Method and System for Protecting Data Flow at a Mobile Device
AssigneeSRI International
InventorPhillip A. Porras
Life of this patent
Estimating the term…
Abstract
A method and system for evaluating and enforcing a data flow policy at a mobile computing device includes a data flow policy engine to evaluate data access requests made by security-wrapped software applications running on the mobile device and prevent the security-wrapped software applications from violating the data flow policy. The data flow policy defines a number of security labels that are associated with data objects. A software application process may be associated with a security label if the process accesses data having the security label or the process is in communication with another process that has accessed data having the security label.
Claims23
A data flow policy evaluation system for a mobile computing device embodied as executable instructions in one or more machine-accessible storage media, comprising:
- a system call monitor to monitor system calls made by a plurality of security-wrapped software applications during execution of the security-wrapped software applications at the mobile computing device;
- and
- a data flow policy engine to generate policy decisions to enable the security-wrapped software applications to prevent the execution of system calls that would violate a data flow policy, wherein the data flow policy defines security labels, associates data flow policies with the security labels, and associates data objects with the security labels, and the data flow policy engine is configured to:
- associate an executing process of a security-wrapped software application with a security label if the process accesses a data object having the security label;
- and
- associate another executing process with the security label if the other executing process is in communication with the executing process.
A system for evaluating data access requests at a mobile computing device, embodied as executable instructions in one or more machine-accessible storage media, comprising:
- a system call monitor to monitor system calls relating to data accesses made by an instance of a security-wrapped software application executing on the mobile computing device;
- and
- a data flow policy engine to:
- associate data access tracking data with the instance of the security-wrapped software application, wherein the data access tracking data relates to data objects accessed by the instance and security labels associated with the data objects, and the security labels indicate conflicts of interest between or among the data objects;
- and
- generate data flow policy decisions based on the data access tracking data, wherein the policy decisions are based on one or more current and one or more previous data accesses made by the instance.
A system for enforcing a data flow policy at a mobile computing device, embodied as executable instructions in one or more machine-accessible storage media, the system comprising:
- a system call monitor to monitor system calls made by an instance of a security-wrapped software application executing on the mobile computing device;
- a data flow policy engine to:
- analyze the system calls using a data flow policy, wherein the data flow policy associates security labels with data objects and the security labels indicate conflicts of interest between or among data objects,
- associate a data object with a security label if the data object is produced by a data source having the security label or if the data object is created by a software application process having the security label, and
- associate the instance with the security label if the instance accesses the data object and the data object is associated with the security label;
- and
- a data flow policy enforcer to prevent the instance from executing a system call that violates the data flow policy.
A data flow policy engine for a mobile computing device, embodied as executable instructions in one or more machine-accessible storage media, the data flow policy engine configured to:
- evaluate system calls made by instances of security-wrapped software applications executing on the mobile computing device;
- associate a security label with an instance of a security-wrapped software application if the instance reads a data object having the security label, writes to a data object having the security label, or connects to a data source having the security label;
- wherein the security label indicates that the data object or data source has a conflict of interest with at least one other data object or data source;
- and
- generate a data flow policy decision usable by the security-wrapped software application to prevent the execution of any system call that would result in a conflict of interest.
The data flow policy engine of 18, wherein the security label is defined as either public or private.
The data flow policy engine of 21, wherein in response to the executing instance of the security-wrapped software application attempting to perform a write operation on a data object having a public security label after reading another data object having a private security label, the data flow policy engine is configured to:
- generate a copy of the data object;
- allow the write operation to be performed on the copy of the data object;
- deny the write operation on the data object;
- and
- associate the copy of the data object with the security label.
The data flow policy engine of 22, wherein the data flow policy engine is configured to:
- associate a data access by another executing instance of the security-wrapped software application with the copy of the data object if the other instance is associated with the security label;
- and
- associate the data access by the other instance with the data object if the other instance is not associated with the security label.
Dependencies are inferred from the claim text.