Abstract: Systems, methods, and software can be used to manage resource access. In some aspect, a user interface is outputted on an electronic device. The user interface includes information for resource access and a user interface object for controlling a resource access permission. A user input associated with the user interface object is received. In response to receiving the user input, the resource access permission is changed.

Abstract: Systems, methods, and software can be used to manage resource access. In some aspect, a user interface is outputted on an electronic device. The user interface includes information for resource access and a user interface object for controlling a resource access permission. A user input associated with the user interface object is received. In response to receiving the user input, the resource access permission is changed.

Abstract: A method for administering multiple management agents on a mobile device, the method receiving, at a policy manager on the mobile device, a policy from each of the multiple management agents; determining a current state of the mobile device; and consolidating the policies based on rules within the policy manager and the current state of the mobile device.

Abstract: A method of applying information on the display of the electronic device includes displaying content elements associated with an application running on the electronic device on a display of the electronic device, receiving a selection of a content element associated with the application running on the electronic device, determining an identity profile having an associated key, encrypting information associated with the selected content element utilizing the key associated with the determined identity profile to generate encrypted information, displaying the encrypted information in the selected content element.

Abstract: A method at a computing device having a plurality of concurrently operative operating systems, the method comprising: operating a proxy process within a target operating system on the computing device; receiving, from an originating operating system, a request for resources from a target process within the target operating system at the proxy process; requesting, from the proxy process, the resources of the target process; and returning a handle to the target process from the proxy process to the originating operating system.

Abstract: Described are a method and system of authorizing software execution on a computing device having a processor, the device storing a production key associated with software authorized for end-user release and storing a pre-release key associated with software not authorized for end-user release. The method includes determining that a signed software image is not signed with the production key; determining that the device has stored in memory thereon a pre-release token, the pre-release token containing data uniquely identifying the device and identifying the pre-release key; validating the pre-release token; and authenticating the signed software image using the pre-release key and, in response, permitting execution of the software image.

Abstract: A computing device and a method for a computing device to control access to data stored on a data store of the device. An access component of the device having control over access to the data. The access component being operative to receive a request for data from a requesting component, identify an assigned access domain of the requesting component and an assigned data domain of the requested data and determine whether the requesting component is authorized to access the data by comparing the assigned access domain and the data domain with permissions specified in a security policy. If the assigned access domain is authorized to access the data domain, the access component may provide access to the requested data.

Abstract: A method of applying information on the display of the electronic device includes displaying content elements associated with an application running on the electronic device on a display of the electronic device, receiving a selection of a content element associated with the application running on the electronic device, determining an identity profile having an associated key, encrypting information associated with the selected content element utilizing the key associated with the determined identity profile to generate encrypted information, displaying the encrypted information in the selected content element.

Abstract: An electronic device may maintain separate OS domains associated with security permissions. The OS domain may implement separate corresponding clipboard services. A clipboard agent or clipboard mediator service may receive a clipboard data request from a first application. The clipboard agent may determine which OS domain has most recently processed a store command associated with storing data in a corresponding clipboard service of the OS domain. The clipboard agent associated with the OS domain that most recently stored content may determine whether to send the data from the corresponding clipboard service based at least in part on permissions associated with the OS domain. Security of the clipboard access may be enforced on a per domain basis. Access to clipboard content may be mediated at the time of the request without a need to share data prior to the request.

Abstract: Systems, methods, and software can be used to manage resource access. In some aspect, a user interface is outputted on an electronic device. The user interface includes information for resource access and a user interface object for controlling a resource access permission. A user input associated with the user interface object is received. In response to receiving the user input, the resource access permission is changed.

Abstract: A method at a mobile device for creating a managed domain on the mobile device, the method initializing a container on the mobile device to house the managed domain; retrieving, from the mobile device, a management agent for the management domain; establishing policies to govern the creation of the managed domain; and configuring the container for the domain based on the established policies.

Abstract: Described are a method and system of authorizing software execution on a computing device having a processor, the device storing a production key associated with software authorized for end-user release and storing a pre-release key associated with software not authorized for end-user release. The method includes determining that a signed software image is not signed with the production key; determining that the device has stored in memory thereon a pre-release token, the pre-release token containing data uniquely identifying the device and identifying the pre-release key; validating the pre-release token; and authenticating the signed software image using the pre-release key and, in response, permitting execution of the software image.

