Mobile equipment management method and device, medium, electronic equipment and program product

Abstract

The invention relates to a mobile equipment management method and device, a medium, electronic equipment and a program product, belongs to the field of mobile equipment management, and can greatly reduce the management cost of the mobile equipment. A mobile device management method comprises the steps that a strategy client installed on a managed mobile device obtains a pre-configured device management strategy corresponding to the managed mobile device from a strategy server, the managed mobile device is a mobile device which is owned by an enterprise and needs to be managed, and the pre-configured device management strategy corresponds to the managed mobile device. The pre-configured device management strategy is a pre-configured strategy used for managing the managed mobile device, and the strategy server is a server used for storing the pre-configured device management strategy; and managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client.

Description

Technical Field

[0001] The present disclosure relates to the field of mobile device management, and in particular, to a mobile device management method, apparatus, medium, electronic device and program product. Background Art

[0002] Mobile Device Management (MDM) is a technology used to manage and protect mobile devices (such as smartphones, tablets, and laptops) in enterprises. MDM is crucial to enterprises because it can ensure the device security and information security of enterprises. Currently, the cost of MDM solutions is relatively high. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a mobile device management method, the method comprising: The policy client installed on the managed mobile device obtains the preconfigured device management policy corresponding to the managed mobile device from the policy server, wherein the managed mobile device is a mobile device owned by an enterprise and needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy; The managed mobile device is managed by executing the acquired pre-configured device management policy by the policy client.

[0005] In a second aspect, the present disclosure provides a mobile device management device, the mobile device management device comprising: A policy client, installed on the managed mobile device, for acquiring a pre-configured device management policy corresponding to the managed mobile device from a policy server, and executing the acquired pre-configured device management policy to manage the managed mobile device; The managed mobile device is a mobile device owned by an enterprise and needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy.

[0006] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of any one of the methods described in the first aspect.

[0007] In a fourth aspect, the present disclosure provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of any one of the methods in the first aspect.

[0008] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0009] By adopting the above-mentioned technical solution, the policy client installed on the managed mobile device can obtain the pre-configured device management policy corresponding to the managed mobile device from the policy server, and then the managed mobile device is managed by executing the obtained pre-configured device management policy by the policy client. Therefore, since the mobile device management method according to the embodiment of the present disclosure can realize the management of the mobile device only by using the policy client, the management cost of the mobile device is greatly reduced.

[0010] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 The present invention is a flowchart of a method for managing a mobile device according to an embodiment of the present invention.

[0012] Figure 2 The present invention discloses a deployment process of a managed mobile device installed with a Windows operating system according to an embodiment of the present invention.

[0013] Figure 3 The present invention is a deployment process of a managed mobile device installed with a Mac-like operating system according to an embodiment of the present disclosure.

[0014] Figure 4 The present invention is a flowchart of issuing a certificate issued by an enterprise according to an embodiment of the present invention.

[0015] Figure 5is a flow chart of a device verification process according to an embodiment of the present disclosure.

[0016] Figure 6 The present invention is a schematic block diagram of a mobile device management apparatus according to an embodiment of the present invention.

[0017] Figure 7 A schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0020] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0021] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0023] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0024] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0025] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0026] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0027] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0028] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0029] Figure 1 1 is a flow chart of a mobile device management method according to an embodiment of the present disclosure. The mobile device management method is applied to mobile devices. The mobile device management method can be applied to the scenario of managing mobile devices owned by an enterprise. Figure 1 As shown, the mobile device management method may include the following steps S11 to S12.

[0030] In step S11, the policy client installed on the managed mobile device obtains the preconfigured device management policy corresponding to the managed mobile device from the policy server, wherein the managed mobile device is a mobile device owned by an enterprise that needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing preconfigured device management policies.

[0031] The preconfigured device management policy can be set by the enterprise's policy configuration server. The policy configuration server contains the core logic of mobile device management, provides a user interface for users to configure device management policies, and can generate preconfigured device management policy files based on user configurations. After the settings are completed, the preconfigured device management policy can be uploaded from the policy configuration server to a distributed version control system of the source code for storage, and the distributed version control system can be, for example, Git. The policy server can obtain (e.g., download) the preconfigured device management policy from the distributed version control system and store the obtained preconfigured device management policy locally on the policy server.

[0032] Managed mobile devices refer to mobile devices owned by an enterprise that need to be managed, such as smartphones, tablets, laptops, etc.

