Protecting an application via an intra-application firewall

• US 10,366,213 B2
• Filed: 02/09/2016
• Issued: 07/30/2019
• Est. Priority Date: 02/09/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hay, Roee, Kaplan, David N., Kedmi, Sagi, Tripp, Omer
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Cohen, Harvey I
• Application Number:
  US15/019,252
• Publication Number:
  US 20170228524A1
• Time in Patent Office: 1,267 Days
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/629 to features or functions of an application

Abstract

One or more communication interfaces of a first application may be scanned. In response to the scanning, it may be determined that at least a first component of the first application is subject to public access from any application. One or more public access features associated with the first component may be removed, wherein the first component is no longer subject to public access from any application. A first module may be added to the first application to control access to data to or from the first component via one or more security rules.

Claims

1. A computer-implemented method for building a secure computing device application, the method comprising:

scanning one or more communication interfaces of a first application, the first application being stored to a computing device;

determining, in response to the scanning, that at least a first component of a plurality of components of the first application is subject to public access from any application;

removing one or more public access features associated with the first component, wherein the first component is no longer subject to public access from any application;

adding, to the first application, a first module to control access to data to or from the first component via one or more security rules, wherein the scanning, the determining, the removing, and the adding are performed by a first computing device at compile time;

receiving a first request to transfer data from the first component to a second component within the first application;

in response to the receiving of the first request, receiving a second request from a second application within the computing device to inject data to the second component via a driver of a kernel of the computing device; and

blocking, based on the one or more security rules, the second request from the second application; and

wherein the first application is managed by an Android operating system, and wherein the first component is a first activity, the first activity being a user interface screen that represent an instance workflow of the first application, and wherein the public access features includes exported activities, the exported activities corresponding to activities that cross application boundaries and are configured to be invoked from any application.

2. The method of claim 1, wherein the first application is executed on a mobile device and the first application receives a first invocation message from a second application executing on the mobile device, the first invocation message requesting to write a first set of data to the first component, the first module causes the first application to:

obtain a first set of details associated with the write;

compare the first set of details with the one or more security rules to determine whether the write may occur; and

restrict, based on at least the one or more security rules, the first invocation message by blocking the write of the first set of data to the first component.

3. The method of claim 2, wherein the first module causes the first application to further determine that the first invocation message from the second application is associated with an unauthorized injection attack, wherein the restricting is further based on the determining.

4. The method of claim 1, wherein a configuration file of the first application includes a list of particular applications that are allowed to call a particular user interface (UI) instance of the first application, and wherein a first rule of the one or more security rules is based on the list of particular applications that are allowed to call the particular UI instance of the first application, and wherein in response to a particular application not being on a list, a firewall is implemented for the particular application such that the particular application cannot not have access to the particular UI instance for a read or write operation.

5. The method of claim 1, wherein a first rule of the one or more security rules permits a first set of data to be injected to the first component, the one or more security rules including a second rule to block a second set of data to be injected to the first component.

6. The method of claim 1, wherein the one or more security rules includes a first rule to permit a second application to read the data from the first component, the one or more security rules including a second rule to block the second application from writing any of the data to the first component.

7. A system for building a secure computing device application, the system comprising:

a computing device having a processor; and

a computer readable storage medium having program instructions embodied therewith, the program instructions executable by the processor to cause the system to;

scan one or more communication interfaces of a first application, the first application being stored to a computing device;

determine, in response to the scanning, that at least a first user interface (UI) instance of a plurality of UI instances of the first application is subject to public access from any application, wherein public access corresponds to allowing any and all outside applications to invoke the first UI instance;

remove one or more public access features associated with the first UI instance, wherein the first UI instance is no longer subject to public access from any application;

add, to the first application, a first module to control access to data to or from the first UI instance via one or more security rules;

receive a first request to transfer data from the first component to a second component within the first application;

in response to the receiving of the first request, receive a second request from a second application within the computing device to inject data to the second component via a driver of a kernel of the computing device; and

block, based on the one or more security rules, the second request from the second application; and

wherein the first application is managed by an Android operating system, and wherein the first component is a first activity, the first activity being a user interface screen that represent an instance workflow of the first application, and wherein the public access features includes exported activities, the exported activities corresponding to activities that cross application boundaries and are configured to be invoked from any application.

