Communicating data associated with different personas of a user

An electronic device has a plurality of environments including respective communication stacks. The environments correspond to respective different user personas. Data associated with the different user personas are communicated in corresponding separate transport flows over the network.

BACKGROUND

A user can use an electronic device in various different roles. For example, the electronic device may be used by the user in both a work context (such as part of the user's employment by an enterprise) or in a personal context (for personal communications such as personal e-mails, social networking posts, and so forth).

DETAILED DESCRIPTION

Some enterprises (e.g. business concerns, government agencies, educational organizations, etc.) allow a user to use a common electronic device (either the user's personal electronic device or the user's work electronic device) for tasks relating to different roles of the user. The different roles of the user can correspond to different personas of the user, where the different personas can include, as examples, a work persona that relates to communications of the user associated with work for an enterprise, and a personal persona relating to personal communications (e.g. personal e-mails, social networking posts, etc.) of a user. The user can also have other personas, such as another persona relating to charity work by the user, a further persona associated with being a member of a sports league, and so forth.

Security can be a concern when a user uses the same electronic device for tasks associated with the different personas of the user. To enhance security of data associated with the work persona of the user, for example, it is desirable to maintain separation of data associated with the work persona from data associated with other persona(s) of the user.

In accordance with some implementations, techniques or mechanisms are provided to transport data for the different personas of a user in different transport flows. Maintaining separation between data of the different personas of the user allows for isolation of data associated with the different personas of the user, which improves security of data associated with a particular persona (e.g. work persona) of the user.

A “transport flow” refers to a session, stream, or connection that allows for an exchange of data between or among at least two endpoints in a network. In some examples, a transport flow can be in the form of a logical network, such as a virtual local area network (VLAN) or other type of logical network. One or multiple logical networks can be defined on a physical network that includes physical network infrastructure, which can include communication nodes such as switches or routers, and interconnection links between the communication nodes.

FIG. 1is a block diagram of an example network arrangement that includes an electronic device100that is coupled to a network, in accordance with some implementations. In some examples, the electronic device100can include a mobile device, such as a smartphone, a personal digital assistant (PDA), a tablet computer, a notebook computer, and so forth. In other examples, the electronic device100can be a desktop computer, game console, or some other type of electronic device.

The electronic device100includes multiple environments for respective different personas of a user of the electronic device100. In the example ofFIG. 1, two environments102,104are depicted, where the environment102is for a work persona of the user, and the environment104is for the personal persona of the user. Although just two environments102,104are depicted for the work and personal personas, respectively, of a user, in theFIG. 1example, it is noted that in other examples, additional or alternative environments can be provided for other personas of the user.

The different environments102,104can be different virtual or logical environments defined in the electronic device100. As examples, each environment102,104can be a virtual machine, which can refer to a partition of segment of a physical machine (such as the electronic device100). A virtual machine virtualizes or emulates a physical machine. From the perspective of a user or application, a virtual machine can look just like a physical machine. A virtual machine can include one or multiple applications, and other components, such as an operating system, device drivers, and so forth.

In different examples, the environments102and104can be implemented with different types of partitions in the electronic device100.

The work persona environment102includes at least one application106(e.g. web browser, word processing application, spreadsheet application, etc.) and a communication stack108. The application106is used by the user as part of the work persona of the user. The communication stack108is used for communicating (transmitting and/or receiving) data associated with the work persona of a user with a physical network interface110is used to communicate data of the electronic device100over a network112.

Note that there can be one physical network interface110, or multiple physical network interfaces, in the electronic device100. A physical network interface110can be a physical wireless network interface to allow the electronic device100to communicate wirelessly with the network112. Alternatively, the physical network interface110can be a wired physical network interface for wired connection to the network112. In some examples, the physical network interface110can be implemented as a network interface card.

The personal persona environment104similarly includes at least an application114and a communication stack118. The communication stack118in the environment104is used for communicating data associated with the personal persona of the user with the physical network interface110. In examples where there is just one physical network interface110, the physical network interface110is shared by the communication stacks108and118in the different environments102,104. In examples where there are multiple physical network interfaces110, then different ones of the physical network interfaces110can be used for communicating data with respective different ones of the communication stacks108and118in the environments102and104, respectively.

