200522744 九、發明說明： 主張優先權及交互參考 本專利申請案要求下列美國臨時專利申請案之權利： 2003年9月29日提出第60/507,197號名為「GO-KEY SYSTEM」；2003年9月29日提出第60/506,918號名為 「GO-KEY ONLINE MUSIC SUBSCRIPTION AND DISTRIBUTION APPLICATION AND SERVICE」；2003年 9 月 29 日提出第 60/506,919 號名為「GO-KEY E-MAIL APPLICATION AND SERVICE」；2003 年 9 月 29 日提出第 60/506,925 號名為「GO-KEY MOBILE DESKTOP ENVIRONMENT」； 2004年1月22日提出第60/543，735號名為 「MDMS」； 2004年1月22日提出第60/538,763號名為「OMNI FILE SYSTEM (OFS)」；2004年 1 月 22 日提出第 60/538,915 號名為「UDDI DIRECTORY」；以及2004年1月22日提出第 60/538,767號名為「UDDI REPOSITORY」，彼等專利申請案 皆以引用方式併入本文中。另外，本專利申請案係相關於 以下專利申請案且交互參考，並且彼等專利申請案皆以引 用方式併入本文中：2004年4月30日提出第10/837,426號名 為「MOBILITY DEVICE PLATFORM」（代理人檔案號碼 45 597/196314);以及2004年4月 30 日提出第 10/836,933號名 為「MOBILITY DEVICE」（代理人檔案號碼 45597/196314)。 【發明所屬之技術領域】 本文描述之系統及方法係相關於行動電腦作業技術’最 為重要的是，係關於一種允許安全的遠端行動電腦作業之 96373.doc 200522744 行動裝置管理伺服器。 【先前技術】 企業及個人一致地愈來愈需要行動能力作為其電腦環境 的特徵部分。對於企業，行動能力允許在各地理位置部署 人貝，使企業為客卢提供更好的服務。例如，大型製藥企 業會想要在接近未來客戶（例如，醫生）的「現場」部署業務 人員。在此背景下，「現場」人員會想要透過安全連線來存 取機密的銷售和市場資訊以及電腦應用程式。運用現行的 方案，這些人員通常會在工作日結束時，繼續透過某安全 的電腦網路連線（例如，虛擬私人網路）來進行使其資料與公 司.罔路1¾步化」繁雜工作。相比之下，個人尋求其電腦 環境，行動能力，以便能夠易取得其資料及€腦應用程 式，最為重要的是，在網際網路通信期間繼續維持「連線 狀態」。 為了應響行動電腦作業的需要，電腦環境製造商已開發 出行動電腦作業技術（例如，獨立、連線網路及/或内嵌式）， 讓人們可隨時使用其電腦環境。此類行動裝置旨在允許使 用者隨時「攜帶」其標案及應用程式。雖然料裝置提供 :行動能力，但是會由於外型、處理能力及可攜性不同而 傾向於效率有限。由於彼等限制，使用者通常會揭帶大型 Γ 嵩型電腦’以確保其具有所有必要的檑案及電腦應用程 2。貫現此類方案係以電腦作業系統（_pUting system)本 計為前提，#’採用「以裝置為中心」電腦作業。 運用「以裝置為中心、」電腦作業，電腦使用者雖然可經 96373.doc 200522744 由遠端通信應用程式（例如，虛擬私人網路）以遠端且安全方 式來存取標案’但是仍然會攜帶大型笨重的電腦作業設備 來掏取其資料及電腦應用程式。最為重要的是，運用以裝 置為中心型電腦作業，使用者一般會基於企業電腦作業需 求而配備一個裝置（例如，公司個人電腦或膝上型電腦），並 且一般會在家中具有供個人使用的一或多個電腦環境。在 維護多個電腦環境過程中，電腦使用者負責使許多不同電 腦環境之間的自訂偏好設定及各項設定同步化之工作。此 潁工作疋件萬分艱紐的事，並且通常會因電腦使用者無法 在不同電腦辱:境之間存取所要的資料及/或電腦應用程式 而受挫。 例如，電腦使用者會希望隨時從自己的財務規劃管理電 腦應用程式（例如，Quicken、Micr〇s〇ft M〇ney)取得自己的 財務規劃管理資料，以便處理可能出現的支付款項（例如， 到期的帳單）。運用現行方案，電腦使用者需要在每個電腦 裱境（包括公司電腦，這可能會達反企業電腦作業政策及程 序）上安裝財務規劃管理電腦應用程式及資 取所要的資料。相比之下，企業會想要高效率 已解雇之u對機密公司資料的时#取權。在以裝置為 中心型電腦作業為基礎的現行實施中，會要求員工歸還其 電腦環境（例如，膝上型電腦、個人電腦、行動電話或個人 數位助理另外’還會藉由終止即將解雇之員工的企業使 用者目錄資訊’而使得使用公司資料時受職制。但是， 收集此類裝置及終止存取㈣目就„ —段作業時間。此 96373.doc 200522744 段作業時間會導致該員工從企業電腦環境複製檔案以供未 來使用。在此情況下，依據現行的實施，可能會戌露機密 的企業資料。 從前文所述可得知，需要克服現行實施缺點。 【發明内容】 本發明揭示一種用作行動裝置平臺一部分之用於允許保 護行動電腦作業安全性之行動裝置管理伺服器。在一項例 證實施中，一種示例性電子裝置包括：一行動裝置，其可 運作以透過一通信介面與至少一電腦環境通信，並且其中 該行動裝置可運作成處理及儲存安全的Web服務；一通信 網路，其可運作成使用Web服務來傳達資料及電腦應用程 式；以及一行動裝置管理伺服器，其可運作以產生、處理、 儲存及加密關於該行動裝置的Web服務。另外，該行動裝 置&理飼服器可運作以執行一或多項行動裝置管理功能， 用以提供加密金鑰給合作之行動裝置，以及鑑認並確認向 該行動裝置管理伺服器要求Web服務的合作之行動裝置。 該行動裝置管理伺服器及該行動裝置可進一步運作以使用 使用者識別和密碼資訊來執行鑑認和確認。該行動裝置管 理伺服器可進一步運作以執行有關在該行動裝置平臺上所 處理及執行之Web服務的計量功能及作業。另外，該行動 裝置管理祠服器可運作以支援介於該行動裝置管理伺服器 與合作之行動裝置管理伺服器之間的間歇連線。 在運作過私中，该示行性行動裝置被組態以在一合作之 電腦環境上運用。另外，該行動裝置建置與合作之一或多 96373.doc 200522744 個行動裝置管理伺服器之間的通信，並且嘗試由該等合作 之一或多個行動裝置管理伺服器使用所選之鑑認和確認資 訊予以鑑認。在鑑認和確認後，該等合作之一或多個行動 裝置管理伺服器使用Web服務來處理來自於該合作之示例 性行動裝置的資料和電腦應用程式要求。該等合作之一或 多個行動裝置管理伺服器使用該示例性所選之鑑認和確認 資訊（例如，金鑰）來將Web服務加密，以允許從該等合作之 一或多個行動裝置管理伺服器與該示例性行動裝置安全傳 達所要求之資料和電腦應用程式。 下文中會進一步說明本文描述之系統及方法的其他特 徵。 【實施方式】 概覽： ^文描述之系統及方法針對電腦作業和行動電腦作業提 供「以使用者為中心」做法。現行電腦作業方案（企業或個 人）一般被設計成使用「以裝置為中心」模型。以裝置為中 心式模型旨在依據裝置指派及指定來管理及追縱使用者。 例如’在企業電腦作業背景τ，企業電腦環境可包括數個 飼服益電腦環境及許多用戶端電腦環境。_般而言，企業 中的每個使用者都有配備用戶端電腦環境（例如，個人電腦 或膝上型電腦），-般會透過企業通信介面將用戶端電腦環 境以網路連線至伺服雷^ 、 ^饿境，或是，如果使用者身在 返離企業通信網路之處，則菩 / J疋透過虛擬私人網路（VPN)將用 戶端電腦環境連線至連線？ 止業通j吕網路。另外，在習知 96373.doc -10- 200522744 企業電腦環境中，會透過-用於建立使用者權利和權限與 某企業資料和電腦應用程式之關聯性的目錄服務結構，^ 提供使用者的使用者識別資訊及密碼資訊。 -運用此類企業電腦環境，通常僅允許使用者使用自己的 偏好設定及各項設定來自訂所配備的電腦環境，以至於如 果使用者跨網路漫遊且登入非所屬的電腦環境時，就無法° 存取自己的自》丁偏好設定及各項設定。這項問題通常會發 生在企業使用者身上，企業使用者會想要維護介於其企業 電腦環境與其個人電腦環境（例如，家中的電腦）之間的偏好修 設定及各項設定（例如，瀏覽器書籤、桌面的外觀及操作、 色彩配置、應用程式佈局及檔案的目錄結構）同步化，這通 苇需要執行手動同步化。 另外’運用現有企業電腦環境來管理許多用戶端電腦環、 境變成一項繁重的工作。目前，企業的資訊技術部門雇用 數十人（而不是數百人）來支援許多使用者及使用者的電腦 環境。除了僅僅實際管理以外，還提出企業資料完整性及 安全性運用以裝置為中心式電腦作業模型。在此背景下， f業電腦使用者通常需要自行決定複製及包含機密的企業 資料。由於防止使用者未經授權複製企業播案及資料是一 項繁重的工作，所以大部分企業都忽視此工作。對於企業 及個人，這項現有實施的限制可能成本極高。 本文描述之系及方法旨在藉由提供運用「以使用者為 中〜」換型所设计的行動裝置平臺（MDp)來改良現有實施 -的缺點。在-項例證實施中，該行動裝置平臺包含至少一 96373.doc -11- 200522744 行動裝置（MD)，行動裝置可運作以透過通信介面（例如，通 用序列埠（USB)、IEEE 1394 通信介面（Firewire)、802·ΧΧ 通信介面、blutetooth(藍芽）通信介面、個人電腦介面、小 型電腦序列介面及無線應用通訊協定（WAP)通信介面）來與 一或多個合作的電腦環境（例如，個人電腦、個人數位助 理、行動電話、網路連線型電腦及其他電腦環境）通信。另 外，該行動裝置平臺包括一或多個行動裝置管理伺服器 (MDMS)，行動裝置管理伺服器係運作以為合作的行動裝置 及其使用者鑑認、確認及提供使用者管理。 在運作過程中，該行動裝置可與用於調用（invoke)—或多 個工作環境的一或多個電腦環境協作，以便處理Web服 務。可以從位於MD本機中的資料和電腦應用程式來執行該 等Web服務，或是該MD可與一或多個MDMS協作來獲得所 要求的Web服務。該MDMS可運作以鑑認要求方MD，藉此 確保要求方MD具有關於所要求之Web服務的權利及權限。 另外，該MDMS還可與第三方Web服務提供者協作，藉此獲 得所要求的Web服務。在此背景下，該MDMS可採取動作以 將來自非MD原生Web服務格式轉譯成一原生MD Web服 務。當將Web服務從該MDMS傳達至多個合作的MD時，該 MDMS與MD都會使用使用者和裝置鑑認和確認資訊，來進 行1028位元及/或2056位元加密（例如，PKI加密）。該MDMS 提供給該MD的Web服務可包括（但不限於）電腦應用程式及 所要資料。另外，該MD可運作以儲存參與方使用者的自訂 設定及偏好設定至該MD的本機中，讓使用者隨時可取得自 96373.doc -12- 200522744 訂設定及偏好設定。 以此方式使用行動裝置平臺，使用者就可以在任何數目 _ 的協作電腦環境下進行作業，只要使用者確信其可以在合 - 作的電腦環境中存取其自訂設定及偏好設定，最為重要的 是，安全存取自己的電腦應用程式及檔案（例如，提供為Web 服務）。200522744 IX. Description of the Invention: Claiming priority and cross-referencing This patent application claims the following U.S. provisional patent applications: September 29, 2003 No. 60 / 507,197 entitled "GO-KEY SYSTEM"; September 2003 Filed "GO-KEY ONLINE MUSIC SUBSCRIPTION AND DISTRIBUTION APPLICATION AND SERVICE" No. 60 / 506,918 on May 29; Filed "GO-KEY E-MAIL APPLICATION AND SERVICE" No. 60 / 506,919 on September 29, 2003 ; No. 60 / 506,925 named "GO-KEY MOBILE DESKTOP ENVIRONMENT" on September 29, 2003; No. 60 / 543,735 named "MDMS" on January 22, 2004; January 22, 2004 No. 60 / 538,763 filed "OMNI FILE SYSTEM (OFS)"; No. 60 / 538,915 filed "UDDI DIRECTORY" on January 22, 2004; and No. 60 / 538,767 filed on January 22, 2004 As "UDDI REPOSITORY", their patent applications are incorporated herein by reference. In addition, this patent application is related to the following patent applications and cross-referenced, and their patent applications are incorporated herein by reference: No. 10 / 837,426 filed on April 30, 2004 entitled "MOBILITY DEVICE PLATFORM" "(Agent File No. 45 597/196314); and April 30, 2004 filed No. 10 / 836,933 entitled" MOBILITY DEVICE "(Agent File No. 45597/196314). [Technical field to which the invention belongs] The system and method described herein are related to mobile computer operation technology ', and most importantly, it is a 96373.doc 200522744 mobile device management server that allows secure remote mobile computer operations. [Previous Technology] Businesses and individuals increasingly need mobility as a characteristic part of their computer environment. For businesses, mobility allows people to be deployed across geographic locations, enabling them to better serve Kelu. For example, a large pharmaceutical company would want to deploy business personnel "on-site" close to future customers (eg, doctors). In this context, "on-site" personnel would want to secure confidential sales and marketing information and computer applications over a secure connection. With the current solution, these people usually continue to work through a secure computer network connection (such as a virtual private network) at the end of the working day to complicate their data and company. In contrast, individuals seek their computer environment and mobility so that they can easily access their data and brain applications, and most importantly, continue to maintain a "connected state" during Internet communications. In response to the needs of mobile computing, computer environment manufacturers have developed mobile computing technologies (eg, standalone, networked, and / or embedded) that allow people to use their computing environment at any time. These mobile devices are designed to allow users to “carry” their bids and applications at any time. Although the material device provides: mobility, it will tend to have limited efficiency due to different appearance, processing capabilities and portability. Due to their limitations, users often expose large Γ-song computers ’to ensure that they have all the necessary solutions and computer applications2. The implementation of such schemes is based on the premise of the computer operating system (_pUting system). # ’Uses a“ device-centric ”computer operation. With "device-centric," computer operations, computer users can still access the project remotely and securely via a remote communication application (eg, a virtual private network) via 96373.doc 200522744, but still will Carry large, heavy computer equipment to retrieve its data and computer applications. Most importantly, with device-centric computer operations, users typically equip a device (such as a company personal computer or laptop) based on the needs of the enterprise's computer operations, and typically have personal devices at home for personal use. One or more computer environments. In maintaining multiple computer environments, computer users are responsible for synchronizing custom preferences and settings across many different computer environments. This task is extremely difficult and often frustrated by computer users' inability to access the required data and / or computer applications between different computer environments. For example, computer users may wish to obtain their financial planning management data from their financial planning management computer applications (eg, Quicken, Micr0ftft) at any time in order to process possible payments (eg, to Bills). With the current solution, computer users need to install financial planning and management computer applications and obtain the required