External resource control of mobile devices

A security enhanced channel control system comprising:

• a policy module including at least one processor and memory, the policy module configured to store, in the memory, a first policy base for a mandatory access control (“MAC”) base and a second policy base for a discretionary access control (“DAC”) base;
• a policy engine disposed in the policy module, the policy engine being supported by a first vector cache of a first system layer and a second vector cache of a second system layer, wherein the policy engine operates the MAC base and the DAC base and causes the policy module to perform a compliance check at least in response to a channel access request from an application;
• and
• an enforcement module communicably coupled to the policy module, the enforcement module including one or more security hooks and at least one mapping table, wherein the enforcement module queries at least one of the mapping table, the first vector cache, the second vector cache, and the policy engine to determine whether the application can be given access to one or more communication channels of a wireless device.

A method for controlling access to one or more communication channels of a wireless device, comprising:

• establishing, by a policy module, a first policy base containing a security context for at least one communication channel associated with a mandatory access control (“MAC”) base;
• establishing, by the policy module, a second policy base containing a security context for at least one communication channel associated with a discretionary access control (“DAC”) base;
• defining one more security polices for access to one or more communication channels associated with at least one of a first system layer and a second system layer based on the first policy base and the second policy base;
• performing a compliance check at least in response to a communication channel access request from an application, the compliance check being applied to at least one of the MAC base, the DAC base, and the first and second system layers;
• and
• in response to performing the compliance check, querying, by an enforcement module, at least one of a mapping table and a policy engine to determine whether the application can be given access to the one or more communication channels of the wireless computing device.

A method for controlling access to external resources of a portable communication device, comprising:

• integrating enforcement mechanisms of a Discretionary Access Control (“DAC”) and a Mandatory Access Control (“MAC”) in the device;
• specifying policies on at least one external resource;
• hosting a DAC policy base;
• and
• managing the policies and the DAC policy base using a policy engine and Access Vector Cache that support policy checks within security hooks associated with different channels.