mfrontiers white paper November 2013 Enterprise Mobility Management Platform with Simplifying and Empowering the Implementation of Enterprise Mobile Strategy Page 1 of 9
Simplifying and Empowering the Implementation of Enterprise Mobile Strategy Introduction Michael Brey and Walter W. Sloan According to the Enterprise Mobility Foundation, the increasing business possibilities that come from deploying mobile solutions in the workplace are now counterbalanced by an increasingly complex array of options that can make implementing a mobile strategy both complex and risky. Many organizations are deploying mobile device management solutions to secure their mobile devices, but there is much more to be done. 1 While security is the biggest concern for mobile enterprise applications (apps), once security has been addressed, there remain complex issues of developing, deploying and maintaining apps in business environments where users can bring their own devices to the network. This issue is so pervasive that it has its own acronym, BYOD, for Bring Your Own Device. In addition, many mobile apps require access to data where wireless communication may not be available, such as in a hospital, an electrically noisy industrial facility, a remote field location, or a shielded building. Wireless networks are not at 100% coverage and probably will never get there. Even if wireless communication is available, it can be unstable. J.D. Power and Associates has noted that the number of dropped calls has increased tremendously over the past few years. A unified solution that simplifies the development, deployment, maintenance, and management of mobile apps in a BYOD environment, while providing secure access to offline data, would benefit many organizations. Such a unified solution is provided by the Oracle Database Mobile Server and Oracle Berkeley DB, used with the mfinity Enterprise Mobility Management Platform by mfrontiers, Inc. Background To understand the issues in implementing and maintaining mobile apps in a BYOD environment, it is important to first understand the three different types of mobile apps. Native app Built for a specific platform using the platform SDK, tools, and languages that are typically provided by the platform vendor. Native apps are traditionally superior in terms of performance and the only means to access device attributes such as geolocation API, camera, video, audio, and accelerometer. 2 1 The Enterprise Mobility Foundation, Looking Beyond Mobile Device Management to Mobile Application and Enterprise Mobility Management, August 2011 2 Native or Web Application? How Best to Deliver Content and Services to Your Audiences over the Mobile Phone, Global Intelligence Alliance White Paper, April 2010. Page 2 of 9
Web app A server-side app that is written using the same technology used for website development, only the HTML that it renders must fit the form-factor of the mobile devices. Web apps are easier to develop than Native Apps and may be viewed in the browser of any mobile device. Hybrid app Written using the same technology as Web apps, a Hybrid app uses the mobile device s native browser rendering engine, but not the browser itself. A Hybrid app may include calls to access device attributes such as geolocation API, camera, video, audio, and accelerometer. Choosing the type of application for a mobile enterprise app depends on business requirements. Does the app need high performance? Does it need offline execution? Does the app need to access the geolocation API, barcode reader, camera, audio, or video? Does the user simply need to view data on the host, and not interact with it? The answers to these questions will dictate whether the app should best be developed as Native, Web, or Hybrid. Also, cost of developing the solution and keeping it updated as the device platform changes is a factor in this decision. Problem Definition While there are tangible benefits from providing users with mobile access to enterprise data, the challenges of securing data in a BYOD environment are significantly increased. The diversity of smartphones, tablet computers, and mobile operating systems in such an environment presents broad challenges to IT managers, developers, and users. Challenges for the IT Manager: According to Osterman Research, the absence of adequate tools to efficiently manage the diverse environment of mobile devices will force IT to spend an increasing proportion of their time on mobile management activities, resulting in less time available for other initiatives. 3 The challenge of BYOD to IT management is how to increase deployment and maintenance resources without reducing resources for application development. Challenges for the IT Developer: In a BYOD environment, developers must write and maintain software for multiple hardware devices and operating systems. Challenges for the User: With an expanding number of business apps downloaded to a user s mobile device, if each app requires a different login process, then productivity decreases. Also, each time that a user needs to manually download the latest version of an app from the company s online catalog, productivity is disrupted. A uniform look and feel for corporate applications is critical for enduser acceptance of the solution. Another challenge to the user occurs when no 3 Key Issues to Consider in Mobile Device Management, Osterman Research White Paper, May 2011 Page 3 of 9
wireless connection is available and the user needs to access data that is not stored on the mobile device. Problem Solution In the real world, wireless connections are not always available to mobile users, employees change organizational roles, and the application may need to be updated if there is a change to: Business requirements The mobile device operating system The device hardware In the case of Native or Hybrid apps, the application needs to be changed for multiple devices and operating systems. Web apps are less sensitive to changes to the mobile operating systems. But whenever there is a change, if users need to manually download the changes from the enterprise catalog, then productivity is reduced. This user productivity issue can be addressed by implementing an application catalog that automatically delivers updates to users. What is needed is an enterprise mobility management platform that: Simplifies the deployment of mobile apps. Reduces the need to maintain multiple versions of source code for each mobile app. Provides secure offline access to mission-critical data. Solution Details mfinity from mfrontiers Inc. is an Enterprise Mobility Management Platform (EMMP) that simplifies the development, deployment, update, and management of mobile applications, and provides secure offline mobile data access. mfinity EMMP has both a server-side component as well as a mobile device client. The mfinity server-side application runs under Oracle Weblogic and works with Oracle Database Mobile Server (DMS). The mfinity mobile client integrates the DMS mobile sync agent. The system architecture of mfinity EMMP is shown in Figure 2. Oracle Database Mobile Server (DMS) Mobile apps often need to store and access substantial amounts of local data. For system configurations with a backend Oracle database, the best way to accomplish this is using Oracle DMS, which provides: Device autonomy - the ability to perform a primary function without depending on network connectivity. This is accomplished using a high performance, Page 4 of 9