[0033] The preconfigured device management policy may include various management policies for the managed mobile devices, such as deployment-related policies, security-related policies, application-related policies, compliance-related policies, detection-related policies, and the like.

[0034] Deployment-related policies may include, for example, policies that enable managed mobile devices to be deployed in accordance with enterprise standards.

[0035] Security-related policies may include, for example, encryption policies, remote wipe policies, password policy management policies, etc., through which enterprise data can be protected. Encryption policies may include, for example, the encryption method used for encryption, etc. Remote wipe policies may include, for example, whether to allow remote erasure of data on managed mobile devices, the time period for remote erasure, the data allowed to be remotely erased, etc. Password policy management policies may include, for example, the way to store encrypted passwords (for example, local memory storage, persistent storage, etc.), password update cycles, etc.

[0036] Application-related policies may include, for example, policies for deploying, updating, and managing enterprise applications. For example, application-related policies may set a blacklist or whitelist of mobile devices that can deploy enterprise-level applications. Enterprise-level applications refer to enterprise-level applications that can only be deployed on devices owned by the enterprise. If they are deployed on devices not owned by the enterprise, it may lead to the leakage of enterprise data.

[0037] Compliance-related policies may include, for example, policies for detecting whether a managed mobile device is compliant.

[0038] Detection-related policies may include, for example, policies for detecting device performance and status, such as which device performance needs to be detected, which device status needs to be detected, and so on.

[0039] The policy client is a client program that can be implemented using an object-oriented programming language (eg, Ruby).

[0040] The policy client can periodically obtain the pre-configured device management policy corresponding to the managed mobile device on which the policy client is installed from the policy server. The policy server can issue the corresponding pre-configured device management policy to the policy client based on the association between the managed mobile device and the pre-configured device management policy. For example, an enterprise has a first managed mobile device and a second managed mobile device, and the policy client is installed on both the first managed mobile device and the second managed mobile device. Then, the policy client installed on the first managed mobile device can obtain the pre-configured device management policy corresponding to the first managed mobile device from the policy server, and the policy client installed on the second managed mobile device can obtain the pre-configured device management policy corresponding to the second managed mobile device from the policy server.

[0041] In addition, for managed mobile devices installed with a Win operating system (hereinafter referred to as Win devices), the policy client installed on the managed mobile device can directly download the corresponding pre-configured device management policy from the policy server. For managed mobile devices installed with a Mac operating system (hereinafter referred to as Mac devices), the policy client installed on the managed mobile device periodically sends a policy acquisition request to the policy server. The policy server sends the corresponding pre-configured device management policy to the MDM server based on the policy acquisition request. The MDM server notifies the policy client to obtain MDM instructions from the MDM server through a push notification service, such as the Apple Push Notification service (APNs). In this way, the policy client installed on the managed mobile device obtains the corresponding pre-configured device management policy. The MDM server is a lightweight mobile device management server that aims to provide a lightweight method to manage and control devices such as iOS, iPadOS, and macOS.

[0042] In step S12, the policy client executes the acquired pre-configured device management policy to manage the managed mobile device.

[0043] For example, if the acquired pre-configured device management policy includes an encryption policy, the policy client can encrypt the managed mobile device based on the encryption policy, so that the encryption of the managed mobile device meets the requirements of the encryption policy.

[0044] By adopting the above-mentioned technical solution, the policy client installed on the managed mobile device can obtain the pre-configured device management policy corresponding to the managed mobile device from the policy server, and then the managed mobile device is managed by executing the obtained pre-configured device management policy by the policy client. Therefore, since the mobile device management method according to the embodiment of the present disclosure can realize the management of the mobile device only by using the policy client, the management cost of the mobile device is greatly reduced.

[0045] In some embodiments, the policy client is a client program written in a cross-platform programming language (e.g., ruby), so the policy client is a cross-platform client program. Cross-platform means that the policy client can be installed on devices with various operating systems and run on these devices, and various operating systems include, for example, Win, Linux, Mac, iOS, etc. Since the policy client is a cross-platform client program, the cross-platform capability of mobile device management is improved.

[0046] In some embodiments, in order to implement the deployment of the managed mobile device, the policy client may request to issue a Secure Sockets Layer (SSL) certificate, wherein the Secure Sockets Layer certificate is used in the communication between the policy client and the policy server.

