Policy-based secure containers for multiple enterprise applications
Technologies for providing policy-based secure containers for multiple enterprise applications include a client computing device and an enterprise policy server. The client computing device sends device attribute information and a request for access to an enterprise application to the enterprise policy server. The enterprise policy server determines a device trust level based on the device attribute information and a data sensitivity level based on the enterprise application, and sends a security policy to the client computing device based on the device trust level and the data sensitivity level. The client computing device references or creates a secure container for the security policy, adds the enterprise application to the secure container, and enforces the security policy while executing the enterprise application in the secure container. Multiple enterprise applications may be added to each secure container. Other embodiments are described and claimed.
1. An enterprise policy server to determine enterprise security policies for a client computing device comprising:
trust calculation circuitry to:
receive, from the client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device; and
determine a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information; and
policy determination circuitry to:
receive a request for an enterprise application from the client computing device;
determine a data sensitivity level based on the enterprise application;
determine a security policy based on the device trust level and the data sensitivity level; and
send the security policy to the client computing device.
2. The enterprise policy server of claim 1 , wherein the policy determination circuitry is further to select the data sensitivity level from a plurality of predefined data sensitivity levels associated with enterprise data that can be accessed by the enterprise application.
3. The enterprise policy server of claim 1 , wherein the policy determination circuitry is further to send the enterprise application to the client computing device.
4. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to:
allow the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevent the enterprise application from communicating with applications not associated with the security policy.
5. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require a user of the client computing device to authenticate prior to execution of the enterprise application.
6. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require the client computing device to (i) encrypt data accessed or stored by the enterprise application; or (ii) remove data created by the enterprise application when the enterprise application terminates.
7. The enterprise policy server of claim 1 , wherein the security policy comprises a security policy to require the client computing device to log activities of the enterprise application.
8. A method to determine enterprise security policies for a client computing device, the method comprising:
receiving, by an enterprise policy server from the client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device;
determining, by the enterprise policy server, a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information;
receiving, by the enterprise policy server, a request for access to an enterprise application from the client computing device;
determining, by the enterprise policy server, a data sensitivity level based on the requested enterprise application;
determining, by the enterprise policy server, a security policy based on the device trust level and the data sensitivity level; and
sending the security policy from the enterprise policy server to the client computing device.
9. The method of claim 8 , wherein determining the security policy comprises determining a security policy that:
allows the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevents the enterprise application from communicating with applications not associated with the security policy.
10. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires a user of the client computing device to authenticate prior to execution of the enterprise application.
11. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires the client computing device to (i) encrypt data accessed or stored by the enterprise application, or (ii) remove data created by the enterprise application when the enterprise application terminates.
12. The method of claim 8 , wherein determining the security policy comprises determining a security policy that requires the client computing device to log activities of the enterprise application.
13. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause an enterprise policy server to:
receive, from a client computing device, device attribute information that identifies attributes of the client computing device, wherein the device attribute information is indicative of a hardware component of the client computing device or a software environment of the client computing device;
determine a device trust level for the client computing device based on the device attribute information indicative of the hardware component of the client computing device or the software environment of the client computing device, wherein the device trust level is indexed by the device attribute information;
receive a request for access to an enterprise application from the client computing device;
determine a data sensitivity level based on the requested enterprise application;
determine a security policy based on the device trust level and the data sensitivity level; and
send the security policy from the enterprise policy server to the client computing device.
14. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that:
allows the enterprise application to securely communicate with other enterprise applications associated with the security policy; and
prevents the enterprise application from communicating with applications not associated with the security policy.
15. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires a user of the client computing device to authenticate prior to execution of the enterprise application.
16. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires the client computing device to (i) encrypt data accessed or stored by the enterprise application, or (ii) remove data created by the enterprise application when the enterprise application terminates.
17. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the security policy comprises to determine a security policy that requires the client computing device to log activities of the enterprise application.
18. The enterprise policy server of claim 1 , wherein to determine the device trust level comprises to determine the device trust level using a trust level table, the trust level table being indexed by the device attribute information, and wherein to determine the device trust level includes to identify the device trust level stored in the trust level table in association with the hardware component or the software component of the client computing device.
19. The method of claim 8 , wherein determining the device trust level comprises determining the device trust level using a trust level table, the trust level table being indexed by the device attribute information, and wherein determining the device trust level includes identifying the device trust level stored in the trust level table in association with the hardware component or the software component of the client computing device.
20. The one or more non-transitory, computer-readable storage media of claim 13 , wherein to determine the device trust level comprises to determine the device trust level using a trust level table, the trust level table being indexed by the device attribute information, and wherein to determine the device trust level includes to identify the device trust level stored in the trust level table in association with the hardware component or the software component of the client computing device.