System and method for controlling access to data of a user device using a security application that provides accessibility services

• US 9,825,977 B2
• Filed: 11/23/2016
• Issued: 11/21/2017
• Est. Priority Date: 12/18/2015
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Demov, Alexey A., Yablokov, Victor V., Filatov, Konstantin M.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/360,353
• Publication Number:
  US 20170180400A1
• Time in Patent Office: 363 Days
• Field of Search: 726 1- 3, 726 27- 30
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/08 Access security

Abstract

Disclosed are systems and methods for controlling access to data of a user device using a security application that provides accessibility services. An exemplary method comprises: executing, on the user device, the security application and one or more user applications; intercepting, by an interception module of the security application using a plurality of accessibility API functions, data accessed by a user application being executed on the user device; determining, by a categorization module of the security application, a category of intercepted data; intercepting, by the interception module using the accessibility API functions, one or more events of user'"'"'s interaction with a user interface of the user application; and determining, by an access control module of the security application, an access control policy that specifies and controls whether to allow a user'"'"'s access to the intercepted data based on the category of intercepted data and types of intercepted events.

Claims

1. A method for controlling access to data of a user device using a security application installed as an accessibility service on the user device, the method comprising:

executing, by a processor of the user device, the security application and one or more user applications;

intercepting, by an interception module of the security application using a plurality of accessibility application program interface (API) functions, data accessed by a user application being executed on the user device;

determining, by a categorization module of the security application, a category of intercepted data;

intercepting, by the interception module using the accessibility API functions, one or more events of user'"'"'s interaction with a user interface of the user application on the user device; and

determining, by an access control module of the security application, an access control policy that specifies and controls whether to allow a user'"'"'s access to the intercepted data based on the category of intercepted data and types of intercepted events.

2. The method of claim 1, further comprising:

obtaining information relating to at least;

user applications to be monitored by the security application, types of events during an execution of the user applications to be monitored by the security application, and access rights of the user applications.

3. The method of claim 1, wherein executing the security application and the one or more user applications comprises:

executing the security application and the one or more user applications in an isolated environment that is created by an operating system of the user device at the time of launching each of the one or more user applications.

4. The method of claim 1, wherein the plurality of accessibility API functions comprise at least one of:

a voice narration function, a screen magnifier function, a data output function to an external device supporting a Braille display.

5. The method of claim 1, wherein determining, by the categorization module of the security application, the category of intercepted data comprises performing at least one of an anti-virus or anti-phishing analysis of the intercepted data, wherein the anti-virus analysis includes at least one of a signature analysis, a heuristic analysis, or a behavior analysis of the intercepted data for presence of malware, and the anti-phishing analysis includes an analysis of active control elements of the user interface of the user application.

6. The method of claim 1, further comprising blocking, by the access control module of the security application, the user'"'"'s access to at least a portion of the intercepted data in response to detecting that the category of intercepted data indicates a harmful category and the types of intercepted events indicate a presence of undesirable information.

7. The method of claim 1, further comprising:

maintaining a log of data entered and displayed by the user application on the user interface of the user device for parental control purposes.

8. A system for controlling access to data of a user device using a security application installed as an accessibility service on the user device, the system comprising:

a hardware processor of the user device configured to;

execute the security application and one or more user applications;

intercept, via an interception module of the security application using a plurality of accessibility application program interface (API) functions, data accessed by a user application being executed on the user device;

determine, via a categorization module of the security application, a category of intercepted data;

intercept, via the interception module using the accessibility API functions, one or more events of user'"'"'s interaction with a user interface of the user application on the user device; and

determine, via an access control module of the security application, an access control policy that specifies and controls whether to allow a user'"'"'s access to the intercepted data based on the category of intercepted data and types of intercepted events.

9. The system of claim 8, wherein the processor is further configured to obtain information relating to at least:

user applications to be monitored by the security application, types of events during an execution of the user applications to be monitored by the security application, and access rights of the user applications.

10. The system of claim 8, wherein, to execute the security application and the one or more user applications, the processor is further configured to execute the security application and the one or more user applications in an isolated environment that is created by an operating system of the user device at the time of launching each of the one or more user applications.

11. The system of claim 8, wherein the plurality of accessibility API functions comprise at least one of:

a voice narration function, a screen magnifier function, a data output function to an external device supporting a Braille display.

12. The system of claim 8, wherein, to determine, via the categorization module of the security application, the category of intercepted data, the processor is further configured to perform at least one of an anti-virus or anti-phishing analysis of the intercepted data, wherein the anti-virus analysis includes at least one of a signature analysis, a heuristic analysis, or a behavior analysis of the intercepted data for presence of malware, and the anti-phishing analysis includes an analysis of active control elements of the user interface of the user application.

13. The system of claim 8, wherein the processor is further configured to block, via the access control module of the security application, the user'"'"'s access to at least a portion of the intercepted data in response to detecting that the category of intercepted data indicates a harmful category and the types of intercepted events indicate a presence of undesirable information.

14. The system of claim 8, wherein the processor is further configured to maintain a log of data entered and displayed by the user application on the user interface of the user device for parental control purposes.

15. A non-transitory computer readable medium storing computer executable instructions for controlling access to data of a user device using a security application installed as an accessibility service on the user device, including instructions for:

executing, by a processor of the user device, the security application and one or more user applications;

intercepting, by an interception module of the security application using a plurality of accessibility application program interface (API) functions, data accessed by a user application being executed on the user device;

determining, by a categorization module of the security application, a category of intercepted data;

intercepting, by the interception module using the accessibility API functions, one or more events of user'"'"'s interaction with a user interface of the user application on the user device; and

determining, by an access control module of the security application, an access control policy that specifies and controls whether to allow a user'"'"'s access to the intercepted data based on the category of intercepted data and types of intercepted events.

16. The non-transitory computer readable medium of claim 15, further comprising instructions for obtaining information relating to at least:

user applications to be monitored by the security application, types of events during an execution of the user applications to be monitored by the security application, and access rights of the user applications.

17. The non-transitory computer readable medium of claim 15, wherein the instructions for executing the security application and the one or more user applications comprise instructions for executing the security application and the one or more user applications in an isolated environment that is created by an operating system of the user device at the time of launching each of the one or more user applications.

18. The non-transitory computer readable medium of claim 15, wherein the plurality of accessibility API functions comprise at least one of:

a voice narration function, a screen magnifier function, a data output function to an external device supporting a Braille display.

19. The non-transitory computer readable medium of claim 15, further comprising instructions for blocking, by the access control module of the security application, the user'"'"'s access to at least a portion of the intercepted data in response to detecting that the category of intercepted data indicates a harmful category and the types of intercepted events indicate a presence of undesirable information.

20. The non-transitory computer readable medium of claim 15, further comprising instructions for maintaining a log of data entered and displayed by the user application on the user interface of the user device for parental control purposes.