installation of the application.

The client device106is representative of a plurality of client devices106that can be coupled to the network109. The client device106can include, for example, a processor-based system such as a computer system. Examples of these computer systems can include a personal computer (e.g., a desktop computer, a laptop computer, or similar device), a mobile computing device (e.g., personal digital assistants, cellular telephones, smartphones, web pads, tablet computer systems, music players, portable game consoles, electronic book readers, and similar devices), or other devices with like capability. The client device106can include one or more displays, such as liquid crystal displays (LCDs), gas plasma-based flat panel displays, organic light emitting diode (OLED) displays, electrophoretic ink (“E-ink”) displays, projectors, or other types of display devices. In some instances, the display can be a component of the client device106or can be connected to the client device106through a wired or wireless connection. The client device106can be configured to execute various applications, such as a management agent136and a client application139.

The management agent136can maintain data communication with the management service116in order to perform various actions on the client device106in response to instructions received from the management service116. In some instances, the management agent136includes a separate application executing on the client device106. In other instances, the management agent136includes a mobile device management (MDM) framework provided by or included in the operating system installed on the client device106. The management agent136can be configured to communicate with the management service116to enroll or otherwise register the client device106with the management service116. The management agent136can also be configured to contact the management service116at periodic intervals and request that the management service116send any commands or instructions to the management agent136. For example, the management agent136could retrieve one or more commands124stored in a command queue123associated with the client device106. The management agent136can then cause the client device106to perform the commands124provided by the management service116.

The client application139can cause a user interface to be rendered on the display of the client device106. For example, the client application139could be a web browser and the user interface could include a web page rendered within a browser window. This could include a web browser rendering a web-page supplied by the management console113. As another example, the client application139could be a standalone application that renders a user interface using user-interface elements or widgets provided by a library or by the operating system (e.g., MICROSOFT WINDOWS) installed on the client device106.

The client device106may also have a client data store143that is accessible to applications executing on the client device106. The client data store143can be representative of a plurality of data stores, which can include relational databases, object-oriented databases, hierarchical databases, hash tables or similar key-value data stores, as well as other data storage applications or data structures. The data stored in the client data store143is associated with the operation of the management agent136, the client application139, as well as potentially other applications or functional entities described later. This data can include the device identifier125for the client device106, one or more compliance policies126, installer packages129, user supplied scripts133, and potentially other data.

Next, a general description of the operation of the various components of the networked environment100is provided. A more detailed description of the implementations of various examples of the present disclosure is provided later in the discussion of the subsequent figures.

To begin, an administrative user submits through the management console113the identity of an unmanaged client application139which the administrative user wishes to have the management service116assume management of. For example, the administrative user may create a compliance policy126that specifies that a specific version of the unmanaged client application139is to be installed on the client device106. As part of the creation of the compliance policy126, the administrative user may upload an installer package129for the client application139or specify a location where the installer package129may be found. For example, the administrative user could specify a network address from which the installer package129may be downloaded or a file path or other location in the client data store143where the installer package129may be located (e.g., due to the inclusion of the installer package129in a machine image). The administrative user may also upload a user supplied script133to allow for the presence or installation of the client application139to be detected on the client device106.

In addition, a client device106is enrolled with the management service116. As part of the enrollment process, the management service116sends a management agent136to the client device106for installation on the client device106. In some instances, the management service116may also assign a device identifier125to the client device106, which can be stored in the client data store143. The management agent136then sends a request to a command queue123associated with the client device106for one or more commands124to be processed or executed by the management agent136on the client device106. These commands124can include one or more compliance policies126to be implemented or enforced by the management agent136.

For example, when the management agent136implements a compliance policy126that specifies that the management agent136is to manage a client application139, the management agent136may perform a number of related actions. For instance, the management agent136could evaluate a user supplied script133to determine whether or not the client application139is installed on the client device106.

If the client application139is not currently installed on the client device106, the management agent136could then use an installer package129specified by the compliance policy126to install and configure the client application139. For example, if the compliance policy126specifies a folder or file path on the client device106that contains the installer package129(e.g., due to the inclusion of the installer package129in a machine image), the management agent136could execute the installer package129to install the client application139. Likewise, the management agent136could download the installer package129from the data store119in the computing environment103if the compliance policy126specified a network address at which the installer package129was available. The management agent136could then execute the installer package129to install the client application139.

However, if the client application139is determined to be currently installed on the client device106, then the management agent136could determine whether the installation of the client application139satisfies the compliance policy126. For example, if the version of the client application139were installed, the management agent136could execute an appropriate installer package129to update or rollback the current version of the client application139to the approved version of the client application139. As another example, if the version of the client application139were configured in a manner that violated the compliance policy126(e.g., unauthorized features were installed or the client application139were available to prohibited users or groups of users), then the management agent136could invoke the installer package129specified in the compliance policy126to modify the installation of the client application139to comply with the requirements of the compliance policy126.

