Compliance settings are implemented by mobile devices to follow configuration scenarios

Abstract

Embodiments described herein relate to implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario. For example, the computing device may receive configuration information from a server, the configuration information describing the compliance settings to be implemented by the computing device to cause the computing device to comply with the configuration scenario. In addition, the computing device may identify a state machine indicated by the configuration information, the state machine describing a configuration process for implementing the compliance settings, and may execute the state machine to configure the computing device with the compliance settings.

Description

Background Art

[0001] Mobile device management (MDM) is a way to ensure that employees remain productive and do not violate company policies. Many organizations use MDM products / services to control the activities of their employees. MDM mainly deals with corporate data isolation, protecting emails, protecting corporate documents on devices, enforcing corporate policies, and integrating and managing mobile devices (including various categories of laptops and handheld devices). By controlling and protecting the data and configuration settings of all mobile devices in the organization's network, MDM can reduce support costs and business risks. Summary of the invention

[0002] This Summary is provided to introduce some concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] Embodiments described herein relate to implementing compliance settings by a computing device so that the computing device complies with a configuration scenario. For example, a computing device may receive configuration information from a server, the configuration information describing compliance settings for implementation by the computing device so that the computing device complies with the configuration scenario. In addition, the computing device may identify a state machine indicated by the configuration information (e.g., by an identifier), the state machine describing a configuration process for implementing the compliance settings. The state machine may be executed to configure the computing device using the compliance settings. When the state machine is executed, the payload and dependencies included in the configuration information may be processed in an order specified by the state machine to configure the computing device.

[0004] The following will describe in detail other features and advantages of the present invention, as well as the structure and operation of various embodiments of the present invention, with reference to the accompanying drawings. Note that the present invention is not limited to the specific embodiments described herein. Such embodiments are presented herein for illustrative purposes only. Additional embodiments will be apparent to those skilled in the relevant art based on the teachings contained herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The accompanying drawings, which are incorporated herein and constitute a part of the specification, illustrate the embodiments and, together with the description, further serve to explain the principles of the embodiments and to enable those skilled in the relevant art to make and use the embodiments.

[0006] Figure 1 A block diagram of a system for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario is depicted according to an example embodiment.

[0007] Figure 2AA block diagram depicts a system for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario according to an example embodiment. Figure 1 Further detailed examples of systems.

[0008] Figure 2B Another block diagram of a system for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario according to an example embodiment is depicted. Figure 1 Further detailed examples of systems.

[0009] Figure 3 A flow chart of an example method for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario is depicted according to an example embodiment.

[0010] Figure 4 Depicted is a flow chart of an example method for determining whether a mobile device is properly configured according to an example embodiment.

[0011] Figure 5 Depicted is a flow chart of an example method for storing and transmitting configuration results according to an example embodiment.

[0012] Figure 6 Depicted is a flow chart of an example method for requesting correction of errors in configuration information according to one embodiment.

[0013] Figure 7 Depicted is a flow diagram of an example method for receiving updated configuration information and / or additional configuration information according to one embodiment.

[0014] Figure 8 is a block diagram of an exemplary user device in which various embodiments may be implemented.

[0015] Fig. 9 is a block diagram of an example computing device that can be used to implement an embodiment.

[0016] Features and advantages of the present invention will become more apparent from the detailed description set forth below when taken in conjunction with the accompanying drawings in which like reference numerals identify corresponding elements throughout. In the accompanying drawings, like reference numerals generally refer to identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit in the corresponding reference numeral. DETAILED DESCRIPTION

[0017] I. Introduction

[0018] This specification and the accompanying drawings disclose one or more embodiments that include the features of the present invention. The scope of the present invention is not limited to the disclosed embodiments. The disclosed embodiments merely illustrate the present invention, and modified versions of the disclosed embodiments are also covered by the present invention. The embodiments of the present invention are defined by the appended claims.

[0019] References in the specification to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with one embodiment, whether or not explicitly described, it is considered to be within the knowledge of those skilled in the art to implement the feature, structure, or characteristic in conjunction with other embodiments.

[0020] A number of exemplary embodiments are described below. Note that any section / subsection titles provided herein are not intended to be limiting. Various embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. In addition, the embodiments disclosed in any section / subsection may be combined in any manner with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0021] II. Systems and Methods for Managing Device Compliance

[0022] The typical architecture of an enterprise's mobile device management (MDM) process today uses an MDM server that is responsible for executing and monitoring mobile device configurations, storing vast amounts of data, and performing continuous error checking and preventative maintenance. This functionality can be performed for a large number of devices in an enterprise, including hundreds, thousands, tens of thousands, millions, hundreds of millions, or even more devices. As a result, the server expends countless "computing calories" (e.g., uses large amounts of processing power) to determine whether all mobile technology resources of the enterprise network are properly configured, operate within the constraints of security and other important protocols, and whether updates are implemented and followed.

[0023] This means that the server is bogged down by having to communicate with many individual mobile devices on the corporate network and must ultimately oversee the configuration process as well as reporting requirements. In this case, scalability is very challenging for the enterprise, just considering the number of devices, pure traffic, and configuration volume. In other words, the server requires a lot of management work. In addition, due to the non-streamlined and device-specific nature of the configuration execution, the configuration process can also be rife with other avoidable errors.

[0024] These limitations can ultimately be addressed by changing the server's involvement in the device management process. For example, in an embodiment, the server can experience higher productivity by requiring the mobile device to perform its own configuration. In the embodiments described herein, the server can provide configuration details to the mobile device, and the configuration process can be driven by the mobile device by acting as a generalized state machine. These embodiments and additional embodiments refer to Figure 1 A more detailed description is as follows. Note that the embodiments described herein are applicable to any operating system / computing platform, such as Apple and GoogleAndroid TM , and this article is about References to the and / or its components are for descriptive and illustrative purposes only and are not to be construed as limiting.

[0025] Figure 1 1 is a block diagram of a compliance enforcement system 100 for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario according to an example embodiment. Figure 1 As shown in , system 100 includes server 102, computing device 104, and one or more data repositories 108 communicatively coupled via enterprise network 110. Server 102 includes compliance engine 122. Computing device 104 includes compliance agent 120. Although a single computing device 104 is shown, there may be any number of computing devices with compliance settings provided by server 102 in system 100, including tens, hundreds, thousands, tens of thousands, millions, hundreds of millions, and more computing devices. Data repository 108 may include one or more physical memories and / or storage devices. Data repository 108 may be any type of physical memory and / or storage device as described herein and / or as will be understood by a person skilled in the relevant art having the benefit of this disclosure. Enterprise network 110 includes a dedicated computer network established by an enterprise for the purpose of interconnecting enterprise devices (e.g., computing device 104 and other computing devices not shown) at one or more enterprise locations to other enterprise devices and enabling enterprise devices to access and / or share computing resources.

[0026] Computing device 104 is a device utilized or otherwise accessible by one or more members of an enterprise (e.g., employees). As used herein, the term "enterprise" broadly refers to any of a variety of organizational types, including businesses, nonprofit organizations, and government agencies. Users of computing devices 104 may be referred to herein as "enterprise users" or simply "users." Computing devices 104 may include, for example, but not limited to, desktop computers, laptop computers, tablet computers, netbooks, smartphones, and the like. Additional examples of computing devices 104 are referenced below. Figure 8 and Fig. 9 to describe.