information on each computer environment (including company computers, which may be against corporate computer operating policies and procedures). In contrast, companies will want to be highly effective when it comes to seizing confidential company information. In current implementations based on device-centric computer operations, employees are required to return their computer environment (for example, laptops, personal computers, mobile phones or personal digital assistants) Of corporate user directory information, which makes it a duty to use company data. However, collecting such devices and terminating access to them is a period of time. This 96373.doc 200522744 period of time will result in the employee from the enterprise computer The environment copies the archives for future use. In this case, according to the current implementation, confidential corporate information may be revealed. As can be seen from the foregoing, it is necessary to overcome the shortcomings of the current implementation. SUMMARY OF THE INVENTION The present invention discloses an application for A mobile device management server that is part of a mobile device platform to allow the security of mobile computer operations. In an exemplary implementation, an exemplary electronic device includes: a mobile device operable to communicate with at least through a communication interface and at least A computer environment, and the mobile device is operable to process and store Secure Web services; a communications network that operates to communicate data and computer applications using Web services; and a mobile device management server that operates to generate, process, store, and encrypt Web information about the mobile device In addition, the mobile device & feeding device is operable to perform one or more mobile device management functions, to provide an encryption key to a partner mobile device, and to identify and confirm requests to the mobile device management server Web services for cooperating mobile devices. The mobile device management server and the mobile device may further operate to use user identification and password information to perform authentication and confirmation. The mobile device management server may further operate to perform information related to the Metering functions and operations of web services processed and executed on the mobile device platform. In addition, the mobile device management server can operate to support the gap between the mobile device management server and the cooperating mobile device management server. In a private operation, the indicative mobile device is configured to cooperate in a Brain environment. In addition, the mobile device was built and communicated with one or more of the partners 96372.doc 200522744 mobile device management servers and attempted to be used by one or more of the mobile device management servers of such cooperation The selected authentication and confirmation information is authenticated. After the authentication and confirmation, one or more of the mobile device management servers of the cooperation use Web services to process data and computers from the exemplary mobile device of the cooperation Application requirements. One or more of the mobile device management servers use the exemplary selected authentication and confirmation information (eg, key) to encrypt the web service to allow one or more of the cooperations Multiple mobile device management servers and the exemplary mobile device securely communicate the required data and computer applications. Further features of the systems and methods described herein are described further below. [Implementation] Overview: The systems and methods described in the text provide a "user-centric" approach to computer operations and mobile computer operations. Existing computer operations solutions (businesses or individuals) are generally designed to use a “device-centric” model. The device-centric model is designed to manage and track users based on device assignments and assignments. For example, in the background of enterprise computer operation τ, the enterprise computer environment may include several feeding computer environments and many client computer environments. _ In general, every user in the enterprise has a client computer environment (for example, a personal computer or laptop),-generally the client computer environment is connected to the server via a network through the corporate communication interface Lei ^, ^ Hungry, or, if the user is away from the corporate communications network, will Pu / J 疋 connect the client computer environment to the connection through a virtual private network (VPN)?止 业 通 j 吕 网络. In addition, in the conventional 96373.doc -10- 200522744 enterprise computer environment, a directory service structure for establishing the association of user rights and permissions with a certain enterprise data and computer applications will be provided to users. User identification information and password information. -Using this type of enterprise computer environment, users are usually only allowed to use their own preferences and settings to customize the provided computer environment, so that if users roam across the network and log in to a non-owned computer environment, they cannot ° Access your preferences and settings. This problem usually occurs with corporate users who want to maintain preferences and settings (e.g., browsing) between their corporate computer environment and their personal computer environment (e.g., a computer at home). Browser bookmarks, desktop appearance and operation, color scheme, application layout, and file directory structure) synchronization, which requires manual synchronization. In addition, using existing corporate computer environments to manage many client computer environments has become a tedious task. Currently, corporate information technology departments employ dozens (rather than hundreds) to support many users and their computer environments. In addition to just actual management, a device-centric computer operation model for enterprise data integrity and security applications is also proposed. In this context, computer users in the industry often need to decide for themselves to copy and include confidential corporate data. Since preventing users from unauthorized copying of corporate broadcasts and data is a heavy task, most companies ignore this work. For businesses and individuals, this existing restriction can be extremely costly. The system and method described in this article aims to improve the shortcomings of existing implementations by providing a mobile device platform (MDp) designed using a "user-centered ~" transformation. In the example implementation, the mobile device platform includes at least one 96373.doc -11- 200522744 mobile device (MD), and the mobile device is operable to communicate through a communication interface (eg, Universal Serial Port (USB), IEEE 1394 communication interface ( Firewire), 802.XX communication interface, blurtooth communication interface, personal computer interface, small computer serial interface, and wireless application protocol (WAP) communication interface) to cooperate with one or more computer environments (for example, personal Computers, personal digital assistants, mobile phones, networked computers, and other computer environments). In addition, the mobile device platform includes one or more mobile device management servers (MDMS). The mobile device management server is operable to authenticate, confirm, and provide user management for cooperative mobile devices and their users. In operation, the mobile device can cooperate with one or more computer environments for invoking—or multiple work environments—in order to process web services. These Web services can be executed from data and computer applications located locally in the MD, or the MD can collaborate with one or more MDMSs to obtain the required Web services. The MDMS can operate to authenticate the requesting MD, thereby ensuring that the requesting MD has the rights and authority regarding the requested Web service. In addition, the MDMS can collaborate with third-party web service providers to obtain the required web services. In this context, the MDMS can take action to translate a format from a non-MD native web service into a native MD web service. When the Web service is transmitted from the MDMS to multiple cooperating MDs, both the MDMS and the MD use user and device authentication and confirmation information to perform 1028-bit and / or 2056-bit encryption (for example, PKI encryption). The web services provided by the MDMS to the MD may include, but are not limited to, computer applications and required information. In addition, the MD can operate to store the user's custom settings and preferences in the local machine of the MD, allowing users to obtain custom settings and preferences from 96373.doc -12- 200522744 at any time. Using the mobile device platform in this way, users can work in any number of collaborative computer environments, as long as users are confident that they can access their custom settings and preferences in a collaborative computer environment. Yes, securely access your own computer applications and files (for example, as a web service).
