Automatic on by managed mobile VPN only

Abstract

A technique for automatically opening a VPN in a MAM environment is disclosed. A MAM-controlled App is launched on a computer system. A policy is consulted, and a determination of whether to automatically open a VPN application is made based on the policy. Based on the policy, the VPN application is automatically opened, and the VPN application initiates a VPN tunnel that can be used by at least the MAM-controlled App. Then, network communications transmitted to or from the MAM-controlled App pass through the VPN tunnel.

Description

Background Technology

[0001] A Virtual Private Network (VPN) is a type of service that protects communications transmitted over a network connection. Specifically, a VPN provides an encrypted tunnel through which data packets can be transmitted from one point to another. When a client device uses a VPN to connect to an endpoint over the internet, the VPN connection helps protect the user's data, allowing the user to interact with data in a private and secure manner. VPNs can also be used to hide a user's IP address and even their physical address. Furthermore, by encrypting data packets transmitted through the VPN, these packets can be protected from attacks by potential malicious actors. Therefore, many businesses want users to use VPNs, especially when these users are interacting with the business's data. Consequently, the technology for utilizing VPNs needs to be improved.

[0002] The subject matter claimed in this disclosure is not limited to addressing any shortcomings or to embodiments that operate only in environments such as those described above. Rather, this background is provided merely to illustrate an exemplary technical field in which some of the embodiments described in this disclosure can be implemented. Summary of the Invention

[0003] Embodiments of this disclosure relate to a system, device (e.g., wearable device, hardware storage device, etc.) and method for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment operating on a computer system.

[0004] Some embodiments determine that an app controlled by the MAM is launching on a client device. After determining that the app controlled by the MAM is launching, the embodiment queries a policy and determines whether to trigger a VPN application based on the policy. Based on a policy indicating that the VPN application will be triggered after or simultaneously with the launch of the app controlled by the MAM, the embodiment automatically triggers the VPN application, which initiates a VPN tunnel that can be used at least by the app controlled by the MAM. This embodiment also causes network communication transmitted to or from the app controlled by the MAM to pass through the VPN tunnel. Optionally, some embodiments cause the VPN application to terminate the VPN tunnel at a certain time after the application automatically launches.

[0005] Some embodiments determine that a MAM-controlled app is launching on a client device. After determining that the MAM-controlled app is launching, this embodiment queries a policy and determines that the policy indicates that the VPN application will automatically initiate a VPN tunnel after or simultaneously with the MAM-controlled app's user interface (UI) being brought to the foreground on the computer system. In response to the indication that the MAM-controlled app's UI is currently or will subsequently be brought to the foreground, this embodiment causes the VPN application to initiate a VPN tunnel that can be used at least by the MAM-controlled app. Furthermore, this embodiment causes network communication transmitted to or from the MAM-controlled app to pass through the VPN tunnel provided by the VPN application.

[0006] This invention aims to present, in a simplified form, the concept choices further described below in the detailed embodiments. This invention is not intended to identify key or essential features that characterize the subject matter of the claims, nor is it intended as an aid in determining the scope of the claims.

[0007] Additional features and advantages will be set forth in the description which follows, and some features and advantages will be apparent from the description or may be learned by practicing the teachings of this disclosure. The features and advantages of the invention can be realized and obtained by means of the tools and combinations particularly pointed out in the appended claims. The features of the invention will become more apparent from the description and appended claims, or may be learned by practicing the invention as described below. Attached Figure Description

[0008] To describe how the above and other advantages and features can be obtained, the subject matter briefly described above will be described in more detail with reference to specific embodiments illustrated in the accompanying drawings. It is understood that these drawings depict only typical embodiments and are therefore not intended to limit the scope; the embodiments will be described and illustrated in more detail using the accompanying drawings, in which:

[0009] Figure 1 An example of a "Bring Your Own Device (BYOD)" architecture is shown.

[0010] Figure 2 The differences between the Mobile Device Management (MDM) environment and the Mobile Application Management (MAM) environment are illustrated.

[0011] Figure 3 The use of a Virtual Private Network (VPN) is illustrated, which can be used to connect one device or endpoint to another device or endpoint.

[0012] Figure 4 The difference between "micro VPN app" and "VPN app" is shown.

[0013] Figure 5This demonstrates how VPN applications are typically triggered automatically in an MDM environment; however, VPN applications are not typically triggered or enabled automatically in a MAM environment.

[0014] Figure 6 This demonstrates an example implementation of how VPN applications are automatically triggered in a MAM environment based on the disclosed principles.

[0015] Figure 7 This illustrates another scenario where VPN applications are automatically triggered in a MAM environment.

[0016] Figure 8 Example conditions that can trigger the VPN application to start automatically are shown.

[0017] Figure 9 A flowchart is shown as an example method for automatically enabling VPN applications in a MAM environment.

[0018] Figure 10 Another flowchart is shown as an example method for automatically enabling a VPN in a MAM environment.

[0019] Figure 11 An example of a computer system configured to perform any of the disclosed operations is shown. Detailed Implementation

[0020] Embodiments of this disclosure relate to a system, device (e.g., wearable device, hardware storage device, etc.) and method for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment operating on a computer system. As used in this disclosure, the term "startup" can refer to a scenario where an application has begun operation or, optionally, a specific component of the application has begun operation, such as a user interface (UI) being brought to the foreground on a client device or a VPN already in operation. "Startup" can also refer to a scenario where an application resumes foreground operation from a previously paused or background state, such as when an application UI was previously in the background but is now brought to the foreground (e.g., perhaps a user navigated out of the application without it being terminated, and is now returning to the application). The term "auto-startup" (and variations thereof) refers to a scenario where a VPN application automatically (i.e., without user input) starts up and is automatically triggered to establish a VPN tunnel for connections to MAM-controlled apps, where auto-startup is facilitated by a policy. With "auto-startup" of the VPN application, the user does not need to manually launch the VPN application; furthermore, the VPN application may not need to display a foreground UI to the user. Instead, the VPN application can be automatically started and can run in the background.

[0021] Some embodiments determine that an app controlled by the MAM is launching on a client device. After determining that the app controlled by the MAM is launching, the embodiment queries a policy and determines whether to trigger a VPN application based on the policy. Based on a policy indicating that the VPN application will be triggered after or simultaneously with the launch of the app controlled by the MAM, the embodiment automatically triggers the VPN application, which initiates a VPN tunnel that can be used at least by the app controlled by the MAM. This embodiment also causes network communication transmitted to or from the app controlled by the MAM to pass through the VPN tunnel. Optionally, some embodiments cause the VPN application to terminate the VPN tunnel at a certain time after the application automatically launches.

