Dynamically generating perimeters
First Claim
1. A method, comprising:
- receiving a request to add to a mobile device an enterprise application for accessing an enterprise account;
in response to detection of a parameter or a pattern associated with an account setting, retrieving a security policy from a resource server for the enterprise account;
in response to the request to add the enterprise application and the detection of the parameter or the pattern associated with the account setting, generating, by the mobile device, a new logical separation of resources associated with the enterprise application and other enterprise resources on the mobile device, wherein the new logical separation of resources prevents applications on the mobile device external to the new logical separation of resources from accessing resources associated with the new logical separation of resources;
receiving, from the resource server, a client certificate for establishing a secure channel with an enterprise;
assigning the client certificate to the new logical separation of resources;
when the new logical separation of resources is unlocked, granting access between the other enterprise resources and the enterprise application and granting the external resources on the mobile device to access the enterprise application and the other enterprise resources on the mobile device, wherein an unlock state allows applications to access files in a file system domain;
when the new logical separation of resources is soft locked, granting access and operations between the other enterprise resources and the enterprise application while preventing user interactions with the enterprise application the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein the soft locked state allows applications running on the mobile device to access the files in the file system domain and locks an user interface on the mobile device; and
when the new logical separation of resources is hard locked, preventing access between the other enterprise resources and the enterprise application while preventing the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein a hard lock state prohibits applications from accessing the files in the file system domain and locks an underlying encryption domain.
8 Assignments
0 Petitions
Accused Products
Abstract
Systems and techniques relating to securely managing electronic resources are described. A described technique includes receiving a request to add to a mobile device an account setting for a server resource account. Detecting a trigger event for a new perimeter based on the account setting. In response to a parameter or a pattern associated with the account setting, retrieving a security policy from a resource server for the server resource account, and generating, by the mobile device, a new perimeter including the server resource account based on the security policy. The new perimeter is configured to prevent transferring data associated with the server resource account being transferred to mobile-device resources external to the new perimeter.
-
Citations
25 Claims
-
1. A method, comprising:
- receiving a request to add to a mobile device an enterprise application for accessing an enterprise account;
in response to detection of a parameter or a pattern associated with an account setting, retrieving a security policy from a resource server for the enterprise account;
in response to the request to add the enterprise application and the detection of the parameter or the pattern associated with the account setting, generating, by the mobile device, a new logical separation of resources associated with the enterprise application and other enterprise resources on the mobile device, wherein the new logical separation of resources prevents applications on the mobile device external to the new logical separation of resources from accessing resources associated with the new logical separation of resources;receiving, from the resource server, a client certificate for establishing a secure channel with an enterprise; assigning the client certificate to the new logical separation of resources;
when the new logical separation of resources is unlocked, granting access between the other enterprise resources and the enterprise application and granting the external resources on the mobile device to access the enterprise application and the other enterprise resources on the mobile device, wherein an unlock state allows applications to access files in a file system domain;when the new logical separation of resources is soft locked, granting access and operations between the other enterprise resources and the enterprise application while preventing user interactions with the enterprise application the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein the soft locked state allows applications running on the mobile device to access the files in the file system domain and locks an user interface on the mobile device; and when the new logical separation of resources is hard locked, preventing access between the other enterprise resources and the enterprise application while preventing the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein a hard lock state prohibits applications from accessing the files in the file system domain and locks an underlying encryption domain. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
- receiving a request to add to a mobile device an enterprise application for accessing an enterprise account;
-
11. A mobile device, comprising:
- one or more processors operable to;
receive a request to add to a mobile device an enterprise application for accessing an enterprise account; in response to detection of a parameter or a pattern associated with an account setting, retrieve a security policy from a resource server for the enterprise account;
in response to the request to add the enterprise application and the detection of the parameter or the pattern associated with the account setting, generate, by the mobile device, a new logical separation of resources associated with the enterprise application and other enterprise resources on the mobile device, wherein the new logical separation of resources prevents applications on the mobile device external to the new logical separation of resources from accessing resources associated with the new logical separation of resources including the enterprise application;receive, from the resource server, a client certificate for establishing a secure channel with an enterprise; assign the client certificate to the new logical separation of resources;