Web服務： 透過如網際網路等通信網路提供的服務（泛稱為Web服務 或應用程式服務）正在成長中。同樣地，促進此類服務的技 術也正在成長中。Web服務可被定義為任何資訊源，用於 執行基於供使用者的應用程式使用而便利套裝的商業邏輯 程序。Web服務日益成長意謂著，可在網路上利用Web服務 來提供功能。Web服務通常包括某種程式設計與資料之組 合，促使使用者及其他網路連線的應用程式可從應用程式 伺服器來取得Web服務。Web服務的範圍涵蓋如儲存管理和 客戶關係管理等服務，且向下延伸至如提供股票即時行情 及查核拍賣項目投標價等更有限的服務。 著重於定義及標準化Web服務用途的行動包括開發Web 月艮務描述語言（Web Services Description Language ; WSDL)。WSDL是一種可延伸標記語言（Extensible Markup Language ; XML)格式，用於將Web服務描述為用於處理含 文件導向式或程序導向式資訊之訊息的一組結束點。作業 及訊息係以抽象方式予以描述，並且接著繫結（bound)成具 - 體（concrete)網路協定及定義結束點的訊息格式。相關的具 96373.doc -13- 200522744 體結束點被組合成抽象結束點（服務）。 目前，廣泛主張的Web服務使用方式模型如下： (1) 服務係實施及部署在某站點（通常稱為伺服器方）上。 (2) 服務係使用WSDL予以描述並且經由如UDDI (Universal Description，Discovery，and Integration ;通用描 述、探索與整合）等手段多以發行，UDDI是一種適用於全 球企業的XML型登錄（XML-based registry)，藉此按所提供 的Web服務而列入網際網路上。 (3) 用戶端應用程式藉由先解譯一或多個WSDL文件，藉 此在其他站點處（通常稱為用戶端方）使用Web服務。經過解 譯後，用戶端就可以瞭解相關服務的特性。例如，服務特 性可包括服務API規格，例如：（a)輸入資料類型；（b)服 務輸入資料格式；（c)服務存取機制或樣式（例如，RPC相 對於訊息發送服務）；以及（d)相關編碼格式。 (4) 用戶端應用程式以各種Web服務瞭解的方式來準備 資料。 (5) 用戶端應用程式按照一特定服務所指定的方式（例 如，在相關的WSDL文件中指定的方式）來調用該服務。 各種Web服務的輸入資料格式及調用方式皆不相同。例 如，假設某應用程式服務提供者提供一項服務 (getCityWeather)，該服務要求如慣例城市名稱（例如，Salt Lake City的慣例城市名稱為SLC)的單一輸入參數。一預計 調用此類服務的用戶端應用程式必須撰寫成，促使該應用 程式内的資料或所輸出的資料能夠被分析以提取城市資 96373.doc -14- 200522744 讯。在執行時期，會使用適當的API，將所準備的符號傳遞 至getCityWeather服務站點。 然而，假設其他應用程式服務提供者提供類似的服務但 是要求兩個輸入參數’例如，城市名稱及郵遞區號。因此， 如果一用戶端應用程式預計調用彼等二項服務，則必須考 慮到所要求的服務輸入參數來適當地分析及擴取其資料。 因此，如果一單一應用程式預計調用彼等兩項服務，則必 須使用服務特定的API資訊及程序來硬式編碼該應用程 式。另外，如果一單一應用程式預計調用許多服務，則必 須使用該應用程式預計調用之每項及所有服務相關的API 資訊及程序來硬式編碼該應用程式。 如上文所述，各種Web服務都可以提供類似的功能，但 是提供方式不同。本文描述之系統及方法旨在藉由提供一 種具有行動裝置管理伺服器的行動裝置平臺來改良此類不 同點，除了其他項目以外，該行動裝置管理伺服器包括一 Web服務轉譯模組，該web服務轉譯模組運作以接受來自 Web服務提供者的資料，並且將web服務以Web服務模型原 型提供給合作的行動裝置。 簡單物件存取通訊協定（SOAP)概覽： 簡單物件存取通訊協定（Simple Object Access Protocol ; SOAP)是一種在分權（decentralized)、分散式環境中用來交 換資訊的輕量型XML架構通訊協定。SOAP支援不同樣式的 資訊交換，包括： 遠端程序呼叫（Remote Procedure Call ; RPC)樣式，其允 96373.doc -15- 200522744 許要求回應（request-response)處理，其中一結束點接收一程 序導向式訊息（procedure oriented message)，並且回覆一關 聯性的回應訊息（correlated response message)。 訊息導向式資訊交換（Message-oriented information exchange)，其支援需要交換商業或其他類型文件的組織及 應用，其中會傳送一訊息，但是寄件者不會預期或等待一 立即回應。 一般而言，SOAP訊息係由一 SOAP包絡（SOAP envelope， 其封入兩個資料結構SOAP標頭及SOAP主體）與關於命名 空間（用於定義SOAP訊息）的資訊所組成。標頭屬於選用項 目；如果有標頭，則標頭會運送關於SOAP主體中定義之要 求的資訊。例如，標頭可包含交易、安全性、内容或使用 者設定檔（user profile)資訊。主題包含XML格式的一 Web服 務要求或對要求的回覆。下列圖式顯示SOAP訊息的高階結 構。 當使用SOAP訊息來載送Web服務要求及回應時，SOAP 訊息可遵循用於定義可用Web服務的Web服務定義語言 (web services definition language ; WSDL。WSDL可定義用 於存取Web服務的SOAP訊息、可用來交換SOAP訊息的協定 以及可存取Web服務的網際網路位置。WSDL描述項 (descriptor)可駐存在UDDI或其他目錄服務中，並且還可以 經由組態或其他途徑（例如，SOAP要求回覆的主體中）來提 供WSDL描述項。 有一項SOAP規格（例如，w3 SOAP規格，如需相關資訊， 96373.doc -16- 200522744 請造訪www.w3.org)提供要求及回應的標準編碼方式。規格 中使用XML結構描述（XML Schema)來描述訊息内容 (message payload)的結構及資料類型。可適用於Web服務之 訊息及回應的SOAP使用方式為： SOAP用戶端使用遵循SOAP規格且含有服務要求的XML 文件。 SOAP用戶端傳送該文件至一 SOAP伺月艮器，並且該伺月艮 器上執行的SOAP servlet會使用（例如，HTTP或HTTPS)來處 理該文件。Web services: Services (commonly known as web services or application services) provided over communication networks such as the Internet are growing. Similarly, technologies to promote such services are growing. Web services can be defined as any source of information that executes business logic programs that are conveniently packaged based on the applications used by the user. The growing Web services means that Web services can be used to provide functions on the network. Web services usually include a combination of programming and data that enables users and other network-connected applications to obtain Web services from an application server. The scope of web services covers services such as storage management and customer relationship management, and extends downwards to more limited services such as providing real-time stock quotes and checking auction project bid prices. Actions focused on defining and standardizing the use of Web services include the development of a Web Services Description Language (WSDL). WSDL is an Extensible Markup Language (XML) format used to describe Web services as a set of end points for processing messages containing document-oriented or process-oriented information. The assignments and messages are described in an abstract way, and then bound to a concrete network protocol and a message format that defines the end point. The related end points of 96373.doc -13- 200522744 are combined into abstract end points (services). At present, the widely advocated web service usage model is as follows: (1) The service is implemented and deployed on a site (usually called the server side). (2) Services are described using WSDL and issued through means such as UDDI (Universal Description, Discovery, and Integration). UDDI is an XML-based login (XML-based registry) to list on the Internet based on the web services provided. (3) The client application uses Web services at other sites (commonly referred to as the client side) by first interpreting one or more WSDL files. After interpretation, the client can understand the characteristics of related services. For example, service characteristics may include service API specifications, such as: (a) input data types; (b) service input data formats; (c) service access mechanisms or styles (eg, RPC versus messaging services); and (d ) Related encoding formats. (4) The client application prepares the data in a manner known by various Web services. (5) The client application invokes the service in the manner specified by the specific service (for example, the manner specified in the relevant WSDL file). The input data format and invocation method of various Web services are different. For example, suppose an application service provider provides a service (getCityWeather) that requires a single input parameter such as a custom city name (for example, Salt Lake City's custom city name is SLC). A client application that is expected to call such a service must be written so that the data in the application or the output data can be analyzed to extract city information 96373.doc -14- 200522744. During execution, the prepared symbols are passed to the getCityWeather service site using the appropriate API. However, suppose other application service providers provide similar services but require two input parameters' such as city name and postal code. Therefore, if a client application is expected to invoke their two services, it must consider the required service input parameters to properly analyze and expand its data. Therefore, if a single application is expected to call both of these services, the application must be hard-coded using service-specific API information and procedures. In addition, if a single application is expected to invoke many services, the application must be hard-coded with API information and procedures related to each and all services that the application is expected to invoke. As mentioned above, various Web services can provide similar functions, but in different ways. The system and method described herein aims to improve such differences by providing a mobile device platform with a mobile device management server. Among other items, the mobile device management server includes a Web service translation module, the web The service translation module operates to accept data from a Web service provider, and provides the web service as a Web service model prototype to a cooperating mobile device. Overview of Simple Object Access Protocol (SOAP): Simple Object Access Protocol (SOAP) is a lightweight XML-based communication protocol used to exchange information in a decentralized, decentralized environment . SOAP supports different styles of information exchange, including: Remote Procedure Call (RPC) style, which allows 96373.doc -15- 200522744 request-response processing, where an end point receives a program-oriented Procedure-oriented message, and reply with a correlated response message. Message-oriented information exchange supports organizations and applications that need to exchange business or other types of documents. A message is sent, but the sender does not expect or wait for an immediate response. Generally speaking, a SOAP message consists of a SOAP envelope (which encapsulates two data structures: a SOAP header and a SOAP body) and information about a namespace (used to define a SOAP message). The header is optional; if a header is present, the header carries information about the requirements defined in the SOAP body. For example, the header may contain transaction, security, content, or user profile information. The subject contains a web service request or a response to the request in XML format. The following diagram shows the high-level structure of a SOAP message. When SOAP messages are used to carry Web service requests and responses, SOAP messages can follow the web services definition language (WSDL) that defines the available web services. WSDL can define the SOAP messages used to access web services, Protocols that can be used to exchange SOAP messages and Internet locations that can access Web services. WSDL descriptors can reside in UDDI or other directory services, and can also be configured or otherwise (for example, a SOAP request response) To provide WSDL description items. There is a SOAP specification (for example, the w3 SOAP specification, if you need relevant information, 96373.doc -16- 200522744 please visit www.w3.org) to provide the standard encoding method of the request and response. The specification uses XML Schema to describe the structure and data type of the message payload. The SOAP usage methods applicable to the messages and responses of Web services are: The use of SOAP clients conforms to the SOAP specification and contains service requirements XML file. The SOAP client sends the file to a SOAP server, and the SOAP servlet executed on the server Used (e.g., HTTP or HTTPS) to handle the file.