[0022] Some embodiments determine that a MAM-controlled app is launching on a client device. After determining that the MAM-controlled app is launching, this embodiment queries a policy and determines that the policy indicates that the VPN application will automatically initiate a VPN tunnel after or simultaneously with the MAM-controlled app's user interface (UI) being brought to the foreground on the computer system. In response to the indication that the MAM-controlled app's UI is currently or will subsequently be brought to the foreground, this embodiment causes the VPN application to initiate a VPN tunnel that can be used at least by the MAM-controlled app. Furthermore, this embodiment causes network communication transmitted to or from the MAM-controlled app to pass through the VPN tunnel provided by the VPN application.

[0023] Examples of technological advantages, improvements, and practical applications

[0024] The following sections outline some exemplary improvements and practical applications provided by the disclosed embodiments. However, it is understood that these are merely examples, and the embodiments are not limited to these improvements.

[0025] The disclosed embodiments bring numerous substantial benefits to the art. For example, by enabling the VPN to be automatically enabled in a MAM environment, this embodiment directly and significantly improves the user experience when using client devices hosted in a MAM environment. For instance, by following the disclosed principles, users no longer need to manually enable the VPN. Furthermore, users and IT administrators can be confident that the VPN is protecting corporate data. In this sense, an automatically enabled VPN provides stronger data protection for corporate data.

[0026] This embodiment also improves the low-level operation of the computer system. For example, this embodiment can automatically and intelligently turn the VPN on and off when it is in use. Through this intelligence, this embodiment helps to maximize or at least improve the device's battery life, because the VPN is used only when needed, rather than always being on. In a similar manner, the embodiment improves memory usage through the ability to intelligently turn the VPN on and off. These advantages, and many other advantages, will be described in detail in the remainder of this disclosure.

[0027] BYOD architecture

[0028] Now let's turn our attention to... Figure 1 , Figure 1 An example of a "Bring Your Own Device" (BYOD) architecture 100 is shown. For example, the BYOD architecture 100 includes client devices 105, such as employees' own personal devices (e.g., smartphones, tablets, laptops, etc.), and an enterprise environment 110 (e.g., the network infrastructure of an organization). Device 105 can be connected to the enterprise environment 110 via any type of network 115, such as the Internet, a local area network (LAN), or some other type of wide area network (WAN).

[0029] exist Figure 1 In this context, enterprise environment 110 is shown as comprising a perimeter network 120 and an intranet 125. The perimeter network 120 may contain any number of servers, such as relay servers 130. Relay servers 130 can potentially be used to select internal servers to receive and process requests, similar to a load balancer. Intranet 125 is shown as containing any number of servers, such as server 135. For example, a request can be received by relay server 130. Relay server 130 can then determine which server within the intranet 125 portion of enterprise environment 110 is available to process and handle the request.

[0030] In some cases, firewall 140 may be logically positioned in front of enterprise environment 110 to protect enterprise environment 110 from various types of incoming traffic. Similarly, intermediate firewall 145 may be positioned between perimeter network 120 and intranet 125 to provide additional protection for internal servers within intranet 125.

[0031] This architecture allows businesses to allow users / employees to handle business-related tasks using their own personal devices. The BYOD (Bring Your Own Device) architecture trend is growing due to the convenience it offers employees. Organizations are also increasingly focused on ensuring data security when employees use personal devices. To provide these safeguards, various architectures have been developed. These include MDM (Multi-Device Management) and MAM (Multi-Device Management) environments, as described below.

[0032] MDM and MAM environments

[0033] As mentioned above, there are different technologies for securing and controlling enterprise data within a BYOD architecture. One such technology is called "Mobile Device Management" or "MDM," while another is called "Mobile Application Management" or "MAM." Figure 2 The differences between the two technologies are shown.

[0034] Figure 2 The diagram illustrates devices controlled by an MDM 200 and a MAM 205. Typically, MDM 200 is a management technology used by enterprises to control user devices. User devices are typically configured to include various on-device applications and / or configurations, policies, tokens, backend infrastructure, and / or certificates designed to allow enterprises (e.g., IT departments) to control user devices in specific ways, such as by limiting the operations that the device can perform on or access to enterprise data. MDM 200 allows policies to be implemented on the device via over-the-air downloads of data, applications, configurations, etc. Typically, MDM 200 can control the entire device, such as... Figure 2 As shown, this is a "prison fence" covering the entire device. In this respect, MDM 200 allows enterprise IT administrators to control, guarantee, and enforce policies on user devices.

[0035] With MDM 200, typically a client agent is installed on the user's device. The enterprise system comprises a server and a server agent. Policies are configured via the server, and then the server agent pushes or transmits the policies to agents on the device. Agents are configured to implement the policies by communicating with various application programming interfaces (APIs) and the operating system (OS) of the device. The agents then control the entire device.

[0036] On the other hand, the MAM 205 focuses on finer-grained or sophisticated control. That is, unlike the MDM 200, which effectively controls the entire device, the MAM 205 controls specific applications mounted on the device. In other words, each application can contain an embedded MAM component that then implements policies and operates to control that specific application.

[0037] As an example, MAM 205 can control controlled App 210 (e.g., an email application used to access corporate data), but can restrict control over App 215, which could be a game application installed on a user's device. Controlled App 210 may have an embedded MAM component for implementing corporate policies, while App 215 may not have an embedded MAM component.

[0038] In this sense, MAM 205 can be used to control specific software or applications installed on a user's device, but not the entire device. Furthermore, the MAM environment operates to restrict the App 220 controlled by the MAM (e.g., controlled App 210), but avoids restricting other applications installed on the client device (such as App 215).

[0039] Virtual Private Network

[0040] Enterprises typically want users to use Virtual Private Networks (VPNs) when interacting with their data. That is, regardless of whether the user's device is in an MDM or MAM environment, enterprises generally prefer to use a VPN. Typically, a VPN establishes a private network (e.g., a tunnel) over a public network. A VPN allows users to send and receive data using this VPN tunnel, as if their devices were directly connected to a specific endpoint, rather than through a public network (e.g., the Internet). Figure 3 It is illustrative.

