The application relates to data protection in mobile device, and more particularly to protecting data using one or more isolated environments.
In recent years, intelligent terminals, including mobile computing or communication devices, have become an indispensable personal item. People store their personal data such as contacts, messages or photos in mobile devices for easy access. Therefore, the security of mobile devices has become a personal privacy issue.
Unfortunately, the storage environment on a mobile device is not protected because the operating platform is usually open to third-party developers. Mobile device users can install many applications (Apps) from App markets. Some of these Apps may be malicious and are configured to steal user's personal data. In a non-protected environment, stored data can be controlled by any or other Apps and can be accessed via Inter-Process Communication (IPC). However, blocking all access by other Apps is not practical on an open platform. Accordingly, mobile device users are in need of security techniques to protect their privacy and data in mobile devices.
Data on intelligent terminals can be classified according to privacy. For example, contact information stored in address book and relating to famous persons or public figures is considered sensitive, whereas an e-mail of advertisement nature is non-sensitive. Typically, mobile device users may not take issue with leakage of non-sensitive data. However, leakage of sensitive data could result in dire consequences and is therefore unacceptable to users.
In US Patent Application Publication No. US 2014/0006347 A1, a system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and protected enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a protected container for locally storing enterprise data, creating a protected execution environment for running enterprise applications, and/or creating protected application tunnels for communicating with the enterprise system.
International Publication No. WO 2014/067222 A1 discloses a system for isolating mobile data. The system comprises a tag control management module and a mobile data management module. The tag control management module comprises a tag generator, tag storage management and tag transmission control. The mobile data management module mainly identifies the user permission and a data privacy level according to a tag and performs operational control on a mobile application of the mobile data, so as to achieve maintained security protection on the fine-grained mobile data. The mobile data management module is divided into security isolation control during data processing, security control during data transmission and security isolation control during data storage. Also disclosed at the same time is a method for isolating mobile data. The present application can effectively isolate the data of a mobile intelligent terminal, perform operational control on the fine-grained data, achieve different privacy policies, and guarantee the maintained security of mobile data.
In Chinese Patent Application Publication No. CN103313238, the application discloses a safety system for a mobile terminal. The safety system comprises a user data isolation module; the user data isolation module comprises a user authority management module and a data protection module and is used for protecting privacy data of a user; the user can enter standby interfaces corresponding to different authority passwords by the aid of the user authority management module; the data protection module is arranged between application and a database interface and is used for managing user data access authority of application programs. The application further discloses a safety protection method for the mobile terminal. The safety system and the safety protection method have the advantages that the real data can be protected by the system for the mobile terminal, personal information of the mobile terminal is prevented from being revealed or stolen, and the privacy information of the user can be effectively protected.
Embodiments of the application provide a mobile device architecture having non-protected environment and one or more protected containers for isolating application programs and application data according to their sensitivity or privacy levels. Access policy and exception policy are defined for each protected container to limit access to application program and data associated with or stored in the protected container(s). A communication monitor module is provided to implement the access and exception policy, and manage communication in the mobile device, including intra-container communication, inter-container communication and communication to and from the non-protected environment.
According to a first embodiment, a mobile device comprises a computer-readable storage and a processor communicably coupled to the processor, the computer-readable storage including:
In this first embodiment, the first access policy may further include the non-protected application data is accessible to any of the first plurality of protected application programs and the non-protected application program.
In this first embodiment, the first protected container may further include: a first authentication module configured to verify receipt of an authorized first passcode associated with the first plurality of protected programs, and a first cryptography module configured to render the first protected application data in encrypted form if the authorized first password is not received, and in decrypted form if the authorized first password is received.
According to a second embodiment of the application, in addition to the aforementioned described in the first embodiment, the computer-readable storage further includes:
In this second embodiment, the second access policy may further include the second protected application data is inaccessible to the first protected application program unless both the first exception policy and the second exception policy are complied with, wherein the first access policy further includes the first protected application data is inaccessible to the second protected application program unless both the first exception policy and the second exception policy are complied with.
According to a third embodiment of the application, in addition to the aforementioned described in the first embodiment, the computer-readable storage further includes:
In this third embodiment, the second access policy further includes the second protected application data is inaccessible to the first plurality of protected application programs unless both the first exception policy and the second exception policy are complied with.
Embodiments of the application are disclosed hereinafter with reference to the drawings, in which:
In the following description, numerous specific details are set forth in order to provide a thorough understanding of various illustrative embodiments of the application. It will be understood, however, to one skilled in the art, that embodiments of the application may be practiced without some or all of these specific details. In other instances, well known process operations have not been described in detail in order not to unnecessarily obscure pertinent aspects of embodiments being described. In the drawings, like reference numerals refer to same or similar functionalities or features throughout the several views.
