HARDWARE INTERFACE ACCESS CONTROL FOR MOBILE APPLICATIONS

• US 20130055347A1
• Filed: 08/31/2011
• Published: 02/28/2013
• Est. Priority Date: 08/31/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chawla, Deepak, Muller, Urs A.
• Granted Patent: US 8,918,841 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Methods, articles of manufacture, and apparatus for hardware interface access control for mobile applications are disclosed. A disclosed example method includes restricting an application from accessing a set of hardware interfaces of a mobile device, and providing a virtual interface to the application via which the application is to access a first hardware interface in the set of hardware interfaces, the virtual interface provided by a program in a kernel layer of an operating system of the mobile device to control at least one of access or a method of access to the first hardware interface in the set of hardware interfaces, the first hardware interface that is accessible via the virtual interface being unknown to the application.

Claims

1. A method comprising:

restricting an application from accessing a set of hardware interfaces of a mobile device; and

providing a virtual interface to the application via which the application is to access a first hardware interface in the set of hardware interfaces, the virtual interface provided by a program in a kernel layer of an operating system of the mobile device to control at least one of access or a method of access to the first hardware interface in the set of hardware interfaces, the first hardware interface that is accessible via the virtual interface being unknown to the application.

2. A method as defined in claim 1 wherein the application executes in at least one of an application layer of the operating system different from the kernel layer of the operating system or in a network accessible by the mobile device, and the program executes persistently in a background process.

3. A method as defined in claim 1 further comprising:

providing the virtual interface to the application if the application is permitted to access at least one of the hardware interfaces, the first hardware interface that is accessible via the virtual interface being one of the at least one of the hardware interfaces the application is permitted to access; and

not providing the virtual interface to the application if the application is not permitted to access any of the set of hardware interfaces.

4. A method as defined in claim 1 further comprising:

restricting a second application from accessing the set of hardware interfaces; and

providing the virtual interface to the second application via which the second application is to access a second hardware interface in the set of hardware interfaces, the second hardware interface that is accessible via the virtual interface being unknown to the second application, the second hardware interface being different from the first hardware interface.

5. A method as defined in claim 1 wherein the set of hardware interfaces comprises a set of network interfaces, the program corresponds to a virtual private network client, and the virtual interface corresponds to an endpoint of a virtual private network tunnel automatically established by the virtual private network client in response to detecting a query by the application for available network interfaces for establishing a network connection.

6. A method as defined in claim 1 wherein the set of hardware interfaces comprises a set of memory interfaces, and the virtual interface provides access to a first memory interface to store data in a first storage device of a set of storage devices associated respectively with the set of memory interfaces.

7. A method as defined in claim 6 wherein the program is to encrypt data written to the virtual interface by the application prior to providing the data to the first memory interface for storage in the first storage device, and the program is to decrypt data read from the first storage device via the particular memory interface prior to providing the data from the first storage device to the virtual interface.

8. A tangible article of manufacture storing machine readable instructions that, when executed, cause a machine to at least:

restrict an application from accessing a set of hardware interfaces of a mobile device; and

provide a virtual interface to the application via which the application is to access a first hardware interface in the set of hardware interfaces, the virtual interface provided by a program in a kernel layer of an operating system of the mobile device to control at least one of access or a method of access to the first hardware interface in the set of hardware interface, the first hardware interface that is accessible via the virtual interface being unknown to the application.

9. A tangible article of manufacture as defined in claim 8 wherein the application is to execute in at least one of an application layer of the operating system different from the kernel layer of the operating system or in a network accessible by the mobile device, and the program is to execute persistently in a background process.

10. A tangible article of manufacture as defined in claim 8 wherein the machine readable instructions, when executed, further cause the machine to:

provide the virtual interface to the application if the application is permitted to access at least one of the hardware interfaces, the first hardware interface that is accessible via the virtual interface being one of the at least one of the hardware interfaces the application is permitted to access; and

not provide the virtual interface to the application if the application is not permitted to access any of the set of hardware interfaces.

11. A tangible article of manufacture as defined in claim 8 wherein the machine readable instructions, when executed, further cause the machine to:

restrict a second application from accessing the set of hardware interfaces; and

provide the virtual interface to the second application via which the second application is to access a second hardware interface in the set of hardware interfaces, the second hardware interface that is accessible via the virtual interface being unknown to the second application, the second hardware interface being different from the first hardware interface.

12. A tangible article of manufacture as defined in claim 8 wherein the set of hardware interfaces comprises a set of network interfaces, the program corresponds to a virtual private network client, and the virtual interface corresponds to an endpoint of a virtual private network tunnel automatically established by the virtual private network client in response to detecting a query by the application for available network interfaces for establishing a network connection.

13. A tangible article of manufacture as defined in claim 8 wherein the set of hardware interfaces comprises a set of memory interfaces, and the virtual interface provides access to a first memory interface to store data in a first storage device of a set of storage devices associated respectively with the set of memory interfaces.

14. A tangible article of manufacture as defined in claim 13 wherein the program is to encrypt data written to the virtual interface by the application prior to providing the data to the first memory interface for storage in the first storage device, and the program is to decrypt data read from the first storage device via the particular memory interface prior to providing the data from the first storage device to the virtual interface.

15. A mobile device comprising:

a set of hardware interfaces;

a policy engine to determine whether an application is authorized to access one or more of the set of hardware interfaces; and

a hardware access engine to;

restrict the application from accessing the set of hardware interfaces; and

provide a virtual interface to the application via which the application is to access a first hardware interface in the set of hardware interfaces, the virtual interface to be provided by a program integrated in a kernel layer of an operating system of the mobile device and that is to control at least one of access or a method of access to the first hardware interface in the set of hardware interface, the first hardware interface being unknown to the application, but being one of the one or more hardware interfaces the application is permitted to access.

16. A mobile device as defined in claim 15 wherein the application is to execute in at least one of an application layer of the operating system different from the kernel layer of the operating system or in a network accessible by the mobile device, and the program executes persistently in a background process.

17. A mobile device as defined in claim 15 wherein the policy engine is to process a digital certificate to determine whether the application is authorized to access one or more of the set of hardware interfaces.

18. A mobile device as defined in claim 15 wherein the set of hardware interfaces comprises a set of network interfaces, the program corresponds to a virtual private network client, and the virtual interface corresponds to an endpoint of a virtual private network tunnel established by the virtual private network client in response to detecting a query by the application for available network interfaces for establishing a network connection.

19. A mobile device as defined in claim 15 wherein the set of hardware interfaces comprises a set of memory interfaces, and the virtual interface provides access to a first memory interface to store data in a first storage device of a set of storage devices.

20. A mobile device as defined in claim 19 wherein the program is to encrypt data written to the virtual interface by the application prior to providing the data to the first memory interface, and the program is to decrypt data read from the first storage device via the first memory interface prior to providing the data to the virtual interface.