[0041] Figure 3 The diagram shows a computer system 305 (e.g., possibly a client device, such as...). Figure 2 The example architecture 300 includes those shown and an access point (AP) 310 (e.g., possibly a router). Architecture 300 also includes a network 315, such as the public internet or some other wide area network. The embodiment is capable of initiating a VPN tunnel 320 over the network, enabling computer system 305 to connect to another AP 325 and computer system 330, such as possibly an enterprise server. The VPN tunnel 320 provides a secure path for the transmission of data packets between the two computer systems 305 and 330.

[0042] Figure 4 Some different VPN implementations are illustrated. In one case, App A may include a so-called microVPN application 400, which is configured to initiate a VPN tunnel 405 so that network communications (e.g., network communications 410) can be transmitted only to or from App A to the server 415. Note that the microVPN application 400 is an embedded component or part of App A.

[0043] It is important to note that the microVPN application 400 is limited to transmitting communication only for application A and not for any other application. That is, if the device contains application B, application B will not be able to use the VPN tunnel 405 provided by the microVPN application 400. Instead, application B will have to use a different VPN tunnel. Therefore, as used in this disclosure, the phrase "microVPN application" refers to a VPN service that provides a dedicated tunnel VPN for a single application (e.g., application A).

[0044] In another scenario, a VPN application 420 (which differs from a “micro VPN application”) can be provided to enable multiple different applications to use the same VPN tunnel 425. Note that the VPN application 420 is a standalone application and is not necessarily an embedded part or component of the underlying application.

[0045] Figure 4 Three different applications (Application B, Application C, and Application D) are illustrated, each using the same VPN tunnel 425 to send and receive communications. For illustration, Application B is sending or receiving App B network communications 430; Application C is sending or receiving App C network communications 435; and Application D is sending or receiving App D network communications 440 to or from server 445. Therefore, compared to the VPN tunnel 405 provided by microVPN application 400, the VPN tunnel 425 provided by VPN application 420 can be used by multiple different applications and is not dedicated to a single application.

[0046] Because MDM has control over the entire device, the ability to automatically start, launch, trigger, or initiate VPN applications is traditionally available in an MDM environment. For example, MDM can monitor when an application starts. MDM can consult policies to determine whether a VPN should be used for that application. Based on that policy, MDM can automatically initiate a VPN for the application to use. These operations are available because MDM typically has control over the entire device, including all applications on that device. In some cases, the MDM agent may not actually monitor application startup; instead, the MDM agent can only configure the OS using APIs provided by the OS (e.g., APIs available only to agents with full device MDM privileges) with commands such as "keep VPN running" or "automatically start VPN when this application starts." The execution of these commands can be done at the OS level.

[0047] However, this is not the case in a MAM environment. Recall that in a MAM environment, control is only exercised at the application level with lower privileges. Although MAMs have the ability to control the operation of specific applications, traditionally, MAMs cannot "reach" and control these applications in the same way that MDMs control other applications (such as VPN applications). Therefore, traditional MAM systems do not include the ability to automatically launch VPN applications in response to the launch of another application.

[0048] It should also be noted how microVPN applications have traditionally started automatically in MDM or MAM environments. This is because microVPN applications are embedded parts or components of an application. When the underlying application starts, the microVPN application also starts, regardless of whether the application is controlled by an MDM or a MAM. As previously stated, this disclosure explicitly states that a "microVPN application" is distinct from a "VPN application." Therefore, VPN applications traditionally cannot be automatically started, launched, triggered, or initiated in a MAM environment. Figure 5 Further details were provided.

[0049] Figure 5 Two scenarios are illustrated, one involving a traditional MDM environment and the other involving a traditional MAM environment. Specifically, Figure 5 A device with an MDM environment 500 is shown. Because the MDM environment 500 can control the entire device (including any applications installed on it), the MDM environment 500 can automatically start the VPN application 510, which can then use the server 520 to initiate a VPN tunnel 515. For example, when the device is used to interact with enterprise data, the MDM environment 500 can automatically trigger or start the VPN application 510.

[0050] Traditionally, this is not the case in a MAM environment 525. That is, while a client-side MAM agent embedded in an application can control that specific application, the MAM agent lacks the ability to control or even trigger the launch of another application, such as a VPN application 530; instead, users traditionally must manually trigger or start the VPN application 530 and then initiate a VPN tunnel 535 to the server 540. Using these traditional techniques, users need to perform additional work, increasing their frustration and burden. Furthermore, IT administrators often feel frustrated and worried that users might not be able to secure enterprise data due to the lack of VPN usage. Therefore, an improved technology is needed to automatically start, trigger, launch, or initiate VPN applications in a MAM environment, allowing the VPN application to provide VPN tunnels for one or potentially multiple MAM-controlled apps.

[0051] In other words, popular mobile device platforms provide an ability for applications to establish VPN connections, which (with end-user consent) will be used to tunnel traffic from other applications on the device. When MDM is in use, the administrator of the MDM solution can configure the device to automatically enable VPN applications. In contrast, traditionally, device platforms do not have such automatic enabling configurations when MAM is only in use and not for device management. Nevertheless, administrators of MAM deployments still want to be able to automatically enable VPN applications when managing application usage.

[0052] Automatically enable VPN application in MAM environment

[0053] Based on the disclosed principles, a software library can be embedded in a MAM-controlled app or an MAM-managed application. This library can be configured to automatically enable (i.e., "auto-enable") a separate external (relative to the MAM-controlled app) VPN application (i.e., a non-micro VPN application) based on certain administrator configuration settings or "policies," without explicit operation from the device platform or even the MAM-controlled app logic. For example, a MAM-controlled app can embed a software library or a third-party development tool "SDK" created by the MAM vendor. The SDK can be configured to use standard mechanisms provided by the device platform (e.g., the operating system) to run code when the MAM-controlled app is launched.

[0054] When a MAM-controlled app is launched, the SDK code is also launched (as a result of the MAM-controlled app being embedded). The SDK code then looks up certain policies provided by the administrator; these policies may be cached locally or retrieved via the internet in a standard manner. If the policy indicates otherwise, the SDK can then trigger the launch of a VPN application, which can then create a VPN tunnel. Triggering the launch of the VPN application can be done by the SDK sending a message to the device's OS using standard platform-provided IPC mechanisms (e.g., the internet on the Android platform).

[0055] Upon receiving this message, the VPN application can then establish a connection to the associated remote server and configure the VPN tunnel interface using the platform-defined method. Then, network traffic from MAM-controlled apps can flow through the VPN tunnel without human users needing to manually launch the VPN application, and developers of MAM-controlled apps do not need to write code for this. With the above introduction, now let's look at... Figure 6 .