8. The system of claim 7, wherein the first application is executed on a mobile device and the first application receives a first invocation message from a second application executing on the mobile device, the first invocation message requesting to read a first set of data from the first UI instance the first module causes the first application to:

obtain a first set of details associated with the read;

compare the first set of details with the one or more security rules to determine whether the read may occur; and

restrict, based on at least the one or more security rules, the first invocation message by blocking the read of the first set of data from the first UI instance.

9. The system of claim 7, wherein a first rule of the one or more security rules permits any explicit invocations to be sent from the first application, the first rule not permitting any implicit invocations to be sent from the first application, the explicit invocations identifying a specific recipient application by name, the implicit invocations identifying a particular action to be executed without identifying a particular recipient application by name.

10. The system of claim 7, wherein a first rule of the one or more security rules permits a first set of data to be read from the first component, the one or more security rules including a second rule to block a second set of data to be read from the first component.

11. The system of claim 7, wherein the one or more security rules includes a first rule that only particular application types are permitted to read from the first component or write to the first component.

12. The system of claim 7, wherein the one or more security rules includes a first rule to permit a second application to write a first set of data to the first component, the one or more security rules including a second rule to block the second application from writing a second set of data to the first component.

13. The system of claim 7, wherein the first application includes a plurality of components, the one or more security rules includes a first rule to permit the first component to invoke a second component only after the first component invokes a third component, the plurality of components including:

the first component, the second component, and the third component.

14. A computer program product for building a secure computing device application, the computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code comprising computer readable program code configured for:

scanning one or more communication interfaces of a first application, the first application being stored to a computing device;

determining, in response to the scanning, that at least a first component of a plurality of components of the first application is subject to public access from any application;

removing one or more public access features associated with the first component, wherein the first component is no longer subject to public access from any application;

adding, to the first application, a first module to control access to data to or from the first component via one or more security rules;

receiving a first request to transfer data from the first component to a second component within the first application;

in response to the receiving of the first request, receiving a second request from a second application within the computing device to inject data to the second component via a driver of a kernel of the computing device; and

blocking, based on the one or more security rules, the second request from the second application; and

wherein the first application is managed by an Android operating system, and wherein the first component is a first activity, the first activity being a user interface screen that represent an instance workflow of the first application, and wherein the public access features includes exported activities, the exported activities corresponding to activities that cross application boundaries and are configured to be invoked from any application.

15. The computer program product of claim 14, wherein the first application is executed on a mobile device and the first application receives a first invocation message from a third application, the first invocation message requesting to write a first set of data to the first component, the first module causes the first application to:

obtain a first set of details associated with the write;

compare the first set of details with the one or more security rules to determine whether the write may occur; and

restrict, based on at least the one or more security rules, the first invocation message by blocking the write of the first set of data to the first component.

16. The computer program product of claim 14, wherein the first application includes a list of particular applications that are allowed to call the first application only at a particular time of day or night, and wherein a first rule of the one or more security rules is based on the list of particular applications that are allowed to call the first application only at a particular time of day or night.

17. The computer program product of claim 14, wherein the first application includes a third component, the one or more security rules including a first rule that permits a write to the first component, the first rule not permitting a write to the third component.

18. The computer program product of claim 14, wherein the one or more security rules includes a first rule that only a first set of data may be read from the first component, the security rules including a second rule that a second set of data may not be read from the first component.

19. The computer program product of claim 14, wherein a first rule of the one or more security rules permits any explicit invocations to be sent from the first application, the first rule not permitting any implicit invocations to be sent from the first application, the explicit invocations identifying a specific recipient application by name, the implicit invocations identifying a particular action to be executed without identifying a particular recipient application by name.