Citrix Systems, Inc.

James Robert Walker

Gary Lee Barton

Zhongmin Lang

Nitin Desai

Vipin Aravindakshan

Methods and systems for accessing conflicting frameworks and classes are presented. In some embodiments, a conflicting frameworks computing platform may receive an application classloader corresponding to a mobile application. The application classloader may indicate one or more child application-defined classloaders. Subsequently, the conflicting frameworks computing platform may create a framework-defined classloader comprising a first class that conflicts with a second class in the one or more child application-defined classloaders. Further, the conflicting frameworks computing platform may create a framework-termination classloader. The framework-termination classloader may be a parent classloader of the framework-defined classloader. Next, the conflicting frameworks computing platform may replace, using a reflection function, the application classloader with a new application classloader. The new application classloader may indicate the one or more child application-defined classloaders, the framework-defined classloader, and the framework-termination classloader.

Accessing conflicting frameworks and classes

A method and system for managing an application with multiple modes are described. A device manager that manages a mobile device may monitor the mobile device. The device manager may detect that a first type of application that runs in a managed mode (or in multiple managed modes) and an unmanaged mode is installed on the mobile device. When the application is executed on the device, the application executes in accordance with the selected application mode, e.g., based on location, user, role, industry presence, or other predefined context.

Data management for an application with multiple operation modes

Methods and systems for developing, modifying, and distributing software applications for enterprise systems are described herein. A software component, such as a native mobile application or a template application, may be modified into a managed mobile application, and metadata associated with the managed mobile application may be generated. The managed application and associated metadata may be provided to one or more application stores, such as public application stores and/or enterprise application stores. Managed applications and/or associated metadata may be retrieved by computing devices from public application stores and/or enterprise application stores, and may be executed as managed applications in an enterprise system.

Application wrapping for application management framework

Starting execution of a mobile application on a mobile device includes creating a process that is used by the operating system of the mobile device to execute the mobile application on the mobile device. An initialization method is invoked by the mobile application that i) instantiates a replacement instrumentation object, and ii) assigns the replacement instrumentation object to the process used by the operating system to execute the mobile application on the mobile device. The replacement instrumentation object processes calls from the operating system to the mobile application and redirects at least one call made by the operating system to the mobile application to at least one call to mobile application management logic executing on the mobile device.

Mobile application management by run-time insertion of a replacement instrumentation object into a mobile application process

In response to determining that a graphical user interface displayed on the display device of a mobile device at the time a screenshot capture request is received is being generated at least in part by an enterprise application executing within a protected workspace container in the mobile device, a secure screenshot save operation is performed. The secure screenshot save operation includes i) storing, within the mobile device, a screenshot image of the graphical user interface displayed on the display device of the mobile device at the time the screenshot capture request is received, and ii) preventing the screenshot image from being accessed by any personal application executing on the mobile device outside of the protected workspace container.

Protecting screenshots of applications executing in a protected workspace container provided in a mobile device

Starting execution of a mobile application on a mobile device causes the mobile application to invoke an initialization method that i) creates a substitute application class loader, and ii) replaces a default application class loader for the mobile application with the substitute application class loader. The substitute application class loader processes a request for a requested object class defined by the mobile application by returning, instead of the requested object class, an alternate object class that is different from the requested object class and that is defined by mobile application management logic also executing on the mobile device. Continued execution of the mobile application on the mobile device includes performing at least one mobile application management action using the alternate object class returned by the substitute application class loader.

Mobile application management by run-time insertion of a substitute application class loader into a mobile application process

A last task view is captured for an application executing on a user device, in response to detecting that the user has stopped using the application. The user device may be a mobile device, and the application executing on the user device may be a native application. The last task view may be an image of the contents of a user interface displayed on the user device by the application when the user stopped using the application, and is transmitted from the user device to a server computer for storage in a repository storing views of applications most recently used by the user. A viewer application executing on the server computer may then display the views of applications most recently used by the user to the user on a user device other than the user device on which the last task view was captured.

Providing most recent application views from user devices

Methods and systems are disclosed for providing approaches to generating managed applications from unmanaged applications on a mobile device. The methods and systems may include storing, by a mobile device in a memory of the mobile device, one or more unmanaged applications each comprising a corresponding application bundle and decoding, by the mobile device, the retrieved application bundle corresponding to the first unmanaged application. The methods and systems may also include modifying, by the mobile device, the decoded application bundle corresponding to the first unmanaged application by adding a set of one or more policy-based control instructions, compiling, by the mobile device, the modified application bundle to generate a first managed application, the first managed application being configured to operate in accordance with the set of one or more policy-based control instructions, and providing, by the mobile device, the first managed application.

Wrapping unmanaged applications on a mobile device

Methods and systems for preventing unsecured mobile applications from accessing encrypted resources are presented. In some embodiments, a mobile device may determine that a background process associated with a mobile application is requesting to access an encrypted resource. The mobile device may further determine whether the mobile application has been secured with authentication information. In response to determining that the mobile application has not been secured, the mobile device may suspend the background process until the mobile application has been secured and transmit a request to a mobile application management agent to secure the mobile application using authentication information.

Enabling user entropy encryption in non-compliant mobile applications

Various aspects of the disclosure relate to providing a per-application policy-controlled virtual private network (VPN) tunnel. In some embodiments, tickets may be used to provide access to an enterprise resource without separate authentication of the application and, in some instances, can be used in such a manner as to provide a seamless experience to the user when reestablishing a per-application policy controlled VPN tunnel during the lifetime of the ticket. Additional aspects relate to an access gateway providing updated policy information and tickets to a mobile device. Other aspects relate to selectively wiping the tickets from a secure container of the mobile device. Yet further aspects relate to operating applications in multiple modes, such as a managed mode and an unmanaged mode, and providing authentication-related services based on one or more of the above aspects.

Providing virtualized private network tunnels

Various aspects of the disclosure relate to providing secure containers or data vaults for data of one or more managed applications. In some embodiments, each managed application may be assigned its own private data vault and/or may be assigned a shared data vault that is accessible to at least one other managed application. As the managed application executes, calls for access to the data may be intercepted and redirected to the secure containers. Data stored in a secure container may be encrypted according to a policy. Other aspects relate to deleting data from a secure container, such as via a selective wipe of data associated with a managed application. Further aspects relate to configuring and creating the secure containers, retrieving key information required to encrypt/decrypt the data stored in the secure containers, and publishing the managed applications, policy information and key information for download to a mobile device.

Controlling mobile device access to secure data

A method of managing access to enterprise resources is provided. An access manager may operate at a mobile device to validate a mobile application installed at that mobile device. If the access manager does not successfully validate the mobile application, the access manager may prevent the mobile application from accessing computing resource. If the access manager does successfully validate the mobile application, then the access manager may identify the mobile application as a trusted mobile application. The access manager may thus permit the trusted mobile application to access the computing resource.

Growing community of inventors

Deerfield Beach, FL, United States of America

James Robert Walker