Managing access to resources
In some implementations, a method of managing access to resources in a single device including receiving, from a first resource assigned to a first perimeter, a request to access a second resource assigned to a second perimeter different from the first perimeter. The single device includes the first perimeter and the second perimeter. Whether access to the second resource is prohibited is determined based on a management policy for the first perimeter. The management policy defining one or more rules for accessing resources assigned to the second perimeter including the second resource.
1. A method of managing access to resources in a device, comprising:
receiving, by a hardware data processing apparatus on the device, from a first resource that is included in a first plurality of resources defined on the device, a request to access a second resource that is included in a second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, and wherein the first plurality of resources and the second plurality of resources are logically separated and access between the first plurality of resources and the second plurality of resources is determined based on one or more management policies, the first plurality of resources including a first network access resource and a first encryption certificate, and the second plurality of resources including a second network access resource and a second encryption certificate that is different from the first encryption certificate, and wherein the first network access resource comprises a first network configuration used to connect to a first network, the second network access resource comprises a second network configuration used to connect to a second network that is different from the first network, the first network configuration is different than the second network configuration, and the request to access the second resource comprises a request to make a network connection by the first resource using the second network access resource;
determining, by a hardware data processing apparatus on the device, whether the request to make the network connection is prohibited based on a first management policy for the first plurality of resources, the first management policy defining one or more rules that allow one or more resources in the first plurality of resources to access resources associated with the second plurality of resources including the second resource, and wherein the determining whether the request to make the network connection is prohibited comprises:
determining that the request to make the network connection is prohibited based on the first resource being different than the one or more resources in the first plurality of resources that are allowed by the first management policy to use any network access resources included in the second plurality of resources to make the network connection; and
processing the request to make the network connection based on the determining whether the request to make the network connection is prohibited.
2. The method of claim 1 , further comprising:
receiving a request to grant administrative access to resources associated with the second plurality of resources; and
prohibiting administrative access to resources associated with the second plurality of resources.
3. The method of claim 1 , wherein the device comprises a tablet computer.
4. The method of claim 1 , wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.
5. The method of claim 1 , wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.
6. The method of claim 1 , wherein the first management policy comprises a personal management policy.
7. The method of claim 1 , wherein the second resource comprises data associated with at least one of a corporate messaging account, a corporate calendar account, or a corporate contact database.
8. The method of claim 1 , wherein the first plurality of resources is associated with a first perimeter, and resources in the first perimeter comprise software and hardware resources, and wherein the second plurality of resources is associated with a second perimeter, and resources in the second perimeter comprise software and hardware resources.
9. A device, comprising:
a first plurality of resources including a first resource, a first network access resource, a first encryption certificate and a first management policy, the first management policy defining one or more rules that allow one or more resources in the first plurality of resources to access resources associated with a second plurality of resources including a second resource;
the second plurality of resources including the second resource, a second encryption certificate that is different from the first encryption certificate, wherein the second plurality of resources includes a second network access resource, the first network access resource comprises a first network configuration used to connect to a first network, the second network access resource comprises a second network configuration used to connect to a second network that is different from the first network, the first network configuration is different than the second network configuration, and the first plurality of resources and the second plurality of resources are logically separated; and
one or more hardware processors operable to:
receive, from the first resource associated with the first plurality of resources on the device a request to access the second resource associated with the second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, wherein the request to access the second resource comprises a request to make a network connection by the first resource using the second network access resource;
determine whether the request to make the network connection is prohibited based on the first management policy for the first plurality of resources, and wherein the one or more hardware processors operable to determine whether the request to make the network connection is prohibited comprises:
determine that the request to make the network connection is prohibited based on the first resource being different than the one or more resources in the first plurality of resources that are allowed by the first management policy to use any network access resources included in the second plurality of resources to make the network connection; and
process the request to make the network connection based on the determining whether the request to make the network connection is prohibited.
10. The device of claim 9 , the one or more hardware processors further operable to:
receive a request to grant administrative access to resources associated with the second plurality of resources, wherein the request identifies an administrator;
determine the identified administrator is different from an administrator associated with the second plurality of resources; and
prohibit administrative access to resources associated with the second plurality of resources.
11. The device of claim 9 , wherein the device comprises a tablet computer.
12. The device of claim 9 , wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.
13. The device of claim 9 , wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.
14. The device of claim 9 , wherein the first management policy comprises a personal management policy.
15. The device of claim 9 , wherein the second resource comprises data associated with at least one of a corporate messaging account, a corporate calendar account, or a corporate contact database.
16. A computer program product encoded on a tangible, non- transitory storage medium, the computer program product comprising computer readable instructions for causing one or more processors to perform operations comprising:
receiving, by a hardware data processing apparatus on a device, from a first resource that is included in a first plurality of resources defined on the device, a request to access a second resource that is included in a second plurality of resources, wherein the device includes the first plurality of resources, the first resource, the second plurality of resources, and the second resource, and wherein the first plurality of resources and the second plurality of resources are logically separated and access between the first plurality of resources and the second plurality of resources is determined based on one or more management policies, the first plurality of resources including a first network access resource and a first encryption certificate, and the second plurality of resources including a second network access resource and a second encryption certificate that is different from the first encryption certificate, and wherein the first network access resource comprises a first network configuration used to connect to a first network, the second network access resource comprises a second network configuration used to connect to a second network that is different from the first network, the first network configuration is different than the second network configuration, and the request to access the second resource comprises a request to make a network connection by the first resource using the second network access resource;
determining, by a hardware data processing apparatus on the device, whether the request to make the network connection is prohibited based on a first management policy for the first plurality of resources, the first management policy defining one or more rules that allow one or more resources in the first plurality of resources to access resources associated with the second plurality of resources including the second resource, and wherein the determining whether the request to make the network connection is prohibited comprises:
determining that the request to make the network connection is prohibited based on the first resource being different than the one or more resources in the first plurality of resources that are allowed by the first management policy to use any network access resources included in the second plurality of resources to make the network connection; and
processing the request to make the network connection based on the determining whether the request to make the network connection is prohibited.
17. The computer program product of claim 16 , the operations further comprising:
receiving a request to grant administrative access to resources associated with the second plurality of resources, wherein the request identifies an administrator;
determining the identified administrator is different from an administrator associated with the second plurality of resources; and
prohibiting administrative access to resources associated with the second plurality of resources.
18. The computer program product of claim 16 , wherein the device comprises a tablet computer.
19. The computer program product of claim 16 , wherein the first plurality of resources comprises a personal plurality of resources, and the second plurality of resources comprises a corporate plurality of resources.
20. The computer program product of claim 16 , wherein an enterprise is granted administrative access to the first plurality of resources, and a user is granted administrative access to the second plurality of resources.
21. The computer program product of claim 16 , wherein the first management policy comprises a personal management policy.