As used in the description and claims, unless otherwise specified the use of the ordinal adjectives “first”, “second”, “third”, etc., to describe a common element, merely indicate that different instances of like elements are being referred to, and are not intended to imply that the elements so described must be in a given sequence, either temporally, spatially, in ranking, or in any other manner.
In the non-protected environment 50, application programs installed therein are hereinafter referred to as “non-protected application programs” 51, 53, etc., and application data stored therein, and associated with the non-protected application programs are hereinafter referred to as “non-protected application data” 52, 54, etc. The non-protected application data refers to data of non-sensitive or less sensitive nature or lower privacy level. Access to non-protected application programs 51, 53 and non-protected application data 52, 54, and communication among non-protected application programs 51, 53 are generally unrestricted.
In the protected environment 100 (hereinafter “protected container”), application programs installed therein are hereinafter referred to as “protected application programs” 101, 103 etc and application data stored therein and associated with the protected application programs are hereinafter referred to as “protected application data” 102, 104. The protected application data refers to data of more sensitive nature or higher privacy level. Access to protected application data 102, 104 is generally restricted to protected application programs 101, 103. Particularly, access to a protected container is allowed only after successful authentication of a received password. Examples of password include, but are not limited to, alpha and/or numeric characters, and biometric information. Communication among protected application programs which are installed within the same protected container is generally unrestricted. Communication from protected application programs to non-protected application programs is generally unrestricted, whereas communication from non-protected application programs to protected application programs is restricted with certain exceptions as will be described later in the present disclosure.
A communication monitor module 80 is provided to monitor communication requests within the non-protected environment, within the protected environment, and traversing therebetween. Accordingly, the communication module 80 is communicably coupled to the non-protected environment 50 and the first protected container 100. Communication requests to be monitored includes, but not limited to, intents (in Android system), sockets and pipes. The communication monitor module 80 serves as a firewall to the protected container 100, more particularly to manage or limit access to protected application programs 101, 103 and data 102, 104 based on preconfigured access policies and exception policies.
A method for installing and configuring a protected container in a mobile device is described with reference to the flow sequence 20 of
In block 22, a user installs or enables a first protected container.
In block 24, a user installs a first protected application program in the first protected container. This may be performed by installing the application program with a modified path, redefining the owner of the application program or other suitable methods.
In block 26, the user selects or enters first protected application data to be protected by the first protected container. This may be performed by manual data entry, selection via the user interface of the first protected application program or other suitable methods.
In block 28, the user configures access policy for the first protected container (hereinafter referred to as “first access policy”) to limit access to the first protected application data. The first access policy includes specifying which data are to be stored in the protected container and which data are to be stored outside the protected container, i.e. in the non-protected environment. The user may further configure exception policy for the first protected container (hereinafter referred to as “first exception policy”) to manage communication requests from non-protected application.
After the first protected container is installed (block 22), any user who wishes to access the first protected application program and/or first protected application data has to be successfully authenticated by the first authentication module before allowing access.
It is to be appreciated that the flow sequence of
Block 26 is further illustrated with reference to
A method for managing or limiting data access within a mobile device, illustrated in
In block 32, when App A is instructed to access data from or associated with App B, App A generates a communication request which includes destination address as App B. The generated communication request is to be passed to App B to be processed.
In block 34, the communication monitor module intercepts the communication request, ascertains from the communication request its origin address as App A and its destination address as App B.
In block 36, based on the first access policy and any first exception policy as configured earlier, the communication monitor module ascertains whether any of the policies is complied with. If the first access policy or first exception policy is complied, the communication request is performed. Otherwise, the communication request is blocked.
The first access control policy may include, but are not limited to:
(a) If both origin and destination addresses correspond to the non-protected environment, the communication request is to be performed. (In other words, non-protected application data is accessible to non-protected application programs.)
(b) If both origin and destination addresses correspond to the first protected container, the communication request is to be performed. (In other words, first protected application data is accessible to first plurality of protected application programs.)
(c) If the origin address corresponds to the first protected container but the destination address corresponds to the non-protected environment, the communication request is to be performed. (In other words, non-protected application data is accessible to first plurality of protected application programs.)
(d) If the destination address corresponds to the first protected container but the origin address does not correspond to the first protected container, both origin and destination addresses will be determined whether they conform to the first exception policy. If both origin and destination addresses comply with the first exception policy, the communication request is to be performed. If both origin and destination addresses do not comply with the first exception policy, the communication request would not be performed or would be blocked. (In other words, first protected application data is inaccessible to non-protected application programs unless the first exception policy is complied with.)
