Trusted network detection

1. A non-transitory computer-readable storage medium storing one or more sequences of instructions for dynamically determining how a device should process network access requests, which when executed by one or more processors, cause:

enforcing a security constraint imposed upon virtual machines executing on the device that prevents said virtual machines from establishing a connection to an Internet Protocol (IP) address within a net block assigned to an Intranet,

a software component rendering a judgment, based on a policy that weighs one or more factors, about whether the device is on a trusted network, wherein the policy interprets the device making a mutually authenticated connection with a network as support for deciding that the device is on a trusted network, and wherein the judgement is rendered against a network not previously identified as being trustworthy;

upon rendering a judgment that the device is on the trusted network, allowing a network resource identified on a white list of trusted resources to be retrieved within a host operating system resident on the device; and

upon rendering a judgment that the device is not on a trusted network, performing:

preventing the network resource identified on the white list of trusted resources to be retrieved within the host operating system, and

ceasing to enforce said security constraint imposed upon said virtual machines to allow said virtual machines to establish connections to said net block only while said device is not on a trusted network.

2. The non-transitory computer-readable storage medium of claim 1 , wherein execution of the one or more sequences of instructions further causes:

upon rendering a judgment that the device is not on a trusted network in response to attempting to access the network resource identified on the white list, performing one or more of: (a) informing a user of the device that the integrity of a requested resource cannot be verified, (b) asking the user for permission to retrieve the requested resource despite the resource being potentially compromised, (c) preventing the device from retrieving the requested resource, (d) allowing the device to retrieve the resource within a virtual machine, (e) only allow the requested resource to be accessed if the identity of the requested resource can be validated using a Hypertext Transfer Protocol Secure (HTTPS) certificate, and (f) only allow the requested resource to be accessed if the access is performed using https and the identity of the requested resource can be validated.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the one or more factors include whether the device can connect and verify the identity of a particular network resource that is known only to be accessible over the trusted network.

4. The non-transitory computer-readable storage medium of claim 3 , wherein the identity of the particular network resource is verified using a Secure Socket Layer (SSL) certificate.

5. The non-transitory computer-readable storage medium of claim 1 , wherein the policy interprets the device making a mutually authenticated connection to an Active Directory (AD) domain controller registered with the device as support for deciding that the device being on a trusted network.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the policy interprets the device communicating with a Domain Name Server (DNS) or an Internet Protocol (IP) Gateway over a trusted network as support for deciding that the device being on a trusted network.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the policy interprets a domain name server (DNS) having a network address associated with a virtual private network (VPN) as support for deciding that the device being on a trusted network.

8. The non-transitory computer-readable storage medium of claim 1 , wherein the policy interprets the Internet Protocol (IP) address of a domain name server (DNS) being in a set of trusted net blocks as support for the device being on a trusted network.

9. The non-transitory computer-readable storage medium of claim 1 , wherein the policy interprets the device successfully performing a required Institute of Electrical and Electronic Engineers (IEEE) 802.1X authentication to gain access to a network associated with a domain name server (DNS) as support for the device on a trusted network.

10. The non-transitory computer-readable storage medium of claim 1 ,

wherein the policy interprets the device successfully performing a required Wi-Fi Protocol Access 2 (WPA2) authentication to gain access to a network associated with a domain name server (DNS) as support for the device being on a trusted network.

11. An apparatus for dynamically determining how a device should process network access requests, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed by the one or more processors, cause:

enforcing a security constraint imposed upon virtual machines executing on the device that prevents said virtual machines from establishing a connection to an Internet Protocol (IP) address within a net block assigned to an Intranet;

a software component rendering a judgment, based on a policy that weighs one or more factors, about whether the device is on a trusted network, wherein the policy interprets the device making a mutually authenticated connection with a network as support for deciding that the device is on a trusted network, and wherein the judgement is rendered against a network not previously identified as being trustworthy;

upon rendering a judgment that the device is on the trusted network, allowing a network resource identified on a white list of trusted resources to be retrieved within a host operating system resident on the device; and

upon rendering a judgment that the device is not on a trusted network, performing:

preventing the network resource identified on the white list of trusted resources to be retrieved within the host operating system, and

ceasing to enforce said security constraint imposed upon said virtual machines to allow said virtual machines to establish connections to said net block only while said device is not on a trusted network.

12. A method for dynamically determining how a device should process network access requests, which when executed by one or more processors, comprising:

enforcing a security constraint imposed upon virtual machines executing on the device that prevents said virtual machines from establishing a connection to an Internet Protocol (IP) address within a net block assigned to an Intranet;

a software component rendering a judgment, based on a policy that weighs one or more factors, about whether the device is on a trusted network, wherein the policy interprets the device making a mutually authenticated connection with a network as support for deciding that the device is on a trusted network, and wherein the judgement is rendered against a network not previously identified as being trustworthy;

upon rendering a judgment that the device is on the trusted network, allowing a network resource identified on a white list of trusted resources to be retrieved within a host operating system resident on the device; and

upon rendering a judgment that the device is not on a trusted network, performing:

preventing the network resource identified on the white list of trusted resources to be retrieved within the host operating system, and

ceasing to enforce said security constraint imposed upon said virtual machines to allow said virtual machines to establish connections to said net block only while said device is not on a trusted network.