[0047] The policy client can request the certificate server (Policy CA Server) to issue an SSL certificate. This is applicable to managed mobile devices installed with a Windows operating system or a Mac operating system. To improve security, the certificate server can be deployed in the intranet.

[0048] For managed mobile devices installed with an operating system similar to Mac, during the process of requesting an SSL certificate, you can register by installing a description file on the managed mobile device, and while installing the description file, you can report the information of the managed mobile device; if the enterprise uses Apple Business Manager (ABM), you can set up out-of-the-box configurations for the managed mobile devices, so that the managed mobile devices will be automatically installed and configured during initialization.

[0049] Figure 2 This is a deployment process of a managed mobile device installed with a Windows operating system according to an embodiment of the present disclosure, that is, firstly, a policy client is installed on the managed mobile device, and then the policy client requests a certificate server to issue an SSL certificate.

[0050] Figure 3 It is a deployment process of a managed mobile device installed with a Mac operating system according to an embodiment of the present disclosure, that is, the Mac device sends a request to the MDM server to install a policy client, the MDM server sends an MDM instruction to install the policy client to the Mac device, and then the Mac device downloads and installs the policy client, and then the policy client requests the certificate server to issue an SSL certificate.

[0051] By adopting the above technical solution, the deployment of managed mobile devices is realized, ensuring that the managed mobile devices are deployed in accordance with enterprise standards. After the deployment is completed, the policy client can obtain the corresponding pre-configured device management policy from the policy server.

[0052] In some embodiments, the preconfigured device management policy may include an application installation policy. The application installation policy may include an application download address and application installation rules. The application installation rules may include, for example, the time period during which the application can be deployed and updated, which applications can be deployed and updated on the managed mobile device, a device whitelist and a device blacklist for deploying or updating the application, and the like.

[0053] Then, the management of the managed mobile device by executing the obtained pre-configured device management policy by the policy client as described in step S13 may include: the policy client downloads and installs the application according to the application download address and application installation rules indicated by the application installation policy to achieve management of the managed mobile device.

[0054] For example, the policy client can download the corresponding application from the address indicated by the application download address, and install the corresponding application according to the application installation rule. For example, deploy the application for the first time according to the application installation rule, update the application according to the application installation rule, manage the application according to the application installation rule, etc.

[0055] The application download address can be an object storage server (OSS).

[0056] By adopting the above technical solution, it is possible to deploy, update and manage applications for managed mobile devices according to pre-configured device management policies, thereby achieving management of managed mobile devices and greatly reducing the management cost of mobile devices.

[0057] In some embodiments, the preconfigured device management policy may include a device security policy, wherein the device security policy is used to indicate policies related to the security of the managed mobile device. For example, the device security policy may include an encryption policy, a remote wipe policy, a password policy management policy, and the like. The encryption policy may be used to indicate the encryption method used for encryption, and the like. The remote wipe policy may be used to indicate whether remote wipe is possible, the data that can be remotely wiped, the time period during which remote wipe is allowed, and the like. The password policy management policy may be used to indicate how to manage passwords, the password update cycle, the password storage method, and the like.

[0058] Then, managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client in step S13 may include: the policy client performs security management on the managed mobile device according to the device security policy to achieve management of the managed mobile device.

[0059] For example, the policy client can encrypt the managed mobile device according to the encryption policy indicated by the device security policy. The policy client can also remotely wipe the data of the managed mobile device according to the remote wipe policy indicated by the device security policy.

[0060] By adopting the above technical solution, it is possible to perform security management on the managed mobile devices according to the device security policy, thereby not only protecting the security of enterprise data but also greatly reducing the management cost of the mobile devices.

[0061] In some embodiments, the preconfigured device management policy may include a certificate policy, wherein the certificate policy is used to instruct the installation of a certificate issued by the enterprise as the identity certificate of the managed mobile device, and the certificate issued by the enterprise is used to identify that the managed mobile device belongs to the enterprise. The certificate issued by the enterprise is set to be unable to be exported, which means that the certificate is a read-only certificate, ensuring the security of the certificate.

[0062] Then, managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client in step S13 may include: the policy client installs the certificate issued by the enterprise as the identity certificate of the managed mobile device according to the certificate policy to manage the managed mobile device.

