MANAGING ACCESS TO RESOURCES

• US 20170208098A1
• Filed: 04/04/2017
• Published: 07/20/2017
• Est. Priority Date: 11/10/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: 2236008 Ontario Inc. (Blackberry Limited), Blackberry Limited
• Inventors: Bender, Christopher Lyle, Ferguson, Geordon Thomas, Schneider, Kenneth Cyril, Whitehouse, Oliver, Hobbs, Christopher William Lewis, Zubiri, Alberto Daniel
• Granted Patent: US 10,848,520 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/086 using security domains

Abstract

In some implementations, a method of managing access to resources in a single device including receiving, from a first resource assigned to a first perimeter, a request to access a second resource assigned to a second perimeter different from the first perimeter. The single device includes the first perimeter and the second perimeter. Whether access to the second resource is prohibited is determined based on a management policy for the first perimeter. The management policy defining one or more rules for accessing resources assigned to the second perimeter including the second resource.

Claims

1-27. -27. (canceled)

28. A method of managing access to resources in a device, comprising:

receiving, by a hardware data processing apparatus on the device, from a first resource associated with a first plurality of resources defined on the device, a request to access a second resource associated with a second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, and wherein the first plurality of resources and the second plurality of resources are logically separated and access between the first plurality of resources and the second plurality of resources is determined based on one or more management policies, the first plurality of resources including a first network connection profile, and the second plurality of resources including a second network connection profile, and wherein the request to access the second resource comprises a request to make a network connection by the first resource using the second network connection profile;

determining, by a hardware data processing apparatus on the device, whether the request to make the network connection is prohibited based on a first management policy for the first plurality of resources or a second management policy for the second plurality of resources, the first management policy defining one or more rules for the first plurality of resources for accessing resources associated with the second plurality of resources including the second resource, the second management policy defining one or more rules for the second plurality of resources for allowing access to resources associated with the second plurality of resources including the second resource, and

processing the request to make the network connection based on the determining.

29. The method of claim 28, further comprising:

receiving a request to grant administrative access to resources associated with the second plurality of resources; and

prohibiting administrative access to resources associated with the second plurality of resources.

30. The method of claim 28, wherein the device comprises a tablet computer.

31. The method of claim 28, wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.

32. The method of claim 28, wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.

33. The method of claim 28, wherein the first management policy comprises a personal management policy, and the second management policy comprises a corporate management policy.

34. The method of claim 28, wherein the second resource comprises data associated with at least one of a corporate messaging account, a corporate calendar account, or a corporate contact database.

35. A device, comprising:

a first plurality of resources associated with a first resource and a first management policy, the first management policy defining one or more rules for accessing resources associated with the second plurality of resources including the second resource, wherein the first plurality of resources including a first network connection profile;

a second plurality of resources associated with a second resource and a second management policy, the second management policy defining one or more rules for allowing access to resources associated with the second plurality of resources including the second resource, wherein the second plurality of resources including a second network connection profile, the first plurality of resources and the second plurality of resources being logically separated; and

one or more hardware processors operable to;

receive, from the first resource associated with the first plurality of resources on the device a request to access the second resource associated with the second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, wherein the request to access the second resource comprises a request to make a network connection by the first resource using the second network connection profile;

determine whether the request to make the network connection is prohibited based on the first management policy for the first plurality of resources or the second management policy for the second plurality of resources; and

process the request to make the network connection based on the determining.

36. The device of claim 35, the one or more processors further operable to:

receive a request to grant administrative access to resources associated with the second plurality of resources, wherein the request identifies an administrator;

determine the identified administrator is different from an administrator associated with the second plurality of resources; and

prohibit administrative access to resources associated with the second plurality of resources.

37. The device of claim 35, wherein the device comprises a tablet computer.

38. The device of claim 35, wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.

39. The device of claim 35, wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.

40. The device of claim 35, wherein the first management policy comprises a personal management policy, and the second management policy comprises a corporate management policy.

41. The device of claim 35, wherein the second resource comprises data associated with at least one of a corporate messaging account, a corporate calendar account, or a corporate contact database.

42. A computer program product encoded on a tangible, non-transitory storage medium, the product comprising computer readable instructions for causing one or more processors to perform operations comprising:

receiving, by a hardware data processing apparatus on the device, from a first resource associated with a first plurality of resources defined on the device, a request to access a second resource associated with a second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, and wherein the first plurality of resources and the second plurality of resources are logically separated and access between the first plurality of resources and the second plurality of resources is determined based on one or more management policies, the first plurality of resources including a first network connection profile, and the second plurality of resources including a second network connection profile, and wherein the request to access the second resource comprises a request to make a network connection by the first resource using the second network connection profile;

determining, by a hardware data processing apparatus on the device, whether the request to make the network connection is prohibited based on a first management policy for the first plurality of resources or a second management policy for the second plurality of resources, the first management policy defining one or more rules for the first plurality of resources for accessing resources associated with the second plurality of resources including the second resource, the second management policy defining one or more rules for the second plurality of resources for allowing access to resources associated with the second plurality of resources including the second resource; and

processing the request to make the network connection based on the determining.

43. The computer program product of claim 42, the operations further comprising:

receiving a request to grant administrative access to resources associated with the second plurality of resources, wherein the request identifies an administrator;

determining the identified administrator is different from an administrator associated with the second plurality of resources; and

prohibiting administrative access to resources associated with the second plurality of resources.

44. The computer program product of claim 42, wherein the device comprises a tablet computer.

45. The computer program product of claim 42, wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.

46. The computer program product of claim 42, wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.

47. The computer program product of claim 42, wherein the first management policy comprises a personal management policy, and the second management policy comprises a corporate management policy.