Web服務接收該SOAP訊息，並且將當做一訊息引動過程 (service invocation)的該訊息分派（dispatch)至用於提供所 要求之服務的應用程式。 再次使用該SOAP協定，將一來自該服務的回應傳回至該 SOAP伺服器，並且將該訊息傳回至該原始SOAP用戶端。 顯而易見，雖然本文描述SOAP作為適用於本文描述之系 統及方法的通信協定，但是此說明内容僅僅是例證，本文 描述之系統及方法可採用各種通信協定及訊息發送標準。 例證性電腦環境 圖1繪示根據本文描述之系統及方法的示例性電腦系統 100。電腦系統100能夠執行各種作業系統180及可在作業系 統180上運作的電腦應用程式180’（例如，Web瀏覽器及行動 桌面環境）。示例性電腦系統100主要受控於可能是軟體形 式的電腦可讀型指令、何處及如何儲存及存取此類軟體的 方式。此類軟體可在中央處理單元（CPU) 110内執行，藉此 96373.doc -17- 200522744 促使貝料處理系統1 〇 〇運作。在許多已知的電腦伺服器中， 會運用稱為微處理器的微電子晶片cpu來實作工作站及個 人電腦中央處理單元110。副處理器115是一種不同於主The Web service receives the SOAP message and dispatches the message as a service invocation to an application program for providing the requested service. Using the SOAP protocol again, a response from the service is returned to the SOAP server, and the message is returned to the original SOAP client. Obviously, although SOAP is described in this article as a communication protocol applicable to the systems and methods described in this article, the content of this description is only an example. The systems and methods described in this article can use various communication protocols and messaging standards. Exemplary Computer Environment FIG. 1 illustrates an exemplary computer system 100 in accordance with the systems and methods described herein. The computer system 100 can execute various operating systems 180 and computer applications 180 '(e.g., web browsers and mobile desktop environments) that can operate on the operating system 180. The exemplary computer system 100 is primarily controlled by computer-readable instructions, which may be in the form of software, where and how to store and access such software. This type of software can be executed in the central processing unit (CPU) 110, which enables 96373.doc -17- 200522744 to make the shell material processing system 1000 operate. In many known computer servers, a microelectronic chip CPU called a microprocessor is used to implement a workstation and a personal computer central processing unit 110. The sub processor 115 is a different type from the main
CPU 110的選用之處理器，用於執行額外功能或輔助CPU 110。可透過互連112將CPU 11〇連接至副處理器115。一種 通用類型副處理器是浮點運算副處理器，也稱為數值或數 學田彳處理為，其被設計成以比一般用途CPU 11 〇更快速地執 行數值計算。 顯而易見，雖然圖中所示之例證性電腦環境包含單一 CPU 110，但是此說明内容僅僅是例證，電腦環境1〇〇可包 含數個CPU 110。另外，電腦環境1〇〇還可以透過通信網路 160或其他 > 料通信構件（圖中未緣示）來利用遠端CPU(圖 中未顯示）的資源。 在運作過程中，CPU 11 〇擴取、解碼及執行指令，並且經 由電腦的主要資料傳輸路徑（系統匯流排105)來傳出及傳入 資源的資訊。此一系統匯流排連接電腦環境100中的各組 件，並且足義資料交換媒體。系統匯流排105通常包括用於 傳送資料的資料線、用於傳送位址的位址線以及用於傳送 中Wf和用於操作該系統匯流排的控制線。此一系統匯流排 的實例是PCI (周邊組件互連）匯流排。某些現今的進階匯流 排提供一種稱為匯流排仲裁的功能，用於管理擴充卡、控 制器及CPU 110對匯流排之存取。附接至彼等匯流排且仲裁 接苍匯/1排的裝置稱為匯流排主控（bus master)。支援匯流 排主控還允許藉由附加含有處理器及支援晶片的匯流排主 96373.doc 200522744 控卡來建立彼等匯流排的多處理器組態。 耦合至系統匯流排105的記憶體裝置包括隨機存取記憶 體（RAM) 125及唯讀記憶體（ROM) 130 〇此類記憶體包含允 許儲存及擷取資訊的電路。ROM 130通常包含無法被修改 的儲存之資料。CPU 110或其他硬體裝置可讀取或變更ram 125中所儲存的資料。可由記憶體控制器120來控制ram 125及/或ROM 130之存取。記憶體控制器120可提供位址轉 譯功能’用於轉譯虛擬位址成為指令所執行的實體位址。 呑己憶體控制益12 0還可提供記憶體保護功能，用於隔離系統 内的處理序及隔離系統處理序（system process)與使用者處 理序（user process)。因此，在執行模式中執行程式通常僅 也存取自已處理序虛擬位址空間所映射的記憶體；而無法 存取其他處理序虛擬位址空間内的記憶體，除非已設定處 理序之間的記憶體共用。 此外，電腦系統100可包括周邊裝置控制器135，周邊裝 置控制為13 5負責將指令從C P U 110傳達至周邊裝置，例 如’印表機140、键盤145、滑鼠150及資料儲存機155。 顯示器16 5 (受控於顯示器控制器16 3)的用途是顯示電腦 系統100所產生的可見輸出。此類可見輸出可包括文字、圖 形、動畫及視訊。可使用CRT型視訊顯示器、lcd型平面顯 示器、氣體電漿型平面顯示器、觸控式面板或其他顯示器 形式來實作顯示器165。顯示器控制器163包括用以產生要 傳送至顯示器165之視訊訊號所需的電子組件。 另外，電腦系統100還可包含網路卡170，網路卡ι7〇的用 96373.doc -19- 200522744 途是將電腦系統10 0連接至外部通信網路16 0。通信網路16 〇 可提供電腦使用者以電子方式傳達及傳送軟體和資訊的途 徑。另外，通信網路160還可提供分散式處理，分散式處理 涉及數台電腦，並且會在執行工作過程中分擔工作負載或 協作。應明白，如圖所示的網路連接是示範性的網路連接， 並且可使用其他的裝置來建立電腦之間的通訊連結。 應明白，示例性電腦系統1〇〇僅僅是適合本文描述之系統 及方法運作的例證性電腦環境，而不是限制本文描述之系The optional processor of the CPU 110 is used to perform additional functions or assist the CPU 110. The CPU 11 can be connected to the sub-processor 115 through the interconnect 112. One general-type sub-processor is a floating-point arithmetic sub-processor, also known as a numerical or mathematical field operation, which is designed to perform numerical calculations faster than a general-purpose CPU 110. Obviously, although the exemplary computer environment shown in the figure includes a single CPU 110, this description is merely an example. The computer environment 100 may include several CPUs 110. In addition, the computer environment 100 can also utilize the resources of the remote CPU (not shown) through the communication network 160 or other communication components (not shown in the figure). During operation, the CPU 110 extracts, decodes, and executes instructions, and transmits and transmits information about resources through the computer's main data transmission path (system bus 105). This system bus connects the various components in the computer environment 100 and serves as a data exchange medium. The system bus 105 generally includes a data line for transmitting data, an address line for transmitting an address, and a control line for transmitting Wf and for operating the system bus. An example of such a system bus is a PCI (Peripheral Component Interconnect) bus. Some of today's advanced buses provide a feature called bus arbitration for managing expansion card, controller, and CPU 110 access to the bus. The devices attached to their buses and arbitrated to the Canghui / 1 bus are called bus masters. Supporting bus masters also allows multi-processor configurations of their buses to be created by attaching a bus master 96373.doc 200522744 controller card containing processors and supporting chips. The memory devices coupled to the system bus 105 include random access memory (RAM) 125 and read-only memory (ROM) 130. This type of memory contains circuitry that allows storage and retrieval of information. ROM 130 usually contains stored data that cannot be modified. The CPU 110 or other hardware device can read or change the data stored in the ram 125. Access to the ram 125 and / or ROM 130 may be controlled by the memory controller 120. The memory controller 120 may provide an address translation function 'for translating a virtual address into a physical address executed by a command.呑 益 memory control benefits 120 can also provide memory protection function, used to isolate the processing sequence within the system and isolate the system process and the user process. Therefore, in the execution mode, the execution program usually only accesses the memory mapped from the virtual address space of the process; it cannot access the memory in the virtual address space of other processes unless the Memory sharing. In addition, the computer system 100 may include a peripheral device controller 135, and the peripheral device is controlled to 135 to transmit instructions from the CP 110 to the peripheral devices, such as a 'printer 140, a keyboard 145, a mouse 150, and a data storage device 155. The purpose of the display 16 5 (controlled by the display controller 16 3) is to display the visible output produced by the computer system 100. Such visible output can include text, graphics, animation, and video. The display 165 may be implemented using a CRT type video display, an lcd type flat display, a gas plasma type flat display, a touch panel, or other display forms. The display controller 163 includes electronic components required to generate a video signal to be transmitted to the display 165. In addition, the computer system 100 may further include a network card 170, and the use of the network card iota 70 96.doc -19-200522744 is to connect the computer system 100 to an external communication network 160. The communication network 16 provides a way for computer users to communicate and transfer software and information electronically. In addition, the communication network 160 can also provide decentralized processing, which involves several computers, and will share the workload or collaboration during the execution of the work. It should be understood that the network connection shown in the figure is an exemplary network connection, and other devices may be used to establish a communication link between the computers. It should be understood that the exemplary computer system 100 is merely an exemplary computer environment suitable for the operation of the systems and methods described herein, and is not intended to limit the systems described herein.
