Polymorphic virtual appliance rule set

• US 9,495,560 B2
• Filed: 10/11/2013
• Issued: 11/15/2016
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Saidi, Hassen, Oberg, Scott A., Lockett, Christopher S., Forsberg, Sean M., Casper, Jeffrey E.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): DE JESUS LASSAIA, CARLOS MANUEL
• Application Number:
  US14/052,169
• Publication Number:
  US 20140380406A1
• Time in Patent Office: 1,131 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A domain manager system as disclosed herein can control the selective activation of multiple independently-operable execution environments or domains on a computing device in accordance with one or more policies. In some embodiments, activation of a domain may at least temporarily transform a general purpose computing device into a specific purpose computing device or “appliance” by disabling use of one or more shared system resources by other domains.

Claims

1. A method for temporarily transforming a general purpose computing device into a specific-purpose appliance, the method comprising, with the computing device:

detecting an event on the computing device, and in response to the event;

identifying a shared system resource of the computing device to which a specific-purpose appliance application needs exclusive access while the specific-purpose appliance application is activated on the computing device, the shared system resource comprising hardware coupled to the computing device;

enabling the identified shared system resource for use by the specific-purpose appliance application;

disabling use of the identified shared system resource by other executable components on the computing device;

activating the specific-purpose appliance application if the identified shared system resource is enabled for use by the specific-purpose appliance application and the identified shared system resource is disabled for the other executable components; and

deactivating at least one of the other executable components in response to determining that the at least one of the other executable components is in conflict with the specific-purpose appliance application,

wherein the conflict is based on the at least one of the other executable components requiring exclusive access to the shared system resource.

2. The method of claim 1, comprising determining if the identified shared system resource can be disabled for one of the executable components pursuant to a policy of the executable component, and if the identified shared resource cannot be disabled for the executable component, activating the specific-purpose appliance application.

3. The method of claim 2, comprising receiving user input, and in response to the user input, enabling use of the identified shared system resource by the component.

4. The method of claim 1, comprising determining if the identified shared system source can be disabled for one of the executable components pursuant to a policy of the component, and presenting a notification with the computing device if the identified shared system resource cannot be disabled for the component pursuant to the policy of the component.

5. The method of claim 1, comprising changing a visual display of the computing device to indicate that the specific-purpose appliance application is activated.

6. The method of claim 5, comprising changing a color of the visual display to a different color to indicate that the specific-purpose appliance application is activated.

7. The method of claim 1, comprising detecting a subsequent event with the computing device, and deactivating the specific-purpose appliance application in response to the subsequent event.

8. The method of claim 1, comprising detecting a condition relating to the current operating context of the computing device, and deactivating the specific-purpose appliance application in response to the detected condition.

9. A domain manager system for a computing device comprising a plurality of isolated, independently executable domains, the domain manager system comprising a plurality of instructions embodied in one or more computer accessible storage media and executable by one or more processors to:

detect an event with the computing device, and in response to the event;

identify a shared system resource of the computing device to which a specific-purpose domain needs exclusive access while the specific-purpose domain is activated on the computing device, the shared system resource comprising hardware coupled to the computing device;

enable the identified shared system resource for use by the specific-purpose domain;

disable use of the identified shared system resource by the other domains;

activate the specific-purpose domain if the identified shared system resource is enabled for the specific-purpose domain and the identified shared system resource is disabled for the other domains; and

deactivate at least one of the other domains in response to a determination that the at least one of the other domains is in conflict with the specific-purpose domain,

wherein the conflict is based on at least one of the other domains requiring exclusive access to the shared system resource.

10. The domain manager system of claim 9, wherein the instructions are executable to, for each of the plurality of domains, determine if the identified shared system resource can be disabled pursuant to a policy of the domain, and if the identified shared system resource cannot be disabled for one or more of the domains, deactivate the specific-purpose domain.

11. The domain manager system of claim 9, wherein the instructions are executable to receive user input, and in response to the user input, activate the specific-purpose domain and enable use of the identified shared system resource by the specific-purpose domain.

12. The domain manager system of claim 9, wherein the instructions are executable to, for each of the plurality of domains, determine if the identified shared system resource can be disabled pursuant to a policy of the domain, and present a notification with the computing device if the identified shared resource cannot be disabled for the domain.

13. The domain manager system of claim 9, wherein the domain manager system is embodied as one or more extensions to an Application Programming Interface (API).

14. The domain manager system of claim 9, wherein the domain manager system is embodied as a trusted component of a mobile computing device having a virtualized system architecture.

15. A computing device arranged according to a Multiple Independent Levels of Security (MILS) architecture and comprising the domain manager system of claim 9.

16. A mobile computing device, comprising:

one or more processors; and

one or more machine accessible storage media having embodied therein a domain manager system, a mobile appliance application, and one or more other executable components, wherein the domain manager is executable by the one or more processors to;

identify a shared system resource of the mobile computing device to which the mobile appliance application needs exclusive access while the mobile appliance application is activated, the shared system resource comprising hardware coupled to the mobile computing device;

enable the identified shared system resource for use by the mobile appliance application;

disable use of the identified shared system resource by the one or more other executable components;

activate the mobile appliance application if the identified shared system resource is enabled for use by the mobile appliance application and the identified shared system resource is disabled for the one or more other executable components; and

deactivate at least one of the other executable components in response to determining that the at least one of the other executable components is in conflict with the specific-purpose appliance application,

wherein the conflict is based on the at least one of the other executable components requiring exclusive access to the shared system resource.

17. The mobile computing device of claim 16, wherein the domain manager identifies the shared system resource to which the mobile appliance application needs exclusive access in response to a trigger to activate the mobile appliance application.

18. The mobile computing device of claim 17, wherein the mobile computing device comprises a control operable to authenticate a user and receive a user request to activate the mobile appliance application, and the domain manager invokes the mobile appliance application in response to the user request.

19. The mobile computing device of claim 18, wherein the control comprises user-operable hardware coupled to the mobile computing device.

20. The mobile computing device of claim 19, wherein the user-operable hardware comprises a rotating member.

21. The mobile computing device of claim 16, wherein the mobile computing device comprises a detector operable to detect an aspect of a current operating context of the computing device, and the domain manager is invoked in response to the detected aspect of the current operating context of the computing device.

22. The mobile computing device of claim 16, wherein the mobile computing device comprises a general purpose mobile device that can execute a plurality of applications each using the identified shared system resource, and wherein activation of the mobile appliance application at least temporarily transforms the general purpose mobile device into a specific-purpose mobile appliance operable to allow the mobile appliance application access to the identified shared system resource and disable access to the identified shared system resource to the plurality of applications while the mobile appliance application is running.

23. The mobile computing device of claim 22, wherein the mobile appliance application comprises a health care application, a medical device application, a financial application, an entertainment application, an automotive application, or a business-specific application.