# US 2018/0025180 A1 · External resource control of mobile devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025180 A1
- Document ID: US20180025180A1
- Status: Published application
- Kind: A1
- Application number: 15/547,402
- Filed: 2016-02-02
- Published: 2018-01-25
- Earliest claimed: 2015-02-02
- Assignees: The Board of Trustees of the University of Illinoi
- Applicants: Indiana University Research and Technology Corporation; The Board of TRustees of the University of Illinoi
- Inventors: XiaoFeng Wang; Kan Yuan; Xiaoyong Zhou; Muhammad Naveed; Soteris Demetriou; Carl Gunter
- Web page: https://patentgrep.com/patent/US20180025180A1

## CPC

- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present disclosure provides a security enhanced channel control system useable on a wireless device comprising a policy module including at least one processor and memory, the policy module configured to store, in the memory, one or more security policies and apply a compliance check to a first system layer and a second system layer; and a first policy base stored in the memory of the policy module, the first policy base being associated with a mandatory access control (“MAC”) base and defining one more security polices for access to a plurality of channels associated with the first and second system layers. The policy module cooperates with the first policy base to establish one or more access control rules that are applied to at least one of the plurality of channels to preclude an unauthorized application from accessing at least one of the channels.

## Claims

### Claim 1

A security enhanced channel control system useable on a wireless device comprising:
a policy module including at least one processor and memory, the policy module configured to store, in the memory, one or more security policies and apply a compliance check to a first system layer and a second system layer; and
a first policy base stored in the memory of the policy module, the first policy base being associated with a mandatory access control (“MAC”) base and defining one more security polices for access to a plurality of channels associated with the first and second system layers;
wherein the policy module cooperates with the first policy base to establish one or more access control rules that are applied to at least one of the plurality of channels to preclude an unauthorized application from accessing at least one of the channels.

### Claim 2 (depends on 1)

The system of claim 1, further including a second policy base stored in the memory of the policy module, the second policy base being associated with a discretionary access control (“DAC”) base and adaptable to include one or more user defined security policies corresponding to channel access permissions of one or more resource channels.

### Claim 3 (depends on 2)

The system of claim 2, wherein the policy module cooperates with at least one of the first policy base and the second policy base to establish one or more access control rules that are applied to at least one of the plurality of channels to preclude the unauthorized application from accessing at least one of the channels.

### Claim 4 (depends on 1)

The system of claim 1, further including a policy engine disposed in the policy module, the policy engine being supported by at least one vector cache, wherein the policy engine operates the MAC base and the DAC base and causes the policy module to perform the compliance check.

### Claim 5 (depends on 4)

The system of claim 4, wherein the first system layer is a framework layer and the second system layer is a Linux kernel layer, and wherein the plurality of channels include at least one of a message channel, a Bluetooth channel, an audio channel, an internet channel, a Near Field Communication (“NFC”) channel, a wireless channel, and an infrared channel.

### Claim 6 (depends on 5)

The system of claim 5, wherein one or more security types represent a resource based upon a resource identity observed from a channel, wherein the resource identity includes a Media Access Control (“MAC”) address of a Bluetooth accessory, a serial number of an Near Field Communication (“NFC”) device, an Internet Protocol (“IP”) address of a socket, and a message ID of an Short Message Service (“SMS”) sender.

### Claim 7 (depends on 6)

The system of claim 6, further including an enforcement module communicably coupled to the policy module, the enforcement module including one or more security hooks and at least one mapping table, wherein the security hooks are disposed within system functions responsible for operations on one or more channels over the first system layer and a second system layer.

### Claim 8 (depends on 7)

The system of claim 7, wherein the security hooks identify a security context of an application and a resource identity from a channel by querying the at least one mapping table and wherein the identified security context is used to query at least one of the policy engine and the vector cache to determine, based on the query, whether an application can access the channel.

### Claim 9 (depends on 1)

The system of claim 1, wherein the system detects a coupling of an external resource to the wireless device and, in response to detecting the coupling, associates the external resource to at least one of a security context and one or more applications assigned to a domain, and wherein the system instructs a user to select at least one application that is allowed to access the external resource.