[0027] The data repository 108 may be configured to store configuration information 112 for the computing device 104 and / or one or more other computing devices. In an embodiment, the configuration information 112 may be stored locally in a memory of the server 102. The configuration information 112 may specify one or more compliance settings for the computing device 104 and / or for a user of the computing device 104, and include data, one or more files, etc., for installation on the computing device 112 according to a particular configuration scenario. For example, a first compliance setting of the configuration information 112 may be associated with a first user of the computing device 104, and a second compliance setting of the configuration information 112 may be associated with a second user of the computing device 104. Examples of compliance settings include, but are not limited to, encryption settings to be implemented by the computing device 104, security settings to be implemented by the computing device 104, a minimum version of at least one of an application or an operating system that needs to be installed on the computing device 104, etc. The encryption setting may specify whether a storage device included in the computing device 104 is to be encrypted (e.g., via a security feature such as, but not limited to, BitLocker). TM The security settings may specify a password policy to be implemented by the computing device 104 (e.g., setting password length to a minimum of 10 characters, 12 characters, etc.), whether code signing should be implemented by the computing device 104, whether a Trusted Platform Module (TPM) should be implemented by the computing device 104, etc. Note that the above compliance settings are purely exemplary and other configuration settings may be used.

[0028] Server 102 may be configured to manage compliance of computing devices including computing device 104 according to configuration scenarios. Such computing devices may include fixed devices (e.g., desktop computers) and / or mobile devices (e.g., smartphones, laptops, tablet computers, wearable computing devices (e.g., including devices such as The server 102 may also be referred to as a mobile device manager (MDM) when managing mobile devices. Configuration scenarios may be as simple as a set of discrete policies or as complex as the configuration of a virtual private network (VPN) connection. Policies may be specified by the enterprise (e.g., data and / or security policies). Policies may be specified based on one or more compliance settings. One or more compliance settings may be specified by an administrator of the enterprise (e.g., an IT (information technology) administrator) or other personnel within the enterprise responsible for deploying, maintaining, and / or configuring computing devices 104 on behalf of enterprise users.

[0029] like Figure 1As shown in , the server 102 includes a compliance engine 122. The compliance engine 122 can determine configuration information 112 to be provided to the computing device 104 and provide the determined configuration information 112 to the computing device 104. For example, the server 102 can receive and / or access configuration information 112 in the form of a compliance manifest or other document, which indicates configuration settings for deployment to a specific set of devices. The server 102 can obtain the configuration information 112 from the data repository 108 via the network 110, and provide the configuration information 112 to the indicated device, such as the computing device 104, via the network 110. Figure 1 The transmission of configuration information 112 over network 110 is depicted in FIG by dashed line 112. Configuration information 112 may specify compliance settings for computing device 104 (and optionally, additional devices) to implement in order for computing device 104 to comply with a configuration scenario.

[0030] Computing device 104 may be configured to implement compliance settings specified by configuration information 112. Figure 1 As shown in , computing device 104 includes compliance agent 120. Computing device 104 may be configured to execute compliance agent 120, which is configured to implement compliance settings specified by received configuration information 112 by identifying and executing a state machine that describes a configuration process for implementing compliance settings for a configuration scenario on computing device 104. For example, compliance agent 120 may identify state machine 118 as the state machine indicated by configuration information 112, and execute state machine 118 to configure compliance settings for computing device 104 to comply with the configuration scenario.

[0031] According to embodiments, the state machine 118 may be generated in various ways. For example, during a build process, one or more documents may be generated (e.g., by a developer), which may be compiled and stored on the computing device 104. For example, during a build process, one or more files describing a configuration scenario are generated (enabling the server to consume and present a user interface (UI) (e.g., at a management console generated by the compliance engine 122 of the server 102)), and a state machine is generated. The UI allows an IT administrator to enter configuration information for a specific configuration scenario, which may then be sent to the computing device 104. As described herein, the configuration information is processed by the computing device 104, using a configuration service provider (CSP) to change security according to a specific configuration scenario and to change the functional behavior of the computing device. A CSP is an interface for reading, setting, modifying, or deleting configuration settings on a device. In addition, when a state machine (e.g., the state machine 118) is processed, the CSP is called in the order indicated by the state machine to use the configuration information provided by the server to meet the desired state at the computing device.

[0032] After implementing the configuration setting according to the state machine 118, the compliance agent 120 can provide a confirmation (e.g., an "alert") to the compliance engine 122. The confirmation indicates that the computing device has implemented the configuration setting, or that a failure has occurred. After receiving the confirmation indicating that the configuration setting has been successfully implemented, the compliance engine 122 can designate the computing device 104 as complying with the configuration scenario. The compliance engine 122 can maintain the confirmation in various ways.

[0033] For example, the server 102 may maintain a compliance record 106, which includes an assignment for each user-device pair as to whether the particular user-device pair is compliant. For example, the compliance record 106 may include a data structure (e.g., a table) having a plurality of entries, each of which specifies a particular user-device pair and specifies an indication of whether the user-device pair is compliant. The server 102 may be further configured to maintain a local configuration reference 114 of configuration settings implemented for each user-device pair. The configuration reference 114 may include a data structure (e.g., a table) having a plurality of entries, each of which specifies a particular user-device pair and a configuration setting implemented by the pair. Note that the structure and / or organization of the configuration reference 114 and / or compliance record 106 described above is purely exemplary, and other structures and / or organizations may be used. The server 102 may maintain the configuration reference 114 and the compliance record 106 at any location and in any manner, including storing it in the data repository 108 or elsewhere.

[0034] The compliance engine 122 may be configured to use the reference 114 to determine whether the computing device(s) 104 remain in compliance with the compliance rules. By doing so, the compliance engine 122 only needs to access the reference 114 to determine the configuration settings implemented by the computing device 104, rather than having to query the computing device(s) 104 for their configuration settings. The compliance engine 122 may determine whether the computing device 104 remains in compliance upon detecting any suitable triggering event, including the expiration of a predetermined time period, a request from an administrator, auditor, and / or management, other persons and / or entities who wish to confirm or otherwise learn / confirm whether the computing device 104 and / or other computing devices comply with one or more compliance settings and / or requirements of interest. The request to determine whether a device complies with the compliance settings / requirements may involve any number of devices, including hundreds, thousands, or millions of devices. Thus, by accessing such compliance information from the configuration reference 114 and / or the compliance record 106, the server 102 does not need to expend a significant amount of processing power as compared to having to separately poll each device of interest.

[0035] In the embodiments, this can be achieved in various ways Figure 1 system 100. For example, Figure 2ADetailed block diagram of system 200 according to an example embodiment is depicted. System 200 is an example of system 100. Figure 2A As shown in FIG. 1 , system 200 includes server 102 and computing device 204. Computing device 204 is as described above with reference to FIG. Figure 1 An example of the computing device 104 is shown. Figure 2A As further shown in FIG. 1 , computing device 204 includes compliance agent 220, state machine (SM) data repository 224, and configuration information (CI) data repository 222. State machine data repository 224 and configuration information data repository 222 may each include one or more physical memories and / or storage devices, including any type of physical memories and / or storage devices described herein and / or as would be understood by a person skilled in the relevant art having the benefit of this disclosure. Compliance agent 220 is as described above with reference to Figure 1 An example of the compliance agent 120 is shown.