[0063] Figure 4This is a flow chart of issuing a certificate issued by an enterprise according to an embodiment of the present disclosure. The policy configuration server issues the certificate issued by the enterprise to the policy client installed on the managed mobile device. After installing the certificate on the managed mobile device, the policy client returns the execution status to the policy configuration server (this operation is optional). Then, the policy configuration server detects the installation status of the certificate issued by the enterprise (this operation is also optional).

[0064] By adopting the above technical solution, it is possible to install a certificate uniformly issued by the enterprise as the identity certificate of the managed mobile device on the managed mobile device according to the certificate policy included in the pre-configured device management policy, so as to indicate that the managed mobile device is owned by the enterprise, thereby enhancing the security and reliability of device management.

[0065] Figure 5 is a flow chart of a device verification process according to an embodiment of the present disclosure.

[0066] like Figure 5 As shown, when it is detected that the enterprise-level application of the enterprise is started or logged in, the enterprise-level application that is started or logged in obtains the identity certificate of the mobile device on which the enterprise-level application is started or logged in, and verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise. If the identity certificate of the mobile device does not match the certificate issued by the enterprise, it means that the identity certificate of the mobile device is untrustworthy or invalid, and the enterprise-level application prohibits starting or logging in the enterprise-level application on the mobile device. If the identity certificate of the mobile device matches the certificate issued by the enterprise, it means that the identity certificate of the mobile device is credible or valid, so the enterprise-level application can allow the enterprise-level application to be started or logged in on the mobile device.

[0067] For example, the enterprise-level application itself may detect whether it is started or logged in, or other components outside the enterprise-level application may detect whether the enterprise-level application is started or logged in.

[0068] For example, verifying whether the identity certificate of the mobile device matches the certificate issued by the enterprise can be achieved in at least one of the following ways.

[0069] The first method is for the enterprise-level application to compare the identity certificate of the mobile device with the certificate features of the certificate issued by the enterprise to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise. The certificate features of the certificate issued by the enterprise can be pre-embedded in the enterprise-level application, or can also be stored in a memory, and when needed, the enterprise-level application obtains the certificate features of the certificate issued by the enterprise from the memory.

[0070] The second way is that the enterprise-level application uploads the identity certificate of the mobile device to the verification server, so that the verification server verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise. The verification server can be, for example, the policy configuration server, policy server, etc. described in this disclosure.

[0071] The third method is for an enterprise-level application to obtain the certificate fingerprint of the identity certificate of the enterprise's managed mobile device, and compare the certificate fingerprint with the identity certificate of the mobile device to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise.

[0072] For example, an enterprise-level application can send a certificate fingerprint request to a policy configuration server to request the certificate fingerprint of the identity certificate of all managed mobile devices of the enterprise. The certificate fingerprint refers to a hash value calculated by a hash function based on the certificate content.

[0073] Optionally, after the identity certificate of the mobile device matches the certificate issued by the enterprise, a secondary confirmation can be further performed. That is, the enterprise-level application can obtain the device information of the mobile device and request verification of the device information. If the device information verification is passed, the enterprise-level application will allow the enterprise-level application to be started or logged in on the mobile device. For example, the enterprise-level application can send a device verification request to the policy configuration server, and then the policy configuration server can perform device verification on the mobile device and return the device controllable status of the mobile device to the enterprise-level application, such as device asset status, network access status, compliance status, etc. If the device controllable status is correct, it means that the mobile device has the authority to use the enterprise-level application. Therefore, the enterprise-level application can allow the enterprise-level application to be started or logged in on the mobile device.

[0074] Through the above technical solution, the compliance of devices that launch or log in to enterprise-level applications can be ensured, ensuring that only mobile devices owned by the enterprise can launch or log in to enterprise-level applications, while mobile devices that are not owned by the enterprise cannot launch or log in to enterprise-level applications, thereby ensuring the security of corporate data and enhancing the security and reliability of device management. In addition, it also greatly reduces the management cost of mobile devices.

[0075] In some embodiments, the preconfigured device management policy may include a data collection policy, wherein the data collection policy is a policy for instructing the collection of status data of managed mobile devices. By way of example, the data collection policy may be implemented in the form of a script. The policy server may issue a corresponding data collection policy to the policy client based on the association between the data collection policy and the managed mobile device. The data collection policy may indicate, for example, the collection of performance data, health status data, compliance data, and the like of the managed mobile devices. Through the performance data and health status data, status detection and diagnosis of the managed mobile devices may be implemented. Through the compliance data, compliance detection of the managed mobile devices may be implemented, thereby supporting audit and compliance requirements.

