# US 11,310,279 B2 · Implementation of selected enterprise policies

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,279 B2
- Document ID: US11310279B2
- Status: Granted
- Kind: B2
- Application number: 16/376,369
- Filed: 2019-04-05
- Published: 2020-10-08
- Granted: 2022-04-19
- Earliest claimed: 2019-04-05
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Vinicio Bombacino; Andrea Tortosa; Stefania Oliverio; Rosario Boccia; Fabio D'Alfonso; Mario Rocco Garasto
- Web page: https://patentgrep.com/patent/US11310279B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06Q 50/265: {Personal security, identity or safety}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Access is temporarily allowed to selected enterprise resources. A request to carry out an action is received from a private device. The private device is associated with an enterprise device, which has one or more enterprise policies in place. One or more steps for carrying out the requested action are defined, and it is determined that at least one policy from the enterprise policies is required for at least one of the steps. It is also determined that the at least one policy is in place on the private device. The private device is then allowed to carry out the requested action according to the at least one policy.

## Claims

### Claim 1

A system, comprising:
a memory component;
a set of enterprise policies that are implemented on an enterprise device; and
a processor communicatively coupled to the memory, wherein the processor is configured to:
receive a request to carry out an action from a private device;
verify that the request is from a user associated with the enterprise device;
verify that the private device is associated with the enterprise device;
in response to the verifications, define steps for carrying out the requested action;
provide a virtual machine that implements the set of enterprise policies, wherein each of the enterprise policies on the virtual machine is set to prohibit all associated action steps;
receive a warning prompt each time a step from the attempted steps is prohibited by an enterprise policy on the virtual machine;
in response to each warning prompt, mapping the prohibited step to the prohibiting enterprise policy;
determine whether each mapped prohibiting enterprise policy is in place on the private device; and
allow the private device to carry out the requested action when each mapped prohibiting enterprise policy is in place on the private device;
determine that a mapped prohibiting enterprise policy is not in place on the private device;
prior to the allowing, implement the mapped prohibiting enterprise policy on the private device;
determine that the requested action has been completed; and
remove the mapped prohibiting enterprise policy from the private device.

### Claim 2 (depends on 1)

The system of claim 1, wherein the processor is further configured to map the prohibiting enterprise policy to the requested action.

### Claim 3 (depends on 1)

The system of claim 1, wherein the enterprise device includes an application associated with the private device.

### Claim 4 (depends on 1)

The system of claim 1, wherein the the private device is not allowed to carry out actions other than the requested action.

### Claim 5 (depends on 1)

The system of claim 1, wherein the enterprise device is on a list of devices recognized by the enterprise environment.

### Claim 6 (depends on 5)

The system of claim 5, wherein the list is maintained by a device management database.

### Claim 7 (depends on 5)

The system of claim 5, wherein the verifying that the private device is associated with the enterprise device comprises determining that a record of the private device is on the list.

### Claim 8 (depends on 1)

The system of claim 1, wherein the processor is further configured to:
determine that the requested action has been completed; and
in response to the determining that the requested action has been completed, remove data associated with the enterprise policies from the private device.

### Claim 9 (depends on 1)

The system of claim 1, wherein the processor is further configured to receive a request for access to the enterprise environment before receiving the request to carry out the action.

### Claim 10 (depends on 9)

The system of claim 9, wherein the processor is further configured to:
verify that the request for access is from the user; and
grant the request for access.

### Claim 11 (depends on 1)

The system of claim 1, wherein an enterprise policy from the set of enterprise policies is not required for carrying out the requested action.

### Claim 12 (depends on 11)

The system of claim 11, wherein the unrequired enterprise policy is not implemented on the private device.

### Claim 13 (depends on 11)

The system of claim 11, wherein the processor is further configured to, in response to each warning prompt, permit the prohibited step on the virtual machine.

### Claim 14

A computer program product for allowing access to an enterprise environment, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the device to perform a method, the method comprising:
receiving a request to carry out an action from a private device;
verifying that the request is from a user associated with an enterprise device;
verifying that the private device is associated with the enterprise device;
in response to the verifications, defining steps for carrying out the requested action;
identifying a set of enterprise policies implemented on the enterprise device;
providing a virtual machine that implements the set of enterprise policies, wherein each of the enterprise policies on the virtual machine is set to prohibit all associated action steps;
attempting, on the virtual machine, each of the steps for carrying out the requested action;
receiving a warning prompt each time a step from the attempted steps is prohibited by an enterprise policy on the virtual machine;
in response to each warning prompt, mapping the prohibited step to the prohibiting enterprise policy;
determining whether each mapped prohibiting enterprise policy is in place on the private device; and
allowing the private device to carry out the requested action when each mapped prohibiting enterprise policy is in place on the private device;
determining that a mapped prohibiting enterprise policies is not in place on the private device;
prior to the allowing, implementing the mapped prohibiting enterprise policy on the private device;
determining that the requested action has been completed; and
removing the implemented mapped prohibiting enterprise policy from the private device.

### Claim 15 (depends on 14)

The computer program product of claim 14, further comprising mapping the mapped prohibiting enterprise policy to the requested action.

### Claim 16 (depends on 14)

The computer program product of claim 14, wherein the enterprise device includes an application associated with the private device.