WO2019083210A1

WO2019083210A1 - System for controlling security service and operating method thereof

Info

Publication number: WO2019083210A1
Application number: PCT/KR2018/012099
Authority: WO
Inventors: 장소정; 문승호; 정우영; 황석준; 황승오
Original assignee: 삼성전자주식회사
Priority date: 2017-10-23
Filing date: 2018-10-15
Publication date: 2019-05-02
Also published as: KR20190044815A

Abstract

Various embodiments of the present invention relate to a system for controlling a security service and an operating method thereof. According to various embodiments, a system may comprise: a network interface; at least one processor operatively connected to the network interface; and at least one memory operatively connected to the processor, wherein: the memory stores instructions that, when executed, cause the processor to receive a request for authentication of a license through the network interface from an electronic device to which MDM is applied, authenticate the license, and provide the electronic device with information related to the license through the network interface; the information comprises a permission indicating at least one allowed function or component of the electronic device and a service indicating at least one application program that the electronic device is allowed to use; and the electronic device downloads the at least one application program, and operates on the basis of whether the service is allowed during execution of the application program. Various embodiments are possible.

Description

SYSTEM AND METHOD FOR CONTROLLING SECURITY SERVICE

Various embodiments of the present invention disclose a system for controlling a security service and a method of operation thereof.

(PDAs), wearable devices, digital cameras (personal digital assistants), personal digital assistants (PDAs), personal digital assistants various types of electronic devices such as a camera or a personal computer are widely used.

In recent years, as the information and communication technology (IT) industry development has accelerated, the business environment is also rapidly changing. According to one embodiment, a company recently introduced BYOD (bring your own device) system. BYOD can be a way for businesses to make electronic devices such as employees' personal smartphones, tablet PCs, laptops, etc. available for work at work. This has the advantage of being cost-effective (eg, reducing the cost of purchasing equipment) for the enterprise and has the advantage of improving employee productivity. On the other hand, the BYOD system may be vulnerable to corporate security such as leakage of business information due to the use of personal electronic devices and external mobility. Recently, interest, research and development on a mobile device management (MDM) solution have been increasing.

MDM can refer to a series of processes to protect, manage, monitor, and support electronic devices. For example, MDM can represent a solution that enables some functions of electronic devices to be centrally controlled by enterprise IT managers and managed to enforce security policies.

In general, when a particular application in an electronic device attempts to use a secured (or restricted) function (e.g., an application programming interface (API) for a function), the application must have permission related to the security function May be possible. If the application is not authorized, the application may be able to invoke the secured function (eg API) after activating the license. According to one embodiment, an API for a secured function may exist for each secured feature (or service). Therefore, in an electronic device to which a security solution is applied, there is an inconvenience that complicated procedures for activating licenses must be performed every time a characteristic (or service) is to be used for an unauthorized application, May be increased.

In various embodiments, a licensing system for managing a security license for controlling a security service in a mobile device management (MDM) solution and a control method thereof are disclosed.

A system according to various embodiments of the present invention includes a network interface, at least one processor operatively connected to the network interface, and at least one memory operatively coupled to the processor, Wherein the processor is configured to receive a request to authenticate a license through the network interface from an electronic device to which mobile device management (MDM) is applied, perform authentication of the license, The method comprising the steps of: storing instructions that allow the electronic device to provide information related to the license, the information including at least one permission or permission to specify at least one permitted function or component of the electronic device, ), And at least one Wherein the electronic device is operable to download the at least one application program and to operate based on whether the service is permitted when the application program is executed, have.

An electronic device in accordance with various embodiments of the present invention includes a network interface, at least one processor operatively coupled to the network interface, and at least one memory operatively coupled to the processor, Wherein the processor, when executing an application program, transmits a request for authenticating a license through the network interface to the server, and from the server, via the network interface, information relating to the license Wherein the information includes permission to indicate at least one permitted function or component of the electronic device, and instructions for the electronic device to use At least one permitted application program The electronic device, comprising: a service (service) indicates may be operated at least one application download (download) the program and on the basis of whether or not to allow execution of the service to the application program.

A method of operating a system in accordance with various embodiments of the present invention includes receiving a request to authenticate a license through a network interface from an electronic device to which mobile device management (MDM) is applied, performing authentication of the license And providing, via the network interface, information related to the license to the electronic device, the information including at least one permitted function or component of the electronic device, And at least one application program that is permitted to be used by the electronic device, the electronic device downloading the at least one application program, And when executing the application program, It may be operated on the basis of whether or not for.

An operation method of an electronic device according to various embodiments of the present invention includes an operation of transmitting a request for authenticating a license through a network interface to a server when an application program is executed, The method comprising: receiving, via a network interface, information related to the license, the information comprising: a permission indicating at least one permitted function or component of the electronic device; The electronic device comprising a service representative of at least one application program permitted to be used by the electronic device, the electronic device downloading the at least one application program and determining whether the service is permitted upon execution of the application program Based operation.

According to the system and method of operation according to various embodiments, it may be possible to control usage for a service in a system applying a mobile device management (MDM) solution. According to various embodiments, the range of the security function that is controlled based on the permission (or authority) can be extended to the service base, thereby extending the control range of the license system.

1 is a block diagram of an electronic device in a network environment in accordance with various embodiments.

2 is a block diagram of a program according to various embodiments.

3 is a diagram schematically illustrating an example of a system configuration according to various embodiments.

4 is a diagram illustrating an example of controlling licenses on a service basis in a system according to various embodiments.

5 is a diagram illustrating an example of controlling a license based on a service in a system according to various embodiments.

6 is a flow chart illustrating operation of an electronic device according to various embodiments.

7 is a flow chart illustrating operation of a manufacturer server in accordance with various embodiments.

8 is a flow diagram illustrating operation of a vendor server in accordance with various embodiments.

9 is a diagram illustrating operations for managing licenses in a system according to various embodiments.

Hereinafter, various embodiments of the present document will be described with reference to the accompanying drawings. The embodiments and terminology used herein are not intended to limit the invention to the particular embodiments described in the specification, but are intended to cover various modifications, equivalents, and / or alternatives of the embodiments. Should be understood. In connection with the description of the drawings, like reference numerals may be used for similar components. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. Accordingly, the scope of the present invention should be construed as including all modifications based on the technical idea of the present invention or various other embodiments.