[0076] Then, managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client in step S13 may include: the policy client collects and uploads the status data of the managed mobile device according to the data collection policy to manage the managed mobile device.

[0077] For example, if the data collection policy indicates to collect the performance data and health status data of the managed mobile device, the policy client can collect the relevant performance data and health status data and report them. For example, the policy client can report the collected data to the policy configuration server. In the policy configuration server, the reported data can fall into different data warehouses asynchronously in the form of message queues.

[0078] By adopting the above technical solution, relevant data of the managed mobile device can be collected according to the data collection strategy, and the managed mobile device can be detected, thereby providing troubleshooting support. In addition, the management cost of the mobile device can be greatly reduced.

[0079] Figure 6 1 is a schematic block diagram of a mobile device management device according to an embodiment of the present disclosure. The mobile device management device is applied to a mobile device. The mobile device management device can be applied to a scenario of managing mobile devices owned by an enterprise. Figure 6 As shown, the mobile device management apparatus 60 may include: a policy client 61, installed on a managed mobile device, for acquiring a preconfigured device management policy corresponding to the managed mobile device from a policy server, and executing the acquired preconfigured device management policy to manage the managed mobile device; wherein the managed mobile device is a mobile device owned by an enterprise and needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing preconfigured device management policies.

[0080] By adopting the above-mentioned technical solution, the policy client installed on the managed mobile device can obtain the pre-configured device management policy corresponding to the managed mobile device from the policy server, and then the managed mobile device is managed by executing the obtained pre-configured device management policy by the policy client. Therefore, since the mobile device management method according to the embodiment of the present disclosure can realize the management of the mobile device only by using the policy client, the management cost of the mobile device is greatly reduced.

[0081] Optionally, the policy client is a client program written in a programming language that supports cross-platform.

[0082] Optionally, the preconfigured device management policy includes an application installation policy; Then, the policy client 61 manages the managed mobile device by executing the acquired pre-configured device management policy, which may include: The policy client 61 downloads and installs the application according to the application download address and application installation rules indicated by the application installation policy to manage the managed mobile device.

[0083] Optionally, the preconfigured device management policy includes a device security policy, wherein the device security policy is used to indicate a policy related to the security of the managed mobile device; Then, the policy client 61 manages the managed mobile device by executing the acquired pre-configured device management policy, which may include: The policy client 61 performs security management on the managed mobile device according to the device security policy to achieve management of the managed mobile device.

[0084] Optionally, the preconfigured device management policy includes a certificate policy, wherein the certificate policy is used to instruct the installation of a certificate issued by the enterprise as an identity certificate of the managed mobile device, and the certificate issued by the enterprise is used to identify that the managed mobile device belongs to the enterprise; Then, the policy client 61 manages the managed mobile device by executing the acquired pre-configured device management policy, which may include: The policy client 61 installs the certificate issued by the enterprise as the identity certificate of the managed mobile device according to the certificate policy to manage the managed mobile device.

[0085] Optionally, when it is detected that an enterprise-level application of an enterprise is launched or logged in, the enterprise-level application that is launched or logged in obtains the identity certificate of the mobile device on which the enterprise-level application is launched or logged in, and verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise; if the identity certificate of the mobile device does not match the certificate issued by the enterprise, the enterprise-level application prohibits the enterprise-level application from being launched or logged in on the mobile device.

[0086] Optionally, verifying whether the identity certificate of the mobile device matches the certificate issued by the enterprise includes at least one of the following: The enterprise-level application compares the identity certificate of the mobile device with the certificate characteristics of the certificate issued by the enterprise to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application uploads the identity certificate of the mobile device to the verification server, so that the verification server verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application obtains the certificate fingerprint of the identity certificate of the enterprise's managed mobile device and compares the certificate fingerprint with the identity certificate of the mobile device to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise.

[0087] Optionally, if the identity certificate of the mobile device matches the certificate issued by the enterprise, the enterprise-level application obtains the device information of the mobile device and requests verification of the device information; if the device information verification is successful, the enterprise-level application allows the enterprise-level application to be started or logged in on the mobile device.

[0088] Optionally, the preconfigured device management policy includes a data collection policy, wherein the data collection policy is a policy for instructing to collect status data of the managed mobile device; Then, the policy client 61 executes the acquired pre-configured device management policy to manage the managed mobile device, which may include: The policy client 61 collects and uploads the status data of the managed mobile devices according to the data collection policy to manage the managed mobile devices.