[0036] The server 102 is configured to determine configuration information 112 to be provided to the computing device 204 and to provide the determined configuration information 112 thereto. For example, when a user first logs into a computing device provided to him / her, the server 102 may retrieve device configuration information 112 associated with the computing device and / or the user and provide the configuration information 112 to the computing device. Additionally or alternatively, the server 102 may retrieve configuration information 112 associated with the computing device and / or the user and provide the configuration information 112 to the computing device when software or firmware (including device drivers) is newly installed to the computing device, when new hardware is added to the computing device, when software and / or firmware is updated or deleted from the computing device, when hardware is removed from the computing device, and / or during other events that modify the configuration of the computing device.

[0037] Similar to reference Figure 1 104, computing device 204 may be configured to execute compliance agent 220, which is configured to implement the configuration settings specified by configuration information 112. More specifically, compliance agent 220 consumes the appropriate state machine based on the desired configuration scenario. Server 102 may provide a "configuration scenario identifier" in configuration information 112 to specify the appropriate state machine to computing device 204. Compliance agent 220 may use this identifier to find the correct state machine for the orchestrator to follow. Configuration information 112 provided by server 102 is then provided to the appropriate CSP by compliance agent 220 based on the state machine, as described in further detail below.

[0038] like Figure 2AAs shown in , compliance agent 220 includes configuration manager 206 and orchestrator engine 208. In addition, configuration manager 206 includes compliance configuration information handler 228 and configuration information error checker 210.

[0039] The compliance configuration information handler 228 may be configured to access the configuration information 112 from the compliance engine 122 of the server 102 (e.g., distributed to the computing device 204 via SyncML or a CDN (content delivery network)) and store the configuration information 112 in the configuration information data repository 222 (e.g., Figure 2A 102, the compliance configuration information handler 228, and the configuration information data repository 222). As another example, the configuration information 112 can be provided by JavaScript Object Notation (JSON). The configuration information 112 can be distributed directly to the computing device by the server, or the server can instruct the computing device where to obtain the configuration information 112 via a CDN (described in more detail below).

[0040] Configuration information 112 may have any suitable form. According to one embodiment, configuration information 112 may be represented by an extensible markup language (XML) file, which includes a payload associated with compliance settings and a corresponding uniform resource identifier (URI) for downloading and processing the payload. For example, a CDN storing a payload may include a separate tag representing a URI for asynchronously downloading and processing the payload. To further illustrate, a simple configuration scenario for a set of discrete policies (e.g., provided by a policy CSP) may require only a single payload included in an XML file. For more complex configuration scenarios (e.g., configurations for VPN connections), multiple payloads may need to be specified in an XML file. For example, in a VPN configuration scenario, a profile payload and a certificate payload may be provided. The server may create these scenario configuration files before attempting a synchronous session with a computing device. This avoids creating the same file on demand for each computing device interacting with the server, and enables the server to be used to perform more useful work, thereby improving scalability.

[0041] The following is an example of a scenario configuration XML file that indicates the policies to be set by the Policy CSP, which includes multiple declarative configuration payloads. Note that the "Id", "checksum", and "OSDefinedScenario" attributes of the example scenario configuration XML file constitute a unique identifier. Also note that the "OSDefinedScenario" attribute in the example indicates that this is a published configuration scenario, which means that the configuration scenario will rely on a declared configuration scenario state machine that dictates how the configuration scenario is configured. The declared configuration scenario state machine is compiled into the operating system (OS) build. After the manifest, the state machine can be stored in the registry. In addition, since it can be specified in the state machine whether each payload should be atomic or whether the entire document should be atomic, it may not be necessary to specify this behavior. In addition, the following XML file sets some computing device-wide policies and configures the example encryption features (i.e., BitLocker TM ):

[0042]

[0043] Below is an example of a multi-payload XML file that describes a configuration scenario defined by an MDM. In this example, there is no declared configuration scenario state machine:

[0044]

[0045] The compliance configuration information handler 228 may be further configured to request (eg, using a Hypertext Transfer Protocol (HTTP) GET method request) the configuration information 112 from the server 102 and provide the configuration information 112 to the configuration information error checker 210 .

[0046] The configuration information error checker 210 may be configured to parse the configuration information 112, determine errors in the configuration information 112 (e.g., errors in XML code, attributes, URIs in XML configuration scenario files, etc.), and request correction of the errors from the server 102. For example, in the example discussed above where the configuration information 112 is represented as an XML file, the configuration information error checker 210 may parse and validate the XML code, store the URIs in a registry location, and if any errors are detected, synchronously report the errors to the server 102 and request correction of the errors by the server 102 (e.g., Figure 2ATypically, the MDM server ensures that there are no conflicts or errors in the configuration information. However, the client device detecting conflicts and errors allows immediate feedback to be provided to the MDM server and allows any errors in the configuration information to be quickly corrected.

[0047] The compliance configuration information handler 228 may also be configured to transmit the stored configuration information 112 to the server 102, and to receive updated configuration information and / or additional configuration information from the server 102 in response to sending the configuration information to the server 102. For example, the compliance configuration information handler 228 may be configured to verify the status (e.g., out-of-date or stale) of the configuration information data 112 stored in the configuration information data repository 222 by sending it to the server 102, and based on the status of the stored configuration information 112 determined by the server 102, the server 102 may provide the compliance configuration information handler 228 with the updated configuration information and / or additional configuration information. Subsequently, the compliance configuration information handler 228 may store the received updated configuration information and / or additional configuration information in the configuration information data repository 222 (e.g., out-of-date or stale). Figure 2A As described below, orchestrator engine 208 of compliance agent 220 is configured to implement the configuration settings received in configuration information 112 and generate configuration results 226 based thereon.

[0048] Specifically, Figure 2B 2 depicts a detailed block diagram of a system 230 according to an example embodiment. The system 230 is another example of the system 100. Figure 2B As shown in FIG. 1 , system 230 includes server 102 and computing device 244. Computing device 244 is Figure 1 244 includes a compliance agent 240, an SM data repository 224, and a configuration information data repository 222. The compliance agent 240 is as described above with reference to Figure 1 Another example of the compliance agent 120 is described.

[0049] With reference Figure 1 Similar to computing device 104 described above, computing device 244 executes compliance agent 240, which is configured to implement the configuration settings specified by configuration information 112. Figure 2B As shown in , compliance agent 240 includes configuration manager 206 and orchestrator engine 208. Configuration manager 206 includes compliance configuration information handler 228 and setting implementation trigger 232. Orchestrator engine 208 includes state machine selector 234 and state machine execution engine 236. These features of compliance agent 240 are described as follows.

[0050] Setting implementation trigger 232 is configured to trigger orchestrator engine 208 to implement the compliance settings described by configuration information 112 in computing device 244. For example, Figure 2B As shown in FIG. 1 , the configuration implementation trigger 232 provides a trigger 218 to the state machine selector 234. More specifically, after the configuration information error checker 210 parses and verifies the configuration information 112 (as described above with reference to FIG. 1 ), the configuration information error checker 210 parses and verifies the configuration information 112 (as described above with reference to FIG. 1 ). Figure 2A After the trigger 218 is triggered, the task may be scheduled (and the scheduled task may be triggered by the "DeclaredConfiguration" CSP). According to an embodiment, the task may be stored in an active queue and processed after any unprocessed tasks stored in the active queue have been processed.