Each of the environments102and104can also include other modules, such as an operating system (not shown), and so forth.

As further shown inFIG. 1, the network112includes network node(s)120for routing data through the network112. The network node(s)120can include an access point (e.g. wireless or wired access point) and other network node(s), as examples. As examples, such other network node(s) can include any one or combination of switch, router, a firewall, a load balancer, and so forth. A remote endpoint122(which can be another electronic device or a server, as examples) is coupled to the network112. The network nodes120can communicate data between the electronic device100and the remote endpoint122.

The network node(s)120of the network112can include a transport flow module124, which is able to establish multiple transport flows for communicating respective data of the work persona environment102and personal persona environment104, respectively. As discussed further below, different logical network connection points can be established in the electronic device100, such as at the communication stacks108and110, for the multiple transport flows. The transport flow module124in the network node(s)120is able to separate data from the electronic device100into the multiple transport flows, depending upon which logical network connection point the data is associated with.

The network node(s)120can also include a mobility management module126, which can be used to manage mobility of the electronic device100, such as when the electronic device100is wirelessly attached to a wireless access network. For example, the mobility management module126can manage handoff of the electronic device100from a source wireless access network to a destination wireless access network, such as when the electronic device100crosses a boundary between different coverage areas of the corresponding wireless access networks. The mobility management module126of the network node(s)120can interact with a handoff control module128in the electronic device100for performing the handoff operations.

FIGS. 2A-2Cillustrate three different example implementations of the environments102and104of the electronic device100. InFIG. 2A, the communication stack108of the work persona environment102includes an Internet Protocol (IP) layer202and a Medium Access Control (MAC) layer204. Similarly, the communication stack118of the personal persona environment104includes an IP layer206and a MAC layer208.

The IP layer202or206performs network communications using IP packets, where each IP packet contains source and destination IP addresses to identify a source network device and a destination network device. The IP addresses are used to route the IP packets through the network112(FIG. 1).

The MAC layer204or208is a data link layer that provides addressing and channel access control mechanisms to allow for multiple network devices to communicate over a shared network. The MAC layer204or206can use MAC addresses for communicating data frames between a source network device and a destination network device.

It is noted that the IP layer202or206is above the respective MAC layer204or208in the corresponding communication stack108or118. An IP packet generated by an IP layer is carried in the payload section of a MAC frame produced by a MAC layer.

Although not shown, the communication stack108or118ofFIG. 2Acan further include additional layers above the IP layer202or206.

In examples according toFIG. 2A, the electronic device100further includes an entity management module210to map data between a MAC layer204or208in the environment102or104and at least one physical MAC layer associated with at least one physical network interface of the electronic device100. In the example ofFIG. 2A, two MAC layers212and214are associated with respective physical network interfaces216and218.

The entity management module210can selectively map the MAC layer204in the work persona environment102to either the MAC layer212or MAC layer214in the physical network interface216or218, respectively. Similarly, the entity management module210can map the MAC layer208in the personal persona environment104to either the MAC layer212or MAC layer214. Mapping data between the MAC layers refers to mapping between a MAC address of a MAC layer associated with the physical network interface and a MAC address of the MAC layer associated with the environment102or104. For example, if the entity management module210routes data of the work persona environment102through the physical network interface218, then the entity management module210would map between the physical MAC address of the MAC layer214in the physical network interface218, and an internal or logical MAC address associated with the MAC layer204of the communications stack108in the work persona environment102.

In some examples, the MAC layers212and214associated with the physical network interfaces216and218can be referred to as “physical” MAC layers. On the other hand, the MAC layers204and208in the respective communications stacks108and118of the environments102and104, respectively, can be referred to as “internal” or “logical” MAC layers.