Abstract: Information is shared between processing entities that each have a corresponding private data area by placing data corresponding to information for a first one of the private data areas for a first one of the processing entities directly into a second one of the private data areas for a second one of the processing entities without placing the data in an intervening shared data area and without directly invoking a system administrator-like entity. In addition, these private data areas can be pre-populated with a plurality of directories that each have a one-to-one correspondence to a particular predetermined information recipient and then providing a link to a given one of the recipients as corresponds to a given one of the directories when information is placed in that directory to provide the corresponding predetermined information recipient with at least read access to the information.

Abstract: A method at a computing device having a plurality of concurrently operating domains for providing a unified home screen, the method sending a request for package information from a home screen application on the computing device; receiving the request for package information at a unified package manager on the computing device; requesting, from the plurality of concurrently operating domains, package information; receiving package information from at least one of the plurality of concurrently operating domains at the unified package manager on the computing device; decorating the received package information with domain information for a domain from which the package information was received at the unified package manager on the computing device; and providing the decorated package information to the home screen application.

Abstract: A method of preventing observation of password entry on an electronic device is provided. The electronic device has a processor coupled to a camera, a display, and a memory. The method comprises activating the camera to acquire an image when the electronic device is in a password entry mode; detecting one or more faces present in the image; and presenting a warning when more than one face is present in the image.

Abstract: A computing device and a method for a computing device to control access to data stored on a data store of the device. An access component of the device having control over access to the data. The access component being operative to receive a request for data from a requesting component, identify an assigned access domain of the requesting component and an assigned data domain of the requested data and determine whether the requesting component is authorized to access the data by comparing the assigned access domain and the data domain with permissions specified in a security policy. If the assigned access domain is authorized to access the data domain, the access component may provide access to the requested data.

Abstract: Systems, methods, and software can be used to share data across profiles. In some aspects, a first request from a first application for application data associated with a second application is received at a first hybrid agent. The first application and the first hybrid agent are associated with a first profile on a mobile device. The second application is associated with a second profile. A second request for the application data is sent to a second hybrid agent. The second hybrid agent is associated with the second profile. The application data from the second hybrid agent is received from the second hybrid agent. The application data is sent to the first application. The application data is used by the first application to generate a graphical interface for presentation on the mobile device. The graphical interface includes a unified view of data associated with the first and second profiles.

Abstract: A device and its operations are described herein. In some examples, the operations can include executing a first application within a first operating system domain of a device, the first application associated with at least a first activity view. The operations can further include detecting user input associated with the first application. The user input is associated with activating a second activity view of a second application. The operations can further include determining that the second application corresponds to a second operating system domain of the device. The operations can further include establishing a first proxy link within the first operating system domain that corresponds with a second proxy link within the second operating system domain. The first proxy link is associated with causing the second proxy link to invoke the second activity view of the second application within the second operating system domain.

Abstract: Systems, methods, and software can be used to share data across profiles. In some aspects, a first request from a first application for application data associated with a second application is received at a first hybrid agent. The first application and the first hybrid agent are associated with a first profile on a mobile device. The second application is associated with a second profile. A second request for the application data is sent to a second hybrid agent. The second hybrid agent is associated with the second profile. The application data from the second hybrid agent is received from the second hybrid agent. The application data is sent to the first application. The application data is used by the first application to generate a graphical interface for presentation on the mobile device. The graphical interface includes a unified view of data associated with the first and second profiles.

Abstract: An apparatus, and an associated method, facilitates security at a wireless device, such as a wireless device comprising a mobile computing platform. A security decision engine is provided that monitors for an event necessitating a security decision. When a security decision is required, request is made of a knowledge fetcher, provided by a trusted third-party, installed at the wireless device for the security decision. The knowledge fetcher obtains the security decision, such as by obtaining the security decision from a remote, trusted third-party server, and provides the security decision to the decision engine. Use is made of the security decision pursuant to a setting for which the security decision is needed.