Systems and methods to control device endpoint behavior using personae and policies
AssigneeInternational Business Machines Corporation
InventorsAkhilesh Gupta, Anupam Joshi, Gopal S. Pingali
Life of this patent
Estimating the term…
Abstract
The creation of multiple personae in mobile devices. Access to personae is controlled based on the persona that is currently active. The creation or existence of different personae helps prevent data leakage or loss, in that any or all of the following characteristics, by way of example, may be manifested: business data and applications are firewalled from applications or other items associated with personal use; connectivity of the device is controlled; resources (such cameras, GPS, other sensors, etc.) on the device are controlled; data are protected even if removable storage or the device itself are lost.
Claims20
A method comprising:
- utilizing a processor to execute computer code configured to perform the steps of:
- defining a plurality of personae for a device, each persona according variable access responsive to different access criteria;
- applying a policy for each persona, each policy defining conditions for the different access criteria;
- defining a sandbox for each persona based on the policy of each persona, each sandbox comprising a security mechanism for separating running programs;
- and
- according access to device resources responsive to access criteria;
- said according of access comprising mounting at least one data file relative to at least one of the personae.
An apparatus comprising:
- one or more processors;
- and
- a computer readable storage medium having computer readable program code embodied therewith and executable by the one or more processors, the computer readable program code comprising:
- computer readable program code configured to define a plurality of personae for a device, each persona according variable access responsive to different access criteria;
- computer readable program code configured to apply a policy for each persona, each policy defining conditions for the different access criteria;
- computer readable program code configured to define a sandbox for each persona based on the policy of each persona, each sandbox comprising a security mechanism for separating running programs;
- and
- computer readable program code configured to accord access to device resources responsive to access criteria, via mounting at least one data file relative to at least one of the personae.
A computer program product comprising:
- a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
- computer readable program code configured to define a plurality of personae for a device, each persona according variable access responsive to different access criteria;
- computer readable program code configured to apply a policy for each persona, each policy defining conditions for the different access criteria;
- computer readable program code configured to define a sandbox for each persona based on the policy of each persona, each sandbox comprising a security mechanism for separating running programs;
- and
- computer readable program code configured to accord access to device resources responsive to access criteria, via mounting at least one data file relative to at least one of the personae.
Dependencies are inferred from the claim text.