統及方法在具有不同組件及組態之電腦環境中的實施，在 具有各種組件及組態的各種電腦環境中皆可實施本文描述 之本發明觀念。 例證性電腦網路環境：The implementation of the system and method in a computer environment with different components and configurations can be implemented in various computer environments with various components and configurations. Illustrative computer network environment:
如上文所述之電腦系統100可部署為電腦網路之部分。_ 般而言’前文關於電腦環境的說明内容適用於部署於網) %境中的伺服器電腦及用戶端電腦。圖2繪示一種可採用； 又描述之㈣及方法的种卜_路連線電腦環境·，並」 有經由通信網路與用戶端電腦通訊的伺服器。如圖2所示/ 飼服器205可經由通訊網路⑽（可能是固線或無線[謂 WAN、内部網路、外部網路、對等式網路、網際網路或^ 他通信網路）而互連於數個用戶端電腦環境，例如，平板^ 個人電腦2 10、行動電話2丨5、雷爷. 电話220、個人電腦1〇()及伯 人數位助理225。另外，太十妒、+、名 卜本又描述心系統及方法可經由通右 網路160與汽車電腦環境（圖中 腦環境（圖中未緣示）及建築物^ #性電子以1 建采物自動化控制電腦環境（圖中未 96373.doc •20- 200522744 繪示）協合。例如，在通訊網路160是網際網路的網路環境 中，伺服器205可能是專用電腦環境伺服器，其可運作以處 理Web服務，並且經由任何數目的已知通訊協定（例如，超 文字傳輸通訊協定（hypertext transfer protocol ; HTTP)、樓 案傳輸通訊協定（file transfer protocol ; FTP)、簡單物件 存取通訊協定（simple object access protocol ; SOAP)或無線 應用通信協定（wireless application protocol; WAP))，將 Web 服務傳入及傳出用戶端電腦環境100、210、215、220和225。 每個用戶端電腦環境1〇〇、21〇、215、220和225還可配備割 覽器作業系統180(其可運作以支援如web瀏覽器（圖中未緣 不）等一或多個電腦應用程式），或配備行動桌面環境（用以 獲得存取伺服器電腦環境2〇5)。 在運作過程中’使用者（圖中未繪示）可互動於用戶端電 腦環境上執行的電腦應用程式，藉此獲得所要的資料及/或 電腦應用程式。資料及/或電腦應用程式可儲存在伺服器電 腦裱境205上’並且透過示例性通信網路160傳達至透過用 戶端電腦環境1〇〇、210、215、220和225合作的使用者。表 與方使用者會使用Web服務交易來要求存取伺服器電腦環 境205上完整或部分裝載的特定資料及應用程式。可在用戶 端電腦環境100、210、215、220和225與伺服器電腦環境之 間傳達這些Web服務交易，以進行處理及儲存。伺服器電 腦裱境205可裝載電腦應用程式、處理序（pr〇cess)&程式項 (applet)，用以產生、鑑認及傳達Web服務，並且可與其他 伺服器電腦環境（圖中未繪示）、第三方服務提供者（圖中未 96373.doc -21 - 200522744 、士示）、、，罔路附接式儲存裝置（netw〇rk attached st〇rage ; NAS) 和儲存區域網路（storage area network; SAN)協作，以便實 現彼等Web服務交易。 因此，在具有用來存取網路或互動於網路的用戶端電腦 裱境及用來互動於用戶端電腦環境的伺服器電腦環境的電 腦網路環境中，可利用本文描述之系統及方法。但是，可 運用各種網路架構來實施用於提供行動裝置平臺的系統及 方法，因此，不應限定於所示之實例。現在將引用本例證 性實施來詳細說明本文描述之系統及方法。 行動裝置平臺組件之協作： 圖3繪示介於示例性行動裝置平臺之組件間的示例性互 動。一般而言，如圖3所示，示例性行動裝置平臺3〇〇 (簡言 之）可包括示例性行動裝置310，其使用依據一所選用之通 仏f功足（圖中未繪示）運作的通信介面305來與用戶端電腦環 境1 〇〇協作。另外，示例性行動裝置平臺300可進一步包括 通信網路160 (如圖1所示）及伺服器電腦環境2〇5。 在運作過程中，該行動裝置可透過通信介面305來與用戶 端電腦環境1〇〇協作，以便執行源自於行動裝置31〇的一或 夕個呢細應用程式1 80’，並且可顯示在該用戶端電腦環境 100上以供使用者互動。電腦應用程式180,可包括（但不限於） 用於提供習知作業系統外觀和操作的瀏覽器應用程式、文 書處理應用程式、試算表、資料庫應用程式、Web服務應 用程式及使用者管理/偏好設定應用程式。另外，行動裝置 31〇可使用用戶端電腦環境1〇〇,經由通信網路丨6〇來與伺服 96373.doc -22- 200522744 器電腦環境205協作，以便獲得Web服務形式的資料及/或電 腦應用程式。 圖4繪示介於示例性行動裝置平臺400之組件間的互動。 如圖4所示，示例性行動裝置平臺400包括行動裝置（MD) 405、電腦環境410、通信網路435、行動裝置管理伺服器 (MDMS) 420及第三方Web服務提供者440。另外，如MD分 解圖進一步所示，MD 405進一步包括處理單元（PU)、作業 系統（OS)、儲存記憶體（RAM/ROM)及一 MD通信介面。而 且，MDMS 420進一步包括轉譯引擎425、Web服務430及加 密引擎445。 在運作過程中，MD 405使用一或多個MD組件PU、OS、 RAM/ROM和MD通信介面，透過MD/電腦環境通信介面410 來與電腦環境415通信。當與電腦環境415通信時，MD 405 可啟動一或多個電腦應用程式（圖中未繪示），其可包括（但 不限於）作為組態部分的行動桌面環境、使用者自訂及鑑認 管理員及Web服務應用程式。已設定組態後，MD 405可進 一步與電腦環境415協作，以便處理一或多個Web服務（例 如，Web服務資料及/或電腦應用程式）。在此背景下，MD 405 可使用通信網路435來向合作的MDMS 420要求Web服務資 料及/或電腦應用程式，以便處理彼等Web服務。在此案例 中，MDMS 420可運作以鑑認MD 405，藉此確保參與方使 用者（圖中未繪示）及行動裝置405具有所要求之資料及/或 電腦應用程式的正確權限。此類鑑認程序還可採用可駐存 在該MD 405上的一或多個安全性周邊裝置，包括（但不限於） 96373.doc -23- 200522744 生物測定安全性周邊裝置、視網膜掃描安全性周邊裝置及 安全性語音辨識周邊裝置。 如果已經過適當鑑認，MDMS 420可進一步運作以在 MDMS 420本機尋找所要求之資料及/或電腦應用程式，並 且透過通信網路435將彼等所要求之資料及/或電腦應用程 式（例如，Web服務）提供給該經鐘認之MD 405,或者，MDMS 420可運作以與第三方服務提供者440協作’以便獲仔要傳 達給該經鑑認之MD 405的Web服務。當與第三方服務Web 提供者440協作時，MDMS 420可運作以使用轉譯引擎425 ’ 將源自於第三方Web服務提供者440的Web服務430轉譯成 MD原生（native)格式。另外，MDMS 420可運作以在滿足來 自於經鑑認之MD 405的Web服務要求時，使用加密引擎445 來加密所要求的Web服務。 另外，MDMS 420可進一步運作以使用一所選的加密協定 (例如，PKI加密）來與檔案系統（圖中未繪示）協作，以便獲 得要傳達給MD 405的Web服務。合作的檔案系統可包括（但 不限於）樓案配置表（file allocation table ; FAT)樓案系統及 新技術標案系統（new technology files system ; NTFS)。 圖5繪示部署在例證性網路連線電腦環境中之例證性行 動裝置管理伺服器（MDMS)之示例性組件的方塊圖。如圖所 示，例證性網路連線電腦環境包括站點A、站點B及站點C， 各站點分別具有示例性MDMS及組件。站點A包括MDMS 502’ MDMS 502本身具有作業系統504。圖中所示之作業系 統（OS) 504支援java虛擬機器（jvm) 506，接著java虛擬機 96373.doc -24- 200522744 器（JVM) 506支援MDMS. java程式碼508。本文中的MDMS. java程式碼508包括SOAP鏈結（chaining) 538及服務548。另 外，作業系統504還可運作以支援且協作於使用者資料庫 510、金鑰資料庫5 12及檔案儲存區514。再者，作業系統504 還可運作以支援且協作於常駐應用程式550、JVM 552及 JVM 554。另外，作業系統504還可運作以支援且協作於加 密驅動程式、通信介面驅動程式及網路驅動程式。鏡像處 理OS 504，MDMS 502維護硬體，例如，在MDMS 502運作 期間協作於加密驅動程式、通信介面驅動程式及網路驅動 程式的硬體加速器、通信介面埠及通信介面卡（NIC)。 另外，如圖所示，MDMS包括儲存區域網路（SAN)/網路 附接式儲存裝置（NAS)介面516，介面516可運作以將MDMS 502連接至合作之檔案/資料存放區518及合作之MDMS 520 和522。可透過通信網路5 19將SAN/NAS介面5 16耦合至合作 之檔案/資料存放區518及合作之MDMS 520和522。再者， 如圖所示，MDMS 502可與駐存在MDMS 502本機或與 MDMS 502地理分隔的其他MDMS環境536和528協作。 MDMS環境536可包括MDMS 534及檔案/資料存放區532。 同樣地，MDMS環境528可包括以運作方式耦合檔案/資料存 放區 524的 MDMS 526及MDMS 530 〇 SOAP鏈結模組538内可駐存數個子組模，包括（但不限 於）：一封包偵查器（packet sniffer)，其可運作以監視資料 通信；安全性強制執行（security enforcement)，其可運作以 維護資料權限及存取；使用方式/監視器（usage/monitor*)， 96373.doc -25- 200522744 其可運作以計量服務使用方式；以及一 Web服務代理伺服 器（web services proxy)，其可運作以快取要與要求方組件 (例如，經鑑認的MD，圖中未繪示）協作的Web服務。彼等 子組模可受控於一或多個子組模應用程式，包括（但不限 於）：管理债錯器（administration debugger)，用於在該封包 偵查器（packet sniffer)子組模上執行；安全性管理員 (security manager)，用於在該安全性/強制執行子組模上執 行；計量管理員（metering manager)，用於在該使用方式/ 監視器子組模上執行；以及代理伺服器管理員（proxy manager)，用於在該Web服務代理伺服器上執行。 SOAP鏈結模組548内可駐存數個子組模，包括（但不限 於）：一行動裝置管理員；一加密管理員（PKCS管理員）；一 檔案傳輸服務；一 Web服務管理員；Web服務存取控制服 務；一 Web服務計量服務；一通用描述、描述、探索與整 合目錄（Universal， Description， Discovery， and Integration; UDDI)服務；一 UDDI存放庫（UDDI repository) 服務；一檔案系統（例如，Omni檔案系統）；一 SOAP代理伺 服器管理員（SOAP proxy)服務；一 Web服務轉譯器服務；以 及一服務品質作業，其運作以執行包括（但不限於）負載平 衡、MDMS帶電交換（hot swapping)及錯誤後移轉等功能。 常駐應用程式550可包括（但不限於）安全性、路由器、 SAN/NAS控制及加密控制。JVM 552可包括在加密資訊（例 如，金鑰資訊）、使用者鑑認、服務配罝及MDMS java作業 上運作且予以處理的程式碼。相比之下，JVM 554可包括允 96373.doc -26- 200522744 許模擬行動裝置硬體組態的java程式碼。 在運作過程中，MDMS充分利用一或多個上文所述之組 ' 件來處理Web服務要求，並且使用加密處理序來安全地提 • 供Web服務給使用鑑認和確認資訊的要求方合作之組件。 MDMS 502可與其他MDMS環境（例如，MDMS環境536和528) 協作以滿足Web服務要求。 在一項例證實施中，MDMS 501提供安裝管理使用者資 料、應用程式和服務登錄及協調儲存裝置。在運作過程中， MDMS 501支援使用者存取及管理功能。例如，行動桌面使 用者可透過MDMS 501來連線至其應用程式及資料。在此背 景下，已連線後，MDMS 501就會檢查使用者鑑認及偏好設 定。可自動強制實行存取控制，並且可將「面板」（skins) 套用至應用程式及服務，促使應用程式及服務配合參與方 使用者的環境。應用程式及資料之要求可配合本機裝置之 速度予以處理，並且可基於改良系統來予以監視。 另外，MDMS 502還可運作以讓使用者能夠存取其具有權 限的檔案存放區（例如，518、532和524)，並且發行樓案至 個人、群組或全球。在此背景下，MDMS 502可採用各種 MDMS組件，藉以提供檔案、應用程式/服務（548和550)及 大容量儲存裝置之管理。另外，由於MDMS 502讓系統管理 員能夠使用合作之行動裝置（圖中未繪示）來從遠端位置連 線至MDMS 502，因此允許更強固的系統管理。 如圖5所示，MDMS 502可包括數個功能組件及模組。彼 - 等組件及模組可運作以提供各項功能，包括（但不限於）安全 96373.doc -27- 200522744 性、行動裝置管理、加金金输追縱和管理、交易計量、樓 案系統管理、應用程式/服務管理、應用程式訂閱 管理、Web 服務監視、舊型基礎設施擴充、資料存放區管理及叢集部 署和管理。 圖6繪例性MDMS 502與合和MD協助時 所執行的程序。如圖所示，程序從步驟6〇〇開始，並且進行 到步騾605，在步驟605實行檢查以判定是否需要建立或更 新合作之MD鑑認。如果在步驟6〇5的檢查結果指示出不需 要建jl或更新MD銀認，則程序返回步驟6〇〇並繼續程序。 然而，如果在步驟605的檢查結果指示出需要建立或更新 MD鑑認，則程序進行到步驟61〇，在步驟61〇實行檢查以判 足合作之MD是否是MDMS的新合作對象且需要MDMS進行 起始鑑認。如果在步驟61〇的檢查結果指示出需要鑑認新的 MD，則程序進行到步驟615，*MDMS產生關於新…^的鑑 認資訊。接著，程序進行到步驟62〇，產生加密金鑰並且傳 達至被鑑認的MD。接著，在步驟625，將鑑認和加密資訊 傳達至被鑑認的合作之MD。接著，用該鑑認和加 欲資訊在合作之檔案系統上建立適用於MD之群組成員的 關聯性。接著在步驟5進行檢查，以判定是否已成功鑑 遇。如果在步驟635的檢查結果指示出視為未成功鑑認，則 程序進行到步驟64〇以產生錯誤。接著在步驟645，可矯正 銘^忍錯誤。接著，程序返回步驟63 5並繼續程序。 然而’如果在步驟635判定已通過鑑認測試，則程序進行 到步驟650 ’在步驟650實行檢查以判定是否需要變更合作 96373.doc 200522744 之MD的權限。如果在步驟650的檢查結果指示出需要變更 權限，則程序進行到步驟655，以更新鑑認及/或加密資訊。 接著，程序返回步驟635並繼續程序。 然而，如果在步驟650的檢查結果指示出不需要變更權 限，則程序進行到步驟660，以MD鑑認組態設定結束。再 者’如果在步驟610的檢查結果指不出不是需要鑑認的新 MD，則程序進行到步騾650並繼續程序。 圖7繪示在示例性Web服務處理實施中，行動裝置管理伺 服器502所執行的程序。如圖7所示，程序從步騾700開始， 並且進行到步驟705，在步騾705實行檢查以判定MDMS是 否已進行與合作之電腦網路通信。如果在步驟700的檢查結 果指示出未進行通信，則程序返回步驟700並繼續程序。然 而，如果在步驟705判定MDMS已進行與合作之電腦網路通 信，則程序進行到步驟710，在步驟710實行檢查以判定一 或多個合作之MD是否已向該MDMS要求一或多個Web服 務。如果在步驟710的檢查結果指示出沒有MD要求Web服 務，則程序返回步驟710並繼續程序。 然而，如果在步驟710的檢查結果指示出一或多個合作之 MD已要求一或多個Web服務，則程序進行到步驟7 15，由 MDMS使用MD安全性和鑑認服務來鑑認該MD。接著在步 驟720進行檢查，以判定是否已鑑認MD。如果已鑑認MD， 則程序進行到步驟735，以處理Web服務要求。然後，在步 驟740及步驟745，MDMS和MD執行Web服務。 然而，如果在步驟7 2 0的檢查結果指示出未成功鑑認 96373.doc -29- 200522744 MD，則程序進行到步騾725以產生錯誤。接著，程序進行 到步驟727，在步驟727實行檢查以判定是否再次嘗試鑑 認。如果在步驟727的檢查結果指示出再次嘗試md鑑認， 則程序返回步驟720並繼續程序。然而，如果在步驟727判 足未再次嘗試MD鐘認，則程序於步驟73〇終止。 圖8繪示在另一項web服務處理實施中，行動裝置管理伺 服為502所執行的程序。如圖8所示，程序從步騾8〇〇開始， 並且進行到步驟805，在步騾805實行檢查以判定一或多個 經鑑認之MD是否已要求一或多個Web服務。如果在步驟8〇5 的檢查結果指示出沒有經鑑認tMD要求Web服務，則程序 返回步驟800並繼續程序。然而，如果在步驟8〇5的檢查結 果指不出有一或多個經鑑認之MD是否已要求一或多個Web 服務，則程序進行到步驟81 〇，由MDMS從合作之資料存放 區、合作之Web服務提供者及其他合作之MDMS中任何項目 來擷取資料及/或電腦應用程式。接著，在步驟815實行檢 查以判定所擷取的Web服務是否需要轉譯成MD原生Web服 務格式。如果在步驟81 5的檢查結果指示出需要轉譯，則程 序進行到步驟825，依據所選之加密協定（例如，使用公開/ 私密金鑰）來加密所要求之資料及/或電腦應用程式。接著， 程序進行到步驟830，將已加密之資料及/或電腦應用程式 傳達至要求方經鑑認之MD。接著，在步驟835，由MDMS 來計量MD作業，以便獲得使用方式、行為、相似性及類似 的度量資訊。然後，在步驟840儲存該計量資料以供未來使 用。接著，在步驟845實行檢查以判定是否要報告該儲存之 96373.doc -30- 200522744 計量資料。如果在步驟845的檢查結果指示出要報告該計量 資料，則程序進行到步驟850，分析該計量資料以產生計量 報告。接著程序在步驟855終止。 然而’如果在步驟815的檢查結果指示出需要轉譯，則程 序進行到步驟820以將所要求之Web服務轉譯成MD原生 Web服務。接著，程序進行到步驟825並繼續程序。 圖9繪示在另一項Web服務處理實施中，MDMS 502所執 行的程序。如圖9所示，程序從步騾900開始，並且進行到 步驟905，在步驟905實行檢查以判定一或多個經鑑認之]^!) 是否已要求一或多個Web服務。如果在步驟905的檢查結果 才曰示出（又有經鑑認之MD要求Web服務，則程序返回步驟9〇〇 並繼續程序。然而，如果在步驟9〇5的檢查結果指示出有一 或多個經鑑認之MD是否已要求一或多個web服務，則程序 進行到步驟910 ’由MDMS從合作之標案存放區、合作之Web 服務提供者及其他合作之MDMS中任何項目來擷取資料及/ 或電腦應用程式。接著，在步驟915實行檢查以判定所掏取 的Web服務是否需要轉譯成MD原生Web服務格式。如果在 步驟91 5的檢查結果指示出需要轉譯，則程序進行到步驟 925 ’依據所選之加密協定（例如，使用公開/私密金输）來加 密所要求之資料及/或電腦應用程式。接著，程序進行到步 驟930，將已加密之資料及/或電腦應用程式傳達至要求方 經鑑認之MD。接著，在步驟935實行檢查以判定介於MDMS 與合作之MD之間的通信鏈結是否為使用中狀態。 如果在步騾935的檢查結果指示出通信鏈結為使用中狀 96373.doc -31 - 200522744 怨’則程序進行到步驟945以使任何快取之交易同步化。接 著，在步驟950，由MDMS來計量MD作業，以便獲得使用 万式、行為、相似性及類似的度量資訊。然後，在步驟955 儲存泫什1資料以供未來使用。接著，在步驟96〇實行檢查 以判疋是否要報告該儲存之計量資料。如果在步驟96〇的檢 且〜果彳曰示出要報告該計量資料，則程序進行到步驟965， 刀析居计量;貝料以產生計量報告。接著程序在步驟終 止。 然而，如果在步驟935的檢查結果指示出通信鏈結不是在 使用中狀態，則程序進行到步驟94〇以快取所要求之web服 務。接著，程序進行到步驟935並繼續程序。再者，如果在 步驟915的檢查結果指示出需要轉譯，則程序進行到步驟 920以將所要求之Web服務轉譯成md原生服務。接著， 程序進行到步驟925並繼續程序。 總言之，本文描述之系統及方法提供一種用作行動裝置 平^-部分之行動裝置管理飼服器。然而，應明白，本發 明谷4各種修改及替代建構。本發明不限Μ如本文所述 的特定建構。反之，本發日賴定涵蓋屬於本發明精神與範 疇内的所有修改案、替代建構及同等案。 請注意，在各種電腦環境（包括非無線及無線電腦環 境）、局部電腦環境及真實環境中皆可實施本發明。本文中 所說明的各種技術可運用硬體、軟體或軟硬體組合來實 施。較佳方式為’可在維護可程式化電腦的電腦環境中來 實施各項技術，其中電腦包括處理器、處理器可讀取的儲 96373.doc -32- 200522744 存媒體（包括揮發性及非揮發性記憶體及/或儲存元件）、至 少一個輸入裝置及至少一個輸出裝置。配合各種指令集協 作之電腦硬體邏輯被套用至資料，以執行如上文所述之Z 能並且產生輸出資訊。輸出資訊被供至一或多個輸出裝 置。較佳方式4，可使用各種程式設計語言（包括高階程序 或物件導向式程式設計語言）來實施示例性電腦硬體所使 用的程式，以與電腦系統通信。作為例證，若希望，可使 用組合語T或電腦語T來實施本文描述之裝置及方法。在 任何情況下吾吕可能是編譯或解譯語言。較佳方式為， 每個電腦程式係儲存在一般或特殊用途之可程式化電腦可 讀取的儲存媒體或裝置（例如，ROM或磁碟），用於當電腦 讀取儲存媒體或裝置時來組態及操作電腦，以便執行如上 文所述之程序。裝置也可建構為電腦可讀取的儲存媒體並 使用電腦程式設定其組態，其中儲存媒體被組態成促使電 腦以特定或預先定義的方式運作。 雖然如文中已詳細說明本發明之示例性實施，但是熟悉 此類技術者很容易明白示例性具體實施例有許多可實行的 額外修改案，而不會實質上脫離本發明的新穎講授内容與 優點。據此’這些及所有此類修改案預定涵蓋在本發明的 範疇内。下列示例性申請專利範圍更適當地定義本發明。 