[0056] Figure 6 This demonstrates an example implementation for automatically enabling VPN applications in a MAM environment. Specifically, Figure 6 A representative client device 600, representing the client devices described to date, is shown. Client device 600 includes an operating system (OS) 605 and an App 610 controlled by a MAM, such as from... Figure 2 App 210 is under control.

[0057] In some example scenarios, the MAM-controlled App 610 is configured to include a MAM component 615, which is used to control the operations of the MAM-controlled App 610 as described above (e.g., implementing enterprise policies). The MAM component 615 may be equipped or configured to include a third-party development tool SDK (aka library) 620. In some cases, the MAM component 615 and the SDK 620 are identical. Accordingly, in some embodiments, the MAM-controlled App 610 includes the MAM component 615, which limits or restricts the operations of the MAM-controlled App based on enterprise policies according to MAM principles. As an example of such restriction, the policy may require the MAM-controlled App to use only a VPN when interacting with enterprise data. As another example of restriction, the policy may require the MAM-controlled App to perform a certain level of user authentication.

[0058] As previously mentioned, the policy is used to control the operation of App 610, which is controlled by MAM. SDK 620 can be configured to acquire and implement this policy, which includes a policy specifying that a VPN tunnel should be used.

[0059] In one example technology, SDK 620 can communicate with storage 625 of client device 600 via message 630. Storage 625 may cache or otherwise store policy 635, which may have been received by client device 600 at some previous time. In this sense, SDK 620 can query a local repository to retrieve policy 635.

[0060] In another example, SDK 620 can communicate with server 645 via network 640 to gain access to remote storage 650, which can retain policy 650A. In this sense, SDK 620 can obtain policy 650A from a remote location.

[0061] Regardless of how SDK 620 obtains policies 635 and 650A, SDK 620 uses these policies to perform multiple operations. For example, the policy can specify whether a VPN tunnel should be initiated when the MAM-controlled App 610 is in use, or when the user interface (UI) of the MAM-controlled App 610 is brought to the foreground of the client device 600. In practice, the policy can specify that a VPN tunnel should be initiated based on any number of specified conditions or criteria, which will be described in more detail later.

[0062] Because SDK 620 is part of MAM-controlled App 610 (i.e., SDK 620 is embedded in MAM-controlled App 610), SDK 620 will start when MAM-controlled App 610 starts. SDK 620 can then communicate with OS 605 to determine various states of MAM-controlled App 610, such as when the UI of MAM-controlled App 610 will be surfaced (i.e. brought to the foreground on the client device display).

[0063] Because SDK 620 now has a policy that can describe whether the VPN application 655 will be launched based on various criteria (e.g., perhaps the UI is brought to the foreground), SDK 620 can trigger the automatic launch 660 (also known as launch 660A) of the VPN application 655 when the criteria or conditions are met or will be met within a predetermined upcoming time period. Further details about this automatic launch will be provided later.

[0064] The policy can specify any type of condition or criterion to trigger the automatic startup of the VPN application. As mentioned above, an example condition could be when the UI of the MAM-controlled app is brought to the foreground. Another example condition could be a scenario where the MAM-controlled app is sending or receiving network communication. Yet another example condition could be a scenario where the client device has its Wi-Fi function enabled. Therefore, the policy can specify any type of condition or criterion. When the condition or criterion is met, the SDK can automatically start the VPN application.

[0065] SDK 620 enables VPN application 655 to automatically start 660, so VPN application 655 can then initiate a potential VPN tunnel 665 to server 645, through which network communication 670 from or to MAM-controlled App 610 can pass. The process of automatically triggering VPN application 655 and initiating VPN tunnel 665 can be performed using standard platform-provided inter-process communication (IPC), such as through communication with OS 605 or possibly by intercepting communication related to OS 605. Furthermore, VPN tunnel 665 can be used by other MAM-controlled Apps running on client device 600.

[0066] In this regard, even if client device 600 is hosting or contains a MAM environment, VPN application 655 can be automatically triggered or enabled as a result of the policy implemented by SDK 620. In other words, VPN application 655 initiates VPN tunnel 665 independently of the logic executed for operating App 610 controlled by MAM. That is, once VPN application 655 is triggered by SDK 620, VPN application 655 can operate independently of SDK 620 to initiate VPN tunnel 665. Further details regarding this automatic enabling process will also be provided.

[0067] Therefore, in some embodiments, a library (e.g., an SDK) integrated with a MAM-controlled app can be configured to communicate with the operating system of the client device. Based on this communication with the operating system, the library can determine when the user interface (UI) of the MAM-controlled app will subsequently be brought to the foreground on the client device or when certain other specific conditions occur. To this end, the library can interact with the OS to determine when the UI will be brought to the foreground, is currently being brought to the foreground, or has already been brought to the foreground. The library triggers a VPN application to initiate a VPN tunnel in response to (i) a determination that the UI will subsequently be brought to the foreground within a defined time period, (ii) a determination that the UI is currently being brought to the foreground, or (iii) a determination that the UI has already been brought to the foreground. If the UI has already been brought to the foreground, the library can be configured to trigger the VPN application within a defined time period after the UI has been brought to the foreground (i.e., brought to the foreground). This time period can be set to any time period.

[0068] Previously, microVPN applications were mentioned. Traditionally, microVPN applications can be automatically started when the underlying application (i.e., the application embedded in the microVPN application) starts. However, it is worth noting that microVPN applications (or simply "microVPNs") are often less than ideal because they require embedding VPN protocols and network blocking logic into the underlying application, and because of the lack of shared connectivity between multiple applications. On the other hand, the disclosed embodiments can automatically start a VPN application configured to host multiple connections for multiple different applications.

[0069] In this regard, VPN applications can utilize the platform VPN framework and can be used with or without device management. Furthermore, using a VPN application avoids the drawbacks of using a microVPN. Therefore, the disclosed embodiments can automatically enable the VPN application in a MAM environment. These principles differ from automatically enabling a microVPN (in an MDM or MAM environment) and also from automatically enabling a VPN application in an MDM environment. In this sense, the disclosed principles provide an application layer manager (i.e., SDK) that can leverage the native operating system and platform VPN functionality to automatically enable and manage shared VPN tunnels. The VPN application initiating the shared VPN tunnel can be automatically triggered or initiated based on enterprise policies. Furthermore, the VPN application allows multiple MAM-controlled apps to use the same VPN tunnel. Moreover, if the VPN application is already running, management does not actually need to do anything to connect a second MAM-controlled app to the VPN tunnel. Instead, this connection can occur automatically through OS mechanisms, as the VPN application is a dedicated VPN application that uses platform mechanisms to tell the OS that it is providing VPN functionality.

