POLYMORPHIC COMPUTING ARCHITECTURES

• US 20140380425A1
• Filed: 10/11/2013
• Published: 12/25/2014
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Lockett, Christopher S., Oberg, Scott A., Forsberg, Sean M., Saidi, Hassen, Casper, Jeffrey E.
• Granted Patent: US 9,501,666 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Polymorphic computing architectures can support and control separate, independently executable domains and other components on a computing platform. In some embodiments, the architectures may control the different domains and/or components according to different purposes. In some embodiments, the architectures can control domains and/or components to enforce a desired “purpose” of a domain/component while simultaneously denying a corresponding “anti-purpose.”

Claims

1. A computing device, comprising:

a processing unit comprising one or more hardware processors;

a context detector in communication with the processing unit to receive data indicating a current operating context of the computing device;

shared system resources in communication with the processing unit, the shared system resources comprising one or more of a telephony subsystem, a camera subsystem, and a network subsystem;

machine accessible storage media; and

a plurality of well-defined communication channels operably coupling the processing unit with the context detector, the shared system resources, and the machine accessible storage media, wherein the machine accessible storage media has embodied therein;

a plurality of isolated independently executable domains, each domain having a domain-specific purpose governing use by the domain of the shared system resources, the domain-specific purpose being different for each of the domains; and

wherein the processing unit monitors the current operating context of the computing device and, for each of the domains;

enables the domain to use the shared system resources if the current operating context of the computing device does not conflict with the domain'"'"'s domain-specific purpose; and

disables the domain'"'"'s use of one or more of the shared system resources if the current operating context conflicts with the domain-specific purpose.

2. The computing device of claim 1, wherein the processing unit maintains data relating to the domain-specific purposes of all of the domains, and, for each of the domains, enables the domain to use the shared system resources if the current operating context of the computing device does not conflict with any of the domains'"'"' domain-specific purposes;

and disables the domain'"'"'s use of one or more of the shared system resources if the current operating context conflicts with any of the domains'"'"' domain-specific purpose.

3. The computing device of claim 1, wherein the processing unit modifies without fully disabling the domain'"'"'s use of one or more of the shared system resources if the current operating context conflicts with the domain-specific purpose.

4. The computing device of claim 3, wherein the processing unit causes data to be shared by the domain with another entity to be modified before the data is shared by the domain with the other entity, if the current operating context conflicts with the domain-specific purpose.

5. The computing device of claim 1, wherein the processing unit prevents data from being shared by the domain with another domain on the computing device if the current operating context conflicts with the domain-specific purpose.

6. The computing device of claim 1, wherein the processing unit enables data to be shared by the domain with another domain on the computing device if the current operating context does not conflict with the domain-specific purpose.

7. A method for activating an executable component on a polymorphic computing device, the method comprising, with the polymorphic computing device:

receiving data indicating a current operating context of the polymorphic computing device; and

, in response to the data;

independently of any operating system running on the polymorphic computing device, verifying the integrity of the component;

determining a defined purpose of the component;

determining an anti-purpose corresponding to the defined purpose of the component;

determining if a use of the component in the current operating context is permitted by the purpose;

determining if the current operating context enables the use of the component for the anti-purpose; and

activating the component on the polymorphic computing device only if the use of the component in the current operating context is permitted by the purpose and the current operating context does not enable the use of the component for the anti-purpose.

8. The method of claim 7, comprising receiving natural language input from a user of the polymorphic computing device, determining the purpose based on the natural language user input, and deriving the anti-purpose from the purpose.

9. The method of claim 7, comprising determining if a use of a shared system resource of the polymorphic computing device by the component in the current operating context is permitted by the purpose, determining if the current operating context enables the use of the shared system resource for the anti-purpose, and enabling use of the shared system resource by the component only if the use of the shared system resource by the component in the current operating context is permitted by the purpose and the current operating context does not enable the use of the shared system resource for the anti-purpose.

10. The method of claim 9, comprising disabling the use of the shared system resource by the component if the use of the shared system resource by the component in the current operating context is not permitted by the purpose and the current operating context enables the use of the component for the anti-purpose.

11. The method of claim 7, comprising determining if a sharing of data by the component with another entity in the current operating context is permitted by the purpose, determining if the current operating context permits the sharing of the data by the component for the anti-purpose, and enabling the sharing of the data by the component only if the sharing of the data by the component in the current operating context is permitted by the purpose and the current operating context does not permit the sharing of the data for the anti-purpose.

12. The method of claim 11, comprising preventing the sharing of the data by the component if the sharing of the data by the component in the current operating context is not permitted by the purpose and the current operating context would permit the sharing of the data for the anti-purpose.

13. A polymorphic computing device, comprising:

a processing unit comprising one or more processors;

one or more context detectors in communication with the processing unit to receive data indicating a current operating context of the polymorphic computing device;

shared system resources in communication with the processing unit; and

machine accessible storage media having embodied therein;

a plurality of independently executable domains, each domain having a domain-specific purpose governing use by the domain of the shared system resources, and a plurality of components executable within the domain, each component comprising a component-specific purpose governing the sharing of component resources by the component with other components;

an integrity verification system to verify the integrity of each of the domains and components independently of any operating system running on the polymorphic computing device;

a provisioning system to provision each of the components for use on the polymorphic computing device independently of the provisioning of the other components and according to the component-specific purpose;

a policy arbitration system to determine a global policy for use of the shared system resources by the domains, wherein the global policy is a combination of all of the domain-specific purposes that does not violate any of the domain-specific purposes and the policy arbitration system enforces the global policy during operation of the polymorphic computing device; and

a domain manager to activate and deactivate the domains on the polymorphic computing device in accordance with the global policy;

wherein the processing unit selectively executes the domains, the components, the integrity verification system, the provisioning system, the policy arbitration system, and the domain manager in response to the data indicating a current operating context of the polymorphic computing device.

14. The polymorphic computing device of claim 13, wherein both the domain-specific purpose and the component-specific purpose are defined differently for different operating contexts of the polymorphic computing device.

15. The polymorphic computing device of claim 13, wherein the domain-specific purposes are different for each of the plurality of domains.

16. The polymorphic computing device of claim 13, wherein the component-specific purposes are different for each of the plurality of components.

17. The polymorphic computing device of claim 13, wherein each domain has a domain-specific anti-purpose corresponding to the domain-specific purpose, and the policy arbitration system enforces the global policy to prevent execution of the domain-specific anti-purposes.

18. The polymorphic computing device of claim 13, wherein each component has a component-specific anti-purpose corresponding to the component-specific purpose, and the provisioning system provisions each of the components for use on the polymorphic computing device to prevent execution of the component-specific anti-purpose.

19. The polymorphic computing device of claim 13, wherein the polymorphic computing device is arranged according to a Multiple Independent Levels of Security (MILS) architecture, each of the domains is memory-isolated from each of the other domains, and each of the domains communicates with other domains only through well-defined communication channels.

20. The polymorphic computing device of claim 13, wherein the polymorphic computing device comprises a mobile computing device arranged according to a mobile device virtualization architecture.