1 is a block diagram of an electronic device 101 in a network environment 100 in accordance with various embodiments.

1, an electronic device 101 in a network environment 100 communicates with an electronic device 102 via a first network 198 (e.g., near-field wireless communication) or a second network 199 (E. G., Remote wireless communication). &Lt; / RTI > According to one embodiment, the electronic device 101 is capable of communicating with the electronic device 104 through the server 108. According to one embodiment, the electronic device 101 includes a processor 120, a memory 130, an input device 150, an audio output device 155, a display device 160, an audio module 170, a sensor module 176, an interface 177, a haptic module 179, a camera module 180, a power management module 188, a battery 189, a communication module 190, a subscriber identity module 196, and an antenna module 197 ). In some embodiments, at least one (e.g., display 160 or camera module 180) of these components may be omitted from the electronic device 101, or other components may be added. In some embodiments, for example, as in the case of a sensor module 176 (e.g., a fingerprint sensor, an iris sensor, or an illuminance sensor) embedded in a display device 160 Components can be integrated and implemented.

Processor 120 drives at least one other component (e.g., hardware or software component) of electronic device 101 that is coupled to processor 120 by driving software, e.g., program 140, And can perform various data processing and arithmetic operations. Processor 120 loads instructions and data received from other components (e.g., sensor module 176 or communications module 190) into a volatile memory 132 for processing, May be stored in a non-volatile memory (134). According to one embodiment, the processor 120 may include a main processor 121 (e.g., a central processing unit (CPU) or an application processor (AP)) and, independently, (E.g., a graphics processing unit (GPU), an image signal processor (ISP), a sensor hub, etc.) using a lower power than the main processor 121, A sensor hub processor, or a communication processor (CP)). Here, the coprocessor 123 may be operated separately from or embedded in the main processor 121.

In such a case, the coprocessor 123 may, for example, be on behalf of the main processor 121 while the main processor 121 is inactive (e.g., in a sleep state) At least one of the components of the electronic device 101 (e.g., the display device 160, the sensor), the main processor 121, (E.g., module 176, or communication module 190). According to one embodiment, the coprocessor 123 (e.g., an image signal processor or communications processor) is implemented as a component of some other functionally related component (e.g., camera module 180 or communication module 190) .

Memory 130 may store various data used by at least one component (e.g., processor 120 or sensor module 176) of electronic device 101, e.g., software (e.g., program 140) ), And input data or output data for the associated command. The memory 130 may include a volatile memory 132 or a non-volatile memory 134.

The program 140 may be software stored in the memory 130 and may include, for example, an operating system (OS) 142, a middleware 144,

The input device 150 is an apparatus for receiving a command or data to be used for a component (e.g., processor 120) of the electronic device 101 from the outside (e.g., a user) of the electronic device 101, A microphone, a mouse, a keyboard, or the like.

The sound output device 155 is an apparatus for outputting a sound signal to the outside of the electronic device 101. For example, the sound output device 155 may include a speaker for general use such as a multimedia reproduction or a sound reproduction and a receiver receiver. According to one embodiment, the receiver may be formed integrally or separately with the speaker.

Display device 160 may be an apparatus for visually providing information to a user of electronic device 101 and may include, for example, a display, a hologram device, or a projector and control circuitry for controlling the projector. According to one embodiment, the display device 160 may include a pressure sensor (or force sensor) capable of measuring the intensity of pressure on a touch circuitry or touch .

The audio module 170 is capable of bi-directionally converting sound and electrical signals. According to one embodiment, the audio module 170 may acquire sound through the input device 150, or may be connected to the audio output device 155, or to an external electronic device (e.g., Electronic device 102 (e.g., a speaker or headphone)).

The sensor module 176 may generate an electrical signal or data value corresponding to an internal operating state (e.g., power or temperature) of the electronic device 101, or an external environmental condition. The sensor module 176 may be, for example, a gesture sensor, a gyro sensor, a barometer sensor, a magnetic sensor, an acceleration sensor, a grip sensor a proximity sensor, a color sensor (e.g., an RGB (red, green, blue) sensor, an infrared (IR) sensor, a biomedical sensor, sensor, a humidity sensor, an illuminance sensor, and the like.

The interface 177 may support a designated protocol that can be wired or wirelessly connected to an external electronic device (e.g., the electronic device 102). According to one embodiment, the interface 177 may include a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, a secure digital (SD) card interface, or an audio interface.

The connection terminal 178 may be a connector capable of physically connecting the electronic device 101 and an external electronic device such as the electronic device 102, for example, an HDMI connector, a USB connector, an SD card connector , Or an audio connector (e.g., a headphone connector).

The haptic module 179 may convert electrical signals into mechanical stimuli (e.g., vibrations or movements) or electrical stimuli that the user may perceive through a tactile or kinesthetic sense. The haptic module 179 may include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

The camera module 180 can capture a still image and a moving image. According to one embodiment, the camera module 180 may include one or more lenses, an image sensor, an image signal processor, or a flash.

The power management module 188 is a module for managing the power supplied to the electronic device 101, and may be configured as at least a part of, for example, a power management integrated circuit (PMIC).

The battery 189 is an apparatus for supplying power to at least one component of the electronic device 101 and includes, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell .

The communication module 190 is responsible for establishing a wired or wireless communication channel between the electronic device 101 and an external electronic device (e.g., electronic device 102, electronic device 104, or server 108) Lt; / RTI > Communication module 190 may include one or more communication processors that support wired communication or wireless communication, operating independently of processor 120 (e.g., an application processor). According to one embodiment, the communication module 190 may include a wireless communication module 192 (e.g., a cellular communication module, a short range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module 194 (E.g., a local area network (LAN) communication module, or a power line communication module), and the corresponding communication module may be used to communicate with a first network 198 (e.g., Bluetooth, WiFi direct, Communication network) or a second network 199 (e.g., a telecommunications network such as a cellular network, the Internet, or a computer network such as a LAN or wide area network (WAN)). The various types of communication modules 190 described above may be implemented as a single chip or may be implemented as separate chips.