[0070] Figure 7 Another scenario is illustrated, where policies can be obtained to determine when and how to automatically enable VPN applications in a MAM environment. Specifically, Figure 7 The diagram shows a client device 700, a MAM-controlled App 705, and an SDK 710, all included as part of a MAM-controlled App 705. Meanwhile... Figure 6 In this context, MAM component 615 is part of App 610, which is controlled by MAM. Figure 7 This illustrates a scenario where MAM component 715 is not part of an MAM-controlled App 705, but rather a separate component operating on client device 700. In this scenario, MAM component 715 can operate as a central control component on client device 700 and can potentially control multiple MAM-controlled Apps. Figure 6 The MAM component 615 controls only one MAM-controlled App 610. That said, the MAM component 715 still does not have complete control over the client device 700; instead, the MAM component 715 has limited control because it can only control a specified application. Therefore, in some embodiments, the client device includes a MAM component that limits or restricts the operation of the MAM-controlled App.

[0071] The aforementioned SDK is configured to communicate with the OS to determine when the UI of a MAM-controlled app is about to be brought to the foreground or brought to the foreground. The SDK can also determine whether the UI has already been brought to the foreground or is currently being brought to the foreground. Such scenarios could be triggers for automatically starting VPN applications. Figure 8 It is illustrative.

[0072] Figure 8 An example of UI 800 initially located in the background (805) of the client device is shown. UI 800 is the UI of the MAM-controlled application. The aforementioned SDK is able to communicate with the client device's OS to determine when UI 800 transitions from the background (805) to the foreground (810). In some cases, the SDK can determine the time period (815) during which UI 800 transitions based on communication with the OS. In this regard, the SDK can determine whether UI 800 is currently transitioning to the foreground (810) and / or can determine the upcoming time period during which UI 800 will subsequently transition. The SDK can also determine whether UI 800 has already transitioned to the foreground (810).

[0073] Before, during, or after UI 800 transitions to the foreground 810, the SDK can implement policies that, when implemented, cause the VPN application to be automatically activated or launched, as shown in Auto-Start 820. In other words, the SDK can optionally communicate with the OS to trigger the automatic launch of the VPN application.

[0074] Similarly, when the UI transitions from the foreground (825) to the background (830), the SDK can detect this transition (e.g., through communication with the OS) and then automatically stop or terminate the VPN tunnel and / or the VPN application, as shown in the automatic stop (835) example. This will now be combined with... Figure 9 and Figure 10 The flowchart discusses further details about these features.

[0075] Example Method

[0076] The following discussion now involves multiple methods and method actions that can be performed. Although method actions can be discussed in a certain order, or described in a flowchart as being performed in a specific order, a specific order is not required unless otherwise specified, or because an action depends on another action being performed before it is performed.

[0077] Figure 9 A flowchart of an example method 900 for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment operating on a client device is shown. For example, method 900 can use... Figure 6 Client device 600 or Figure 7 The client device 700 is implemented. Similarly, method 900 can be implemented on client devices. Figure 1 This is implemented in the BYOD architecture 100. At least some of the exposed operations can be executed by the aforementioned SDK, which can be implemented by a computer processor. Furthermore, at a higher level, the exposed operations can be executed by the computer processor. For example, the processor can execute SDK operations, OS operations, and VPN application operations, etc. Detailed information about processors will be provided later. Figure 11 supply.

[0078] Initially, there is an action (Action 905) to determine that the MAM-controlled App is launching on the client device. The term "launch" should be interpreted broadly and may include the initial launch of the MAM-controlled App, or even a scenario where the MAM-controlled App is being resumed and the application's UI is brought to the foreground on the device.

[0079] The process of determining when a MAM-controlled app is launching can be executed by the aforementioned SDK. Specifically, the SDK can be triggered when a MAM-controlled app launches. Similarly, the SDK can communicate with the OS to determine additional information about the MAM-controlled app, such as when the app's UI might transition from the background to the foreground.

[0080] After determining that an app controlled by MAM is starting up, Action 910 involves querying the policy and using that policy to determine whether to automatically enable the VPN application. For example, Figure 6 SDK 620 can query policies 635 stored or locally cached on the client device, and / or can query policies 650A stored remotely. This policy is an enterprise policy that describes whether a VPN should be used when an app controlled by the MAM is in use. The SDK (or library) can interpret the policy and then apply it, for example, by facilitating self-triggering or automatic activation of the VPN application, and then a VPN tunnel can be initiated (i.e., the VPN application is configured to initiate a VPN tunnel). When a policy is stored remotely, the process of querying the policy can optionally trigger the download of a local policy from a remote server to the client device.

[0081] Based on a policy that instructs VPN applications to automatically launch upon or simultaneously with the startup of MAM-controlled applications (including scenarios where the UI is brought to the foreground), Action 915 includes automatically triggering or launching VPN applications to initiate a VPN tunnel usable by at least the MAM-controlled app. For example, Figure 6 Policy 635, 650A can instruct that a VPN should be used when the UI of an App 610 controlled by MAM is brought to the foreground.

[0082] In some cases, a VPN application initiates a VPN tunnel after determining that the UI of an app controlled by a MAM will subsequently be brought to the foreground on the client device. For example, by communicating with the OS (or potentially intercepting communication from the OS), the SDK can determine when the UI will subsequently be brought to the foreground. For instance, communication can be intercepted or received, indicating that within a specified time period (e.g., perhaps 1 millisecond (ms), 2 milliseconds, 3 milliseconds, 4 milliseconds, 5 milliseconds, etc.), the UI will be surfaced and brought to the foreground. Based on this communication, the SDK can then trigger the VPN application to start or automatically open.

[0083] In this sense, libraries (e.g., SDKs) integrated into MAM-controlled apps indicate when the MAM-controlled app's user interface (UI) will subsequently be brought to the foreground on the client device. Furthermore, the library can submit messages to query policies, thereby determining whether the VPN application will be automatically launched.

[0084] In some cases, a VPN application initiates a VPN tunnel after the MAM-controlled app launches but before its UI is brought to the foreground. In other cases, the VPN application initiates a VPN tunnel within a specified time frame after the UI is brought to the foreground. For example, the specified time frame might be 1 millisecond (ms), 2 milliseconds, 3 milliseconds, 4 milliseconds, 5 milliseconds, etc.

