Fast reconfiguring environment for mobile computing devices

• US 10,609,076 B1
• Filed: 06/28/2018
• Issued: 03/31/2020
• Est. Priority Date: 08/02/2016
• Status: Active Grant

• Current Assignee: Architecture Technology Company
• Original Assignee: Architecture Technology Company
• Inventors: Hartley, Timothy, Ramanujan, Ranga, Al-Gharaibeh, Jafar
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US16/022,531
• Time in Patent Office: 642 Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0664 at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

An example method includes receiving an indication of a selection of a first application environment that includes a first virtual environment associated with a first security domain and is configured to isolate execution of software applications within the first application environment, suspending execution of a second application environment that includes a second virtual environment associated with a second security domain different from the first security domain, initiating execution of the first application environment, identifying information associated with the first security domain and provided by the first application environment that is to be sent to an external computing device associated with the first security domain, selecting communication network(s) from one or more communication networks that are each available to the mobile computing device for data communication, encrypting, based on the first security domain and network(s), the information, and sending, to the external computing device via the network(s), the encrypted information.

Claims

1. A mobile computing device, comprising:

one or more processors; and

a computer-readable storage device communicatively coupled to the one or more processors, wherein the computer-readable storage device stores instructions that, when executed by the one or more processors, cause the one or more processors to;

responsive to receiving an indication of a selection of a first application environment from a plurality of application environments, suspend execution of a second application environment from the plurality of application environments, wherein the first application environment comprises a first virtual environment that is associated with a first security domain, and wherein the second application environment comprises a second virtual environment that is associated with a second security domain different from the first security domain;

after suspending execution of the second application environment, initiate execution of the first application environment, wherein the first application environment is configured to isolate execution of one or more software applications within the first application environment;

select, based on one or more determined criteria, a first communication network from a plurality of different communication networks;

after sending information provided by the first application environment to an external computing device via the first communication network, and responsive to determining that the first communication network is no longer available to the mobile computing device for data communication, select, based on the one or more determined criteria, a second communication network from the plurality of different communication networks, the second communication network being different than the first communication network;

while the first communication is unavailable to the mobile computing device for data communication, send, to the external computing device via the second communication network, additional information provided by the first application environment;

after sending the additional information, and responsive to determining that the first communication network becomes available to the mobile computing device for data communication, select, based on the one or more determined criteria, the first communication network; and

while the first communication network is available to the mobile computing device for data communication, send, to the external computing device via the first communication network, further additional information provided by the first application environment.

2. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

determine one or more resources of the mobile computing device that are allocated to the first application environment during execution, wherein the one or more resources comprise at least one of processor usage, memory, or persistent storage of the mobile computing device; and

limit access of the first application environment to the one or more determined resources.

3. The mobile computing device of claim 1, wherein the one or more criteria are associated with one or more of (a) a categorization or priority of information provided by the first application environment that is associated with the first security domain, (b) a type of each of the plurality of different communication networks, (c) latency characteristics of each of the plurality of different communication networks, (d) speed characteristics of each of the plurality of different communication networks, (e) bandwidth characteristics of each of the plurality of different communication networks, (f) packet loss characteristics of each of the plurality of different communication networks, or (g) the one or more software applications executing in the first application environment.

4. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

select an external gateway that is communicatively coupled to the external computing device; and

create a virtual private network across the first communication network that includes the mobile computing device and the external gateway, wherein the virtual private network is associated with the first security domain,

wherein the instructions stored by the computer-readable storage device that cause the one or more processors to send the information provided by the first application environment cause the one or more processors to send the information to the external computing device via the external gateway using the virtual private network.

5. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

provide a virtual disk image associated with the first application environment, wherein the virtual disk image comprises at least one file image or at least one physical partition of at least one storage device, and wherein the virtual disk image includes state information associated with the first application environment.

6. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

provide a virtual disk image associated with the second application environment, wherein the virtual disk image comprises at least one file image or at least one physical partition of at least one storage device; and

prohibit the first application environment from modifying the virtual disk image associated with the second application environment.

7. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

provide a virtual disk image that is associated with the first application environment and with the second application environment;

assign, to the first application environment, first access rights to the virtual disk image; and

assign, to the second application environment, second access rights to the virtual disk image,

wherein one of the first access rights or the second access rights comprises read-only access rights, and wherein another one of the first access rights or the second access rights comprises at least write access rights, such that the mobile computing device enables one-way communication of information via the virtual disk image between the first application environment and with the second application environment.

8. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device further cause the one or more processors to:

limit access of the first application environment to one or more resources of the mobile computing device at least by providing one or more virtualized communication channels between the first application environment and a communication manager executing on the mobile computing device, wherein the communication manager controls the one or more virtualized communication channels, and wherein the communication manger operates in a separate execution domain with respect to the first application environment.

9. The mobile computing device of claim 8, wherein the instructions stored by the computer-readable storage device cause the one or more processors to execute the communication manager in a virtual environment that is isolated from the first application environment and from the second application environment.

10. The mobile computing device of claim 1, wherein the instructions stored by the computer-readable storage device that cause the one or more processors to select the first communication network from the plurality of different communication networks cause the one or more processors to select, by the communication manager, the first communication network from available physical communication networks, and to select one or more gateways for use in one or more virtual private networks.

11. A method comprising:

responsive to receiving an indication of a selection of a first application environment from a plurality of application environments, suspending, by a mobile computing device, execution of a second application environment from the plurality of application environments, wherein the first application environment comprises a first virtual environment that is associated with a first security domain, and wherein the second application environment comprises a second virtual environment that is associated with a second security domain different from the first security domain;

after suspending execution of the second application environment, initiating, by the mobile computing device, execution of the first application environment on the mobile computing device, wherein the first application environment is configured to isolate execution of one or more software applications within the first application environment;

selecting, by the mobile computing device, and based on one or more determined criteria, a first communication network from a plurality of different communication networks;

after sending information provided by the first application environment to an external computing device via the first communication network, and responsive to determining that the first communication network is no longer available to the mobile computing device for data communication, selecting, by the mobile computing device and based on the one or more determined criteria, a second communication network from the plurality of different communication networks, the second communication network being different than the first communication network;

while the first communication is unavailable to the mobile computing device for data communication, sending, by the mobile computing device, to the external computing device via the second communication network, additional information provided by the first application environment;

after sending the additional information, and responsive to determining that the first communication network becomes available to the mobile computing device for data communication, selecting, by the mobile computing device and based on the one or more determined criteria, the first communication network; and

while the first communication network is available to the mobile computing device for data communication, sending, by the mobile computing device and to the external computing device via the first communication network, further additional information provided by the first application environment.

12. The method of claim 11, further comprising:

determining, by the mobile computing device, one or more resources of the mobile computing device that are allocated to the first application environment during execution, wherein the one or more resources comprise at least one of processor usage, memory, or persistent storage of the mobile computing device; and

limiting, by the mobile computing device, access of the first application environment to the one or more determined resources.

13. The method of claim 11, wherein the one or more criteria are associated with one or more of (a) a categorization or priority of information provided by the first application environment that is associated with the first security domain, (b) a type of each of the plurality of different communication networks, (c) latency characteristics of each of the plurality of different communication networks, (d) speed characteristics of each of the plurality of different communication networks, (e) bandwidth characteristics of each of the plurality of different communication networks, (f) packet loss characteristics of each of the plurality of different communication networks, or (g) the one or more software applications executing in the first application environment.

14. The method of claim 13, wherein the one or more criteria are associated at least with one of the latency characteristics, the bandwidth characteristics, or the packet loss characteristics of each of the plurality of different communication networks, and wherein the method further comprises:

measuring, by the mobile computing device in cooperation with one or more agents located remotely from the mobile computing device, at least one of the latency characteristics, the bandwidth characteristics, or the packet loss characteristics of at least one of the plurality of different communication networks.

15. The method of claim 11, wherein the first communication network comprises a wired network, and wherein the second communication network comprises a wireless network.

16. The method of claim 11, further comprising:

selecting, by the mobile computing device, an external gateway that is communicatively coupled to the external computing device; and

creating, by the mobile computing device, a virtual private network across the first communication network that includes the mobile computing device and the external gateway,

wherein the virtual private network is associated with the first security domain, wherein sending the information provided by the first application environment comprises sending the information to the external computing device via the external gateway using the virtual private network.

17. The method of claim 11, further comprising:

after suspending execution of the second application environment;

storing, by the mobile computing device, state information associated with at least one resource of the mobile computing device previously used by the second application environment; and

prohibiting, by the mobile computing device, any communication with the second application environment.

18. The method of claim 11, further comprising:

providing, by the mobile computing device, a virtual disk image associated with the first application environment, wherein the virtual disk image comprises at least one file image or at least one physical partition of at least one storage device, and wherein the virtual disk image includes state information associated with the first application environment.