【圖式簡單說明】 現在將參考附圖來詳細說明行動裝置平臺及使用方法， 圖中： 圖1績示根據本文描述之系統及方法之實施的示例性電 96373.doc -33- 200522744 腦環境方塊圖； 圖2繪示根據本文描述之系統及方法的示例性電腦網路 環境方塊圖； 圖3繪不根據本文描述之系統及方法的示例性電腦作業 組件間互動之方塊圖； 圖4繪不根據本文描述之系統及方法的行動裝置平臺之 例證實施方塊圖；The computer system 100 as described above may be deployed as part of a computer network. _ Generally speaking, the content of the previous description of the computer environment is applicable to server computers and client computers deployed in the Internet.) FIG. 2 illustrates a kind of computer environment that can be adopted and described in the following description, and a method for connecting a computer environment and a server that communicates with a client computer via a communication network. As shown in Figure 2 / Feeder 205 can be via a communication network (may be fixed or wireless [referred to as WAN, internal network, external network, peer-to-peer network, Internet or other communication network) And it is interconnected with several client computer environments, such as tablet ^ personal computer 2 10, mobile phone 2 丨 5, Lei Ye. Phone 220, personal computer 10 (), and Bo's assistant 225. In addition, Tai Shi jealousy, +, and Ming Bu also described the mental system and method through the right network 160 and the car computer environment (brain environment (not shown in the figure) and buildings in the picture) ^ # 性 电子 以 1 建The mining automation controls the computer environment (not shown in the figure 96373.doc • 20-200522744). For example, in a network environment where the communication network 160 is the Internet, the server 205 may be a dedicated computer environment server. It operates to handle Web services and is accessible via any number of known protocols (for example, hypertext transfer protocol (HTTP), file transfer protocol (FTP), simple object access Communication protocol (simple object access protocol; SOAP) or wireless application protocol (wireless application protocol; WAP)) to transfer Web services to and from the client computer environment 100, 210, 215, 220, and 225. Each client The computer environment 100, 21, 215, 220, and 225 can also be equipped with a browser operating system 180 (which can operate to support one or more such as a web browser (not shown in the figure)) Brain applications), or equipped with a mobile desktop environment (to obtain access to the server computer environment 205). In the process of operation 'users (not shown) can interact with the computer running on the client computer environment Application to obtain the required data and / or computer application. The data and / or computer application can be stored on the server computer environment 205 'and communicated through the exemplary communication network 160 to the client computer environment 1 〇〇, 210, 215, 220, and 225. Users will use Web service transactions to request access to specific data and applications loaded on the server computer environment 205. These web service transactions are communicated between the computer environment 100, 210, 215, 220, and 225 and the server computer environment for processing and storage. The server computer environment 205 can be loaded with computer applications, processes &; Program items (applets), used to generate, identify and communicate Web services, and can be used with other server computer environments (not shown), third-party service providers (Figure 96763.doc -21-200522744, Shishi) ,,, Kushiro attached storage device (network attached storage; NAS) and storage area network (SAN) collaboration in order to achieve the other Wait for web service transactions. Therefore, in a computer network environment having a client computer environment for accessing the network or interacting with the network and a server computer environment for interacting with the client computer environment, the systems and methods described herein can be utilized . However, systems and methods for providing mobile device platforms can be implemented using a variety of network architectures and should not be limited to the examples shown. This exemplary implementation will now be referenced to explain the systems and methods described herein in detail. Collaboration of Mobile Device Platform Components: Figure 3 illustrates an exemplary interaction between components of an exemplary mobile device platform. Generally speaking, as shown in FIG. 3, the exemplary mobile device platform 300 (in short) may include an exemplary mobile device 310 whose use is based on a selected general purpose (not shown in the figure) The communication interface 305 operates to cooperate with the client computer environment 100. In addition, the exemplary mobile device platform 300 may further include a communication network 160 (as shown in FIG. 1) and a server computer environment 205. In operation, the mobile device can cooperate with the client computer environment 100 through the communication interface 305, so as to execute one or more detailed application programs 180 'derived from the mobile device 31 and can be displayed on The client computer environment 100 is provided for user interaction. Computer applications 180, which may include (but are not limited to) browser applications, word processing applications, spreadsheets, database applications, web services applications, and user management / Preferences application. In addition, the mobile device 31 can use the client computer environment 100 and cooperate with the server 96373.doc -22- 200522744 computer environment 205 via the communication network 丨 in order to obtain data and / or computers in the form of Web services application. FIG. 4 illustrates interactions between components of an exemplary mobile device platform 400. As shown in FIG. 4, an exemplary mobile device platform 400 includes a mobile device (MD) 405, a computer environment 410, a communication network 435, a mobile device management server (MDMS) 420, and a third-party web service provider 440. In addition, as further shown in the MD resolution diagram, the MD 405 further includes a processing unit (PU), operating system (OS), storage memory (RAM / ROM), and an MD communication interface. Moreover, the MDMS 420 further includes a translation engine 425, a web service 430, and an encryption engine 445. In operation, the MD 405 uses one or more MD components PU, OS, RAM / ROM, and MD communication interfaces to communicate with the computer environment 415 through the MD / computer environment communication interface 410. When communicating with the computer environment 415, the MD 405 can launch one or more computer applications (not shown in the figure), which may include (but is not limited to) a mobile desktop environment as a configuration part, user customization and authentication Recognized administrator and web services applications. Once the configuration has been set, the MD 405 can further collaborate with the computer environment 415 to process one or more web services (e.g., web service data and / or computer applications). In this context, the communication network 435 may be used by the MD 405 to request the cooperating MDMS 420 for web service information and / or computer applications in order to process their web services. In this case, the MDMS 420 can operate to authenticate the MD 405, thereby ensuring that the participant user (not shown) and the mobile device 405 have the correct permissions for the required data and / or computer applications. Such authentication procedures may also use one or more security peripherals that may reside on the MD 405, including (but not limited to) 96373.doc -23- 200522744 biometric security peripherals, retinal scan security peripherals Device and security voice recognition peripherals. If properly authenticated, the MDMS 420 may further operate to find the requested data and / or computer applications locally on the MDMS 420 and to communicate their requested data and / or computer applications via the communication network 435 ( For example, a web service) is provided to the recognized MD 405, or the MDMS 420 may operate to cooperate with a third party service provider 440 'in order to obtain a web service to be communicated to the recognized MD 405. When working with a third-party service web provider 440, the MDMS 420 is operable to use a translation engine 425 'to translate the web service 430 originating from the third-party web service provider 440 into an MD native format. In addition, the MDMS 420 is operable to use the encryption engine 445 to encrypt the required Web service while satisfying the Web service requirements from the authenticated MD 405. In addition, the MDMS 420 can further operate to use a selected encryption protocol (e.g., PKI encryption) to cooperate with a file system (not shown) to obtain a Web service to be communicated to the MD 405. The cooperative file system may include, but is not limited to, a file allocation table (FAT) building case system and a new technology files system (NTFS). Figure 5 illustrates a block diagram of exemplary components of an exemplary mobile device management server (MDMS) deployed in an exemplary network-connected computer environment. As shown, the exemplary networked computer environment includes Site A, Site B, and Site C, each site having an exemplary MDMS and components, respectively. Site A includes MDMS 502 'MDMS 502 itself has an operating system 504. The operating system (OS) 504 shown in the figure supports the java virtual machine (jvm) 506, followed by the java virtual machine 96373.doc -24- 200522744 The machine (JVM) 506 supports MDMS. Java code 508. The MDMS.java code 508 in this article includes SOAP chaining 538 and services 548. In addition, the operating system 504 can also operate to support and collaborate with the user database 510, the key database 512, and the file storage area 514. Furthermore, the operating system 504 can also operate to support and collaborate with resident applications 550, JVM 552, and JVM 554. In addition, the operating system 504 can also operate to support and cooperate with encryption drivers, communication interface drivers, and network drivers. Mirroring OS 504, MDMS 502 maintains hardware, for example, hardware accelerators, communication interface ports, and communication interface cards (NICs) that work with encryption drivers, communication interface drivers, and network drivers during the operation of MDMS 502. In addition, as shown in the figure, the MDMS includes a storage area network (SAN) / network-attached storage device (NAS) interface 516 that is operable to connect the MDMS 502 to a cooperative file / data storage area 518 and cooperation MDMS 520 and 522. The SAN / NAS interface 5 16 can be coupled to the cooperative file / data storage area 518 and the cooperative MDMS 520 and 522 through the communication network 5 19. Furthermore, as shown, the MDMS 502 may cooperate with other MDMS environments 536 and 528 that reside locally to the MDMS 502 or are geographically separated from the MDMS 502. The MDMS environment 536 may include an MDMS 534 and a file / data storage area 532. Similarly, the MDMS environment 528 may include MDMS 526 and MDMS 530 which are operatively coupled to