Abstract: Various technologies described herein pertain to policy management on a mobile device. The mobile device includes a device policy manager system that includes a unified interface component and a policy handler component. The unified interface component is configured to receive policy configuration requests from multiple policy sources, including at least an internal policy source component executed by the mobile device and a device management server external to the mobile device. The policy configuration requests include at least a first policy configuration request (a first policy value for a policy) from a first policy source and a second policy configuration request (a second policy value for the policy) from a second policy source. The policy handler component is configured to resolve the conflict between the first and second policy values based on a conflict resolution technique to set a current policy value for the policy that controls the mobile device.

Abstract: When receiving multiple security policy configurations from different management sources, a computer device can apply the most secure of the policy configurations to the device. If one of the policy configurations is removed from the device, a determination can be made regarding which of the remaining security policy configurations is the most secure. Once the determination is made, one of the remaining security policies that is the most secure is applied.

Abstract: A unified enrollment client is described that allows authentication and communication with disparate enterprise management source types. A first enterprise management source type can have a corporate-based management server which is on the premises of the corporation. A second enterprise management source type can have a cloud-based management server in which a corporate server communicates through a federation gateway to a cloud-based management server. Authentication can be handled regardless of the source type through the use of a discovery request which identifies the source type so that the enrollment client knows how to tailor the authentication, if any is needed, to the particular enterprise management source.

Abstract: A method and apparatus are described for unenrolling applications, such as from a mobile device. An enterprise can be associated with one or more applications. Rather than uninstalling the applications individually, a single unenroll user interface command can be used to remove all data on the mobile device associated with the enterprise. Moreover, the applications associated with the enterprise can be uninstalled. A user's personal data on the mobile device is not affected during the unenrollment.

Abstract: A method and system extends the functionality of the Open Mobile Alliance (OMA) Device Management (DM) standard to manage vendor specific configuration parameters and settings. An OMA DM structure is provided as an extension to the tree structure of the OMA DM standard. The OMA DM extension allows selected vendor specific parameters and settings to be managed under the OMA DM protocol.

Abstract: A read-only management object is created to contain information relating to firmware components that can be updated. This information includes a component identifier, a component version and a user-friendly name for the component. The information also includes a state identifier that indicates a state of a device that includes firmware components. Information from the management object can be used by other components as part of a firmware update process. An update management object is dynamically created to deliver an update package to the device. The update package can contain updates to multiple firmware components.

Abstract: Translators are provided that enable automated and remote device configurations in an efficient and abstract manner. In one aspect, a device configuration system is provided. A configuration component stores one or more remote configuration trees for various devices. A translator component maps the remote configuration trees to at least one device configuration tree associated with the respective devices to enable device configuration in an automated manner.

Abstract: A system and method of configuring network access parameters of a portable computing device is provided. A portable computing device usually includes wireless networking components and may be used with various wireless networks. A configuration server using a device management protocol, such as the OMA-DM protocol, sends network configuration information to a portable computing device. This configuration information includes network parameters such as network identifiers, encryption keys and authentication credentials. The portable computing device then uses the provided parameters to set its configuration information so that it can access a defined wireless network.

Abstract: A mobile device management system is provided. The mobile device management system may include a device management client configured to be executed on a mobile computing device. The device management client may include a client scheduler module configured to contact a device management server via a computer network and download a device management schedule for storage on the mobile computing device. The device management schedule may be generated at the device management server and include one or more schedule items. Each schedule item may include a predefined event and an associated action. The client scheduler module may be configured to monitor the device management schedule, detect the predefined event defined in a schedule item, and perform the associated action associated with the event, to thereby configure software on the mobile computing device.

Abstract: The present invention is provides a system and method for managing connectivity objects and their associated parameters for a mobile device. The connectivity parameters are stored in a tree structure. For example, a proxy may be a node in the tree with its connectivity parameters listed as leafs. Similarly, a network access point (NAP) object may be a node within the tree. The parameters stored within the tree may be created, modified, deleted, and queried remotely or locally. Any portion of the tree may be modified or queried without having to send the entire tree to the device. Provisioning and modification of the tree is enabled via eXtensible Markup Language (XML). A wireless access protocol (WAP) sub tree is defined under the proxy object. The NAP object may also be used to help manage Wi-Fi connections and desktop pass-through connections. A vendor specific sub tree is also included within the tree that may be used to contain vendor specific settings.