The first exception policy includes identification of at least one first pre-specified origin address and at least one first pre-specified destination address for which access to the first protected application data would be allowed. The first exception policy is complied with if origin and destination addresses in the communication request comply with any first pre-specified origin address and any first pre-specified destination address identified in the first exception policy. As an additional condition in certain embodiments, the first exception policy is complied with if an authorized first password associated with the first protected container is further received.
In addition to the foregoing flow sequence 30, a verification step may precede or be interposed within the flow sequence 30. The verification step is to verify for receipt of authorized password at authentication module of a protected container if access to application program or data of a protected container is required.
It is to be appreciated that the foregoing description on the first protected container, including architecture, access and exception policies, is replicated (with corresponding changes to the ordinal adjectives) the second (and any subsequent) protected container.
In addition, the access policies (first and second access policies) of the first and the second protected containers may further include: (e) if the origin address corresponds to one of the first and the second protected containers, and the destination address corresponds to the other one of the first and the second protected containers, both origin and destination addresses will be determined whether they conform to the first and the second exception policy. If both origin and destination addresses comply with both exception policies, the communication request is to be performed. If both origin and destination addresses do not comply with both exception policies, the communication request would be blocked. (In other words, first and second protected application data are inaccessible to second and first protected application program respectively unless the first and the second exception policy are both complied with.)
It is to be appreciated that the foregoing description on the first protected container 100, including architecture, access and exception policies, is applicable to the first protected container 100 of
In addition, the second protected container 200c comprises a second authentication module 210c, a second cryptography module 220c. The second protected container is logically separate from the non-protected environment and the first protected container, and is configured to store at least a second protected application program 201c, 203c, etc and second protected application data associated with the second protected application program. The second authentication module is configured to verify receipt of the authorized second password. The second cryptography module 220c is configured to render the second protected application data in encrypted form if the authorized first password and the authorized second password are both not received, and in decrypted form if the authorized first password and the authorized second password are both received. The communication monitor module 80 is further communicably coupled to the second protected container 200c, and configured to manage or limit access to the second protected application data by implementing a second access policy.
The second access control policy may include, but are not limited to:
(a) If both origin and destination addresses correspond to the non-protected environment, the communication request is to be performed. (In other words, non-protected application data is accessible to non-protected application programs.)
(b) If both origin and destination addresses correspond to the second protected container, the communication request is to be performed. (In other words, second protected application data is accessible to second protected application program.)
(c) If the origin address corresponds to the second protected container and the destination address corresponds to the non-protected environment or first protected container, the communication request is to be performed. (In other words, non-protected application data and first protected application data are accessible to second protected application program.)
(d) If the destination address corresponds to the second protected container and the origin address corresponds to the non-protected application program or the first protected container, both origin and destination addresses will be determined whether they conform to the second exception policy. If both origin and destination addresses comply with the second exception policy, the communication request is to be performed. If both origin and destination addresses do not comply with the second exception policy, the communication request would be blocked. (In other words, second protected application data is inaccessible to non-protected application programs and the first plurality of protected applications unless the second exception policy is complied with.)
In the embodiments having two or more protected containers as illustrated in
Embodiments of the application provide several advantages including, but not limited to, the following:
the application proposes an isolated environment or protected container implementation for mobile devices, including smart phones and tablets. Application programs and application data which are considered more sensitive or have higher privacy level are stored in the protected environment, and generally cannot be accessed by application programs which are outside the protected environment. Only the authenticated user can enter the protected environment and access the sensitive or private data.
For convenience, in the protected environment, the authenticated user can access the non-sensitive data stored outside the protected environment. This protects user's sensitive data without compromising usability.
For convenience and without comprising on security, in the non-protected environment, the authenticated user can access sensitive data, which is stored in the protected environment, only in certain circumstances as specified in an exception policy.
Protection level may be increased by nesting a container within another container. In a nested arrangement, application programs and application data with higher protection needs can be stored in an inner or nested container. In order to access these programs and data in the nested container, a user has to be successfully authenticated by two or more authentication modules depending on the level of nesting. Accordingly, differentiated protection levels can be implemented by providing protected containers having different nesting levels.
Other embodiments will be apparent to those skilled in the art from consideration of the specification and practice of the application. Furthermore, certain terminology has been used for the purposes of descriptive clarity, and not to limit the disclosed embodiments of the application. The embodiments and features described above should be considered exemplary.
Number | Date | Country | Kind |
---|---|---|---|
SG10201500698Y | Jan 2015 | SG | national |
This application is a continuation of International Application No. PCT/SG2016/050042, filed on Jan. 28, 2016, which claims priority to Singapore Patent Application No. SG10201500698Y, filed on Jan. 29, 2015. The disclosures of the aforementioned applications are hereby incorporated by reference in their entireties.
Number | Date | Country | |
---|---|---|---|
Parent | PCT/SG2016/050042 | Jan 2016 | US |
Child | 15663237 | US |