According to one embodiment, the wireless communication module 192 may use the user information stored in the subscriber identification module 196 to identify and authenticate the electronic device 101 within the communication network.

The antenna module 197 may include one or more antennas for externally transmitting or receiving signals or power. According to one embodiment, the communication module 190 (e.g., the wireless communication module 192) may transmit or receive signals to or from an external electronic device via an antenna suitable for the communication scheme.

Some of the components are connected to each other via a communication method (e.g., bus, general purpose input / output (GPIO), serial peripheral interface (SPI), or mobile industry processor interface (MIPI) (For example, commands or data) can be exchanged with each other.

According to one embodiment, the command or data may be transmitted or received between the electronic device 101 and the external electronic device 104 via the server 108 connected to the second network 199. Each of the

electronic devices

102 and 104 may be the same or a different kind of device as the electronic device 101. [

According to one embodiment, all or a portion of the operations performed in the electronic device 101 may be performed in the other one or more of the plurality of external electronic devices 102,104. According to one embodiment, in the event that the electronic device 101 has to perform some function or service automatically or upon request, the electronic device 101 may be capable of executing the function or service itself, And may request the external

electronic device

102, 104 to perform at least some functions associated therewith. The external

electronic device

102, 104 receiving the request can execute the requested function or additional function and transmit the result to the electronic device 101. [ The electronic device 101 can directly or additionally process the received result to provide the requested function or service. For this purpose, for example, cloud computing, distributed computing, or client-server computing techniques may be used.

2 is a block diagram 200 of a program 140 in accordance with various embodiments.

According to one embodiment, the program 140 includes an operating system 142 for controlling one or more resources of the electronic device 101, a middleware 144, or an application executable on the operating system 142 146 < / RTI >

The operating system 142 may include, for example, Android ^TM , iOS ^TM , Windows ^TM , Symbian ^TM , Tizen ^TM , or Bada ^TM . At least some of the programs 140 may be pre-loaded into the electronic device 101 at the time of manufacture, or may be pre-loaded in the user's environment by external electronic devices such as electronic devices 102 or 104 (E.g., server 108, or server 108).

The operating system 142 may control (e.g., allocate or recover) system resources (e.g., processes, memory, or power) of the electronic device 101. The operating system 142 may additionally or alternatively include other hardware devices of the electronic device 101 such as an input device 150, an audio output device 155, a display device 160, an audio module 170, A sensor module 176, an interface 177, a haptic module 179, a camera module 180, a power management module 188, a battery 189, a communication module 190, a subscriber identification module 196, And one or more driver programs for driving the antenna module 197.

The middleware 144 may provide various functions to the application 146 so that the application 146 may use the functions or information provided by the one or more resources of the electronic device 101. [ The middleware 144 includes an application manager 201, a window manager 203, a multimedia manager 205, a resource manager 207, A power manager 209, a database manager 211, a package manager 213, a connectivity manager 215, a notification manager (not shown) 217, a location manager 219, a graphic manager 221, a security manager 223, a telephony manager 225, or a speech recognition manager 227, and the like.

The application manager 201 can manage the life cycle of the application 146, for example. The window manager 203 can manage GUI (graphical user interface) resources used in the screen, for example. The multimedia manager 205 can recognize a format required for playback of media files and perform encoding or decoding of the media file using a codec suitable for the format. The resource manager 207 can manage, for example, the source code of the application 146 or the space of the memory.

The power manager 209 manages the capacity, the temperature, or the power supply of the battery, for example, and can determine or provide the power information necessary for the operation of the electronic device 101 by using the information among them. According to one embodiment, the power manager 209 can interface with a basic input / output system (BIOS).

The database manager 211 may create, retrieve, or modify the database to be used in the application 146, for example. The package manager 213 can manage installation or update of an application distributed in the form of a package file, for example. The connectivity manager 215 can manage, for example, a wireless or wired connection between the electronic device 101 and an external electronic device. The notification manager 217 may provide a function for notifying a user of, for example, a generated event (e.g., a call, a message, or an alarm). The location manager 219 can manage the location information of the electronic device 101, for example. The graphic manager 221 may manage, for example, a graphical effect to be provided to the user or a user interface associated therewith. The security manager 223 may provide, for example, system security or user authentication. The call manager 225 can manage, for example, a voice call or a video call function of the electronic device 101. [ The voice recognition manager 227 transmits the voice data of the user to the server 108 and transmits a command corresponding to the function to be performed in the electronic device 101 or a corresponding voice The converted character data can be received based on the data.

According to one embodiment, the middleware 244 may dynamically delete some existing components or add new ones. According to one embodiment, at least some of the middleware 144 may be included as part of the operating system 142, or may be implemented in software separate from the operating system 142.

The application 146 includes a home 251, a dialer 253, an SMS / MMS 255, an instant message 257, a browser 259, a camera 261, an alarm 263, Contact 265, voice recognition 267, email 269, calendar 271, media player 273, album 275, watch 277, health 279 (e.g., Measurement), or environmental information 281 (e.g., pressure, humidity, or temperature information) applications.

According to one embodiment, the application 146 may further include an information exchange application (not shown) capable of supporting the exchange of information between the electronic device 101 and an external electronic device. The information exchange application may include, for example, a notification relay application for communicating information (e.g., a call, a message, or an alarm) designated as an external electronic device, or a device management application for managing an external electronic device have.

The notification relay application transmits notification information corresponding to an event (e.g., mail reception) generated in another application (e.g., an email application 269) of the electronic device 101 to an external electronic device , Or receive notification information from an external electronic device and provide it to the user of the electronic device 101. [

The device management application may be used to control the power (e.g., turn on) of an external electronic device that communicates with the electronic device 101 or some of its components (e.g., the display device 160 or the camera module 180) (e.g., brightness, resolution, or focus of the display device 160 or the camera module 180) of the display device 160 or the display device 160 or the turn-off of the display device 160 or the turn-off of the display device 160 or the camera module 180. The device management application may additionally or alternatively support the installation, deletion, or update of an application running on an external electronic device.

