Airwatch LLC

Vmware, Inc.

Other

Nicira, Inc.

Adam Stephen Rykowski

Sridhara Babu Kommireddy

Kabir A Barday

Emily Hong Xu

Ashish Kumar Jain

Kyle Austin

Dale Robert Olds

Huda Osman

Harit Patel

Jeremy Dejiacomo

Mithila Tople

Jacob Postema

Manikandan Sigamani

Jonathan Blake Brannon

Craig Farley Newell

Sulay Shah

Leung Tao Kwok

Nishita Manjunath

Camilo Lotero

Erich Peter Stuntebeck

Kevin Jones

John L Marshall

Abhishek Mishra

Ramana Malladi

Pratik Jagad

Krishna Kumar Bhavesh

Sai Kiran Vudutala

Jonathan Spaeth

Jyothiprakash Halebeed

Lucas Chen

Adarsh Subhash Chandra Jain

Raghuram Rajan

Daniel Benjamin Quintas

Kai Chen

Dale Roberts Olds

Sridhar Kommireddy

Jayant Jain

Anirban Sengupta

Uday Suresh Masurekar

Kalyan Regula

Srinivas Nimmagadda

Kausum Kumar

Adam Michael Hardy

Ravishankar Chamarajnagar

Sagar Date

John Joseph Manton

Utkarsh Singh

Disclosed are various embodiments for accessing resources when a client device complies with distribution rules. A client device receives distribution rules associated with resources that are accessible at a distribution service. The client device determines whether the client device complies with the distribution rules. The client device transmits an indication of compliance for the distribution to the distribution service. The client device receives the resource from the distribution service.

Controlling distribution of resources in a network

Disclosed are various examples for providing a single sign-on experience for mobile applications that may or may not be managed. A first application executed in a client device sends an access request to a service provider. The first application receives a redirection response from the service provider that redirects the first application to an identity provider. The first application then receives a further redirection response from the identity provider that causes the first application to request an identity assertion from a second application executed in the client device. The first application receives the identity assertion from the second application. The first authentication then authenticates with the service provider using the identity assertion.

Single sign-on for unmanaged mobile devices

Examples of detecting whether a device meets an enrollment level are disclosed. In one case, a method for providing access to an application on a client device includes receiving a request to access an application from the client device, determining an enrollment level associated with the application, and determining that multi-factor authentication is required for access to the application on the client device based on the enrollment level associated with the application. The method can also include initiating multi-factor authentication on the client device before access to the application is permitted. The method can also include determining that multi-factor authentication is successful on the client device, transmitting a management component to the client device, and installing the management component on the client device for enrollment as a managed device with a management service.

Providing access to applications with varying enrollment levels

Disclosed are various examples for providing network content filtering to client devices on a per-application basis. A client device is identified. Then the client device is authenticated by the device management service. If the client device is not authenticated, a user interface will facilitate the enrollment process on the client device to authenticate the client device with the management service. Then, an authentication token is received. The management application receives a request from an application to initiate a network connection. Based at least in part on the identity of the application and the client device, the management application routes network traffic associated with the application and the network connection using or without using a managed network tunnel.

Per-application network content filtering

Disclosed are various examples of integrating multiple domains within a directory service. A computing device retrieves a first list of members in a first group of users for the domain from a first directory service for a first domain. The computing device then determines that a second group of users is a member of the first group of users, wherein the second group of users corresponds to a second domain. The computing device then retrieves a second list of members in the second group of users from a second directory service for a second domain. The computing device subsequently compares the first list of members in the first group of users and the second list of members in the second group of users with a third list of members in a third group of users, wherein the third list of members in the third group of users corresponds to a user list maintained by the application. The computing device then adds to the third list of members in the third group of users each user that is both present in the first list of members in the first group of users or in the second list of members in the second group of users and missing from the third list of members in the third group of users.

Multiple domain directory integration

Disclosed are various examples for providing network content filtering to client devices on a per-application basis. A network stack receives a request from an application to connect to a network service. The network stack then determines the identity of the application. Based at least in part on the identity of the application, the network stack initiates a network connection between the application and the network service using or without using a managed network tunnel.

Disclosed are various examples for the dynamic construction of configuration profiles using settings common across different operating systems. A computing environment having a management service can determine variable names for inclusion in configuration profiles based on operating systems. The computing environment can dynamically generate configuration profiles using the appropriate variable names such that the value provided by an administrator is a value or parameter of the variable name for deployment to a client device having an operating system capable of interpreting the value using the variable name.

Dynamic construction of configuration profiles for settings common across different operating systems

Disclosed are various examples for configuring network security based on device management characteristics. In one example, a specification of a set of network resources on an internal network is received from an administrator client. The set of network resources are those network resources that a particular application executed in client devices on an external network should be authorized to access. A gateway from the external network to the internal network is then configured to permit the particular application to have access to the set of network resources.

Configuring network security based on device management characteristics

Disclosed are various embodiments for accessing resources when a client device complies with distribution rules. A client device receives selected resources and distribution rules associated with the resources. The client device determines whether the client device complies with the distribution rules. When the resources are modified, the changes are sent to a distribution service associated with the resources.

Controllng distribution of resources in a network

Disclosed are various examples for providing a single sign-on experience for managed mobile devices. A management application executed in a computing device receives a single sign-on request from a managed client application executed by the same computing device. The management application determines that the client application is permitted to access a management credential for single sign-on use. The management application provides the management credential to the client application in response to the single sign-on request.

Single sign-on for managed mobile devices

Disclosed are various examples for the use of network micro-segmentation in enterprise mobility management. In one example, a network device receives a packet with one or mote device management attribute embedded in its header. The network device extracts the device management attribute from the packet header. A compliance status of a client device in an external network is determined based on the device management attribute. The network device forwards the packet based on the compliance status.

Enterprise mobility management and network micro-segmentation

Disclosed are various examples for single-sign on by way of managed mobile devices using Kerberos. For example, a certificate is received from a client device. In response, a Kerberos ticket-granting ticket is generated and sent to the client device. A request for a service ticket is later received from the client device. The request for the service ticket can include the ticket-granting ticket. The service ticket is then generated and sent to the client device. Subsequently, the service ticket is received from the client device and a security assertion markup language (SAML) response is sent to the client device in reply. The SAML response can provide authentication credentials for a service provider associated with the service ticket.

Single sign-on for managed mobile devices using kerberos

Disclosed are various examples for remote email configuration using dynamically generated configuration profiles. A computing environment having a management service can determine variable names for inclusion in configuration profiles that are capable of configuring email settings on various managed device operating systems. The computing environment can dynamically generate configuration profiles using the appropriate variable names such that a client device having a particular operating system installed thereon is capable of interpreting the value and the variable name to configure the email setting.

Remote email configuration using dynamically generated configuration profiles

Growing community of inventors

Decatur, GA, United States of America

Adam Stephen Rykowski