Systems and methods for enforcing access control policies on privileged accesses for mobile devices

• US 9,787,681 B2
• Filed: 06/04/2013
• Issued: 10/10/2017
• Est. Priority Date: 01/06/2012
• Status: Expired due to Fees

• Current Assignee: Optio Labs
• Original Assignee: Optio Labs, Inc.
• Inventors: Clancy, III, Thomas Charles, White, Christopher Jules
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/909,366
• Publication Number:
  US 20130268997A1
• Time in Patent Office: 1,589 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Methods and systems described herein relate to enhancing security on a device by enforcing security and access control policies on privileged code execution.

Claims

1. A method of enforcing access control policies on privileged access of a mobile device, the method comprising:

taking a request made to service executing in user space of a computer processor by at least one application executing on the computer processor for permission to execute privileged code;

directing the request to a system service that governs access control for execution of the privileged code via an inter-process communications controller;

determining by the system service whether the application is permitted to execute the privileged code based upon one or more of an identity of the application, an identity of a user of the mobile device, a time of day, a location of the mobile device, or a configuration of the mobile device; and

permitting execution of the privileged code upon determining that the application is permitted to execute the privileged code.

2. The method of claim 1, wherein the mobile device is one of a mobile phone, a tablet, a laptop, and a smartphone.

3. The method of claim 1, wherein the inter-process communications controller communicates over an inter-process communications bus.

4. The method of claim 1, wherein the method further comprises returning the determination to a system controller via an inter-process communications mechanism.

5. The method of claim 1, wherein the method further comprises logging one or more of the determination, information regarding the application request, conditions used in making the determination, and a resulting action.

6. The method of claim 1, wherein the processor resides on a mobile phone and is adapted to function whether or not the phone is in a jailbroken state.

7. A system for enforcing access control policies on privileged access of a mobile device, comprising:

an inter-process communication bus;

at least one inter-process communication controller to control execution of privileged code by an application, the inter-process communication controller in communication with the inter-process communication bus and the application, wherein the application is adapted to request permission, from the inter-process communication controller, to execute privileged code; and

at least one hardware processor adapted to provide a system service, wherein the system service is enabled to determine whether the privileged code may be executed based at least in part on one or more of an identity of the application, an identity of a user of the mobile device, a time of day, a location of the mobile device, or a configuration of the mobile device; and

a second inter-process communication controller enabled to communicate with an inter-process communication bus and the system service.

8. The system of claim 7, wherein the mobile device is one of a mobile phone, a tablet, a laptop, and a smartphone.

9. The system of claim 7, wherein the application is selected from the group consisting of a game, a utility, a phone application, a web browser, a music player, a tool, and an operating system.

10. The system of claim 7, further comprising an inter-process communications firewall to enforce one or more rules governing communication with the application.

11. The system of claim 10, wherein the inter-process communications firewall is an object-oriented firewall.

12. The system of claim 7, wherein the first inter-process communications controller is adapted to communicate with one or more inter-process communications firewalls.

13. The system of claim 7, wherein the at least one hardware processor is adapted to provide a plurality of inter-process communications firewalls on the mobile device.