[0051] The state machine selector 234 is configured to receive a trigger from the setting implementation trigger 232 to implement the compliance setting in the computing device 244. In one embodiment, the state machine selector 234 identifies a state machine indicated by the configuration information 112, which describes a configuration process for implementing the compliance setting. After receiving the trigger 218, the state selector machine 234 can obtain the stored configuration information 112 from the configuration information data repository 222, and after consuming the properties of the stored configuration information 112, determine that the state machine 118 is associated with the configuration information 112. For example, the configuration information 112 can specify an identifier for a particular state machine.

[0052] The state machine selector 234 may be further configured to provide the state machine 118 to the state machine execution engine 236. The state machine execution engine 236 is configured to execute the state machine 118 to configure the computing device 244 using the compliance settings described in the configuration information 112. For example, the state machine selector 234 may process the configuration information 112 in the order specified by the state machine 118 (see FIG. 2 ). Figure 2A Alternatively, if there is no state machine associated with the configuration information 112, the payload specified by the configuration information 112 will be processed in the order specified by the configuration information 112. In addition, the state machine selector 234 can access the state machine data repository 224 to obtain a list of state machines 118. The list can include state machines 118 and their dependencies.

[0053] An example XML file of a declared configuration scenario state machine manifest is reproduced below.

[0054]

[0055] The state machine execution engine 236 can be further configured to store configuration results 226 (e.g., XML files with URIs and values, events, last error codes, states, etc.) in the configuration information data repository 222. For example, the configuration results 226 can include the configuration information data repository 222 described above. Figure 1 The compliance configuration information handler 228 may be configured to obtain configuration results 226 from the configuration information data repository 222 and provide the configuration results 226 to the compliance engine 122 (e.g., Figure 2B 226) for analysis by server 102. In the event that configuration results 226 include errors, server 102 can provide an earlier version of confirmation information 112 to compliance configuration information handler 228 so that any erroneous changes to the mobile device can be reversed, including instructing orchestrator engine 208 to roll back the state of the computing device to a state prior to executing the state machine.

[0056] For example, according to the embodiments described herein, a state machine may include configuration instructions for configuring a scenario. To further illustrate, a state may be described by entities "FromState", "Activity", and "ToState". An Activity may be in the form of executable code owned and created by the configuration scenario (or multiple) owners. In addition, an Activity may return different ToState states at runtime for advancing to the next step. If the Activity does not modify the Tostate, the default ToState is used, and the default ToState is specified in the data representation of the state machine. An Activity may have predefined input data and output data that are marshaled into the Activity, and the input data and output data are represented as XML. This ensures that a single Activity can be developed and tested separately. The ability to modify the ToState of an Activity allows runtime adjustments to the state machine. A state machine may be used to configure, verify, refresh, and delete configuration scenarios.

[0057] Systems 100, 200, and 230 may operate in a variety of ways to perform their functions. For example, Figure 3 A flowchart 300 is depicted of a method for implementing compliance settings by a computing device to cause the computing device to comply with a configuration scenario according to an example embodiment. Figure 1 , Figure 2A and Figure 2B To describe Figure 3 However, based on the following description of flowchart 300 and Figure 1 , Figure 2A and Figure 2BGiven the discussion of systems 100, 200, and 230, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0058] like Figure 3 As shown in FIG. 3 , flowchart 300 starts at step 302. In step 302, configuration information is received from a server, the configuration information describing compliance settings for implementation by a mobile device to enable the mobile device to comply with a configuration scenario. Figure 1 , Figure 2A and Figure 2B , the compliance configuration information handler 228 receives information 112 from the compliance engine 122 of the server 102.

[0059] In step 304, the configuration information is stored. For example, continue to refer to Figure 1 , Figure 2A and Figure 2B , the compliance configuration information handler 228 stores the configuration information 112 in the configuration information data repository 222 .

[0060] In step 306, a trigger is received to implement compliance settings in the mobile device. Figure 1 , Figure 2A and Figure 2B , setting implementation trigger 232 provides trigger 218 to state machine selector 234 of orchestrator engine 208 , thereby starting to implement the compliance settings described by configuration information 112 in computing device 244 .

[0061] In step 308, a state machine indicated by the configuration information is identified, the state machine describing a configuration process for implementing compliance settings. Figure 1 , Figure 2A and Figure 2B After receiving the trigger 218 , the state selector machine 234 obtains the stored configuration information 112 from the configuration information data repository 222 and determines that the state machine 118 is associated with the configuration information 112 .

[0062] In step 310, continue to refer to Figure 1 , Figure 2A and Figure 2B , executes the state machine to configure the mobile device with compliance settings. For example, continue to refer to Figure 1 , Figure 2A and Figure 2B , the state machine selector 234 provides the state machine 118 (or a pointer to the state machine 118 ) to the state machine execution engine 236 , and the state machine execution engine 236 executes the state machine 118 to configure the computing device 244 using the compliance settings described in the configuration information 112 .

[0063] Figure 4 A flowchart 400 is depicted of a method for determining whether a mobile device is properly configured according to an example embodiment. Figure 1 , Figure 2A and Figure 2B describe Figure 4 However, based on the following description of flowchart 400 and Figure 1 , Figure 2A and Figure 2B Given the discussion of systems 100, 200, and 230, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0064] like Figure 4 As shown in FIG. 4 , flowchart 400 includes step 402. In step 402, a state machine is executed to determine whether the mobile device is properly configured according to the configuration information. Figure 1 , Figure 2A and Figure 2B , the state machine execution engine 236 executes the state machine 118 without modifying the configuration of the computing device 244 to evaluate whether the computing device 244 is in the correct configuration state. Specifically, according to the embodiments described herein, the state machine can run in either of two modes, a "configuration" mode and an "analysis" mode. The configuration mode configures the computing device based on the configuration information (as described above). The analysis mode performs an evaluation of the computing device without modifying the computing device to ensure that the device is indeed in the correct configuration state. For example, the state machine is configured to retrieve one or more current settings and / or other information (related to a specific hardware / software / firmware configuration) of the computing device (e.g., determining an operating system version number, a version number of another application, an entry in a file (such as a DLL (dynamic link library) file), etc.; determining whether one or more files exist, etc.). The state machine can compare the retrieved information with the correct configuration information, which is maintained by or accessible to the state machine for the computing device. If all the information matches, the state machine can indicate that the computing device complies with a specific configuration. If not all the information matches, the state machine can indicate that the computing device is non-compliant.

[0065] As described above, the results of a particular configuration executed by the state machine can be transmitted to the compliance engine. For example, Figure 5 A flowchart 500 of a method for storing and transmitting configuration results according to one embodiment is depicted. Figure 1 , Figure 2A and Figure 2B To describe Figure 5 However, based on the following description of flowchart 500 and Figure 1 , Figure 2A and Figure 2BGiven the discussion of systems 100, 200, and 230, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0066] like Figure 5 As shown in FIG. 5 , flowchart 500 starts at step 502. At step 502, the configuration result generated by executing the state machine is stored in a configuration information data repository. For example, continue to refer to Figure 1 , Figure 2A and Figure 2B , the state machine execution engine 236 stores the configuration results 226 in the configuration information data repository 222. In an embodiment, the configuration results 226 may include one or more indications. For example, the configuration results 226 may provide an indication that the (multiple) configuration settings were successfully installed by the orchestrator engine 208, the installation is in progress, or a failure occurred and the configuration settings were not successfully installed. If a failure occurred, the configuration results 226 may include an indication of the failure, such as by listing one or more errors (by error code and / or description), event tracking (e.g., recording information about the state machine execution that can be used for debugging), and / or other diagnostic data generated by the state machine.