the file / data storage area 524. Several submodules may reside in the SOAP link module 538, including (but not limited to): a packet investigation Packet sniffer, which can operate to monitor data communications; security enforcement, which can operate to maintain data permissions and access; usage / monitor *, 96373.doc- 25- 200522744 which can operate to meter service usage; and a web services proxy, which can operate to cache requester components (eg, certified MD, not shown) ) Collaborative Web Services. Their sub-modules can be controlled by one or more sub-module applications, including (but not limited to): an administration debugger for execution on the packet sniffer sub-module A security manager for execution on the security / enforcement sub-module; a metering manager for execution on the usage mode / monitor sub-module; and an agent A server manager (proxy manager) is used to run on the web service proxy server. Several submodules can reside in the SOAP link module 548, including (but not limited to): a mobile device administrator; an encryption administrator (PKCS administrator); a file transfer service; a Web service administrator; Web Service access control service; a web service measurement service; a universal description, description, discovery, and integration (UDDI) service; a UDDI repository service; a file system ( For example, the Omni File System); a SOAP proxy server service; a Web service translator service; and a quality of service operation that operates to perform (including but not limited to) load balancing, MDMS live switching ( hot swapping) and transfer after error. The resident applications 550 may include, but are not limited to, security, router, SAN / NAS control, and encryption control. The JVM 552 may include code that operates on and processes encrypted information (e.g., key information), user authentication, service provisioning, and MDMS java operations. In contrast, JVM 554 may include Java code that allows 96373.doc -26- 200522744 to simulate the hardware configuration of mobile devices. In operation, MDMS makes full use of one or more of the components described above to process Web service requests, and uses cryptographic processes to securely provide • Web services to cooperate with requesting parties that use authentication and confirmation information Of components. MDMS 502 can collaborate with other MDMS environments (eg, MDMS environments 536 and 528) to meet Web services requirements. In one example implementation, the MDMS 501 provides installation management user information, applications, and service registration and coordination of storage devices. In operation, MDMS 501 supports user access and management functions. For example, mobile desktop users can use MDMS 501 to connect to their applications and data. In this context, after being connected, the MDMS 501 will check user authentication and preference settings. Access control can be enforced automatically, and "skins" can be applied to applications and services, enabling applications and services to match the environment of the participating users. Application and data requests can be processed in accordance with the speed of the local device and can be monitored based on improved systems. In addition, the MDMS 502 can also be operated to allow users to access their authorized file storage areas (for example, 518, 532, and 524) and distribute cases to individuals, groups, or globally. In this context, MDMS 502 can use various MDMS components to provide management of files, applications / services (548 and 550) and mass storage devices. In addition, because the MDMS 502 enables system administrators to connect to the MDMS 502 from a remote location using a cooperating mobile device (not shown), it allows for more robust system management. As shown in FIG. 5, the MDMS 502 may include several functional components and modules. The other components and modules can operate to provide various functions, including (but not limited to) security 96373.doc -27- 200522744 sex, mobile device management, gold and gold tracking and management, transaction measurement, building case system Management, application / service management, application subscription management, web service monitoring, legacy infrastructure expansion, data store management, and cluster deployment and management. Figure 6 illustrates the procedures performed by the exemplary MDMS 502 with Hopewell MD. As shown in the figure, the program starts from step 600, and proceeds to step 605, where a check is performed to determine whether the MD authentication of the cooperation needs to be established or updated. If the check result at step 605 indicates that it is not necessary to build jl or update the MD bank identification, the program returns to step 600 and continues the program. However, if the result of the check at step 605 indicates that MD authentication needs to be established or updated, the procedure proceeds to step 61, where a check is performed to determine whether the cooperating MD is a new partner of the MDMS and needs to be performed by the MDMS. Initial authentication. If the check result at step 61 indicates that a new MD needs to be authenticated, the procedure proceeds to step 615, and * MDMS generates authentication information about the new ... ^. The program then proceeds to step 62, where an encryption key is generated and passed to the authenticated MD. Next, at step 625, the authentication and encryption information is transmitted to the authenticated cooperative MD. Then, the identification and desire information are used to establish the relevance of the group members applicable to the MD on the cooperative file system. A check is then performed at step 5 to determine if it has been successfully identified. If the result of the check at step 635 indicates that the authentication was deemed unsuccessful, the program proceeds to step 64 to generate an error. Then in step 645, the error can be corrected. The program then returns to step 63 5 and continues the program. However, 'if it is determined in step 635 that the authentication test has been passed, the program proceeds to step 650' and a check is performed in step 650 to determine whether it is necessary to change the authority of the cooperation 96373.doc 200522744. If the result of the check at step 650 indicates that permission needs to be changed, the process proceeds to step 655 to update the authentication and / or encryption information. The program then returns to step 635 and continues the program. However, if the result of the check at step 650 indicates that the permission does not need to be changed, the program proceeds to step 660 and ends with the MD authentication configuration setting. Furthermore, if the result of the check at step 610 does not indicate a new MD that does not require authentication, the process proceeds to step 650 and continues the process. FIG. 7 illustrates a program executed by the mobile device management server 502 in an exemplary Web service processing implementation. As shown in FIG. 7, the program starts from step 700 and proceeds to step 705 where a check is performed to determine whether the MDMS has performed communication with the cooperating computer network. If the result of the check at step 700 indicates that no communication is taking place, the program returns to step 700 and continues. However, if it is determined in step 705 that the MDMS has performed communication with the cooperating computer network, the program proceeds to step 710 where a check is performed to determine whether one or more cooperating MDs have requested one or more Webs from the MDMS. service. If the check result in step 710 indicates that no MD requires Web service, the program returns to step 710 and continues the program. However, if the result of the check at step 710 indicates that one or more cooperating MDs have requested one or more web services, the process proceeds to step 7 15 and the MDMS uses the MD security and authentication services to authenticate the MD . A check is then made in step 720 to determine if the MD has been authenticated. If the MD has been authenticated, the program proceeds to step 735 to process the Web service request. Then, in steps 740 and 745, the MDMS and the MD execute a Web service. However, if the check result at step 7 2 0 indicates that the authentication was not successful 96373.doc -29- 200522744 MD, the program proceeds to step 725 to generate an error. The program then proceeds to step 727 where a check is performed to determine whether authentication is attempted again. If the check result at step 727 indicates that md authentication is attempted again, the procedure returns to step 720 and continues the procedure. However, if it is determined in step 727 that MD recognition is not attempted again, the program terminates in step 73. FIG. 8 illustrates a procedure executed by the mobile device management server 502 in another web service processing implementation. As shown in Figure 8, the program starts at step 800 and proceeds to step 805 where a check is performed to determine whether one or more authenticated MDs have requested one or more web services. If the result of the check at step 805 indicates that no authenticated tMD requires a web service, the program returns to step 800 and continues the program. However, if the result of the check at step 805 does not indicate whether one or more authenticated MDs have requested one or more web services, the process proceeds to step 81 and the MDMS will retrieve the data from the cooperative data storage area, Retrieve data and / or computer applications from any item in a cooperative Web service provider and other cooperative MDMS. Then, in step 815, a check is performed to determine whether the captured Web service needs to be translated into the MD native Web service format. If the result of the check at step 815 indicates that translation is required, the program proceeds to step 825 to encrypt the requested data and / or computer application according to the selected encryption protocol (for example, using a public / private key). Then, the procedure proceeds to step 830, and the encrypted data and / or computer application program is transmitted to the MD authenticated by the requesting party. Next, in step 835, the MD job is measured by the MDMS to obtain usage information, behavior, similarity, and similar measurement information. The