As the compliance policy126for the client application139is updated over time, the management service116may insert new commands124in the command queue123for the client device106. The new commands124could include a new version of the compliance policy126to be transmitted to the management agent136. When the management agent136receives the new version of the compliance policy126, an appropriate action may be taken. For example, a compliance policy126may be updated to specify that a new version of the client application139is to be installed and that a new version of the installer package129is available at a new location. The management agent136could then execute or otherwise invoke the new version of the installer package129at the new location to update the client application139to the new version specified in the compliance policy126. Similarly, an updated compliance policy126could specify that the client application139is prohibited from being installed on the client device106, in which case the management agent136could use the installer package129to uninstall the client application139form the client device106.

Referring next toFIG. 2, shown is a flowchart that provides one example of the operation of a portion of the management agent136according to various embodiments. It is understood that the flowchart ofFIG. 2provides merely an example of the many different types of functional arrangements that may be employed to implement the operation of the portion of the management agent136as described herein. As an alternative, the flowchart ofFIG. 2may be viewed as depicting an example of elements of a method implemented in the computing environment103according to one or more embodiments.

Beginning with step203, the management agent136retrieves one or more compliance policies126applicable to the client application139. The applicable compliance policies126could be received or retrieved in a number of scenarios using a variety of mechanisms. For example, upon initial enrollment of the client device106with the management service116, the management service116may insert one or more commands124into a command queue123associated with the client device106. Each command124could specify or include a specific compliance policy126to be enforced by the management agent136on the client device106or a single command124could specify or include multiple compliance policies126to be enforced by the management agent136.

A compliance policy126could specify how the presence of a client application139can be detected. For instance, the compliance policy126could provide a user supplied script133, which the management agent136could evaluate or otherwise execute in order to determine whether the client application139is installed on the client device106. As another example, the compliance policy126could specify particular file paths or registry keys to check in order to determine whether or not a client application139is installed on the client device106.

Next at step206, the management agent136can evaluate or otherwise execute the user supplied script133specified in the compliance policy126. For example, if the user supplied script133were computer-executable code that determined whether or not the client application139were installed on the client device106, the management agent136could execute the code (e.g., by executing the script with an interpreter) in order to determine whether or not the client application139were installed on the client device106. As another example, if the management agent136specified particular settings or values to check (e.g., the presence of a specific filename in a specific folder in a specific filepath or the presence of a specific registry key), then the management agent136could check for the presence or absence of the particular settings or values.

Then at step209, the management agent136can determine, based on the user supplied script133, whether or not the client application139is installed on the client device106. For example, if the user supplied script133returned a value indicating that the client application139were not installed on the client device106, then the management agent136could determine that that client application139was not installed on the client device106. Likewise, if the user supplied script133specified particular settings or values to check, then the management agent136could determine whether or not the client application139were installed based on the presence or absence of the settings or values. If the management agent136determines that the client application139is not installed on the client device106, then the process proceeds to step211. However, if the management service136determines that the client application139is installed on the client device106, then the process proceeds to step213.

Proceeding to step211, the management agent136can cause the installer package129for the client application139to execute and install the client application139on the client device. For example, the compliance policy126could also specify the name and the location of the installer package129(e.g., a specific network address or a specific file path on the client device106). The management agent136could then retrieve or begin execution of the specified installer package129. As another example, the management agent136could send a request to the management service116for a copy of the installer package129. The management agent136could then retrieve a command124from the command queue123that includes the installer package129to be executed. After the installer package129is executed, the management agent136may configure the newly installed client application139to comply with the requirements specified in one or more compliance policies126. The process then ends.

However, if the process instead proceeds to step213, the management agent136can evaluate the current installation of the client application139to determine whether or not the client application139complies with the requirements specified in the compliance policy126. For example, the compliance policy126could specify that a specific version of the client application139be installed or that specific components of the client application139be installed. If the management agent136determines that the current installation of the client application139complies with the requirements of the compliance policy126, then the process ends. However, if the current installation of the client application139is not compliant, then the process proceeds to step216.

Then at step216, the management agent136can perform a remedial action to place the installation of the client application in compliance with the requirements specified by the compliance policy126. For example, if the compliance policy126requires that the client application139be configured in a particular manner, the management agent136could execute the installer package129to modify or repair the installation of the client application139in order to bring it into compliance with the compliance policy126. Similarly, if the compliance policy126requires that a specific version of the client application139be installed, then the management agent136could initiate execution of the installer package129to upgrade the client application139to the version specified by the compliance policy126. Other remedial actions may also be performed as required to bring the installation of the client application139into compliance with the compliance policy126. After the appropriate remedial action is performed, the process then ends.

FIG. 3depicts a sequence diagram between the various components depicted in the network environment100ofFIG. 1. It is understood that the sequence of interactions between the various applications depicted inFIG. 3is only an example of many potential sequences of interactions between the various applications depicted inFIG. 1. Other sequences of interactions may also be performed in specific implementations or scenarios.