[0067] In steps 504 and 506, the configuration result is obtained from the configuration information data repository (step 504), and the configuration result is transmitted to the server (step 506). Figure 1 , Figure 2A and Figure 2B , the compliance configuration information handler 228 obtains the configuration result 226 from the configuration information data repository 222, and provides the configuration result 226 to the compliance engine 122 for analysis by the server 102. In the event that the configuration result 226 includes an error, the server 102 may provide the compliance configuration information handler 228 with an earlier version of the confirmation information 112 so that any erroneous changes to the mobile device can be reversed, including instructing the orchestrator engine 208 to roll back the state of the computing device to the state before the execution of the state machine. For example, before executing the state machine or during the execution of the state machine, the current state of the computing device may be saved (e.g., saving the version of the settings that existed before the execution of the state machine, the affected files, etc.), and by restoring the computing device to the saved state information, the computing device may be reconfigured to the saved state. Alternatively, the computing device may be instructed not to roll back to the previous last known good state so that the fault state may be analyzed in detail. For example, another mode referred to as "developer mode" (or by another label) may be defined in which, in the event of an error, the computing device does not roll back to the last known good state.

[0068] Also, note that if an error is encountered during the execution of the state machine, the compliance agent can attempt to correct the error instead of rolling back to the previous state. For example, Figure 6 A flowchart 600 of a method for requesting correction of an error in configuration information is depicted according to an example embodiment. Figure 1 , Figure 2A and Figure 2B To describe Figure 6 However, based on the following description of flowchart 600 and Figure 1 , Figure 2A and Figure 2B Given the discussion of systems 100, 200, and 230, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0069] Flowchart 600 begins at step 602. In step 602, configuration information is parsed. For example, orchestrator engine 208 can be configured to parse configuration information 112 for one or more configuration settings corresponding to the received error code / error description.

[0070] In step 604, it is determined that a configuration information error is determined. In one embodiment, during parsing, orchestrator engine 208 can determine one or more configuration settings corresponding to the received error code / error description.

[0071] In step 606, a request is made to the server to correct the error. In one embodiment, the compliance agent 240 may transmit error information (eg, error code, error description, event tracking, etc.) to the compliance 122 to request correction of the error.

[0072] For example, continue to refer to Figure 1 , Figure 2A and Figure 2B In the example discussed above where the configuration information 112 is represented by an XML file, the configuration information error checker 210 can parse and validate the XML file, store the URI in a registry location, and if any error is detected, synchronously report the error to the server 102 and request the server 102 to correct the error immediately.

[0073] Note that in response to a request to correct an error, and / or at any other time, the compliance engine 122 can provide updated configuration information to the compliance agent. Figure 7 A flowchart 700 of a method for receiving updated configuration information and / or additional configuration information is depicted according to an example embodiment. Figure 1 , Figure 2A and Figure 2B To describe Figure 7 However, based on the following description of flowchart 700 and Figure 1 , Figure 2Aand Figure 2B Given the discussion of systems 100, 200, and 230, other structural and operational embodiments will be apparent to persons skilled in the relevant art(s).

[0074] like Figure 7 As shown in FIG. 7 , flowchart 700 begins at step 702. In step 702, configuration information is stored in a configuration information data repository. For example, referring to FIG. Figure 2A and Figure 2B , the configuration information 112 is stored in the configuration information data repository 222 .

[0075] In step 704, the stored configuration information is transmitted to the server. In an embodiment, the compliance agent 240 may transmit the configuration 112 to the compliance engine 122 at the server 102 to check for updates for any reason, including due to an error (as described above) and any other reason. For example, the compliance configuration information handler 228 may verify the state (e.g., out-of-date or stale) of the configuration information 112 stored in the configuration information data repository 222. If the handler 228 determines that the configuration information 112 contains an error, is out-of-date, stale, etc., the handler 228 may transmit the configuration information 112 (or a portion thereof) to the server 102.

[0076] In response to sending the configuration information to the server, updated configuration information and / or additional configuration information is received from the server in step 706. Based on the state of the stored configuration information 112 determined by the server 102, the server 102 may provide the updated configuration information and / or additional configuration information to the compliance configuration information handler 228. As such, the compliance configuration information handler 228 may update the configuration information data repository 222 with the updated configuration information and / or additional configuration information.

[0077] Thus, embodiments improve the efficiency of pushing configuration settings to a large number of devices, and maintain tracking of such devices' compliance with requirements based on the configuration settings they have received and implemented.

[0078] Embodiments reduce client / server latency (the delay before the transmission of data begins after an instruction for data transmission) by placing more responsibility on the client device to bring itself to the desired state. Each client device accepts a request from the server to implement configuration settings and returns immediately to the server. The request is processed asynchronously by the client device. When the client device completes the request, it will initiate a session to send an alert to the server, which indicates the success or failure of the client device to implement the configuration settings. Embodiments also reduce network activity between client and server devices by eliminating the need for the server to continuously monitor the state of the client device and maintain the desired device state in a piecemeal manner. In an embodiment, the server provides the desired state (in the form of configuration settings) to each client, and the client is expected to maintain the settings (and if it cannot do so, notify the server without prompting from the server). Embodiments also provide a unified way initiated by the server to configure client devices with settings, rather than requiring service providers (e.g., software and / or hardware providers) to manage the process of their own products.

[0079] III. Example Mobile and Fixed Device Embodiments

[0080] The above system and method (including reference Figure 1-Figure 7The device compliance management embodiments described herein can be implemented in hardware or in combination with one or both of software and / or firmware. For example, compliance engine 122, compliance agent 120, orchestrator engine 208, configuration information error checker 210, compliance agent 220, compliance configuration information handler 228, setting implementation trigger 232, state machine selector 234, state machine execution engine 236, compliance agent 240 and / or each component described herein, as well as flowcharts 300, 400, 500, 600 and 700 can be implemented as computer program code / instructions that are configured to be executed in one or more processors and stored in a computer-readable storage medium. Alternatively, the compliance engine 122, the compliance agent 120, the orchestrator engine 208, the configuration information error checker 210, the compliance agent 220, the compliance configuration information handler 228, the setting implementation trigger 232, the state machine selector 234, the state machine execution engine 236, the compliance agent 240 and / or each component described herein, as well as the flowcharts 300, 400, 500, 600 and 700 may be implemented as hardware logic / circuitry devices. In one embodiment, the compliance engine 122, the compliance agent 120, the orchestrator engine 208, the configuration information error checker 210, the compliance agent 220, the compliance configuration information handler 228, the setting implementation trigger 232, the state machine selector 234, the state machine execution engine 236, the compliance agent 240 and / or each component described herein, as well as the flowcharts 300, 400, 500, 600 and 700 may be implemented in one or more SoCs (systems on a chip). The SoC may include an integrated circuit chip that includes a processor (e.g., a central processing unit (CPU), a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces, and / or one or more additional circuits, and may optionally execute received program code and / or include embedded firmware to perform various functions.