when the new logical separation of resources is unlocked, grant access between the other enterprise resources and the enterprise application and grant the external resources on the mobile device to access the enterprise application and the other enterprise resources on the mobile device, wherein an unlock state allows applications to access files in a file system domain;when the new logical separation of resources is soft locked, grant access between the other enterprise resources and the enterprise application and prevent user interactions with the enterprise application, wherein the soft locked state allows applications running on the mobile device to access the files in the file system domain and locks an user interface on the mobile device; and when the new logical separation of resources is hard locked, prevent access between the other enterprise resources and the enterprise application and prevent the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein a hard lock state prohibits applications from accessing the files in the file system domain and locks an underlying encryption domain. - View Dependent Claims (12, 13, 14, 15)
- one or more processors operable to;
-
16. A computer program product encoded on a non- transitory storage medium, the product comprising computer readable instructions for causing one or more processors to perform operations comprising:
-
receiving a request to add to a mobile device an enterprise application for accessing an enterprise account; in response to detection of a parameter or a pattern associated with an account setting, retrieving a security policy from a resource server for the enterprise account;
in response to the request to add the enterprise application and the detection of the parameter or the pattern associated with the account setting, generating, by the mobile device, a new logical separation of resources associated with the enterprise application and other enterprise resources on the mobile device, wherein the new logical separation of resources prevents applications on the mobile device external to the new logical separation of resources from accessing resources associated with the new logical separation of resources;receiving, from the resource server, a client certificate for establishing a secure channel with an enterprise; assigning the client certificate to the new Ironical separation of resources;
when the new logical separation of resources is unlocked, granting access between the other enterprise resources and the enterprise application and granting the external resources on the mobile device to access the enterprise application and the other enterprise resources on the mobile device, wherein an unlock state allows applications to access files in a file system domain;when the new logical separation of resources is soft locked, granting access and operations between the other enterprise resources and the enterprise application while preventing user interactions with the enterprise application the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein the soft locked state allows applications running on the mobile device to access the files in the file system domain and locks an user interface on the mobile device; and when the new logical separation of resources is hard locked, preventing access between the other enterprise resources and the enterprise application while preventing the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein a hard lock state prohibits applications from accessing the files in the file system domain and locks an underlying encryption domain. - View Dependent Claims (17, 18, 19, 20)
-
-
21. A system, comprising:
-
a first mobile device configured to connect a second mobile device to a network through the first mobile device; and a second mobile device configured to receive a request to add to a mobile device an-enterprise application for accessing an enterprise account, retrieve a security policy from a resource server for the enterprise account in response to detection of a parameter or a pattern associated with an account setting, generate a new logical separation of resources associated with the enterprise application and other enterprise resources on the mobile device in response to the request to add the enterprise application and the detection of the parameter or the pattern associated with the account setting, wherein the new logical separation of resources prevents applications on the mobile device external to the new logical separation of resources from accessing resources associated with the new logical separation of resources including the enterprise application, receive a client certificate from the resource server for establishing a secure channel with an enterprise, assign the client certificate to the new logical separation of resources, when the new logical separation of resources is unlocked, granting access between the other enterprise resources and the enterprise application and granting the external resources on the mobile device to access the enterprise application and the other enterprise resources on the mobile device, wherein an unlock state allows applications to access files in a file system domain, when the new logical separation of resources is soft locked, granting access between the other enterprise resources and the enterprise application while preventing user interactions with the enterprise application, wherein the soft locked state allows applications running on the mobile device to access the files in the file system domain and locks an user interface on the mobile device, when the new logical separation of resources is hard locked, the new logical separation of resources is configured to prevent access between the other enterprise resources and the enterprise application while preventing the external resources on the mobile device from accessing the enterprise application and the other enterprise resources on the mobile device, wherein a hard lock state prohibits applications from accessing the files in the file system domain and locks an underlying encryption domain. - View Dependent Claims (22, 23, 24, 25)
-
Specification