### Claim 10

A security enhanced channel control system comprising:
a policy module including at least one processor and memory, the policy module configured to store, in the memory, a first policy base for a mandatory access control (“MAC”) base and a second policy base for a discretionary access control (“DAC”) base;
a policy engine disposed in the policy module, the policy engine being supported by a first vector cache of a first system layer and a second vector cache of a second system layer, wherein the policy engine operates the MAC base and the DAC base and causes the policy module to perform a compliance check at least in response to a channel access request from an application; and
an enforcement module communicably coupled to the policy module, the enforcement module including one or more security hooks and at least one mapping table, wherein the enforcement module queries at least one of the mapping table, the first vector cache, the second vector cache, and the policy engine to determine whether the application can be given access to one or more communication channels of a wireless device.

### Claim 11 (depends on 10)

The system of claim 10, wherein the first policy base contains a security context for at least one communication channel associated with the MAC base and the second policy base contains a security context for at least one communication channel associated with the DAC base.

### Claim 12 (depends on 11)

The system of claim 11, wherein the policy module cooperates with at least one of the first policy base and the second policy base to establish one or more access control rules that are applied to at least one of the communication channels to preclude an unauthorized application from accessing at least one of the channels.

### Claim 13 (depends on 11)

The system of claim 11, wherein the one or more security hooks sanitize a cursor returned to the application based on at least one of a security context and a message address, and wherein sanitizing includes removing a message the application does not have permission to read.

### Claim 14 (depends on 11)

The system of claim 11, wherein the one or more security hooks monitor an audio communication channel and identify an audio device type in response to an audio device connecting to an audio jack of the wireless device.

### Claim 15 (depends on 14)

The system of claim 14, wherein the one or more security hooks identify a security policy that controls access to the audio device and causes a channel control function of the wireless device to assign an object type in the security policy to the audio channel, wherein assignment of the object type precludes use of the audio channel by an unauthorized application.

### Claim 16 (depends on 13)

The system of claim 13, further including a message content provider accessible by the policy module and adapted to perform a compliance check in response to an application attempting to read message content residing within a message content provider database.

### Claim 17 (depends on 10)

The system of claim 10, wherein the system detects a coupling of an external resource to the wireless device and, in response to detecting the coupling, associates the external resource to at least one of a security context and one or more applications assigned to a domain, and wherein the system instructs a user to select at least one application that is allowed to access the external resource.

### Claim 18

A method for controlling access to one or more communication channels of a wireless device, comprising:
establishing, by a policy module, a first policy base containing a security context for at least one communication channel associated with a mandatory access control (“MAC”) base;
establishing, by the policy module, a second policy base containing a security context for at least one communication channel associated with a discretionary access control (“DAC”) base;
defining one more security polices for access to one or more communication channels associated with at least one of a first system layer and a second system layer based on the first policy base and the second policy base;
performing a compliance check at least in response to a communication channel access request from an application, the compliance check being applied to at least one of the MAC base, the DAC base, and the first and second system layers; and
in response to performing the compliance check, querying, by an enforcement module, at least one of a mapping table and a policy engine to determine whether the application can be given access to the one or more communication channels of the wireless computing device.

### Claim 19 (depends on 18)

The method of claim 18, wherein the policy engine is supported by a first vector cache of the first system layer and a second vector cache of the second system layer, and the policy engine operates the MAC base and the DAC base and causes the policy module to perform the compliance check.

### Claim 20 (depends on 18)

The method of claim 18, further including, establishing, by a user of the wireless computing device, one or more user defined security policies associated with the DAC base, the user defined security policies indicating the one or more communication channels the application is permitted to access.

### Claim 21 (depends on 18)

The method of claim 18, wherein the second policy base associated with the DAC base is adaptable to include one or more user defined security policies corresponding to channel access permissions of one or more resource channels.

### Claim 22

A method for controlling access to external resources of a portable communication device, comprising:
integrating enforcement mechanisms of a Discretionary Access Control (“DAC”) and a Mandatory Access Control (“MAC”) in the device;
specifying policies on at least one external resource;
hosting a DAC policy base; and
managing the policies and the DAC policy base using a policy engine and Access Vector Cache that support policy checks within security hooks associated with different channels.