The electronic device 101 according to the various embodiments disclosed herein can be various types of devices. The electronic device can include, for example, at least one of a portable communication device (e.g., a smart phone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance. The electronic device according to the embodiment of the present document is not limited to the above-described devices.

In the various embodiments disclosed herein, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. In this document, the expressions "A or B," "at least one of A and / or B," "A, B or C," or "at least one of A, B, and / Possible combinations. Expressions such as "first", "second", "first" or "second" may be used to qualify the components, regardless of order or importance, and to distinguish one component from another And does not limit the constituent elements. When it is mentioned that some (e.g., first) component is "(functionally or communicatively) connected" or "connected" to another (second) component, Or may be connected through other components (e.g., a third component).

As used herein, the term " module " includes a unit of hardware, software, or firmware and may include, for example, logic, a logic block, Circuits, and the like. A module may be an integrally constructed component or a minimum unit or part thereof that performs one or more functions. For example, the module may be configured as an application-specific integrated circuit (ASIC).

Various embodiments of the present document may include instructions stored in machine-readable storage media (e.g., internal memory 136 or external memory 138) readable by a machine (e.g., a computer) (E. G., Program 140). &Lt; / RTI > The device may include an electronic device (e.g., electronic device 101) in accordance with the disclosed embodiments as an apparatus that is operable to invoke stored instructions from the storage medium and act upon the called instructions. When an instruction is executed by a processor (e.g., processor 120), the processor may perform functions corresponding to the instruction, either directly or using other components under the control of the processor. The instructions may include code generated or executed by a compiler or an interpreter. A device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-temporary' means that the storage medium does not include a signal and is tangible, but does not distinguish whether data is stored semi-permanently or temporarily on the storage medium.

According to one embodiment, a method according to various embodiments disclosed herein may be provided in a computer program product. A computer program product can be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a machine-readable storage medium (eg CD-ROM, compact disc read only memory) or online via an application store (eg PlayStore ^™ ). In the case of on-line distribution, at least a portion of the computer program product may be temporarily stored, or temporarily created, on a storage medium such as a manufacturer's server, a server of an application store, or a memory of a relay server.

Each of the components (e.g., modules or programs) according to various embodiments may be comprised of a single entity or a plurality of entities, and some subcomponents of the aforementioned subcomponents may be omitted, or other subcomponents may be various May be further included in the embodiments. Alternatively or additionally, some components (e.g., modules or programs) may be integrated into a single entity to perform the same or similar functions performed by each respective component prior to integration. Operations performed by a module, program, or other component, in accordance with various embodiments, may be performed sequentially, in a parallel, repetitive, or heuristic manner, or at least some operations may be performed in a different order, Can be added.

3, a system 300 according to various embodiments includes a vendor 310, a manufacturer server (e.g., a Samsung server) 320, an electronic device 330, .

3 illustrates an example of a functional processing module associated with providing a service-based license in a system 300 in accordance with various embodiments. In various embodiments, the functional processing module may be included in each component (e.g., vendor 310, manufacturer server 320, electronic device 330). According to various embodiments, the vendor 310, the manufacturer server 320, and the electronic device 330 process (e.g., request for licenses, generate, register, transmit, or receive) operations related to providing licenses to each other (E.g., at least some of the components corresponding to the components of the electronic device 101 shown in FIG. 1). For example, although not shown, the vendor 310, the manufacturer server 320, and the electronic device 330 may include a network interface for wireless communication with each other, a network interface operatively connected to the network interface, At least one processor, and at least one memory operatively coupled to the processor, respectively.

Referring to FIG. 3, in various embodiments, vendor 310 may represent a module provided (or implemented) by, for example, a vendor (vendor) that intends to use MDM. For example, the vendor 310 may provide services using the MDM API provided by the manufacturer of the electronic device 330 (e.g., the electronic device 101 of FIG. 1), a vendor that builds an MDM solution in the business (or server) of a vendor (e.g., a third party, or a carrier). According to one embodiment, the vendor 310 may include an MDM server 311 or the like.

According to one embodiment, the MDM server 311 is an administration service that manages the electronic device 330 and may change the configuration of the electronic device 330 and other MDM related systems, Patches can be applied. The MDM server 311 may store the security policy established by the administrator. The MDM server 311 can control the violation rights based on the established security policy. For example, the MDM server 311 may limit the camera-related API permissions of the electronic device 330 or may monitor the operation of the electronic device 330.

The MDM server 311 needs a key for the enterprise and may push the license key to the MDM client 337 of the electronic device 330. [ According to one embodiment, the license key may include at least one of a key for authentication, a key for identification, required software development kit (SDK) information, or authorization information. According to one embodiment, the MDM server 311 may apply and obtain via a web portal (e.g., the portal server 321 of the manufacturer server 320). The detailed operation of the MDM server 311 will be described with reference to the following drawings.

In various embodiments, the manufacturer server 320 may be a server that provides an MDM solution, for example, a manufacturer of the electronic device 330. In various embodiments, the manufacturer server 320 may provide the SDK and license key to a particular business (e.g., vendor 310) with the MDM solution. According to one embodiment, the manufacturer server 320 may include a portal server 321, a global server load balancing (GSLB) server 323, and a license server 325 .

According to one embodiment, the portal server 321 may issue a license with an SDK that provides security functions (e.g., a Knox function) within the electronic device 330. For example, the portal server 321 may include an enterprise alliance program (EAP) and a license manager (LM). According to one embodiment, the SEAP provides an SDK for security functions within the electronic device 330, which allows the developer to create a more secure and differentiated enterprise solution via the SDK. According to one embodiment, the license manager may issue licenses.

According to one embodiment, the GSLB server 323 may return the address of a license server (e.g., license server 325 of FIG. 3) that is appropriate for the electronic device 330 (e.g., a license client 331) (E.g., server / site load balancing), a fast service response (e.g., low latency by network proximity) to the electronic device 330, or an electronic device 330 may provide the most suitable license server to the electronic device 330 considering the proximity to the nearest server (e.g. nearest by geographic proximity).

According to one embodiment, the license server 325 may include a server for managing and storing license keys.