In examples according toFIG. 2A, logical network connection points220and222are provided at the respective internal MAC layers204and208of the communication stacks108and112, respectively. A logical network connection point can refer to a point in the electronic device100to which a transport flow is established. InFIG. 2A, the two different logical network connection points220and222are identified by respective different MAC addresses associated with the internal MAC layers204and208. Thus, a transport flow for carrying data associated with the work persona environment102is established with the logical network connection point220, whereas a transport flow of data for the personal persona environment104is established with the logical network connection point222.

In alternative implementations, as shown inFIG. 2B, logical network connection points234and236are provided at an IP layer230and an IP layer232, respectively, of the communication stacks108and118. A router238in the electronic device100can be provided to route data between the IP layers230and232and MAC layers212and214. The router238can selectively route data between the IP layer230and either the MAC layer212or214, and similarly, the router238can selectively route data between the IP layer232and either the MAC layer212or214.

Providing logical network connection points234and236at the IP layers230and232, respectively, of the communication stacks108and118, causes transport flows of data for the work persona environment102and personal persona environment104, respectively, to be routed to IP addresses associated with the respective IP layers230and232.

FIG. 2Cshows yet another alternative example, where the communication stack108includes an upper layer240, an IP layer242, and a MAC layer244, and similarly, the communication stack118includes an upper layer246, an IP layer248, and a MAC layer250. In some examples, the upper layer240or246can be a Transmission Control Protocol (TCP) layer, which is used to establish a connection with a peer or counterpart TCP layer at a remote network device. TCP provides reliable, ordered delivery of data units between endpoints. In other examples, different types of upper layers240and246can be employed.

In examples according toFIG. 2C, logical network connection points252and254are provided at the upper layers240and246. Providing a logical network connection point at an upper layer, such as a TCP layer, results in a transport flow being established with an identifier associated with such upper layer, such as a TCP port, for example.

FIG. 2Calso shows a switch260for switching data between MAC layers244,250of the communication stacks108and118, and MAC layers212and214associated with the physical network interfaces216and218.

Note that the entity management module210, router238, and switch260ofFIGS. 2A, 2B, and 2C, respectively, can be implemented as executable machine-readable instructions.

FIG. 3shows an example arrangement that includes a network infrastructure that is able to support communications of data between the electronic device100and the remote endpoint122, which is connected to a public network302such as the Internet. The network infrastructure ofFIG. 3includes a physical network infrastructure304and a logical network infrastructure306. The physical network infrastructure304includes various network nodes in an enterprise network314(such as a local area network of an enterprise), which includes wireless access point(s)308and switch(es)310. The wireless access point(s)308in the enterprise network314can use WiFi technology or any other wireless communication technology (including cellular technology or other wireless technology) As further shown inFIG. 3, the enterprise network314can also include a router(s)312to allow communications with the public network302.

A wireless access point308allows wireless connectivity by the electronic device100(and any other electronic device within the coverage area of the wireless access point).

The enterprise network314also includes a mobility service node316, which is able to manage mobility of electronic devices in the enterprise network314. For example, the electronic device100can move between coverage areas of respective wireless access points308in the enterprise network314. The mobility service node316is able to manage handoff of the electronic device100between the wireless access points308. In some examples, the mobility service node316can be a standalone node, or alternatively, can be part of any one or combination of the wireless access point308, switch310, router312, or even the communication device100. The mobility service node316can include the mobility management module126ofFIG. 1, for example.

The logical network infrastructure306includes transport flows320and322that can be established on the physical network infrastructure304. In some examples, a transport flow320or322can include a logical network, such as a virtual local area network (VLAN), a Multi-Protocol Label Switching (MPLS) label-switched path (LSP) network, a pseudo-wire (which provides an emulation of a point-to-point connection over network), an Internet Protocol (IP)-security virtual private network (VPN) (a virtual private network protected by the IP-security or IPsec protocol), and so forth. In other examples, other types of transport flows320and322cane be provided. The transport flow320can be used to communicate data associated with the work persona of the user of the electronic device100, while the transport flow322can be used to communicate data associated with the personal persona of the user of the electronic device100.

