Network access by applications in an enterprise managed device system
Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.
1. A system, comprising:
a client device; and
a management component executable in the client device that, when executed, causes the client device to:
initiate enrollment of the client device with a management service based upon a user credential associated with a user account accessible to the management service;
register as a global proxy on the client device through which network traffic from the client device is routed;
obtain a network whitelist associated with the user account, the network whitelist identifying an application and a respective network permission associated with the application;
receive a request to access a network connection of the client device from the application;
determine that the application is allowed to access or disallowed from accessing the network connection based upon the network whitelist; and
return an error to the application in response to the request based upon a rule contained within the network whitelist.
2. The system of claim 1 , wherein the error indicates that the application is disallowed from accessing the network connection based upon the rule.
3. The system of claim 1 , wherein the network whitelist specifies that the application is permitted to access the network connection when the client device is connected to a particular WiFi network.
4. The system of claim 1 , wherein the management component is configured to block the request from the application to access the network connection when a current network status is inconsistent with a condition specified by the network whitelist, wherein the request is blocked by the global proxy on the client device.
5. The system of claim 1 , wherein the management component registers as the global proxy using an operating system application programming interface (API) on the client device.
6. The system of claim 1 , wherein when executed the management component further causes the client device to block the request from the application to access the network connection based upon a current network status of the client device.
7. The system of claim 1 , wherein when executed the management component further causes the client device to block the request from the application to access the network connection based upon a network destination associated with the request.
8. A method implemented by a management component installed on a client device, comprising:
initiating enrollment of the client device with a management service based upon a user credential associated with a user account accessible to the management service;
registering as a global proxy on the client device through which network traffic from the client device is routed;
obtaining a network whitelist associated with the user account, the network whitelist identifying an application and a respective network permission associated with the application;
receiving a request to access a network connection of the client device from the application;
determining that the application is allowed to access or disallowed from accessing the network connection based upon the network whitelist; and
returning an error to the application in response to the request based upon a rule contained within the network whitelist.
9. The method of claim 8 , wherein the error indicates that the application is disallowed from accessing the network connection based upon the rule.
10. The method of claim 8 , wherein the network whitelist specifies that the application is permitted to access the network connection when the client device is connected to a particular WiFi network.
11. The method of claim 8 , further comprising blocking the request from the application to access the network connection when a current network status is inconsistent with a condition specified by the network whitelist, wherein the request is blocked by the global proxy on the client device.
12. The method of claim 8 , further comprising registering as the global proxy using an operating system application programming interface (API) on the client device.
13. The method of claim 8 , further comprising blocking the request from the application to access the network connection based upon a current network status of the client device.
14. The method of claim 13 , further comprising blocking the request from the application to access the network connection based upon a network destination associated with the request.
15. A non-transitory computer-readable medium embodying a management component executable in a client device that, when executed, causes the client device to:
initiate enrollment of the client device with a management service based upon a user credential associated with a user account accessible to the management service;
register as a global proxy on the client device through which network traffic from the client device is routed;
obtain a network whitelist associated with the user account, the network whitelist identifying an application and a respective network permission associated with the application;
receive a request to access a network connection of the client device from the application;
determine that the application is allowed to access or disallowed from accessing the network connection based upon the network whitelist; and
return an error to the application in response to the request based upon a rule contained within the network whitelist.
16. The non-transitory computer-readable medium of claim 15 , wherein the network whitelist specifies that the application is permitted to access the network connection when the client device is connected to a particular WiFi network.
17. The non-transitory computer-readable medium of claim 15 , wherein the management component is configured to block the request from the application to access the network connection when a current network status is inconsistent with a condition specified by the network whitelist, wherein the request is blocked by the global proxy on the client device.
18. The non-transitory computer-readable medium of claim 15 , wherein the management component registers as the global proxy using an operating system application programming interface (API) on the client device.
19. The non-transitory computer-readable medium of claim 15 , wherein the management component is installed on the client device as a device administrator.
20. The non-transitory computer-readable medium of claim 15 , wherein when executed the management component further causes the client device to block the request from the application to access the network connection based upon a network destination associated with the request.