In various embodiments, the electronic device 330 (e.g., the electronic device 101 of FIG. 1) may download a particular application and install the downloaded application. According to various embodiments, the electronic device 330 may be driven based on a predetermined operating system (OS) and may manage the application based on the OS driving method. For example, the electronic device 330 can manage applications based on various operating systems such as Android ^TM , iOS ^TM , Windows ^TM , Symbian ^TM , Tizen ^TM , Bada ^TM , and BlackBerry ^TM . In various embodiments, an application may include a generic meaning of a program, service, or function that may be executed on various operating systems.

According to various embodiments, the electronic device 330 may provide some of the API rights required by the application 335, based on the security policy established by the vendor 310 (e.g., MDM server 311) Can be limited. Accordingly, the user of the electronic device 330 can only use some of the allowed functions of the application 335 (or make some functions unavailable) under the MDM solution, and the security of the business (or in-house) can be enhanced . According to one embodiment, the electronic device 330 may not permanently utilize API privileges initially granted by the MDM solution. For example, the electronic device 330 may periodically or aperiodically query the manufacturer server 320 (or the server of the manufacturer of the electronic device 330) whether the license key is valid. The electronic device 330 may re-establish the API rights that are granted based on the right object (RO) that is answered according to the validity of the license key from the manufacturer server 320.

According to one embodiment, the electronic device 330 includes a license client 331, a framework (e.g., MDM framework) 333, a service 335, and an MDM client 337, .

According to one embodiment, the MDM client 337 may represent a client that interacts between the electronic device 330 and the MDM server 311. According to one embodiment, the MDM client 337 may activate licenses and use features.

According to one embodiment, the license client 331 may include a module for authenticating licenses within the electronic device 330. According to one embodiment, the framework 333 may represent a framework that provides various features (e.g., Knox / MDM Feature) within the electronic device 330. According to one embodiment, the service 335 may represent a Feature (e.g., a Knox Feature) provided within the electronic device 330.

Hereinafter, a description will be given with respect to a scenario in which the range of the feature controlled based on the permission is expanded to the service base and the control range of the license system is extended. For example, an operation example of the license system will be described below as an example of various services. According to various embodiments, a service list (e.g., a Knox service list) that is required to be controlled with the current license may be provided. In various embodiments, the services included in the service list include, for example, a S-browser (Samsung browser) in addition to a security service (e.g., Knox service) such as Samsung Focus or E-FOTA , A Tachyon service or the like, a B2B application provided in the manufacturer's electronic device 101, and the like.

According to various embodiments, using the API provided by the framework 333 (e.g., MDM Framework) of the electronic device 330 at the point in time when the user wants to use the service of the application or application (e.g., Knox Service) It is possible to confirm whether the service is allowed in the electronic device 330. [ For example, if the callback value of the API returns true, the service can be executed. If the API callback value returns false, the service may not be executed.

According to one embodiment, for a particular application (e.g., a Samsung Focus application, a Tachyon application, etc.), a free function (or open function) and a paid function (or security function) ), Or can be provided by a single application. Or the specific application itself may be provided as a service (e.g., a secure application such as a Tachyon application). Thus, the MDM client 337 may be provided by the user to a payload (or security function) The application 335 internally grants the corresponding service (e.g., a service related to the paid (or security) function) to the MDM API at a point in time to perform a service (for example, a security service such as a Knox service) If the electronic device 330 is in a state in which an associated license (e.g., a license authenticated in connection with the application 335) is active and the license includes the service If it is a license, true may be returned, and if the license is a license that does not include the service, a false may be returned. Based on the fact that the True is returned, the user can use the paid function (or security function) in the specific application using the electronic device 330. An example of specific operation for processing this is shown in FIG.

4 is a diagram for explaining an example of controlling a license based on a service in a system according to various embodiments.

4, an operational scenario for an application (e.g., a Samsung focus application, a Tachyon application, etc.) may be displayed in the electronic device 330. [ According to one embodiment, the Samsung focus application is an application that facilitates managing and processing business-related information such as e-mail, schedule, todo, memo, and address book to exchange active sync (EAS) and IMAP / POP3 users . In various embodiments, the Samsung focus application is divided into a free function and a paid function, and at least one Feature related to the paid function can correspond to a " service " according to various embodiments. According to one embodiment, the Tachyon application is an application that provides an automatic setup (or an automatic configuration) in the electronic device 330, for example, an email or a quick response ) Code to support automated configuration and provisioning of mobile devices. In various embodiments, the Tachyon application may correspond to a " service " in accordance with various embodiments where the application itself is included in the security policy, for example, whether or not the Tachyon application is running. According to one embodiment, even if the Tachyon application is installed in the electronic device 330, the Tachyon application may not run in the electronic device 330 if the service does not include a Tachyon application.

Referring to FIG. 4, at operation 401, a vendor 310 using a security service (or an MDM solution) according to various embodiments may request a license including a feature to be used from the portal server 321. For example, the vendor 310 may request a new license key to the portal server 321 based at least on the selected permissions and services selected by the administrator. In accordance with one embodiment, the permissions may represent at least one permitted function or component of the electronic device 330.

In response to the license key request of the vendor 310, the portal server 321 requests the license manager 321A to issue the license internally and the license server 325 issues the issued (generated) license at the operation 403, Lt; / RTI > According to one embodiment, the portal server 321 may generate a requested license based on the license manager 321A, register the permissions and services requested from the vendor 310 to the generated license , And may be stored in the DB 327 through the license server 325.

At operation 405, the vendor 310 (e.g., the MDM server 311) may obtain a license corresponding to the request of the vendor 310 via the EAP 321B of the portal server 321. [ For example, the vendor 310 may obtain a license including permissions and services. According to one embodiment, the license may further include customer information.

At operation 407, the vendor 310 may inject licenses into the MDM server 311 and distribute the licenses to the MDM client 337.

At operation 409, the MDM client 337 calls the MDM API via the framework 333 (e.g., the MDM Framework) of the electronic device 330 to activate the license to the electronic device 330 ).

In operation 411, the framework 333 passes the license and the package name (pkgName, package name) of the MDM client 337 to the license client 331 of the electronic device 330 via an intent (Transmission).

At operation 413, the license client 331 may obtain information about the package. According to one embodiment, the license client 331 may determine whether a certificate is installed in the electronic device 330 based on the signature hash of the application and obtain information about the result of the determination can do.