The transport flows320and322can be established by the transport flow module124ofFIG. 1, which can be implemented in one or some combination of the wireless access point308, switch310, and router312. The transport flow module124can establish the transport flows with respective logical network connection points (such as those depicted inFIGS. 2A-2C) in the electronic device100.

Upon receiving data from the electronic device100, the transport flow module124can identify the logical network connection point that the received data is associated with, and can assign the received data to a selected one of the transport flows320and322. Each of the logical network connection points can be associated with respective network transport policies. In some implementations, a network transport policy can specify which logical and physical network transport mechanism to use for routing data associated with the corresponding logical network connection point. The network transport policy can also specify other parameters.

FIG. 4is a block diagram of a different example arrangement. In theFIG. 4arrangement, a physical network infrastructure402includes the enterprise network314(containing the same network nodes as depicted inFIG. 3) and a service provider network406. While the enterprise network314can he a secure or private network of an enterprise, the service provider network406can be a public network that is accessible by users or subscribers of the service provider that operates the service provider network406.

The service provider network406includes wireless access point(s)408, switch(es)/routers)410, and a mobility service node411. The wireless access point(s)408in the service provider network406can use WiFi technology, cellular technology (e.g. 3G, 4G, or beyond technology), or any other wireless communication technology. When the electronic device100is attached to the service provider network406, the electronic device100communicates through the service provider network406with the public network302.

The electronic device100can selectively attach to either or both of the enterprise network314and the service provider network406, depending upon the location of the electronic device100. In some examples, as the electronic device100moves to different locations, the electronic device100can move into or out of coverage areas associated with the enterprise network314and the service provider network406. In some cases, the electronic device100can be located at a location that is within the coverage areas of both the enterprise network314and the service provider network406, in which case the electronic device100can potentially attach to both the enterprise network314and the service provider network406.

FIG. 4also shows a logical network infrastructure412that can be implemented on the physical network infrastructure402. The logical network infrastructure412includes transport flows414and416that can be provided on the enterprise network314for carrying data associated with different personas of the user of the electronic device100. In addition, the logical network infrastructure412additionally includes transport flows418and420, which can be implemented on the service provider network406, for carrying data associated with different personas of the user of the electronic device100. Similar to examples given inFIG. 3, the transport flows414,416,418, and420can include VLANs, MPLS LSP networks, pseudo-wires, IP-security VPNs, and so forth.

Depending upon which of the enterprise network314and service provider network406the electronic device100is attached to, handoff of data communications can be performed between the transport flows implemented on the enterprise network314and the service provider network406. As an example, if the electronic device100were to leave the enterprise network314and enter the service provider network406, then a handoff is performed where the transport flows418and420are used to transport data of the electronic device100rather than the transport flows414and416. Handoff is managed by the mobility service node316in the enterprise network314, and the mobility service node412in the service provider network406.

FIG. 5is a flow diagram of a process performed by a network node, such as any of the network nodes depicted inFIGS. 1, 4, and 5. The process ofFIG. 5communicates (at502) data with the electronic device100at multiple logical network connection points in respective communication stacks of the electronic device100. The multiple logical network connection points can correspond to different personas of a user of the electronic device100. The process ofFIG. 5separates (at504) the data associated with the different personas into multiple different transport flows that are established with the corresponding logical network connection points.

FIG. 6is a block diagram of an example system600. The system600can be the electronic device100ofFIG. 1, or a network node in the network112(FIG. 1), enterprise network314(FIG. 3 or 4), or service provider network406(FIG. 4). The system600includes machine-readable instructions602, which can represent any of the communication stacks108and118depicted inFIGS. 1 and 2A-2C, the entity management module210ofFIG. 2A, the router238ofFIG. 2B, the switch260ofFIG. 2C, the mobility management module126ofFIG. 1, and so forth.

The machine-readable instructions602are executable on one or multiple processors604, which can be connected to a network interface606to communicate over a data network, and to a storage medium (or storage media)608to store data. A processor can include a microprocessor, microcontroller, processor module or subsystem, programmable integrated circuit, programmable gate array, or another control or computing device.