[0081] Furthermore, server 102, computing device(s) 104, computing device 204, and computing device 244 may each be implemented in a variety of device types. For example, Figure 8A block diagram of an exemplary mobile device 800 is shown that includes various optional hardware and software components generally shown as components 802. As known to those skilled in the relevant art, any number and combination of features / elements of compliance engine 122, compliance agent 120, orchestrator engine 208, configuration information error checker 210, compliance agent 220, compliance configuration information handler 228, setting implementation trigger 232, state machine selector 234, state machine execution engine 236, compliance agent 240, and / or flowcharts 300, 400, 500, 600, and 700, as well as additional and / or alternative features / elements, may be implemented as components 802 included in a mobile device embodiment. Note that any of components 802 may communicate with any other of components 802, but not all connections are shown for ease of illustration. The mobile device 800 can be any of the various mobile devices described or mentioned elsewhere herein or otherwise known (e.g., a cellular phone, a smart phone, a handheld computer, a personal digital assistant (PDA), etc.), and can enable wireless two-way communication with one or more mobile devices over one or more communication networks 804 such as a cellular or satellite network or over a local area network or a wide area network.

[0082] The illustrated mobile device 800 may include a controller or processor (referred to as processor circuit 810) for performing tasks such as signal encoding, image processing, data processing, input / output processing, power control, and / or other functions. The processor circuit 810 is an electronic and / or optical circuit implemented as a central processing unit (CPU), a microcontroller, a microprocessor, and / or other physical hardware processor circuit using one or more physical hardware electronic circuit device elements and / or integrated circuit devices (semiconductor material chips or dies). The processor circuit 810 can execute program codes stored in a computer-readable medium, such as one or more applications 814, program codes of an operating system 812, any program codes stored in a memory 820, and the like. The operating system 812 can control the allocation and use of the component 802 and support one or more applications 814 (also referred to as "applications", "apps", etc.). The application 814 can include common mobile computing applications (e.g., email applications, calendars, contact managers, web browsers, messaging applications) and any other computing applications (e.g., word processing applications, mapping applications, media player applications).

[0083] As shown, the mobile device 800 may include a memory 820. The memory 820 may include a non-removable memory 822 and / or a removable memory 824. The non-removable memory 822 may include RAM, ROM, flash memory, a hard disk or other known memory storage technologies. The removable memory 824 may include a flash memory or a subscriber identity module (SIM) card, which is known in the GSM communication system or other known memory storage technologies, such as "smart cards". The memory 820 may be used to store data and / or code for running an operating system 812 and an application 814. Example data may include web pages, texts, images, sound files, video data or other data sets to be sent to and / or received from one or more network servers or other devices via one or more wired or wireless networks. The memory 820 may be used to store subscriber identifiers such as an international mobile subscriber identity (IMSI), and device identifiers such as an international mobile equipment identifier (IMEI). These identifiers may be transmitted to a network server to identify users and devices.

[0084] A plurality of programs may be stored in the memory 820. These programs include an operating system 812, one or more application programs 814, and other program modules and program data. Examples of such application programs or program modules may include, for example, computer program logic (e.g., computer program code or instructions) for implementing the above-described system, including reference Figure 1-Figure 7 Device compliance management embodiments are described.

[0085] The mobile device 800 may support one or more input devices 830 such as a touch screen 832 , a microphone 834 , a camera 836 , a physical keyboard 838 , and / or a trackball 840 , and one or more output devices 850 such as a speaker 852 and a display 854 .

[0086] Other possible output devices (not shown) may include piezoelectric or other tactile output devices. Some devices may provide more than one input / output function. For example, touch screen 832 and display 854 may be combined in a single input / output device. Input device 830 may include a natural user interface (NUI).

[0087] The wireless modem(s) 860 may be coupled to an antenna (not shown) and may support bidirectional communication between the processor circuit 810 and external devices, as is well understood in the art. The modem(s) 860 are shown generally and may include a cellular modem 866 for communicating with the mobile communication network 804 and / or other radio-based modems (e.g., Bluetooth 864 and / or Wi-Fi 862). The cellular modem 866 may be configured to implement telephone calls (and optionally transmit data) according to any appropriate communication standard or technology (such as GSM, 3G, 4G, 5G, etc.). At least one of the wireless modems 860 is typically configured to communicate with one or more cellular networks (such as a GSM network for data and voice communications within a single cellular network, between cellular networks, or between a mobile device and a public switched telephone network (PSTN)).

[0088] The mobile device 800 may further include at least one input / output port 880, a power supply 882, a satellite navigation system receiver 884 such as a global positioning system (GPS) receiver, an accelerometer 886, and / or a physical connector 890 (which may be a USB port), an IEEE 1394 (Firewire) port, and / or an RS-232 port. The illustrated components 802 are not required or all-inclusive, and as those skilled in the art understand, any component may not be present and other components may be present in addition.

[0089] also, Fig. 9 An exemplary implementation of a computing device 900 in which various embodiments may be implemented is depicted, including computing device 104, computing device 204, computing device 244, server 102. The description of computing device 900 provided herein is for illustration only and is not intended to be limiting. Various embodiments may also be implemented in other types of computer systems as known to those skilled in the relevant art.

[0090] like Fig. 9As shown in , the computing device 900 includes one or more processors (referred to as processor circuits 902), a system memory 904, and a bus 906 that couples various system components including the system memory 904 to the processor circuit 902. The processor circuit 902 is an electronic and / or optical circuit implemented as a central processing unit (CPU), a microcontroller, a microprocessor, and / or other physical hardware processor circuits using one or more physical hardware electronic circuit device elements and / or integrated circuit devices (semiconductor material chips or dies). The processor circuit 902 can execute program codes stored in a computer-readable medium, such as operating system 930, application program 932, program code of other programs 934, etc. Bus 906 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or a local bus using any of various bus architectures. The system memory 904 includes a read-only memory (ROM) 908 and a random access memory (RAM) 910. The basic input / output system 912 (BIOS) is stored in ROM 908.

[0091] The computing device 900 also has one or more of the following drives: a hard disk drive 914 for reading and writing a hard disk, a disk drive 916 for reading or writing a removable disk 918, and an optical drive 920 for reading or writing a removable optical disk 98 such as a CD ROM, DVD ROM or other optical media. The hard disk drive 914, the disk drive 916, and the optical drive 920 are connected to the bus 906 via a hard disk drive interface 924, a disk drive interface 926, and an optical drive interface 928, respectively. These drives and their associated computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer. Although a hard disk, a removable disk, and a removable optical disk are described, other types of hardware-based computer-readable storage media such as flash memory cards, digital video disks, RAM, ROM, and other hardware storage media may also be used to store data.

[0092] A plurality of program modules may be stored on a hard disk, a magnetic disk, an optical disk, a ROM, or a RAM. These programs include an operating system 930, one or more application programs 932, other programs 934, and program data 936. The application programs 932 or other programs 934 may include, for example, computer program logic (e.g., computer program code or instructions) for implementing the above-described system, including reference Figure 1-Figure 7 Device compliance management embodiments are described.