[0085] Action 920 then involves enabling network communication transmitted to or from a MAM-controlled App through a VPN tunnel provided by a VPN application, which is automatically triggered or enabled based on a policy associated with the MAM-controlled App. For illustration, in Figure 6 After VPN tunnel 665 has been initiated by VPN application 655, network communication 670 can be transmitted through VPN tunnel 665. The VPN tunnel provided by the VPN application can be configured to host multiple network communications from multiple different applications (e.g., multiple different MAM-controlled apps) running on the client device.

[0086] Optionally (as indicated by the dashed border), action 925 may include terminating the VPN tunnel at a certain point in time after the VPN application is automatically launched. This termination may occur for the following reasons: (i) due to a determination that the MAM-controlled app has been closed, has stopped operating, or may be in the process of being closed; (ii) due to a determination that the UI is transitioning from (or has transitioned to) the background; or (iii) due to some other condition being met. Another example of a condition could be a scenario where the user has locked his / her device or the device has entered sleep mode.

[0087] Figure 10 Another flowchart of example method 1000, which can also be executed by the disclosed SDK, is shown. Specifically, method 1000 enumerates various operations for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment that operates on a computer system, such as the disclosed client device.

[0088] Action 1005 involves determining that a MAM-controlled app is launching on a computer system. As previously mentioned, this type of operation can be performed by an SDK that interacts with the device's OS to determine how a MAM-controlled app should launch. Launch includes the scenario of bringing the UI of the MAM-controlled app to the foreground.

[0089] After determining that the MAM-controlled App is starting up, Action 1010 includes querying the policy. Action 1015 then includes determining that the policy instructs the VPN application to automatically initiate a VPN tunnel after or simultaneously with the MAM-controlled App's user interface (UI) being brought to the foreground of the computer system. This policy is controlled by the enterprise, and the SDK can implement this policy on the client device.

[0090] In response to an instruction that the UI of the MAM-controlled app will subsequently be brought to the foreground, action 1020 includes enabling the VPN application to initiate a VPN tunnel that can be used by at least the MAM-controlled app. In some embodiments, this instruction may direct the UI of the MAM-controlled app to be brought to the foreground. Furthermore, this instruction may be provided by the operating system of the computer system.

[0091] Additionally, action 1025 includes enabling network communication transmitted to or from an MAM-controlled App through a VPN tunnel provided by the VPN application. Therefore, the disclosed embodiments offer numerous and substantial benefits, particularly as a result of the ability to automatically activate the VPN application within a MAM environment.

[0092] Example computer / computer system

[0093] Now let's turn our attention to... Figure 11 , Figure 11An example computer system 1100 is shown, which may contain and / or be used to perform any of the operations described in this disclosure. The computer system 1100 may take various different forms. For example, the computer system 1100 may be embodied as a tablet computer 1100A, a desktop or laptop computer 1100B, a wearable device 1100C, a mobile device, or a standalone device. The ellipsis 1100D indicates that the computer system 1100 may also take any other form. The computer system 1100 may also be a distributed system containing one or more connected computing components / devices that communicate with the computer system 1100.

[0094] In its most basic configuration, the computer system 1100 contains a variety of different components. Figure 11 The computer system 1100 is shown to include one or more processors 1105 (also known as "hardware processing units") and storage 1110.

[0095] Regarding processor 1105, it should be understood that the functions described herein can be performed, at least in part, by one or more hardware logic components (such as processor 1105). For example, without limitation, illustrative types of hardware logic components / processors that can be used include field-programmable gate arrays (“FPGAs”), application-specific integrated circuits (“ASICs”), application-specific standard products (“ASSPs”), system-on-a-chip (“SOCs”), complex programmable logic devices (“CPLDs”), central processing units (“CPUs”), graphics processing units (“GPUs”), or any other type of programmable hardware.

[0096] As used in this disclosure, the terms “executable module,” “executable component,” “component,” “module,” “engine,” or even “SDK” may refer to a hardware processing unit or a software object, routine, or method that can be executed on computer system 1100. The various components, modules, engines, and services described in this disclosure may be implemented as objects or processors that execute on computer system 1100 (e.g., as independent threads).

[0097] Storage 1110 may be physical system storage, which may be volatile, non-volatile, or some combination of both. The term "storage" may also be used in this disclosure to refer to non-volatile mass storage, such as physical storage media. If the computer system 1100 is distributed, then processing, storage, and / or storage capacity may also be distributed.

[0098] Storage 1110 is shown as containing executable instructions 1115. Executable instructions 1115 represent instructions that can be performed by processor 1105 of computer system 1100 to perform the disclosed operations, such as those described in various methods.

[0099] The disclosed embodiments may include or use a dedicated or general-purpose computer containing computer hardware, such as one or more processors (e.g., processor 1105) and system storage (e.g., storage 1110), which will be discussed in detail below. Embodiments also include physical and other computer-readable media used to carry or store computer-executable instructions and / or data structures. Such computer-readable media may be any available media accessible to a general-purpose or dedicated computer system. A computer-readable medium storing computer-executable instructions in data form is a “physical computer storage medium” or “hardware storage device.” A computer-readable medium carrying computer-executable instructions is a “transmission medium.” Therefore, by way of example and not limitation, embodiments of the invention may include at least two distinct types of computer-readable media: computer storage media and transmission media.

[0100] Computer storage media (also known as “hardware storage devices”) are computer-readable hardware storage devices, such as RAM, ROM, EEPROM, CD-ROM, RAM-based solid-state drives ("SSDs"), flash memory, phase-change memory ("PCM") or other types of storage, or other optical disc storage, disk storage or other magnetic storage devices, or any other medium, or means that can be used to store desired program code in the form of computer-executable instructions, data or data structures, and that can be accessed by a general-purpose or special-purpose computer.

[0101] Computer system 1100 can also be connected via network 1120 (via wired or wireless connection) to external sensors (e.g., one or more remote cameras) or devices. For example, computer system 1100 can communicate with any number of devices or cloud services to acquire or process data. In some cases, network 1120 itself may be a cloud network. Furthermore, computer system 1100 can also connect via one or more wired or wireless networks to remote / separate computer systems configured to perform any of the processing described with respect to computer system 1100.

[0102] A “network,” such as network 1120, is defined as one or more data links and / or data switches that enable the transmission of electronic data in computer systems, modules, and / or other electronic devices. When information is transmitted or provided to a computer via a network (hardwired, wireless, or a combination of hardwired and wireless), the computer correctly treats the connection as a transmission medium. Computer system 1100 will include one or more communication channels used to communicate with network 1120. The transmission medium includes a network that can be used to carry data or required program code in the form of computer-executable instructions or data structures. Furthermore, these computer-executable instructions can be accessed by general-purpose or special-purpose computers. The combination of the above should also be included within the scope of computer-readable media.

