Technologies for multi-factor security analysis and runtime control

• US 10,055,580 B2
• Filed: 05/27/2016
• Issued: 08/21/2018
• Est. Priority Date: 09/23/2014
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Li, Hong, Dewan, Prashant
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US15/166,952
• Publication Number:
  US 20160364566A1
• Time in Patent Office: 816 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Technologies for client-level web application runtime control and multi-factor security analysis by a computing device include receiving application code associated with a browser-based application from a web server. The computing device collects real-time data generated by at least one sensor of the computing device and performs a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code. Further, the computing device establishes a client-level web application runtime security policy associated with the browser-based application in response to performing the multi-factor security assessment and enforces the client-level web application runtime security policy.

Claims

1. A computing device for client-level web application runtime control and multi-factor security analysis, the computing device comprising:

a processor; and

a memory that comprises instructions stored thereon, which when executed by the processor, causes the computing device to;

access application code associated with a browser-based application received from a web server, wherein the application code is to be executed by the processor of the computing device;

collect real-time data associated with the computing device;

perform a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code to determine whether the application code includes impermissible code, wherein the impermissible code is a portion of the application code that, if executed, poses a security risk to the computing device;

determine whether the application code is modifiable to eliminate execution of impermissible code in response to an indication by the multi-factor security assessment that the application code includes the impermissible code;

modify the application code in response to a determination that the application code is modifiable to eliminate the execution of the impermissible code; and

execute the modified application code.

2. The computing device of claim 1, wherein the memory further comprises instructions stored thereon, which when executed by the processor, causes the computing device to:

establish a client-level web application runtime security policy associated with the browser-based application in response to performance of the multi-factor security assessment, wherein the client-level web application runtime security policy identifies at least one of hardware, firmware, or software access rules; and

enforce the client-level web application runtime security policy.

3. The computing device of claim 1, wherein to collect the real-time data comprises to determine an impact of execution of the application code on the operation of computing device.

4. The computing device of claim 3, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on a parameter of the operation of the computing device unrelated to a maliciousness aspect of the application code.

5. The computing device of claim 3, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on concurrent execution of another application of the computing device different from the browser-based application.

6. The computing device of claim 3, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on at least one of power consumption or latency of the computing device.

7. The computing device of claim 1, wherein to collect the real-time data comprises to determine a real-time security threat level of a network of the computing device.

8. The computing device of claim 1, wherein to collect the real-time data comprises to:

transmit the application code to a cloud server for remote simulation of the application code; and

receive security results from the cloud server in response to transmittal of the application code to the cloud server.

9. One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing device, causes the computing device to:

access application code associated with a browser-based application received from a web server, wherein the application code is to be executed by the processor of the computing device;

collect real-time data associated with the computing device;

perform a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code to determine whether the application code includes impermissible code, wherein the impermissible code is a portion of the application code that, if executed, poses a security risk to the computing device;

determine whether the application code is modifiable to eliminate execution of impermissible code in response to an indication by the multi-factor security assessment that the application code includes the impermissible code;

modify the application code in response to a determination that the application code is modifiable to eliminate the execution of the impermissible code; and

execute the modified application code.

10. The one or more non-transitory machine-readable storage media of claim 9, wherein the plurality of instructions further causes the computing device to:

establish a client-level web application runtime security policy associated with the browser-based application in response to performing the multi-factor security assessment, wherein the client-level web application runtime security policy identifies at least one of hardware, firmware, or software access rules; and

enforce the client-level web application runtime security policy.

11. The one or more non-transitory machine-readable storage media of claim 9, wherein to collect the real-time data comprises to determine an impact of execution of the application code on the operation of computing device.

12. The one or more non-transitory machine-readable storage media of claim 11, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on a parameter of the operation of the computing device unrelated to a maliciousness aspect of the application code.

13. The one or more non-transitory machine-readable storage media of claim 11, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on concurrent execution of another application of the computing device different from the browser-based application.

14. The one or more non-transitory machine-readable storage media of claim 11, wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on at least one of power consumption or latency of the computing device.

15. The one or more non-transitory machine-readable storage media of claim 9, wherein to collect the real-time data comprises to determine a real-time security threat level of a network of the computing device.

16. The one or more non-transitory machine-readable storage media of claim 9, wherein to collect the real-time data comprises to:

transmit the application code to a cloud server for remote simulation of the application code; and

receive security results from the cloud server in response to transmittal of the application code to the cloud server.

17. A method for client-level web application runtime control and multi-factor security analysis by a computing device, the method comprising:

accessing, by a computing device, application code associated with a browser-based application received from a web server, wherein the application code is to be executed by a processor of the computing device;

collecting, by the computing device, real-time data associated with the computing device;

performing, by the computing device, a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code to determine whether the application code includes impermissible code, wherein the impermissible code is a portion of the application code that, if executed, poses a security risk to the computing device;

determining, by the computing device, whether the application code is modifiable to eliminate execution of impermissible code in response to an indication by the multi-factor security assessment that the application code includes the impermissible code;

modifying, by the computing device, the application code in response to a determination that the application code is modifiable to eliminate the execution of the impermissible code; and

executing, by the computing device, the modified application code.

18. The method of claim 17, further comprising:

establishing, by the computing device, a client-level web application runtime security policy associated with the browser-based application in response to performing the multi-factor security assessment, wherein the client-level web application runtime security policy identifies at least one of hardware, firmware, or software access rules; and

enforcing the client-level web application runtime security policy.

19. The method of claim 17, wherein collecting the real-time data comprises determining an impact of execution of the application code on the operation of computing device.

20. The method of claim 19, wherein determining the impact of the execution of the application code comprises determining an impact of execution of the application code on a parameter of the operation of the computing device unrelated to a maliciousness aspect of the application code.

21. The method of claim 19, wherein determining the impact of the execution of the application code comprises determining an impact of execution of the application code on at least one of power consumption or latency of the computing device.

22. The method of claim 17, wherein collecting the real-time data comprises determining a real-time security threat level of a network of the computing device.

23. The method of claim 17, wherein collecting the real-time data comprises:

transmitting the application code to a cloud server for remote simulation of the application code; and

receiving security results from the cloud server in response to transmittal of the application code to the cloud server.