AirWatch LLC

Disclosed are various embodiments relating to a security framework for media playback. In one embodiment, a client device has a decryption module, a streaming module, and a playback module. The playback module may be configured to request media data from the streaming module and render the media data on an output device. The streaming module may be configured to obtain the media data from the decryption module by a request that specifies a size of the media data. The size may be dynamically determined based at least in part on an amount of available temporary data storage. The decryption module may be configured to decrypt a portion of an encrypted media file based at least in part on the specified size to produce the media data.

Restricted content of a data file is identified. The restricted content is removed from the data file, and a redacted version of the data file is generated. The restricted content is stored separate from the redacted version of the data file.

Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

Disclosed are various embodiments for accessing resources when a client device complies with distribution rules. A client device receives distribution rules associated with resources that are accessible at a distribution service. The client device determines whether the client device complies with the distribution rules. The client device transmits an indication of compliance for the distribution to the distribution service. The client device receives the resource from the distribution service.

Systems herein include a managed content application that can place markers for conversations within secure documents. A separate social application can serve as the platform for the conversations, allowing for efficient conversations that can occur in real time. The markers can be stored with the documents and identify the conversation, allowing users to retrieve historical conversations that occurred on the social application from within the document. This can allow users to quickly come up to speed without having to rehash the conversations with the original participants. Document security can also be maintained without sacrificing conversation efficiency of the social application.

Disclosed are various examples for providing a single sign-on experience for mobile applications that may or may not be managed. A first application executed in a client device sends an access request to a service provider. The first application receives a redirection response from the service provider that redirects the first application to an identity provider. The first application then receives a further redirection response from the identity provider that causes the first application to request an identity assertion from a second application executed in the client device. The first application receives the identity assertion from the second application. The first authentication then authenticates with the service provider using the identity assertion.

Disclosed are various embodiments relating to a security framework for media playback. In one embodiment, a client device has a decryption module, a streaming module, and a playback module. The playback module may be configured to request media data from the streaming module and render the media data on an output device. The streaming module may be configured to obtain the media data from the decryption module by a request that specifies a size of the media data. The size may be dynamically determined based at least in part on an amount of available temporary data storage. The decryption module may be configured to decrypt a portion of an encrypted media file based at least in part on the specified size to produce the media data.

Examples of detecting whether a device meets an enrollment level are disclosed. In one case, a method for providing access to an application on a client device includes receiving a request to access an application from the client device, determining an enrollment level associated with the application, and determining that multi-factor authentication is required for access to the application on the client device based on the enrollment level associated with the application. The method can also include initiating multi-factor authentication on the client device before access to the application is permitted. The method can also include determining that multi-factor authentication is successful on the client device, transmitting a management component to the client device, and installing the management component on the client device for enrollment as a managed device with a management service.

Disclosed are various embodiments for controlling a distribution of resources on a network. In one example, among others, a system is configured to receive the plurality of resources and a plurality of rules. The system is also configured to determine an authorized location and an authorized area based on the plurality of rules. The authorized location and the authorized area are determined to have different access rights to the plurality of resources. The system is further configured to determine a location of the computing device and grant access to a resource based on the location of the computing device with respect to the authorization location or the authorized area.

On-demand activation of a security policy may be provided. Upon receiving a selection of a link, a profile identified by a security policy associated with the link may be activated and the link may be opened according to the security policy. In some embodiments, opening the link according to the security policy may comprise redirecting the opening of the link from a first application to a second application.