[0093] A user may enter commands and information into the computing device 900 through input devices such as a keyboard 938 and a pointing device 940. Other input devices (not shown) may include a microphone, a joystick, a game controller, a satellite dish, a scanner, a touch screen and / or touch pad, a voice identification system for receiving voice input, a gesture identification system for receiving gesture input, and the like. These and other input devices are typically connected to the processor circuit 902 through a serial port interface 942 coupled to the bus 906, but may be connected through other interfaces such as a parallel port, a game port, or a universal serial bus (USB).

[0094] Display screen 944 is also connected to bus 906 via an interface such as video adapter 846. Display screen 944 can be external to or incorporated into computing device 900. Display screen 944 can display information, as well as serve as a user interface for receiving user commands and / or other information (e.g., by touch, finger gestures, virtual keyboard, etc.). In addition to display screen 944, computing device 900 may also include other peripheral output devices (not shown), such as speakers and printers.

[0095] The computing device 900 is connected to a network 948 (e.g., the Internet) through an adapter or network interface 950, a modem 952, or other means for establishing communications over the network. The modem 952, which may be internal or external, may be connected to the bus 906 via the serial port interface 942, such as a serial bus. Fig. 9 , or may be connected to bus 906 using another interface type including a parallel interface.

[0096] As used herein, the terms "computer program medium", "computer-readable medium", and "computer-readable storage medium" are generally used to refer to physical hardware media, such as a hard disk associated with hard disk drive 914, removable magnetic disk 918, removable optical disk 98, other physical hardware media, such as RAM, ROM, flash memory cards, digital video disks, zip disks, MEMs, nano-based storage devices, and other types of physical / tangible hardware storage media (including Fig. 9 The system memory 904 of the present invention. These computer-readable storage media are distinguished from and do not overlap with (not including) communication media. Communication media typically implement computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave. The term "modulated data signal" means a signal that has one or more characteristics set or changed in a manner that encodes information in the signal. By way of example and not limitation, communication media include, for example, acoustic, RF, infrared, and other wireless media, as well as wired media. Embodiments also relate to such communication media.

[0097] As noted above, computer programs and modules (including application programs 932 and other programs 934) can be stored on a hard disk, disk, optical disk, ROM, RAM or other hardware storage medium. Such computer programs can also be received via network interface 950, serial port interface 942 or any other interface type. These computer programs, when executed or loaded by the application, enable the computer 900 to implement the features of the various embodiments discussed herein. Accordingly, these computer programs represent the controller of the computer system 900.

[0098] The embodiments also relate to computer program products including computer codes or instructions stored on any computer readable medium, including hard disk drives, optical disk drives, memory device packages, portable memory sticks, memory cards, and other types of physical storage hardware.

[0099] IV. Additional Exemplary Embodiments

[0100] In one embodiment, a mobile device includes: at least one processor circuit; and at least one memory storing program code, the program code being configured to be executed by the at least one processor circuit, the program code including: a configuration manager configured to: receive configuration information from a server, the configuration information describing compliance settings to be implemented by the mobile device so that the mobile device complies with a configuration scenario, and store the configuration information; and an orchestrator engine configured to: receive a trigger from the configuration manager to implement the compliance settings in the mobile device; identify a state machine indicated by the configuration information, the state machine describing a configuration process for implementing the compliance settings, and execute the state machine to configure the mobile device using the compliance settings.

[0101] In one embodiment of the aforementioned mobile device, the orchestrator engine is further configured to: execute the state machine to determine whether the mobile device is properly configured according to the configuration information.

[0102] In one embodiment of the aforementioned mobile device, the orchestrator engine is further configured to: store the configuration results generated by executing the state machine in a configuration information data repository; and the configuration manager is further configured to: obtain the configuration results from the configuration information data storage and transmit the configuration results to the server.

[0103] In one embodiment of the aforementioned mobile device, the configuration manager is further configured to: parse the configuration information; determine an error in the configuration information; and request the server to correct the error.

[0104] In one embodiment of the aforementioned mobile device, the configuration manager is further configured to: store the configuration information in a configuration information data repository; transmit the stored configuration information to the server; and in response to sending the configuration information to the server, receive updated configuration information and / or additional configuration information from the server.

[0105] In one embodiment of the aforementioned mobile device, the state machine is stored in a state machine data repository on the mobile device.

[0106] In one embodiment of the aforementioned mobile device, the configuration information is received from the server in an extensible markup language (XML) file, wherein the extensible markup language (XML) file includes a payload associated with the compliance setting and a corresponding uniform resource identifier (URI) for downloading and processing the payload.

[0107] In another embodiment, a method includes: receiving configuration information from a server, the configuration information describing compliance settings to be implemented by a mobile device so that the mobile device complies with a configuration scenario; storing the configuration information; receiving a trigger to implement the compliance settings in the mobile device; identifying a state machine indicated by the configuration information, the state machine describing a configuration process for implementing the compliance settings; and executing the state machine to configure the mobile device using the compliance settings.

[0108] In one embodiment, the aforementioned method further comprises: executing the state machine to determine whether the mobile device is properly configured according to the configuration information.

[0109] In one embodiment, the aforementioned method further includes: storing the configuration result generated by executing the state machine in a configuration information data repository; obtaining the configuration result from the configuration information data repository; and transmitting the configuration result to the server.

[0110] In one embodiment, the aforementioned method further includes: parsing the configuration information; determining an error in the configuration information; and requesting the server to correct the error.

[0111] In one embodiment, the aforementioned method also includes: storing the configuration information in a configuration information data repository; transmitting the stored configuration information to the server; and in response to sending the configuration information to the server, receiving updated configuration information and / or additional configuration information from the server.

[0112] In one embodiment of the foregoing method, the state machine is stored in a state machine data repository on the mobile device.

[0113] In one embodiment of the foregoing method, the configuration information is received from the server in an extensible markup language (XML) file, wherein the extensible markup language (XML) file includes a payload associated with the compliance setting and a corresponding uniform resource identifier (URI) for downloading and processing the payload.

[0114] In another embodiment, a computer-readable storage medium has program instructions recorded thereon, and when the program instructions are executed by at least one processing circuit of a mobile device, a method is performed, the method comprising: receiving configuration information from a server, the configuration information describing compliance settings to be implemented by a mobile device so that the mobile device complies with a configuration scenario; storing the configuration information; receiving a trigger to implement the compliance settings in the mobile device; identifying a state machine indicated by the configuration information, the state machine describing a configuration process for implementing the compliance settings; and executing the state machine to configure the mobile device using the compliance settings.

[0115] In one embodiment of the aforementioned method, it includes: executing the state machine to determine whether the mobile device is properly configured according to the configuration information.

[0116] In one embodiment of the aforementioned method, the method further includes: storing a configuration result generated by executing the state machine in a configuration information data repository; obtaining the configuration result from the configuration information data repository; and transmitting the configuration result to the server.

[0117] In one embodiment of the aforementioned method, it includes: parsing the configuration information; determining an error in the configuration information; and requesting the server to correct the error.

[0118] In one embodiment of the aforementioned method, it includes: storing the configuration information in a configuration information data repository; transmitting the stored configuration information to the server; and in response to sending the configuration information to the server, receiving updated configuration information and / or additional configuration information from the server.

[0119] In one embodiment of the foregoing method, the configuration information is received from the server in an extensible markup language (XML) file, wherein the extensible markup language (XML) file includes a payload associated with the compliance setting and a corresponding uniform resource identifier (URI) for downloading and processing the payload.