19. The method of claim 11, further comprising:

providing, by the mobile computing device, a virtual disk image associated with the second application environment, wherein the virtual disk image comprises at least one file image or at least one physical partition of at least one storage device; and

prohibiting, by the mobile computing device, the first application environment from modifying the virtual disk image associated with the second application environment.

20. The method of claim 11, further comprising:

providing, by the mobile computing device, a virtual disk image that is associated with the first application environment and with the second application environment;

assigning, by the mobile computing device and to the first application environment, first access rights to the virtual disk image; and

assigning, by the mobile computing device and to the second application environment, second access rights to the virtual disk image,

wherein one of the first access rights or the second access rights comprises read-only now abandoned access rights, and wherein another one of the first access rights or the second access rights comprises at least write access rights, such that the mobile computing device enables one-way communication of information via the virtual disk image between the first application environment and with the second application environment.

21. The method of claim 11, further comprising:

limiting, by the mobile computing device, access of the first application environment to one or more resources of the mobile computing device at least by providing one or more virtualized communication channels between the first application environment and a communication manager executing on the mobile computing device, wherein the communication manager controls the one or more virtualized communication channels, and wherein the communication manger operates in a separate execution domain with respect to the first application environment.

22. The method of claim 11,

wherein the first security domain comprises a classified security domain,

wherein the first application environment comprises a persona associated with the classified security domain,

wherein the second security domain comprises an unclassified security domain, and

wherein the second application environment comprises a persona associated with the unclassified security domain.

23. A computer-readable storage device storing instructions that, when executed, cause a mobile computing device comprising one or more processors of a mobile computing device to perform operations comprising:

responsive to receiving an indication of a selection of a first application environment from a plurality of application environments, suspending execution of a second application environment from the plurality of application environments, wherein the first application environment comprises a first virtual environment that is associated with a first security domain, and wherein the second application environment comprises a second virtual environment that is associated with a second security domain different from the first security domain;

after suspending execution of the second application environment, initiating execution of the first application environment on the mobile computing device, wherein the first application environment is configured to isolate execution of one or more software applications within the first application environment;

selecting, based on one or more determined criteria, a first communication network from a plurality of different communication networks;

after sending information provided by the first application environment to an external computing device via the first communication network, and responsive to determining that the first communication network is no longer available to the mobile computing device for data communication, selecting, based on the one or more determined criteria, a second communication network from the plurality of different communication networks, the second communication network being different than the first communication network;

while the first communication is unavailable to the mobile computing device for data communication, sending, to the external computing device via the second communication network, additional information provided by the first application environment;

after sending the additional information, and responsive to determining that the first communication network becomes available to the mobile computing device for data communication, selecting, based on the one or more determined criteria, the first communication network; and

while the first communication network is available to the mobile computing device for data communication, sending, to the external computing device via the first communication network, further additional information provided by the first application environment.

24. The computer-readable storage device of claim 23, wherein the operations further comprise:

determining one or more resources of the mobile computing device that are allocated to the first application environment during execution, wherein the one or more resources comprise at least one of processor usage, memory, or persistent storage of the mobile computing device; and

limiting access of the first application environment to the one or more determined resources.

25. The computer-readable storage device of claim 23, wherein the one or more criteria are associated with one or more of (a) a categorization or priority of information provided by the first application environment that is associated with the first security domain, (b) a type of each of the plurality of different communication networks, (c) latency characteristics of each of the plurality of different communication networks, (d) speed characteristics of each of the plurality of different communication networks, (e) bandwidth characteristics of each of the plurality of different communication networks, (f) packet loss characteristics of each of the plurality of different communication networks, or (g) the one or more software applications executing in the first application environment.

26. The computer-readable storage device of claim 23, wherein the operations further comprise:

selecting an external gateway that is communicatively coupled to the external computing device; and

creating a virtual private network across the first communication network that includes the mobile computing device and the external gateway, wherein the virtual private network is associated with the first security domain,

wherein sending the information provided by the first application environment comprises sending the information to the external computing device via the external gateway using the virtual private network.

27. The computer-readable storage device of claim 23, wherein the operating further comprise:

limiting access of the first application environment to one or more resources of the mobile computing device at least by providing one or more virtualized communication channels between the first application environment and a communication manager executing on the mobile computing device, wherein the communication manager controls the one or more virtualized communication channels, and wherein the communication manger operates in a separate execution domain with respect to the first application environment.