At operation 415, the license client 331 may contact the GSLB server 323 to fetch the address of the license server to which the electronic device 330 will connect (e.g., the address of the license server 325) have. For example, the license client 331 may request the URL associated with the license server to which the electronic device 330 can connect and receive the URL from the GSLB server 323, to the GSLB server 323. [

At operation 417, the license client 331 may request the license server 325 to perform license authentication. The license client 331 may access the license server 325 and request license authentication based on the address (e.g., URL) of the license server 325 obtained from the GSLB server 323 have. According to one embodiment, the license client 331 may request the license application 325 to validate the registration application and the license.

In operation 419, the license server 325 responds to the license authentication request of the electronic device 330 (e.g., the license client 331 of the electronic device 330) to the license server 325 DB 327 You can use the stored license and package information (eg, permissions, services) to determine if the requested license is valid. According to one embodiment, the license server 325 may validate the license through the application's signature hash and set permissions and services on the authenticated license.

In operation 421, the license server 325 may send the authentication result to the license client 331. [ According to various embodiments, if the license is authentic, the authentication result may include a license that includes a permission list and a service list.

According to one embodiment, a license structure (e.g., RO (Right Object) structure) may be provided as shown in Table 1 below.

According to various embodiments, the license (e.g., RO) may include service names, a limitation for each service, and a detail field, (E. G., Focus, E-FOTA, Tachyon). &Lt; / RTI > In Table 1, the information about the services under the services item includes the allowed package version, name, or hash value of the public key. As shown in FIG. According to one embodiment, information about a service is provided as an object (e.g., RO, right object) that includes permissions and services (or a list of services, e.g., Focus, E-FOTA, Tachyon) . For example, the object has a JavaScript Object Notation (JSON) file format and the license server 325 transfers the information including the data in the license structure to the electronic device 330 in the JSON file format . In accordance with one embodiment, an object may be stored in a storage medium such as an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency And may include at least one.

At operation 423, the license client 331 may store the authorization result (e.g., information about constraints) on the license within the application. According to one embodiment, the license client 331 may store the authentication results and objects (e.g., permissions, and services).

At operation 425, the license client 331 may pass the license authorization result and objects (e.g., permissions, and services) to the framework 333 (e.g., the MDM Framework).

In operation 427, the framework 333 may store the results in an internal DB (e.g., enterprise DB) of the framework 333 and may grant permissions for the applications. According to one embodiment, the framework 333 may store objects (e.g., permissions and services) obtained via the license client 331 in an internal DB (e.g., enterprise DB) and may be stored in a package manager You can set the permissions by

In operation 429, the framework 333 may communicate the result (intent, result) of the authentication operation to the MDM client 337 in response to all of the license authentication operations being completed. In this way, the MDM client 337 may be enabled to use a Feature (e.g., a paid function or a security function) provided by an activated license (e.g., a license according to the operation 409).

In operation 431, when the user subsequently uses the electronic device 330 to use a paid function (or security function) of an application (e.g., a Samsung Focus application, a Tachyon application, etc.) The MDM API provided by the framework 333 may be called. For example, the application 335 may request through the framework 333 to verify that the electronic device 330 allows an allowed service (e.g., Focus or Tachyon).

In operation 433, the framework 333 determines whether the corresponding service (e.g., Focus, Tachyon) exists in an allowed service (or service list) in an internal DB (e.g., enterprise DB) And return the result value to the application 335. [ According to one embodiment, the framework 333 may return true when the corresponding service exists in the internal DB, and may return a false if the corresponding service does not exist in the internal DB .

According to one embodiment, the application 335 may allow the user to use a paid function (or a security function, the application itself) when a return from the framework 333 is true. According to one embodiment, the application 335 may not allow the use of a paid function (or a security function, the application itself) by the user when a false return from the framework 333 is returned.

5 is a diagram for explaining an example of controlling a license based on a service in a system according to various embodiments.

5, an operation scenario for an application (or service) (e.g., E-FOTA, etc.) may be displayed on the electronic device 330 at the vendor 310. [ For example, FIG. 5 may be limited to the target electronic devices 330 to which the MDM solution is applied, and may indicate an operation upon execution of firmware update or the like.

5, operations 501 to 529 of FIG. 5 are operations corresponding to the operations 401 to 429 of FIG. 4 as described in the description with reference to FIG. And a detailed description of operations 501 to 529 will be omitted. For example, the vendor 310 and the electronic device 330 may be configured to execute an application on the electronic device 330 by the vendor 310 in a state of storing an authorized license, respectively, An operation example can be shown.

At operation 531, the MDM client 337 sends a request to the framework 333 of the electronic device 330 at a point in time to use an application (e.g., an E-FOTA application) You can call the MDM API provided by For example, the MDM client 337 may request through the framework 333 to verify that the electronic device 330 allows an allowed service (e.g., E-FOTA).

At operation 533, the framework 333 determines whether the corresponding service (e.g., E-FOTA) exists in an allowed service (or service list) in an internal DB (e.g., enterprise DB) And return the result value to the application 335. [ According to one embodiment, the framework 333 may return true when the corresponding service exists in the internal DB, and may return a false if the corresponding service does not exist in the internal DB .

According to one embodiment, the application 335 may allow E-FOTA to be executed (e.g., firmware update, etc.) by the electronic device 330 when TRUE from the framework 333 is returned. According to one embodiment, the application 335 may not allow the execution of E-FOTA by the electronic device 330 when a false return from the framework 333 is returned.

As described above, in a system according to various embodiments (e.g., a server operating a license, e.g., a manufacturer server 320), a network interface, at least one processor operatively coupled to the network interface, And at least one memory operatively coupled to the processor, wherein the memory, in execution, permits the processor to license through the network interface from the electronic device (330) to which the mobile device management (MDM) The method comprising the steps of: receiving a request to authenticate a license, perform authentication of the license, and provide, via the network interface, information relating to the license to the electronic device, At least one permitted function or component of the electronic device 330 ent and at least one application program 325 allowed to be used by the electronic device 330, the electronic device comprising: at least one of the at least one And may be operated based on whether the service is permitted when the application program is executed.