[0120] V. Conclusion

[0121] Although various embodiments have been described above, it should be understood that they are given by way of example only and not limitation. It will be apparent to those skilled in the relevant art that various changes may be made in form and detail without departing from the spirit and scope of the embodiments. Therefore, the breadth and scope of the embodiments should not be limited by any of the above exemplary embodiments, but should only be limited according to the appended claims and their equivalents.

Claims

1. A computing device, comprising: at least one processor circuit; as well as At least one memory storing program code, wherein the program code is configured to be executed by the at least one processor circuit, wherein the program code is configured to perform operations, wherein the operations include: receiving an indication that a user is logging into the computing device for the first time; receiving configuration information from a server, the configuration information including an assignment of a user-device pairing maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the computing device, the configuration information also including a compliance setting configured to adjust the computing device to comply with a configuration scenario; determining an error in the received configuration information; transmitting to the server a request for correcting the error; receiving updated configuration information from the server; configuring the computing device with the updated configuration information; Identifying a state machine indicated by the updated configuration information, the state machine describing a configuration process for implementing compliant settings of the updated configuration information; and determining whether the computing device is configured according to the updated configuration information by executing the state machine.

2. The computing device of claim 1 , wherein the program code is further configured to perform operations comprising: storing the configuration results generated by executing the state machine in a configuration information data repository; Obtaining the configuration result from the configuration information data repository; as well as The configuration result is transmitted to the server.

3. The computing device of claim 1 , wherein the updated configuration information includes a first compliance setting and a second compliance setting and an indication of a state machine of a configuration process configured to implement the compliance setting of the updated configuration scenario, and the program code is further configured to perform operations comprising: identifying the state machine indicated by the updated configuration information, the state machine being configured to specify an order in which the compliance settings and payloads are implemented, the compliance settings comprising the first compliance setting and the second compliance setting, and The computing device is configured with the compliant settings of the updated configuration information according to the sequence by executing the state machine.

4. A computing device according to claim 1, wherein the configuration information is received from the server in an extensible markup language (XML) file, the extensible markup language (XML) file including a payload associated with the compliance setting and a corresponding uniform resource identifier (URI) for downloading and processing the payload.

5. The computing device of claim 1 , wherein the program code is further configured to perform operations comprising: Determining whether the computing device continues to follow the configuration scenario upon detecting a triggering event, the triggering event comprising one of the following: the expiry of a predetermined period of time, or A request from an administrator, auditor, and / or entity that determines whether the computing device is in compliance.

6. The computing device of claim 1, wherein the pairings of the user and the computing device are stored in a table at the server, wherein each entry in the table specifies a user-device pair and a corresponding configuration setting implemented by the user-device pair.

7. The computing device of claim 1 , wherein the received configuration information is in an XML file and the determining an error in the received configuration information comprises: Parsing the XML file; Validate the XML file; as well as Reports an error to the server.

8. A method implemented in a computing device, comprising: receiving an indication that a user is logging into the computing device for the first time; receiving configuration information from a server, the configuration information including an assignment of a user-device pairing maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the computing device, the configuration information also including a compliance setting configured to adjust the computing device to comply with a configuration scenario; determining an error in the received configuration information; transmitting to the server a request for correcting the error; receiving updated configuration information from the server; configuring the computing device with the updated configuration information; identifying a state machine indicated by the updated configuration information, the state machine describing a configuration process for implementing the compliant settings of the updated configuration information; as well as By executing the state machine, it is determined whether the computing device is configured according to the updated configuration information.

9. The method according to claim 8, further comprising: storing the configuration results generated by executing the state machine in a configuration information data repository; Obtaining the configuration result from the configuration information data repository; as well as The configuration result is transmitted to the server.

10. The method of claim 8, wherein the updated configuration information includes a first compliance setting and a second compliance setting and an indication of a state machine of a configuration process configured to implement the compliance setting of the updated configuration scenario, the method further comprising: identifying the state machine indicated by the updated configuration information, the state machine being configured to specify an order in which the compliance settings and payloads are implemented, the compliance settings comprising the first compliance setting and the second compliance setting, and The computing device is configured with the compliant settings of the updated configuration information according to the sequence by executing the state machine.

11. The method of claim 8, wherein the configuration information is received from the server in an Extensible Markup Language (XML) file, the Extensible Markup Language (XML) file comprising a payload associated with the compliance setting and a corresponding Uniform Resource Identifier (URI) for downloading and processing the payload.

12. The method according to claim 8, wherein the method further comprises: Determining whether the computing device continues to follow the configuration scenario upon detecting a triggering event, the triggering event comprising one of the following: the expiry of a predetermined period of time, or A request from an administrator, auditor, and / or entity that determines whether the computing device is in compliance.

13. The method of claim 8, wherein the pairings of the users and the computing devices are stored in a table at the server, wherein each entry in the table specifies a user-device pair and a corresponding configuration setting implemented by the user-device pair.

14. The method of claim 8, wherein the received configuration information is in an XML file and the determining errors in the received configuration information comprises: Parsing the XML file; Validate the XML file; as well as Reports an error to the server.

15. A computer-readable storage medium having program instructions recorded thereon, wherein the program instructions, when executed by at least one processing circuit of a computing device, perform a method in the computing device, the method comprising: receiving an indication that a user is logging into the computing device for the first time; receiving configuration information from a server, the configuration information including an assignment of a user-device pairing maintained at the server in a configuration reference, the user-device pairing corresponding to the user and the computing device, the configuration information also including a compliance setting configured to adjust the computing device to comply with a configuration scenario; determining an error in the received configuration information; transmitting to the server a request for correcting the error; receiving updated configuration information from the server; configuring the computing device with compliant settings of the updated configuration information, in order; identifying a state machine indicated by the updated configuration information, the state machine describing a configuration process for implementing the compliant settings of the updated configuration information; as well as By executing the state machine, it is determined whether the computing device is configured according to the updated configuration information.

16. The computer-readable storage medium of claim 15, wherein the method further comprises: storing the configuration results generated by executing the state machine in a configuration information data repository; Obtaining the configuration result from the configuration information data repository; as well as The configuration result is transmitted to the server.

17. The computer-readable storage medium of claim 15, wherein the updated configuration information includes a first compliance setting and a second compliance setting and an indication of a state machine of a configuration process configured to implement the compliance setting of the updated configuration scenario, and wherein the method further comprises: identifying the state machine indicated by the updated configuration information, the state machine being configured to specify an order in which the compliance settings and payloads are implemented, the compliance settings comprising the first compliance setting and the second compliance setting, and The computing device is configured with the compliant settings of the updated configuration information according to the sequence by executing the state machine.

18. A computer-readable storage medium according to claim 15, wherein the configuration information is received from the server in an extensible markup language (XML) file, the extensible markup language (XML) file including a payload associated with the compliance setting and a corresponding uniform resource identifier (URI) for downloading and processing the payload.

19. The computer-readable storage medium of claim 15, wherein the method further comprises: Determining whether the computing device continues to follow the configuration scenario upon detecting a triggering event, the triggering event comprising one of the following: the expiry of a predetermined period of time, or A request from an administrator, auditor, and / or entity that determines whether the computing device is in compliance.

20. The computer-readable storage medium of claim 15, wherein the pairings of the users and the computing devices are stored in a table at the server, wherein each entry in the table specifies a user-device pair and a corresponding configuration setting implemented by the user-device pair.

Images