metering data is then stored for future use in step 840. Next, a check is performed in step 845 to determine whether to report the stored 96373.doc -30- 200522744 measurement data. If the inspection result at step 845 indicates that the measurement data is to be reported, the procedure proceeds to step 850 to analyze the measurement data to generate a measurement report. The program then terminates at step 855. However, if the result of the check at step 815 indicates that translation is required, the program proceeds to step 820 to translate the requested Web service into an MD native Web service. The program then proceeds to step 825 and continues the program. FIG. 9 illustrates a program executed by the MDMS 502 in another Web service processing implementation. As shown in FIG. 9, the program starts at step 900, and proceeds to step 905, at which a check is performed to determine whether one or more authenticated] ^!) Has requested one or more Web services. If the result of the check in step 905 is shown (there is an authenticated MD requesting a Web service, the program returns to step 900 and continues the program. However, if the check result in step 905 indicates one or more If an authenticated MD has requested one or more web services, the process proceeds to step 910 'Retrieved by MDMS from any item in the cooperation project deposit area, the cooperation Web service provider, and other cooperation MDMS Data and / or computer applications. Next, a check is performed at step 915 to determine whether the extracted web service needs to be translated into the MD native web service format. If the check result at step 91.5 indicates that translation is required, the program proceeds to Step 925 'Encrypt the requested data and / or computer application according to the selected encryption protocol (eg, using public / private gold loss). Then, proceed to step 930 to encrypt the data and / or computer application The program is transmitted to the certified MD of the requesting party. Then, a check is performed at step 935 to determine whether the communication link between the MDMS and the partner MD is in use. If The check result at step 935 indicates that the communication link is in use 96373.doc -31-200522744. The program proceeds to step 945 to synchronize any cached transactions. Then, at step 950, the MDMS sends Measure MD operations to obtain usage metrics, behaviors, similarities, and similar metric information. Then, at step 955, store data for future use. Then, at step 96, a check is performed to determine whether to report the Stored measurement data. If the inspection at step 96 indicates that the measurement data is to be reported, the program proceeds to step 965, where the measurement is performed; the shell material is generated to generate a measurement report. Then the program terminates at step. However, if the check result in step 935 indicates that the communication link is not in use, the program proceeds to step 94 to cache the requested web service. Then, the program proceeds to step 935 and continues the program. Further, If the check result in step 915 indicates that translation is required, the program proceeds to step 920 to translate the requested Web service into the md native service. Then, the program proceeds to Step 925 and continue the process. In summary, the systems and methods described herein provide a mobile device management feeder that is used as a part of a mobile device. However, it should be understood that the present invention includes various modifications and alternative constructions. This The invention is not limited to the specific construction as described herein. On the contrary, the present day depends on all modifications, alternative constructions, and equivalents that fall within the spirit and scope of the present invention. Please note that in various computer environments (including non-wireless and Wireless computer environment), local computer environment and real environment can implement the present invention. The various technologies described in this article can be implemented using hardware, software or a combination of software and hardware. The preferred method is' programmable in maintenance To implement various technologies in the computer environment of the computer, where the computer includes a processor, a processor-readable storage medium 96373.doc -32- 200522744 storage media (including volatile and nonvolatile memory and / or storage elements), At least one input device and at least one output device. Computer hardware logic that cooperates with various instruction sets is applied to the data to perform Z-capability as described above and generate output information. The output information is supplied to one or more output devices. Option 4, various programming languages (including high-level procedures or object-oriented programming languages) can be used to implement programs used by exemplary computer hardware to communicate with computer systems. By way of illustration, if desired, the combination T or computer term T can be used to implement the devices and methods described herein. In any case Wulu may be a compiled or interpreted language. Preferably, each computer program is stored in a general or special purpose programmable computer-readable storage medium or device (for example, ROM or magnetic disk), and is used when the computer reads the storage medium or device. Configure and operate the computer to perform the procedures described above. The device may also be constructed as a computer-readable storage medium and configured using a computer program, where the storage medium is configured to cause the computer to operate in a specific or predefined manner. Although the exemplary implementation of the present invention has been described in detail herein, those skilled in the art will readily understand that the exemplary embodiment has many additional modifications that can be implemented without substantially departing from the novel teaching content and advantages of the present invention . Accordingly, these and all such modifications are intended to be included within the scope of this invention. The following exemplary patent applications define the invention more appropriately. [Brief Description of the Drawings] The mobile device platform and method of use will now be described in detail with reference to the drawings. In the figure: FIG. 1 shows an exemplary electrical implementation of the system and method described in this document 96373.doc -33- 200522744 Block diagram; Figure 2 illustrates a block diagram of an exemplary computer network environment according to the systems and methods described herein; Figure 3 illustrates a block diagram of exemplary computer operating component interactions not based on the systems and methods described herein; Figure 4 illustrates Block diagram of an example implementation of a mobile device platform not based on the systems and methods described herein;
圖5繪不根據本文描述之系統及方法的例證性行動裝置 管理伺服器之示例性架構方塊圖； 圖6績不根據本文描述之系統及方法，例證性行動裝置管 理祠服器所執行之處理使用者和裝置管理程序的流程圖； 圖7緣示根據本文描述之系統及方法，例證性行動裝置管 理伺服器處理Web服務要求時所執行之程序的流程圖，· 圖叫示根據本文描述之系統及方法，例證性行動裝置管 理飼服器在Web服務程序期間轉譯佩服務時所執行之程 序的流程圖；Figure 5 illustrates an exemplary architecture block diagram of an exemplary mobile device management server that is not based on the systems and methods described herein. Figure 6 illustrates a process performed by an exemplary mobile device management server that is not based on the systems and methods described herein. Flow chart of user and device management procedures; Figure 7 shows a flow chart of an example of a process performed by an exemplary mobile device management server in processing a web service request according to the system and method described herein. System and method, a flowchart illustrating an example of a process performed by a mobile device managing a feeder when translating a Pei service during a Web service process;
θ、”曰不根據本文描述之隸及方法，例證性行 理祠服器執行計量及間歇連線處理時所執行之程岸的流 圖0 【主要元件符號說明】 電腦作業環境） 電腦系統（資料處理系統 系統匯流排 110 中央處理單元（CPU) 112 互連 96373.doc -34- 200522744 115 微處理器 120 記憶體控制器 125 隨機存取記憶體（RAM) 130 唯讀記憶體（ROM) 135 周邊裝置控制器 140 印表機 145 鍵盤 150 滑鼠 155 資料儲存機 160 通信網路 163 顯示器控制器 165 顯 TF !§ 170 網路卡 180 作業系統 180? 電腦應用程式 200 網路連線電腦環境 210 平板式個人電腦 215 行動電話 220 電話 225 個人數位助理 300, 400 行動裝置平臺 305 通信介面 310, 405 行動裝置（MD) 410 MD/電腦環境通信介面θ, "Ie not based on the methods and methods described in this article, an example of the flow chart of the process performed by the temple server when performing metering and intermittent connection processing. 0 [Description of main component symbols] Computer operating environment) Computer system ( Data Processing System System Bus 110 Central Processing Unit (CPU) 112 Interconnection 96373.doc -34- 200522744 115 Microprocessor 120 Memory Controller 125 Random Access Memory (RAM) 130 Read Only Memory (ROM) 135 Peripheral device controller 140 Printer 145 Keyboard 150 Mouse 155 Data storage 160 Communication network 163 Display controller 165 Display TF! § 170 Network card 180 Operating system 180? Computer application 200 Network connection computer environment 210 Tablet PC 215 Mobile Phone 220 Telephone 225 Personal Digital Assistant 300, 400 Mobile Device Platform 305 Communication Interface 310, 405 Mobile Device (MD) 410 MD / Computer Environment Communication Interface
96373.doc -35- 200522744 415 電腦環境 420 行動裝置管理伺服器（MDMS) 425 轉譯引擎 430 Web服務 435 通信網路 440 第三方Web服務提供者 445 加密引擎 A，B, C 站點 502， 520， 522, 534 行動裝置管理伺服器（MDMS) 504 作業系統（OS) 506， 552, 554 Java虛擬機器（JVM) 508 MDMS.Java程式碼 510 使用者資料庫 512 金鑰資料庫 514 檔案儲存區 516 儲存區域網路（SAN)/網路附接式儲存裝置 (NAS)介面 518， 524, 532 構案/資料存放區 519 通信網路 528, 536 MDMS環境 96373.doc -36- 200522744 538 548 550 SOAP鏈結（chaining)模組 服務模組 常駐應用程式96373.doc -35- 200522744 415 Computer environment 420 Mobile Device Management Server (MDMS) 425 Translation engine 430 Web service 435 Communication network 440 Third-party web service provider 445 Encryption engine A, B, C Sites 502, 520, 522, 534 Mobile Device Management Server (MDMS) 504 Operating System (OS) 506, 552, 554 Java Virtual Machine (JVM) 508 MDMS.Java Code 510 User Database 512 Key Database 514 File Storage Area 516 Storage Local area network (SAN) / network attached storage device (NAS) interface 518, 524, 532 Architectural / data storage area 519 Communication network 528, 536 MDMS environment 96373.doc -36- 200522744 538 548 550 SOAP chain Chaining module service module resident application
96373.doc -37-96373.doc -37-