According to various embodiments, the information may include an object including the permission and the service.

According to various embodiments, the object may be a JavaScript Object Notation (JSON) file format.

According to various embodiments, the object may include an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency, As shown in FIG.

According to various embodiments, the system includes at least one server (e.g., a portal server 321, a GSLB server 323, a license server 325) that provides the MDM, , Receives a request for a license key from the vendor 310 for MDM construction, generates a license key including the permission and the service in response to the request, and transmits the generated license key to the vendor 310 .

As discussed above, the electronic device 330 utilizing mobile device management (MDM) in accordance with various embodiments includes a network interface, at least one processor operatively coupled to the network interface, and at least one processor operatively coupled to the processor And at least one memory, wherein the processor, upon execution, causes the processor to, upon execution of an application program, send a request to the server (320) to authenticate a license via the network interface And instructions for causing the server (320) to receive, via the network interface, information pertaining to the license, the information including at least one permitted function of the electronic device (330) a permission indicating a function or a component, The electronic device 330 includes a service that represents at least one application program that the device 330 is allowed to use and the electronic device 330 downloads the at least one application program 325 and the application program And may be operated based on whether or not the service is permitted at the time of execution.

According to various embodiments, the license may be obtained from a vendor 310 that receives and distributes the license from the server.

In accordance with various embodiments, the electronic device 330 (or the electronic device 101 of FIG. 1) in FIG. 6 may be an electronic device using a MDM solution.

Referring to FIG. 6, at operation 601, an electronic device 330 (or processor 120 including processing circuitry) may obtain a license. According to one embodiment, the electronic device 330 may install an application (or an application program) and obtain a license associated with the application. According to one embodiment, an application is at least partially associated with a vendor 310 (or business entity), and may be an application in which at least some functions (or services) operate in a limited manner depending on the application. According to one embodiment, the electronic device 330 includes a license (e.g., including permissions and services) that is requested by the vendor 310 and registered with the manufacturer server 320, as described in the description section with reference to FIG. It is possible to obtain a license required by the application.

At operation 603, the processor 120 may detect application execution. According to one embodiment, application execution may include execution by a user (e.g., Samsung Focus application execution) or by a vendor 310 (e.g., execution of an E-FOTA application).

In operation 605, the processor 120, in response to detecting application execution, may determine whether a confirmation of a license based on the application is required. According to one embodiment, the processor 120 may determine whether the function of the application or application for which execution is requested is a paid function (or a security function) that requires confirmation of the license. In accordance with another embodiment, processor 120 determines the type of application and determines whether it is an application that operates based on a specific authority (e.g., an enterprise application, a license-based administration application, etc.) It can be determined whether the application is an operating application.

At operation 605, the processor 120 may execute the requested application at operation 607 if it determines that a license check is not required (NO at operation 605).

At operation 605, processor 120 may call the MDM API at operation 609 if it determines that a license check is required (operation 605). According to one embodiment, at the time of execution of the application, the processor 120 calls the API provided by the framework 333 to determine whether a service related to the application or the application is acceptable to the electronic device 330 . For example, an application requested for execution may request via framework 333 to verify that electronic device 330 allows an allowed service, and framework 333 may request an internal DB (e.g., enterprise DB) (Or the service list) in the service 335, and returns the result to the application 335. [

At operation 611, the processor 120 may determine whether a callback value from the API returns true or whether a false is returned.

At operation 611, processor 120 may allow the application or application to use the service at operation 613, based on confirming that true is returned (operation 611) , Then the application may be run at operation 615. [

At operation 611, processor 120 may determine at operation 617 that it will not allow the application or application to use the service based on confirming that the false is returned (NO at operation 611) (May be unacceptable) and may cause the application or application to stop executing the service at operation 617.

In accordance with various embodiments, in FIG. 7, the manufacturer server 320 may be a server that provides an MDM solution and may be, for example, the manufacturer of the electronic device 330. According to various embodiments, the manufacturer server 320 may provide the SDK and license key to the vendor wishing to build the MDM solution in a particular business.

7, at operation 701, a manufacturer server 320 (e.g., portal server 321) may receive a license key request from a vendor 310 (e.g., MDM server 311). For example, the vendor 310 may request a license key from the manufacturer server 320 based at least on permissions and services for the application (or application program) or application of the application to be used. According to one embodiment, (320) may directly receive a request for a license key from vendor (310), or may receive a request for a license key in a variety of ways, such as relaying a web portal (e.g., portal server (321)).

At operation 703, the manufacturer server 320 may generate a license key based on receiving the license key request. According to one embodiment, the manufacturer server 320 may generate a license key that includes permissions and services.

At operation 705, the manufacturer server 320 may transfer the license key to the vendor 310. [

At operation 707, the manufacturer server 320 may receive a registration request by the license key from the electronic device 330. [ According to one embodiment, the electronic device 330 may receive the license key from the vendor 310 and may request the manufacturer server 320 to register for that license key.

At operation 709, the manufacturer server 320 may perform license authentication. According to one embodiment, the manufacturer server 320 may determine whether the license key of the electronic device 330 is valid and generate an authentication result based on the determination result. According to various embodiments, if the license is authentic, the authentication result may include a license that includes a permission list and a service list.

At operation 711, the manufacturer server 320 may send the authentication result to the electronic device 330. [ According to one embodiment, the authentication result may be provided as an object including permissions and services (or a list of services, e.g., Focus, E-FOTA, Tachyon). For example, the object has a JavaScript Object Notation (JSON) file format, and the manufacturer server 320 (e.g., the license server 325) has a JSON file format, Information to the electronic device 330. According to one embodiment, an object may include an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency, Or the like.

Figure 8 is a flow diagram illustrating the operation of a vendor in accordance with various embodiments.

Referring to FIG. 8, at operation 801, the vendor 310 may obtain a license from the manufacturer server 320, including permissions and services. According to one embodiment, the vendor 310 may request a license key from the manufacturer server 320 based at least on permissions and services for the application (or application program) or application of the application to be used, and the corresponding license key From the manufacturer server (320).