[0103] Upon arrival at various computer system components, program code in the form of computer-executable instructions or data structures can be automatically transferred from the transmission medium to the computer storage medium (and vice versa). For example, computer-executable instructions or data structures received via a network or data link can be buffered in the RAM within a network interface module (e.g., a network interface card or "NIC") and then ultimately transferred to the computer system RAM and / or a less volatile computer storage medium at the computer system level. Therefore, it should be understood that computer storage media can be contained within computer system components that also (even primarily) use the transmission medium.

[0104] For example, computer-executable (or computer-interpretable) instructions include instructions that cause a general-purpose computer, special-purpose computer, or special-purpose processing device to perform a function or a set of functions. Computer-executable instructions can be, for example, binary files, intermediate format instructions such as assembly language, or even source code. Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the features or actions described above. Rather, the described features and actions are disclosed as exemplary forms of implementing the claims.

[0105] Those skilled in the art will understand that this embodiment can be implemented in network computing environments with various types of computer system configurations, including personal computers, desktop computers, laptop computers, message processors, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, microcomputers, mainframe computers, mobile phones, PDAs, pagers, routers, switches, etc. This embodiment can also be implemented in a distributed system environment, where local and remote computer systems, linked by a network (via hardwired data links, wireless data links, or a combination of hardwired and wireless data links), each perform tasks (e.g., cloud computing, cloud services, etc.). In a distributed system environment, program modules can reside in local and remote memory storage devices.

[0106] In view of the above, the present invention can be embodied in a variety of different configurations, as described above, and explained in the following aspects.

[0107] 1. A method for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, the MAM environment being operated on a client device, the method comprising:

[0108] It is confirmed that the MAM-controlled App is launching on the client device;

[0109] After confirming that the MAM-controlled App is starting up, the policy is queried and the VPN application is automatically enabled based on the policy.

[0110] Based on the policy that instructs the VPN application to be automatically started after or simultaneously with the launch of the MAM-controlled App, the VPN application is automatically started, and the VPN application is configured to initiate a VPN tunnel that can be used by at least the MAM-controlled App.

[0111] as well as

[0112] Enables transmission to or from the MAM-controlled App.

[0113] Network communication transmitted by the App is through the VPN tunnel.

[0114] 2. The method according to aspect 1 above, wherein the VPN application initiates the VPN tunnel after confirmation that the user interface (UI) of the MAM-controlled App will subsequently be brought to the foreground of the client device.

[0115] 3. The method according to aspects 1 to 2 above, wherein the VPN application initiates the VPN tunnel after the MAM-controlled App is launched and before the user interface (UI) of the MAM-controlled App is brought to the foreground of the client device.

[0116] 4. The method according to aspects 1 to 3 above, wherein a library integrated within the MAM-controlled App identifies when the user interface (UI) of the MAM-controlled App will subsequently be brought to the foreground of the client device, and wherein the library submits a message to query the policy.

[0117] 5. The method according to aspects 1 to 4 above, wherein the policy is locally cached on the client device.

[0118] 6. The method according to aspects 1 to 5 above, wherein querying the policy triggers the download of the policy from a remote server to the local client device.

[0119] 7. The method according to aspects 1 to 6 above, wherein a library integrated with the MAM-controlled App communicates with the operating system of the client device, wherein the library determines, based on the communication with the operating system, when the user interface (UI) of the MAM-controlled App will subsequently be brought to the foreground of the client device, and wherein, in response to the determination that the UI will subsequently be brought to the foreground within a defined time period, the library triggers the VPN application to initiate the VPN tunnel.

[0120] 8. The method according to aspects 1 to 7 above, wherein the VPN tunnel provided by the VPN application is configured to host multiple network communications from multiple different applications running on the client device.

[0121] 9. The method according to aspects 1 to 8 above, wherein the MAM environment operates to restrict the MAM-controlled App, but avoids restricting a second application installed on the client device.

[0122] 10. The method according to aspects 1 to 9 above, wherein the method further includes causing the VPN application to terminate the VPN tunnel.

[0123] 11. A computer system configured to automatically enable a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, the MAM environment operating on the computer system, the computer system comprising:

[0124] Processor; and

[0125] A computer-readable hardware storage device that stores instructions executable by the processor to cause the computer system to at least:

[0126] It is confirmed that the MAM-controlled App is starting up on the computer system;

[0127] After confirming that the MAM-controlled App is starting up, the policy is queried and the VPN application is automatically enabled based on the policy.

[0128] Based on the policy that instructs the VPN application to be automatically started after or simultaneously with the launch of the MAM-controlled App, the VPN application is automatically started, and the VPN application is configured to initiate a VPN tunnel that can be used by at least the MAM-controlled App.

[0129] To enable network communication transmitted to or from the MAM-controlled App to pass through the VPN tunnel; and

[0130] The VPN application terminates the VPN tunnel.

[0131] 12. The computer system according to aspect 11 above, wherein the VPN application terminates the VPN tunnel in response to a determination that the MAM-controlled App has stopped operating.

[0132] 13. The computer system according to aspects 11 to 12 above, wherein the VPN application terminates the VPN tunnel in response to a determination that the user interface (UI) of the MAM-controlled App has been switched from the foreground to the background of the computer system.

[0133] 14. The computer system according to aspects 11 to 13 above, wherein the VPN application terminates the VPN tunnel in response to a determination that the MAM-controlled App has been closed.

[0134] 15. The computer system according to aspects 11 to 14 above, wherein the MAM-controlled App includes a MAM component that defines the operation of the MAM-controlled App.

[0135] 16. The computer system according to aspects 11 to 15 above, wherein the computer system includes a MAM component that defines the operation of the MAM-controlled App.

[0136] 17. The computer system according to aspects 11 to 16 above, wherein the VPN application initiates the VPN tunnel, the VPN tunnel being independent of the logic executed for operating the MAM-controlled App.

[0137] 18. The computer system according to aspects 11 to 17 above, wherein the VPN application is automatically triggered to be executed by using inter-process communication (IPC) provided by a standard platform, and the VPN application then initiates the VPN tunnel.