[0089] The specific implementation of the operations performed by each module in the mobile device management apparatus according to the embodiment of the present disclosure has been described in detail in the relevant mobile device management method, and will not be repeated here.

[0090] The present disclosure also provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processing device, the steps of any method in the present disclosure are implemented.

[0091] The present disclosure also provides an electronic device, comprising: a storage device having a computer program stored thereon; A processing device is used to execute a computer program in a storage device to implement the steps of any method in the present disclosure.

[0092] The present disclosure also provides a computer program product, comprising a computer program, which implements the steps of any method in the present disclosure when executed by a processor.

[0093] Reference below Figure 7 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0094] like Figure 7 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0095] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0096] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0097] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0098] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0099] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0100] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the preconfigured device management policy corresponding to the managed mobile device from the policy server by a policy client installed on the managed mobile device, wherein the managed mobile device is a mobile device owned by an enterprise that needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy; the managed mobile device is managed by executing the obtained preconfigured device management policy by the policy client.

[0101] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0102] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the policy client may also be described as "a module that obtains the pre-configured device management policy corresponding to the managed mobile device from the policy server and executes the obtained pre-configured device management policy to manage the managed mobile device."

[0104] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0105] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] According to one or more embodiments of the present disclosure, Example 1 provides a mobile device management method, the method comprising: The policy client installed on the managed mobile device obtains the preconfigured device management policy corresponding to the managed mobile device from the policy server, wherein the managed mobile device is a mobile device owned by an enterprise and needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy; The managed mobile device is managed by executing the acquired pre-configured device management policy by the policy client.

[0107] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the policy client is a client program written in a programming language that supports cross-platform.

[0108] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 1, wherein the preconfigured device management policy includes an application installation policy; The managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client downloads and installs the application according to the application download address and application installation rules indicated by the application installation policy, so as to manage the managed mobile device.

[0109] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 1, wherein the preconfigured device management policy includes a device security policy, wherein the device security policy is used to indicate a policy related to the security of the managed mobile device; The managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client performs security management on the managed mobile device according to the device security policy to achieve management of the managed mobile device.

[0110] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 1, wherein the preconfigured device management policy includes a certificate policy, wherein the certificate policy is used to instruct the installation of a certificate issued by the enterprise as an identity certificate of the managed mobile device, and the certificate issued by the enterprise is used to identify that the managed mobile device belongs to the enterprise; The managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client installs the certificate issued by the enterprise as the identity certificate of the managed mobile device according to the certificate policy to manage the managed mobile device.

[0111] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, wherein the method further includes: When it is detected that the enterprise-level application of the enterprise is launched or logged in, the enterprise-level application that is launched or logged in obtains the identity certificate of the mobile device on which the enterprise-level application is launched or logged in, and verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise; if the identity certificate of the mobile device does not match the certificate issued by the enterprise, the enterprise-level application prohibits the enterprise-level application from being launched or logged in on the mobile device.

[0112] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 6, wherein the verifying whether the identity certificate of the mobile device matches the certificate issued by the enterprise includes at least one of the following: The enterprise-level application compares the identity certificate of the mobile device with the certificate features of the certificate issued by the enterprise to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application uploads the identity certificate of the mobile device to the verification server, so that the verification server verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application obtains the certificate fingerprint of the identity certificate of the enterprise's managed mobile device, and compares the certificate fingerprint with the identity certificate of the mobile device to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise.

[0113] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 6, wherein the method further includes: If the identity certificate of the mobile device matches the certificate issued by the enterprise, the enterprise-level application obtains the device information of the mobile device and requests verification of the device information; If the device information is verified successfully, the enterprise-level application allows the enterprise-level application to be started or logged in on the mobile device.

[0114] According to one or more embodiments of the present disclosure, Example 9 provides the method of Example 1, wherein the preconfigured device management policy includes a data collection policy, wherein the data collection policy is a policy for instructing to collect status data of the managed mobile device; The managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client collects and uploads the status data of the managed mobile device according to the data collection policy to manage the managed mobile device.

