Systems and methods to enforce security policies on the loading, linking, and execution of native code by mobile applications running inside of virtual machines

• US 9,609,020 B2
• Filed: 04/08/2013
• Issued: 03/28/2017
• Est. Priority Date: 01/06/2012
• Status: Expired due to Fees

• Current Assignee: Optio Labs
• Original Assignee: Optio Labs, Inc.
• Inventors: White, Christopher Jules, Clancy, Thomas Charles III
• Primary Examiner(s): Vostal, O. C.
• Application Number:
  US13/858,929
• Publication Number:
  US 20130227641A1
• Time in Patent Office: 1,450 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods and systems described herein relate to enhancing security on a device by enforcing one or more policies on the loading, linking, and/or executing of native code by one or more applications executing on the device.

Claims

1. A method of enforcing policies associated with the loading, linking and/or execution of native code by an application, the method comprising:

executing an application, through the use of a computer processor, in a first process on a device running inside of a virtual machine, wherein the application includes calls accessing native code;

executing a policy engine, through the use of a computer processor, in a second process on the device;

receiving a request for one or more of loading, linking, or execution of a native code library from the executing application, wherein the request is communicated by the application to the policy engine via a local cross-process communication mechanism, and wherein the request is received after the application has been assembled and begun executing;

determining by the policy engine whether the request from the application is allowed based on a policy;

permitting the requested access by loading, linking, or execution of the native code library upon determining that the application is allowed to access the native library; and

determining, by the virtual machine, whether the request from the application is allowed based on a local policy separate from the policy applied by the policy engine, and permitting the requested access only if both the local policy and policy engine determine that the application is allowed to access the native library.

2. The method of claim 1, wherein the method further comprises facilitating interaction between the application and an operating system via the native code library.

3. The method of claim 1, wherein executing a policy engine comprises executing a policy engine enabled to communicate with a remote policy server to obtain the policy.

4. The method of claim 3, wherein the remote policy server comprises a policy server managing a policy repository comprising at least one policy.

5. The method of claim 1, further comprising taking requests from a plurality of applications.

6. The method of claim 1, wherein the device is one of a mobile phone, a tablet, a laptop, and a smartphone.

7. The method of claim 1, wherein the policy comprises one or more of a black list, a white list, a signature, a name check, a checksum, a library analysis check, a check for permission for an application, a process check, a user check, and a group check.

8. The method of claim 1, wherein the local cross-process communication mechanism comprises one of an inter-process communication mechanism, a Unix domain socket, and a shared memory.

9. The method of claim 1, wherein the application is selected from the group consisting of a game, a utility, a phone application, a web browser, a music player, a tool, and an operating system.

10. A device comprising:

a memory containing program instructions and a native code library;

a processor connected to the memory, wherein the processor is configured to receive program instructions from the memory and wherein the received program instructions configure the processor to;

execute an application in a first process running inside of a virtual machine on the device, wherein the application includes calls accessing native code;

execute a policy engine in a second process on the device;

receive a request for one or more of loading, linking, or execution of the native code library from the executing application, wherein the request is communicated by the application to the policy engine via a local cross-process communication mechanism, and wherein the request is received after the application has been assembled and begun executing;

determine by the policy engine whether the request from the application is allowed based on a policy;

permit the requested access by loading, linking, or execution of the native code library upon determining that the application is allowed to access the native library; and

determine, by the virtual machine, whether the request from the application is allowed based on a local policy separate from the policy applied by the policy engine, and permit the requested access only if both the local policy and policy engine determine that that the application is allowed to access the native library.

11. The device of claim 10, wherein the received program instructions further configure the processor to facilitate interaction between the application and an operating system via the native code library.

12. The device of claim 10, wherein the executed policy engine comprises a policy engine enabled to communicate with a remote policy server to obtain the policy.

13. The device of claim 12, wherein the remote policy server comprises a policy server managing a policy repository comprising at least one policy.

14. The device of claim 10, wherein the received program instructions further configure the processor to take requests from a plurality of applications executing on the device.

15. The device of claim 10, wherein the device is one of a mobile phone, a tablet, a laptop, and a smartphone.

16. The device of claim 10, wherein the policy comprises one or more of a black list, a white list, a signature, a name check, a checksum, a library analysis check, a check for permission for an application, a process check, a user check, and a group check.

17. The device of claim 10, wherein the local cross-process communication mechanism comprises one of an inter-process communication mechanism, a Unix domain socket, and a shared memory.

18. The device of claim 10, wherein the application is selected from the group consisting of a game, a utility, a phone application, a web browser, a music player, a tool, and an operating system.