Policy-based secure containers for multiple enterprise applications

Patent metadata

Field	Value
Publication number	US-10122766-B2
Application number	US-201615051130-A
Country	US
Kind code	B2
Filing date	Feb 23, 2016
Priority date	Dec 28, 2012
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

Technologies for providing policy-based secure containers for multiple enterprise applications include a client computing device and an enterprise policy server. The client computing device sends device attribute information and a request for access to an enterprise application to the enterprise policy server. The enterprise policy server determines a device trust level based on the device attribute information and a data sensitivity level based on the enterprise application, and sends a security policy to the client computing device based on the device trust level and the data sensitivity level. The client computing device references or creates a secure container for the security policy, adds the enterprise application to the secure container, and enforces the security policy while executing the enterprise application in the secure container. Multiple enterprise applications may be added to each secure container. Other embodiments are described and claimed.

First claim

The invention claimed is:

1. An enterprise policy server to determine enterprise security policies for a client computing device comprising:
trust calculation circuitry to:
receive, from the client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device; and
determine a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information; and

policy determination circuitry to:
receive a request for an enterprise application from the client computing device;
determine a data sensitivity level based on the enterprise application;
determine a security policy based on the device trust level and the data sensitivity level; and
send the security policy to the client computing device.

2. The enterprise policy server of claim 1 , wherein the policy determination circuitry is further to select the data sensitivity level from a plurality of predefined data sensitivity levels associated with enterprise data that can be accessed by the enterprise application.

3. The enterprise policy server of claim 1 , wherein the policy determination circuitry is further to send the enterprise application to the client computing device.

4. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to:
allow the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevent the enterprise application from communicating with applications not associated with the security policy.

5. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require a user of the client computing device to authenticate prior to execution of the enterprise application.

6. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require the client computing device to (i) encrypt data accessed or stored by the enterprise application; or (ii) remove data created by the enterprise application when the enterprise application terminates.

7. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require the client computing device to log activities of the enterprise application.

8. A method to determine enterprise security policies for a client computing device, the method comprising:
receiving, by an enterprise policy server from the client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device;
determining, by the enterprise policy server, a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information;
receiving, by the enterprise policy server, a request for access to an enterprise application from the client computing device;
determining, by the enterprise policy server, a data sensitivity level based on the requested enterprise application;
determining, by the enterprise policy server, a security policy based on the device trust level and the data sensitivity level; and
sending the security policy from the enterprise policy server to the client computing device.

9. The method of claim 8 , wherein determining the security policy comprises determining a security policy that:
allows the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevents the enterprise application from communicating with applications not associated with the security policy.

10. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires a user of the client computing device to authenticate prior to execution of the enterprise application.

11. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires the client computing device to (i) encrypt data accessed or stored by the enterprise application, or (ii) remove data created by the enterprise application when the enterprise application terminates.

12. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires the client computing device to log activities of the enterprise application.

13. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause an enterprise policy server to:
receive, from a client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device;
determine a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information;
receive a request for access to an enterprise application from the client computing device;
determine a data sensitivity level based on the requested enterprise application;
determine a security policy based on the device trust level and the data sensitivity level; and
send the security policy from the enterprise policy server to the client computing device.

14. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that:
allows the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevents the enterprise application from communicating with applications not associated with the security policy.

15. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires a user of the client computing device to authenticate prior to execution of the enterprise application.

16. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires the client computing device to (i) encrypt data accessed or stored by the enterprise application, or (ii) remove data created by the enterprise application when the enterprise application terminates.

17. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires the client computing device to log activities of the enterprise application.

18. The enterprise policy server of claim 1 , wherein to determine the device tru

Assignees

• Intel Corp

Inventors

• Viswanathan Tarun
• Kahana Uri
• Ross Alan D
• Birk Eran

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title