Managing use of network resources

• US 11,032,283 B2
• Filed: 06/13/2016
• Issued: 06/08/2021
• Est. Priority Date: 06/21/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Ryerson, Christopher, Bender, Christopher Lyle, Winkler, Michael Thomas, Bukurak, David, Altman, Benjamin
• Primary Examiner(s): Joshi, Suraj M
• Assistant Examiner(s): Habtemariam, Melaku Y
• Application Number:
  US15/180,911
• Publication Number:
  US 20160373452A1
• Time in Patent Office: 1,821 Days
• Field of Search: 709223-226
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Some aspects of what is described here relate to managing the use of network resources on a mobile device. User input received at the device indicates whether to allow an application associated with a first perimeter on the device to access a network resource associated with a second perimeter on the device. For example, in some instances user input may indicate whether to allow data from applications associated with a personal perimeter on the device to be transmitted over an enterprise communication system. When outbound data associated with the first perimeter are received, the device determines, according to the indication from the user input, whether to route the outbound data to the network resource associated with the second perimeter.

Claims

1. A method of managing use of network resources on a device, the method comprising:

receiving, at the device, outbound data from an application associated with a first group of logically separate resources, while the device is connected to both a first network and a second network, wherein the device includes the first group of logically separate resources and a second group of logically separate resources, the first group of logically separate resources includes a first network resource for accessing the first network, the second group of logically separate resources includes a second network resource for accessing the second network, and the first network is different than the second network;

in response to receiving the outbound data from the application associated with the first group of logically separate resources, outputting, on the device, a graphic user interface that requests a user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources; and

in response to receiving the user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources, determining, according to the user input, whether to route the outbound data received from the application associated with the first group of logically separate resources to the second network using the second network resource associated with the second group of logically separate resources while the device is connected to both the first and the second networks.

2. The method of claim 1, wherein the first group of logically separate resources includes multiple applications, the second group of logically separate resources includes multiple network resources, and the method further comprises routing the outbound data using the second network resource associated with the second group of logically separate resources.

3. The method of claim 1, further comprising:

determining that the second group of logically separate resources includes a policy that allows any applications associated with the first group of logically separate resources to access one or more network resources associated with the second group of logically separate resources; and

wherein the graphic user interface is outputted in response to the determining that the second group of logically separate resources includes the policy.

4. The method of claim 1, wherein the first group of logically separate resources includes a first policy that defines rules for accessing resources associated with the first group of logically separate resources, and the second group of logically separate resources includes a second policy that defines rules for accessing resources associated with the second group of logically separate resources.

5. The method of claim 1, wherein the first group of logically separate resources comprises a personal group of logically separate resources associated with a user of the device, and the second group of logically separate resources comprises an enterprise group of logically separate resources associated with an enterprise.

6. The method of claim 5, wherein the enterprise group of logically separate resources includes parameters for accessing at least one of a virtual private network of the enterprise or a wireless local area network of the enterprise.

7. A device comprising:

a first group of logically separate resources that includes an application and a first network resource for accessing a first network;

a second group of logically separate resources that includes a second network resource for accessing a second network, and the first network is different than the second network;

a user interface operable to, in response to receiving outbound data from the application associated with the first group of logically separate resources, while the device is connected to both the first network and the second network, output a graphic user interface requests a user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources; and

one or more hardware data processing apparatus operable to;

receive the outbound data from the application associated with the first group of logically separate resources; and

in response to receiving the user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources, determine, according to the user input, whether to route the outbound data received from the application associated with the first group of logically separate resources to the second network using the second network resource associated with the second group of logically separate resources while the device is connected to both the first and the second networks.

8. The device of claim 7, wherein the first group of logically separate resources includes multiple applications, the second group of logically separate resources includes multiple network resources, and the one or more hardware data processing apparatus is operable to route the outbound data using the second network resource associated with the second group of logically separate resources in response to the determining.

9. The device of claim 7, wherein the one or more hardware data processing apparatus is operable to:

determine that the second group of logically separate resources includes a policy that allows any applications associated with the first group of logically separate resources to access one or more network resources associated with the second group of logically separate resources; and

output the graphical user interface that enables the user input.

10. The device of claim 7, wherein the first group of logically separate resources comprises a personal group of logically separate resources associated with a user of the device, and the second group of logically separate resources comprises an enterprise group of logically separate resources associated with an enterprise.

11. The device of claim 10, further comprising a communication interface operable to communicate with an enterprise communication system.

12. A non-transitory computer-readable medium comprising instructions that are operable when executed to cause one or more hardware data processing apparatus to perform operations comprising:

receiving, at a device, outbound data from an application associated with a first group of logically separate resources while the device is connected to both a first network and a second network, wherein the device includes the first group of logically separate resources and a second group of logically separate resources, the first group of logically separate resources includes a first network resource for accessing the first network, the second group of logically separate resources includes a second network resource for accessing the second network, and the first network is different than the second network;

in response to receiving the outbound data from the application associated with the first group of logically separate resources, outputting, on the device, a graphic user interface that requests a user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources; and

in response to receiving the user input indicating whether to allow the application associated with the first group of logically separate resources to access the second network resource associated with the second group of logically separate resources, determining, according to the user input, whether to route the outbound data received from the application associated with the first group of logically separate resources to the second network using the second network resource associated with the second group of logically separate resources while the device is connected to both the first and the second networks.

13. The non-transitory computer-readable medium of claim 12, wherein the first group of logically separate resources includes multiple applications, the second group of logically separate resources includes multiple network resources, and the operations further comprises routing the outbound data using the second network resource associated with the second group of logically separate resources.

14. The non-transitory computer-readable medium of claim 12, wherein the operations further comprise determining that the second group of logically separate resources includes a policy that allows any applications associated with the first group of logically separate resources to access one or more network resources associated with the second group of logically separate resources;

and wherein the graphic user interface is outputted in response to the determining that the second group of logically separate resources includes the policy.

15. The non-transitory computer-readable medium of claim 12, wherein the first group of logically separate resources comprises a personal group of logically separate resources associated with a user of the device, and the second group of logically separate resources comprises an enterprise group of logically separate resources associated with an enterprise.