At operation 803, the vendor 310 may store the security policy. According to one embodiment, the vendor 310 may set security policies (e.g., constraints related to an application or application service) established by the administrator.

At operation 805, the vendor 310 may request activation of the license to the electronic device 330. According to one embodiment, the vendor 310 may send at least one of the license key or security policy to the electronic device 330 using the MDM solution. For example, the MDM client 337 may call the MDM API via the framework 333 (e.g., MDM Framework) of the electronic device 330 to activate the license on the electronic device 330 Can be requested.

9 is a flow diagram illustrating operations for managing licenses in a system according to various embodiments.

According to various embodiments, FIG. 9 may illustrate an example of an operation of managing a service-based license in a company (e.g., a manufacturer server 320) operating a license server 325. According to various embodiments, the vendor 310, the manufacturer server 320, and the electronic device 330 may each comprise a network interface (or communication circuit) configured to enable wireless communication with one another .

9, at operation 901, a manufacturer server 320 (or a processor (not shown) of a manufacturer server 320) may receive a request to authenticate a license from the electronic device 330 .

At operation 903, the manufacturer server 320 may perform license authentication based on receiving a request for license authentication from the electronic device 330. [

At operation 905, the manufacturer server 320 may provide the electronic device 330 with information related to the license. According to one embodiment, the license-related information includes, for example, permission to specify at least one permitted function or component of the electronic device 330, and permission for the electronic device 330 to use And may include a service that represents at least one permitted application (or application program). According to one embodiment, the electronic device 330 may download and use at least one application while the MDM is being applied. According to one embodiment, the information associated with the license may be provided as an object including permissions and services. According to one embodiment, the object may have a JavaScript Object Notation (JSON) file format.

As described above, a method of operating a system according to various embodiments (e.g., a server operating a license, for example, a manufacturer server 320) may be implemented by an electronic device 330 Receiving, by the network interface, information relating to the license to the electronic device (330); receiving, via the network interface, a request for authenticating a license through a network interface; performing an authentication of the license; Wherein the information includes permission to indicate at least one permitted function or component of the electronic device 330 and to permit the electronic device 330 to use Wherein the at least one application comprises a service that represents at least one application program (325) And may be operated based on whether the service is permitted when the application program is downloaded.

According to various embodiments, the server 320 includes at least one server (e.g., a portal server 321, a GSLB server 323, a license server 325) that provides the MDM, 320) comprises: receiving a request for a license key from the vendor 310 to build an MDM; generating a license key including the permission and the service corresponding to the request; and generating the generated license key To the vendor (310).

As described above, the operation method of the electronic device 330 using the mobile device management (MDM) according to various embodiments is a method of licensing through the network interface when the application program 325 is executed, To the server (320), and receiving, via the network interface from the server (320), information related to the license, the information including information about the electronic device (330) A permission to indicate at least one permitted function or component of the electronic device 330 and a service to indicate at least one application program that the electronic device 330 is allowed to use, , The electronic device downloads the at least one application program and the application program During running it can be operated on the basis of whether or not to allow the said service.

According to various embodiments, the license may be obtained from a vendor that receives and distributes the license from the server.

The various embodiments of the present invention disclosed in the present specification and drawings are merely illustrative examples of the present invention and are not intended to limit the scope of the present invention in order to facilitate understanding of the present invention. Accordingly, the scope of the present invention should be construed as being included in the scope of the present invention, all changes or modifications derived from the technical idea of the present invention.

Claims

In the system,

Network interface;

At least one processor operatively coupled to the network interface; And

At least one memory operatively coupled to the processor, the memory including, in execution,

Receiving a request to authenticate a license from the electronic device to which the mobile device management (MDM) is applied through the network interface,

Perform the authentication of the license, and

Via the network interface, instructions for providing information related to the license to the electronic device,

Wherein the information includes at least one of an authorization to indicate at least one permitted function or component of the electronic device and at least one application program authorized to use the electronic device, Service,

Wherein the electronic device is operated based on whether the service is allowed when downloading the at least one application program and executing the application program.
The information processing apparatus according to claim 1,

And an object including the permission and the service.
3. The method according to claim 2,

A system that is a JavaScript Object Notation (JSON) file format.
4. The method according to claim 3,

Wherein the system further comprises at least one of an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency.
The system of claim 1,

And at least one server providing the MDM,

The server receives a request for a license key from a vendor to build an MDM,

Generating a license key including the permission and the service in response to the request,

And provides the generated license key to the vendor.
An electronic device using mobile device management (MDM)

Network interface;

At least one processor operatively coupled to the network interface; And

And at least one memory operatively coupled to the processor, wherein the memory, upon execution,

A program for transmitting a request for authenticating a license through the network interface to a server when an application program is executed,

Storing instructions from the server, via the network interface, to receive information related to the license,

Wherein the information includes at least one of a permission indicating at least one permitted function or component of the electronic device and a service indicating at least one application program allowed to be used by the electronic device. Lt; / RTI >

Wherein the electronic device is operable to download the at least one application program and to operate based on whether the service is permitted when the application program is executed.
7. The method of claim 6,

And an object including the permission and the service.
8. The method of claim 7,

An electronic device that is a JavaScript Object Notation (JSON) file format.
7. The method according to claim 6,

Further comprising at least one of an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency.
7. The method of claim 6,

The electronic device being obtained from a vendor that receives and distributes the license from the server.
A method of operating an electronic device using mobile device management (MDM)

Transmitting, upon execution of an application program, a request for authenticating a license via a network interface to a server; and

Receiving, via the network interface, information relating to the license from the server,

Wherein the information includes at least one of a permission indicating at least one permitted function or component of the electronic device and a service indicating at least one application program allowed to be used by the electronic device. Lt; / RTI >

Wherein the electronic device is operative to download the at least one application program and to operate based on whether the service is allowed when the application program is executed.
12. The method of claim 11,

And an object including the permission and the service.
13. The method according to claim 12,

JavaScript Object Notation (JSON) file format.
12. The method according to claim 11,

Further comprising at least one of an ID, a state, an issue date, an expiration date, a license type, an upload time, or an upload frequency.
12. The method of claim 11,

Wherein the license is obtained from a vendor that receives and distributes the license from the server.