Safe and efficient access control mechanisms for computing environments

A method for protecting accessible resources of a mobile device having a limited number of concurrently running processes, wherein said method comprises:

• determining, using a trusted platform module, whether an access monitoring component is safe before allowing said access monitoring component to be initiated on said mobile device, wherein said determining of whether said access monitoring component is safe comprises:
• verifying integrity of computer program code for said access monitoring component to effectively verify it as a trusted component;
• and
• initiating said access monitoring component as a trusted access monitoring component only when said verifying verifies said integrity of said computer program code for said access monitoring component wherein said trusted access monitoring component
• is operable to protect accessible resources of said device by effectively allowing access to said accessible resources to be granted or denied;
• identify one or more executable components that may be executed on said mobile device;
• identify one or more accessible resources that said one or more executable components may respectively try to access;
• determine whether said one or more executable components and/or accessible resources are safe to effectively assess their safety;
• pre-process based on said assessed safety of said one or more executable components and/or accessible resources, one or more access permissions that effectively indicate whether said one or more executable components are allowed or not allowed to access said one or more accessible resources;
• and
• store said one access permissions in kernel space for use by said trusted access monitoring component.

A method for providing access to accessible resources of a mobile device having a limited number of concurrently running processes, said method comprising:

• identifying one or more applications that may be executed on said mobile device;
• indentifying one or more accessible resources of said device that said one or more applications may attempt to access when executing on said mobile device
• pre-processing based on one or more trust levels of one or more applications and/or accessible resources, one or more access permissions that effectively indicate whether said one or more applications are allowed or not allowed to access said one or more accessible resources of said mobile device;
• and
• storing said one or more pre-determined access permissions as one or more stored access permissions in a secure storage in kernel space that is not accessible to said one or more applications but accessible to a trusted reference monitor operable to effectively allow or deny access to said one or more applications based on said one or more pre-determined access permissions, thereby allowing said trusted reference monitor to control access to accessible resources of said device based on said one or more stored access permissions.

A method for controlling access to one or more accessible components of a computing environment in a mobile device having a limited number of concurrently running processes, wherein said method comprises:

• determining one or more accessible components that a first component may attempt to access, wherein said first component may attempt to access said one or more accessible components when said first component is operational on at the mobile device;
• pre-processing one or more access permissions for said one or more accessible components, wherein said one or more access permissions effectively indicate whether said first component is allowed or not allowed to access said one or more accessible components;
• and
• securely storing said one or more access permissions in kernel space as first one or more pre-determined stored access permissions in a manner that said first one or more access stored permissions can be obtained if said first component attempts to access said one or more accessible components, thereby allowing access to said one or more accessible components to be controlled based on said stored one or more access permissions.

A non-transitory computer readable medium including computer program code for controlling access to one or more components accessible components of a mobile device computing environment having a limited number of concurrently running processes, wherein said computer program code includes:

• computer program code for determining one or more accessible components of said computing environment that a first component may attempt to access, wherein said first component may attempt to access said one or more accessible components when said first component is operational on at least a first device;
• computer program code for preprocessing one or more access permissions for said one or more accessible components, wherein said one or more access permissions effectively indicate whether said first component is allowed or not allowed to access said one or more accessible components;
• and
• computer program code for storing said one or more access permissions in kernel space as first one or more stored access permissions in a manner that said first one or more access stored permissions can be obtained if said first component attempts to access said one or more accessible components, thereby allowing access to said one or more accessible components to be controlled based on said stored one or more access permissions.

A mobile device having a limited number of concurrently running processes, the mobile device having a secure and trusted operation computing environment including Mandatory Access Control (MAC) capabilities, the mobile device comprising:

• an access monitoring system and an access storage, wherein said access monitoring system is operable to:
• determine one or more accessible components of said computing system that a first component may attempt to access;
• pre-process one or more access permissions for said one or more accessible components, wherein said one or more access permissions have levels of trust that effectively indicate whether said first component is allowed or not allowed to access said one or more accessible components;
• and
• securely store said one or more access permissions in said access storage in kernel space as first one or more pre-determined stored access permissions in a manner that said first one or more access stored access permissions can be obtained if said first component attempts to access said one or more accessible components.