Beginning at step303, the management console113can configure the management service116to assume management of a previously unmanaged client application139. For example, an administrative user could use a web page or similar user interface to identify the name of the client application139to be managed, upload a user supplied script133to detect whether the client application139is installed on the client device106, and create one or more compliance policies126related to or otherwise applicable to the client application139.

Next at step306, the management service116can create one or more commands124related to the client application139. For example, the management service116could create a command124specifying the compliance policy126created for the client application139and the user supplied script133. The management service116could then insert the command124into a command queue123associated with a client device106.

Then at step309, the management agent136can retrieve the commands124from the command queue123. For example, the management agent136could send a request to the management service116for all commands124currently pending in the command queue123. In response, the management service116could provide the commands124to the management agent136and then remove the commands124from the command queue123.

Moving on to step313, the management agent136can evaluate the user supplied script133specified in a compliance policy126to determine whether or not the client application139is currently installed on the client device106. Various approaches for determining whether or not the client application139is currently installed are previously described in the discussion ofFIG. 2.

Proceeding to step316, after determining that the client application139is installed, or in some instances after installing the client application139using an installer package129for the client application139, the management agent136can evaluate a compliance rule126and determine whether or not the client application139is in a state of compliance with the compliance rule126. For example, the management agent136could determine whether a minimum version or specific version, as specified by a compliance rule126, of the client application139is installed. As another example, the management agent136could determine whether client application139is configured in a manner specified by the compliance rule126(e.g., required components are installed or prohibited components are not installed).

Then at step319, the management agent136can then execute a remedial action to bring the installation of the client application139into a compliant state, if necessary. For example, the management agent136could cause an installer package129for the client application139to execute. The installer package129could upgrade the version of the client application139to the version specified by the compliance rule126, add components indicated by the compliance rule126, remove components specified by the compliance rule126, or perform other remedial actions as desired.

The flowchart ofFIG. 2and the sequence diagram ofFIG. 3show examples of the functionality and operation of implementations of components described herein. The components described herein can include hardware, software, or a combination of hardware and software. If embodied in software, each element can represent a module of code or a portion of code that includes program instructions to implement the specified logical function(s). The program instructions can be embodied in the form of source code that includes human-readable statements written in a programming language or machine code that includes machine instructions recognizable by a suitable execution system, such as a processor in a computer system or other system. If embodied in hardware, each element can represent a circuit or a number of interconnected circuits that implement the specified logical function(s).

Although the flowcharts ofFIG. 2and the sequence diagram ofFIG. 3show a specific order of execution, it is understood that the order of execution can differ from that which is shown. The order of execution of two or more elements can be switched relative to the order shown. Also, two or more elements shown in succession can be executed concurrently or with partial concurrence. Further, in some examples, one or more of the elements shown in the flowcharts can be skipped or omitted. In addition, any number of counters, state variables, warning semaphores, or messages could be added to the logical flow described herein, for purposes of enhanced utility, accounting, performance measurement, or troubleshooting aid. It is understood that all variations are within the scope of the present disclosure.

The components described herein can each include at least one processing circuit. The processing circuit can include one or more processors and one or more storage devices that are coupled to a local interface. The local interface can include a data bus with an accompanying address/control bus or any other suitable bus structure. The one or more storage devices for a processing circuit can store data or components that are executable by the one or processors of the processing circuit.

The components described herein can be embodied in the form of hardware, as software components that are executable by hardware, or as a combination of software and hardware. If embodied as hardware, the components described herein can be implemented as a circuit or state machine that employs any suitable hardware technology. This hardware technology can include one or more microprocessors, discrete logic circuits having logic gates for implementing various logic functions upon an application of one or more data signals, application specific integrated circuits (ASICs) having appropriate logic gates, programmable logic devices (e.g., field-programmable gate array (FPGAs), and complex programmable logic devices (CPLDs)).

Also, one or more or more of the components described herein that includes software or program instructions can be embodied in any non-transitory computer-readable medium for use by or in connection with an instruction execution system such as a processor in a computer system or other system. The computer-readable medium can contain, store, or maintain the software or program instructions for use by or in connection with the instruction execution system.

The computer-readable medium can include physical media, such as magnetic, optical, semiconductor, or other suitable media. Examples of a suitable computer-readable media include, but are not limited to, solid-state drives, magnetic drives, and flash memory. Further, any logic or component described herein can be implemented and structured in a variety of ways. One or more components described can be implemented as modules or components of a single application. Further, one or more components described herein can be executed in one computing device or by using multiple computing devices.

It is emphasized that the above-described examples of the present disclosure are merely examples of implementations to set forth for a clear understanding of the principles of the disclosure. Many variations and modifications can be made to the above-described examples without departing substantially from the spirit and principles of the disclosure. All modifications and variations are intended to be included herein within the scope of this disclosure.