[0138] 19. A computer system configured to automatically enable a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, the MAM environment operating on the computer system, the computer system comprising:

[0139] Processor; and

[0140] A computer-readable hardware storage device that stores instructions executable by the processor to cause the computer system to at least:

[0141] It is confirmed that the MAM-controlled App is starting up on the computer system;

[0142] After confirming that the MAM-controlled App is starting up, query the policy;

[0143] The policy determines that the VPN application will automatically initiate a VPN tunnel after or simultaneously with the user interface (UI) of the MAM-controlled App being brought to the foreground of the computer system.

[0144] In response to an indication that the UI of the MAM-controlled App will subsequently be brought to the foreground, the VPN application initiates a VPN tunnel that can be used by at least the MAM-controlled App; and

[0145] Network communications transmitted to or from the MAM-controlled App are transmitted through the VPN tunnel provided by the VPN application.

[0146] 20. The computer system according to aspect 19 above, wherein the instruction indicating that the UI of the MAM-controlled App will be brought to the foreground is provided by the operating system of the computer system.

[0147] This invention may be embodied in other specific forms without departing from its characteristics. The described embodiments should be considered illustrative rather than restrictive in all respects. Therefore, the scope of the invention is defined by the appended claims rather than the foregoing description. All variations within the meaning and equivalents of the claims should be included within their scope.

Claims

1. A method for automatically enabling a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, wherein the MAM environment is operating on a client device, the method comprising: It is confirmed that an application controlled by MAM is starting on the client device; After determining that the MAM-controlled application is starting, a policy is queried and a determination is made based on the policy to automatically enable a VPN application, wherein the VPN application is configured to enable multiple MAM-controlled applications, including the MAM-controlled application, to use the same VPN tunnel. Based on the policy, the VPN application is instructed to be automatically started after or simultaneously with the startup of the MAM-controlled application, and the VPN application is configured to initiate a VPN tunnel that can be used by at least the MAM-controlled application and by the plurality of MAM-controlled applications. as well as This allows network communications transmitted to or from the MAM-controlled application to pass through the VPN tunnel.

2. The method of claim 1, wherein the VPN application initiates the VPN tunnel after confirmation that the user interface (UI) of the MAM-controlled application will subsequently be brought to the foreground of the client device.

3. The method of claim 1, wherein the VPN application initiates the VPN tunnel after the MAM-controlled application is launched and before the user interface (UI) of the MAM-controlled application is brought to the foreground of the client device.

4. The method of claim 1, wherein a library integrated within the MAM-controlled application identifies when the user interface (UI) of the MAM-controlled application will subsequently be brought to the foreground of the client device, and wherein the library submits a message to query the policy.

5. The method according to claim 1, wherein the policy is locally cached on the client device.

6. The method of claim 1, wherein querying the policy triggers the download of the policy from a remote server to the local client device.

7. The method of claim 1, wherein the library integrated with the MAM-controlled application communicates with the operating system of the client device. The library determines when the user interface (UI) of the MAM-controlled application will be brought to the foreground of the client device based on communication with the operating system. In response to the confirmation that the UI will subsequently be brought to the foreground within a defined time period, the library triggers the VPN application to initiate the VPN tunnel.

8. The method of claim 1, wherein the VPN tunnel provided by the VPN application is configured to host multiple network communications from multiple different applications running on the client device.

9. The method of claim 1, wherein the MAM environment operates to restrict the MAM-controlled application, but avoids restricting a second application installed on the client device.

10. The method of claim 1, wherein the method further comprises causing the VPN application to terminate the VPN tunnel.

11. A computer system configured to automatically enable a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, the MAM environment operating on the computer system, the computer system comprising: processor; as well as A computer-readable hardware storage device that stores instructions executable by the processor to cause the computer system to at least: It is confirmed that an application controlled by MAM is starting up on the computer system; After determining that the MAM-controlled application is starting, a policy is queried and a determination is made based on the policy to automatically enable a VPN application, wherein the VPN application is configured to enable multiple MAM-controlled applications, including the MAM-controlled application, to use the same VPN tunnel. Based on the policy, the VPN application is instructed to be automatically started after or simultaneously with the startup of the MAM-controlled application, and the VPN application is configured to initiate a VPN tunnel that can be used by at least the MAM-controlled application and by the plurality of MAM-controlled applications. Enables network communications transmitted to or from the MAM-controlled application to pass through the VPN tunnel; as well as The VPN application terminates the VPN tunnel.

12. The computer system of claim 11, wherein the VPN application terminates the VPN tunnel in response to a determination that the MAM-controlled application has ceased operation.

13. The computer system of claim 11, wherein the VPN application terminates the VPN tunnel in response to a determination that the user interface (UI) of the MAM-controlled application has transitioned from the foreground to the background of the computer system.

14. The computer system of claim 11, wherein the VPN application terminates the VPN tunnel in response to a determination that the MAM-controlled application has been closed.

15. The computer system of claim 11, wherein the MAM-controlled application includes a MAM component defining the operation of the MAM-controlled application.

16. The computer system of claim 11, wherein the computer system includes a MAM component that restricts the operation of the MAM-controlled application.

17. The computer system of claim 11, wherein the VPN application initiates the VPN tunnel independently of logic, the logic being executed to operate the MAM-controlled application.

18. The computer system of claim 11, wherein the VPN application is automatically enabled using inter-process communication (IPC) provided by a standard platform, and then the VPN application initiates the VPN tunnel.

19. A computer system configured to automatically enable a Virtual Private Network (VPN) in a Mobile Application Management (MAM) environment, the MAM environment operating on the computer system, the computer system comprising: processor; as well as A computer-readable hardware storage device that stores instructions executable by the processor to cause the computer system to at least: It is confirmed that an application controlled by MAM is starting up on the computer system; After determining that the MAM-controlled application is starting up, query the strategy; The policy determines that the VPN application automatically initiates a VPN tunnel after the user interface (UI) of the MAM-controlled application is brought to the foreground of the computer system or simultaneously with the UI of the MAM-controlled application being brought to the foreground of the computer system, wherein the VPN application is configured to enable multiple MAM-controlled applications, including the MAM-controlled application, to use the same VPN tunnel. In response to an instruction that the UI of the MAM-controlled application will subsequently be brought to the foreground, the VPN application initiates a VPN tunnel that can be used by at least the MAM-controlled application and by the plurality of MAM-controlled applications. as well as Network communications transmitted to or from the MAM-controlled application are transmitted through the VPN tunnel provided by the VPN application.

20. The computer system of claim 19, wherein the instruction indicating that the UI of the MAM-controlled application will be brought to the foreground is provided by the operating system of the computer system.

Images