embedded, local database, which also results in a much more responsive user interface, generally faster operations, and data at your fingertips. Total integration enabling data flow, plus device and app management from one central command console. It can quickly turn a collection of devices into a highfunctioning, managed mobile network. Security through encryption that protects data both in-flight and at rest, as well as other security features, detailed below. Three groups of components make up Database Mobile Server: The backend The sync engine and the management console (middle tier). The Mobile Development Kit (MDK) A set of libraries and tools used to create and test mobile apps integrated with DMS. Device clients Applications developed with the MDK utilize either a Berkeley DB or SQLite database that is integrated with a mobile sync client, and optionally a device management agent. DMS sync client and device management agent supports a broad array of device platforms. DMS data sync utilizes a publish/subscribe model, meaning the server will publish data sets which authenticated device users can subscribe against. Once they ve subscribed, it creates a direct association between the user s local device database and the backend. DMS data sync supports data sub-setting and conflict resolution. Sync can be bidirectional or uni-directional push-only (in either direction) and controlled through rulebased logic. The device management agent, or dmagent, enables remote status reporting by devices, as well as mobile application management (MAM) for DMS managed apps. Once the device has been bootstrapped with a first install, applications can be remotely managed, including update, uninstall, data wipe, user mgmt, and more. MAM provides device monitoring and the ability to enable/disable specific device functionality, inspect various configurations, or even lock down an application. In addition to strong encryption, DMS integrates with several different Oracle security products, including Oracle Identity Management and Oracle LDAP. DMS supports platform security services, which provide a set of standardized Java APIs aimed at enhancing security. Additionally, it provides tight control of the application and data stream subscriptions. If a device is compromised, sync technology can disable a viable upstream path for the attacker from the management console. It is important to note that encryption is provided for the local client database, enabling applications to securely store their data. Page 5 of 9
mfinity EMMP The mfinity EMMP server-side application runs under Oracle Weblogic and DMS to provide: An Administrator Console. Role-based deployment of enterprise apps. An interface to an Oracle database. The mfinity EMMP mobile device runtime client provides: A secure container box that isolates enterprise apps from user apps. (Fig. 1) Single sign-on for all apps to which the user has access. The ability to share parameters and data among apps in the device container box. Integration of the Oracle Database Mobile Sync Agent. Access to native functionality such as camera, video, barcode scanning, and geolocation. The Administrator Console is used to: Register users and authenticate devices. Register apps for deployment. Assign apps to roles within the enterprise. Assign users to roles within the enterprise. Grant permissions among role groups. Deploy Push Alert notifications. Generate reports on the status of the mobile network and users. Apps within the container box can share parameters, but data cannot be passed to user apps outside the container box. Whenever the user logs into mfinity on their mobile device, they automatically receive the most recent update to the runtime client and all their enterprise apps. If their role within the organization is changed in the Administrator Console, then the next time they login to mfinity, they will see only the apps defined by their new role. Login Figure 1. The mfinity secure container box isolates enterprise apps from user apps. Page 6 of 9
Business benefits With the role-based deployment of mfinity, a user only needs to perform one manual download the mfinity mobile client. After the user authenticates their mobile device, they immediately have access to all applications for their role within the enterprise, and will automatically receive updates when there is a change to an application or the device operating system. And if the user changes roles within the organization, their applications in the mfinity container box are automatically updated with the proper applications for the user s new role. Another benefit to users is access to offline data. The mfinity mobile runtime client has embedded the Oracle DMS mobile sync agent, allowing offline access to data stored on the device using either Oracle Berkeley DB or SQLite. When wireless communication is available, the host and mobile databases can be synchronized. There are two significant benefits of mfinity to IT developers. To begin, the mfinity runtime client provides access to Native API functionality such as camera, audio, video, geolocation, and barcode scanning. With mfinity it is no longer required to write Native apps to access such functionality. In addition, when there are changes to the mobile operation system that may affect apps, the runtime client is updated so that, in most cases, no change to the mobile app will be required. With mfinity the organizations favorite tools can be used to develop Web apps or Hybrid apps that include the functionality of Native apps. In this way, mfinity simplifies both the development and maintenance of mobile apps. There are three significant benefits of mfinity to IT managers. Because of the way that mfinity simplifies the development and maintenance of apps, IT management does not need to hire programmers with a diversity of skills on each of the mobile device platforms in use. And because of mfinity s role-based deployment and automatic update feature, fewer resources need to be allocated when deploying and maintaining apps, and more resources can be focused on addressing business requirements. The third benefit to IT management is improved security. The device authentication in addition to the user/password, no database connection string in the device ever, encrypted communication between the runtime client and the mfinity server are the only a few examples of enhanced security of mfinity EMMP. Summary The mfinity Enterprise Mobility Management Platform, together with Oracle DMS, simplifies the development, deployment, maintenance, and management of mobile applications, thereby improving the productivity of IT developers, IT managers, and mobile users. Page 7 of 9
IT developers no longer need to write apps that communicate with a wide range of devices and operating systems. With mfinity, developers write apps that interface with the mfinity mobile runtime client, which is consistent across all the user s devices. IT managers can focus resources on transforming business requirements into apps, and spend less time managing the maintenance of apps due to changes in mobile devices and operating systems. Users perform only one manual download the mfinity runtime client. They then receive secure access to all apps for their role within the organization, always updated, even if they change roles within the organization. Users can securely access enterprise data stored on their device, and synchronize the local and host data when a wireless connection is available. Figure 2. The mfinity Enterprise Mobility Management Platform Page 8 of 9
Authors Michael Brey is Director, Embedded Database Technologies, for Oracle Corporation. michael.brey@oracle.com Walter W. Sloan is Vice President, Business Development, for mfrontiers Inc. wwsloan@mfrontiers.com Page 9 of 9