[0115] According to one or more embodiments of the present disclosure, Example 10 provides a mobile device management device, the mobile device management device comprising: A policy client, installed on the managed mobile device, for acquiring a pre-configured device management policy corresponding to the managed mobile device from a policy server, and executing the acquired pre-configured device management policy to manage the managed mobile device; The managed mobile device is a mobile device owned by an enterprise and needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy.

[0116] According to one or more embodiments of the present disclosure, Example 11 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-9 when executed by a processing device.

[0117] According to one or more embodiments of the present disclosure, Example 12 provides an electronic device, including: a storage device having a computer program stored thereon; A processing device is used to execute the computer program in the storage device to implement the steps of the method described in any one of Examples 1-9.

[0118] According to one or more embodiments of the present disclosure, Example 13 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-9 when executed by a processor.

[0119] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0120] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0121] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A mobile device management method, characterized in that: The method comprises: A policy client installed on a managed mobile device obtains a preconfigured device management policy corresponding to the managed mobile device from a policy server, wherein the managed mobile device is a mobile device owned by an enterprise and requiring management, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy; The managed mobile device is managed by executing the acquired pre-configured device management policy by the policy client.

2. The method according to claim 1, characterized in that The policy client is a client program written in a programming language that supports cross-platform.

3. The method according to claim 1, characterized in that The pre-configured device management policy includes an application installation policy; Managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client downloads and installs the application according to the application download address and application installation rules indicated by the application installation policy, so as to manage the managed mobile device.

4. The method according to claim 1, wherein The pre-configured device management policy includes a device security policy, wherein the device security policy is used to indicate a policy related to the security of the managed mobile device; Managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client performs security management on the managed mobile device according to the device security policy, thereby achieving management of the managed mobile device.

5. The method according to claim 1, wherein The pre-configured device management policy includes a certificate policy, wherein the certificate policy is used to instruct the installation of a certificate issued by the enterprise as an identity certificate of the managed mobile device, and the certificate issued by the enterprise is used to identify that the managed mobile device belongs to the enterprise; Managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client installs the certificate issued by the enterprise as the identity certificate of the managed mobile device according to the certificate policy to manage the managed mobile device.

6. The method according to claim 5, characterized in that The method further comprises: When it is detected that the enterprise-level application of the enterprise is launched or logged in, the enterprise-level application that is launched or logged in obtains the identity certificate of the mobile device on which the enterprise-level application is launched or logged in, and verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise. If the identity certificate of the mobile device does not match the certificate issued by the enterprise, the enterprise-level application prohibits the enterprise-level application from being launched or logged in on the mobile device.

7. The method according to claim 6, characterized in that Verifying whether the identity certificate of the mobile device matches the certificate issued by the enterprise includes at least one of the following: The enterprise-level application compares the identity certificate of the mobile device with the certificate characteristics of the certificate issued by the enterprise to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application uploads the identity certificate of the mobile device to a verification server, so that the verification server verifies whether the identity certificate of the mobile device matches the certificate issued by the enterprise; The enterprise-level application obtains the certificate fingerprint of the identity certificate of the enterprise's managed mobile device and compares the certificate fingerprint with the identity certificate of the mobile device to verify whether the identity certificate of the mobile device matches the certificate issued by the enterprise.

8. The method according to claim 6, characterized in that The method further comprises: If the identity certificate of the mobile device matches the certificate issued by the enterprise, the enterprise-level application obtains the device information of the mobile device and requests verification of the device information; If the device information is verified successfully, the enterprise-level application allows the mobile device to start or log in to the enterprise-level application.

9. The method according to claim 1, characterized in that The pre-configured device management policy includes a data collection policy, wherein the data collection policy is a policy for instructing to collect status data of the managed mobile device; Managing the managed mobile device by executing the acquired pre-configured device management policy by the policy client includes: The policy client collects and uploads the status data of the managed mobile device according to the data collection policy to manage the managed mobile device.

10. A mobile device management device, characterized in that: The mobile device management device includes: A policy client, installed on a managed mobile device, configured to obtain a pre-configured device management policy corresponding to the managed mobile device from a policy server and execute the obtained pre-configured device management policy to manage the managed mobile device; The managed mobile device is a mobile device owned by an enterprise that needs to be managed, the preconfigured device management policy is a preconfigured policy for managing the managed mobile device, and the policy server is a server for storing the preconfigured device management policy.

11. A computer-readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 9 are implemented.

12. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, configured to execute the computer program in the storage device to implement the steps of the method according to any one of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images