Abstract: A method and system automatically converts a Wireless Internet Protocol (WAP) Client Provisioning (CP) objects to Open Mobile Alliance (OMA) Device Management (DM) objects. WAP CP is enabled according to XML (eXtensible Markup Language) and defines a standard way to bootstrap mobile device's connectivity settings and application protocol access parameters using XML. OMA DM is also enabled according to XML and provides similar functionality, but is organized according to a mandated tree structure. The present invention automatically converts vendor specific parameters from WAP CP to OMA DM such that the vendor specific parameters are more easily managed by an OMA DM server and client.

Abstract: Described is a provisioning system for receiving configuration changes to and queries of settings on a mobile device. One implementation includes a router component and a configuration manager component. The router component is responsible for receiving messages delivered to the mobile device and parsing the messages into requests for information. The messages may be delivered in document format, such as in the eXtensible Markup Language (XML) format. The requests may take the form of a request to respond with existing configuration settings. The configuration manager component is responsible for determining what configuration settings are affected by the message and for processing the requests within the message. For example, the configuration manager component may process a request to query a configuration setting by retrieving the requested information from a hardware register or a software registry.

Abstract: Providing secure end-to-end notifications from a notification source to a notification sink despite the notification mechanism including one or more message transit points between the notification source and the notification sink. Initially, security information (e.g., the master security, the cryptographic algorithm, and the like) is negotiated out-of-band from the one or more message transit points so that the message transit points are not apprised of the security information. When a designated event occurs, the notification source generates a push message that includes the notification encrypted using the pre-negotiated security information. When the notification sink receives the push message, the notification sink decrypts the notification using the pre-negotiated security information, as well as supplemental information provided in the push message. Thus, the message transit points only have access to the encrypted form of the notification.

Abstract: Translators are provided that enable automated and remote device configurations in an efficient and abstract manner. In one aspect, a device configuration system is provided. A configuration component stores one or more remote configuration trees for various devices. A translator component maps the remote configuration trees to at least one device configuration tree associated with the respective devices to enable device configuration in an automated manner.

Abstract: A provisioning system for receiving configuration changes to and queries of settings on a mobile device. The provisioning system may include a router, configuration manager and one or more configuration service providers. The router component is responsible for receiving messages delivered to the mobile device and parsing the messages into requests for information. The configuration manager component is responsible for determining what configuration settings are affected by the message and for processing the requests within the message. The configuration manager component may implement one or more configuration service providers to perform the actual request processing. The configuration manager component may additionally compose a response document to return in the event that a response has been requested in the message.

Abstract: A system and method for assigning security credentials to particular components within a mobile device, and for ensuring that only configuration messages having sufficient access privilege to those components are allowed access, based on the security credentials. The security credentials or “roles” describe which settings a particular configuration message has authority to modify or query. Access is disallowed to settings for which a message does not have adequate security credentials.

Abstract: A read-only management object is created to contain information relating to firmware components that can be updated. This information includes a component identifier, a component version and a user-friendly name for the component. The information also includes a state identifier that indicates a state of a device that includes firmware components. Information from the management object can be used by other components as part of a firmware update process. An update management object is dynamically created to deliver update package to the device. The update package can contain updates to multiple firmware components.

Abstract: A system and method of configuring network access parameters of a portable computing device is provided. A portable computing device usually includes wireless networking components and may be used with various wireless networks. A configuration server using a device management protocol, such as the OMA-DM protocol, sends network configuration information to a portable computing device. This configuration information includes network parameters such as network identifiers, encryption keys and authentication credentials. The portable computing device then uses the provided parameters to set its configuration information so that it can access a defined wireless network.

Abstract: The present invention is provides a system and method for managing connectivity objects and their associated parameters for a mobile device. The connectivity parameters are stored in a tree structure. For example, a proxy may be a node in the tree with its connectivity parameters listed as leafs. Similarly, a network access point (NAP) object may be a node within the tree. The parameters stored within the tree may be created, modified, deleted, and queried remotely or locally. Any portion of the tree may be modified or queried without having to send the entire tree to the device. Provisioning and modification of the tree is enabled via eXtensible Markup Language (XML). A wireless access protocol (WAP) sub tree is defined under the proxy object. The NAP object may also be used to help manage Wi-Fi connections and desktop pass-through connections. A vendor specific sub tree is also included within the tree that may be used to contain vendor specific settings.

Abstract: Described is a provisioning system for receiving configuration changes to and queries of settings on a mobile device. One implementation includes a router component and a configuration manager component. The router component is responsible for receiving messages delivered to the mobile device and parsing the messages into requests for information. The messages may be delivered in document format, such as in the eXtensible Markup Language (XML) format. The requests may take the form of a request to respond with existing configuration settings. The configuration manager component is responsible for determining what configuration settings are affected by the message and for processing the requests within the message. For example, the configuration manager component may process a request to query a configuration setting by retrieving the requested information from a hardware register or a software registry.