System and method for application usage controls through policy enforcement

Patent metadata

Field	Value
Publication number	US-9326145-B2
Application number	US-201313971759-A
Country	US
Kind code	B2
Filing date	Aug 20, 2013
Priority date	Dec 16, 2012
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

A method includes a particular user application, without operating system kernel access, performing the operations of: identifying a set of applications that a user has permission to access, receiving a request to a access a particular application of the set of applications, and causing execution of the particular application.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes the one or more hardware processors to:
identify, by a particular user application, a first set of applications that a user has permission to access, the first set of applications being selected from a plurality of applications, and wherein each application of the first set of applications comprises a policy enforcer code that automatically applies one or more security policies to control behavior of the application;
provide, by the particular user application to a user, an option to select at least one application of the first set of applications;
receive, by the particular user application from the user, a request to access a first application in the first set of applications;
responsive to receipt of the request, cause, by the particular user application, the policy enforcer code in the first application to intercept system calls and framework calls on the first application and replace symbols for the intercepted system calls in an in-memory symbol table with predefined symbols and the framework calls with predefined calls to enable the policy encoder code to control behavior of the first application; and
cause, by the particular user application, execution of the first application following interception and modification of the system calls and framework calls on the first application.

2. The non-transitory computer readable medium of claim 1 , wherein the particular user application does not have kernel access for an Operating System executing on a same device as the particular user application.

3. The non-transitory computer readable medium of claim 1 , wherein to provide the option to select at least one application of the first set of applications, the instructions are to cause the one or more hardware processors to:
determine a subset of applications from the first set of applications that the user has permission to access; and
display at least one or more icons representing the subset of applications that the user has permission to access.

4. The non-transitory computer medium of claim 1 , wherein to identify the first set of applications that the user has permission to access, the instructions are to cause the one or more hardware processors to at least one of:
determine, by the particular user application, whether the user has permission to access the first application based on a physical location of a device executing the particular user application as controlled by the policy enforcer code of the first application; and
determine, by the particular user application, whether the user has permission to access the first application based on either (i) a network connection of a device executing the particular user application or (ii) a configuration of the device executing the particular user application.

5. The non-transitory computer medium of claim 1 , wherein the instructions are to cause the one or more hardware processors to:
inject the policy enforcer code into a dynamic load library of the first application during a binary instrumentation of the first application, wherein the behavior of the first application after the binary instrumentation of the first application is different than a behavior of the first application prior to the binary instrumentation of the first application.

6. The non-transitory computer medium of claim 1 , wherein to provide the option, the instructions are to cause the one or more hardware processors to:
display an interface comprising:
a first plurality of icons representing the first set of applications that the user has permission to access;
a second plurality of icons representing a second set of one or more applications that the user does not have permission to access;
wherein the interface indicates that (a) the first plurality of icons represents applications that the user has permission to access and (b) the second plurality of icons represents applications that the user does not have permission to access.

7. The non-transitory computer medium of claim 1 , wherein the instructions are to cause the one or more hardware processors to, responsive to the identification of the first set of applications that the user has permission to access, install the first set of applications on a device executing the particular user application.

8. The non-transitory computer medium of claim 1 , wherein the instructions are to cause the one or more hardware processors to:
subsequent to causing execution of the first application, determine a change in permissions associated with the user;
identify, by the particular user application, that the user does not have permission to access the first application based on the change in permissions associated with the user; and
prevent, by the particular user application, the user from accessing the first application.

9. The non-transitory computer medium of claim 1 , wherein the instructions are to cause the one or more hardware processors to:
identify, by the particular user application, a second set of applications that a second user has permission to access, the second set of applications being selected from the plurality of applications, and the second set of applications being different than the first set of applications;
provide, by the particular user application to the second user, an option to select at least one application of the second set of applications;
receive, by the particular user application from the second user, a second request to access a second application in the second set of applications;
responsive to receipt of the second request: cause, by the particular user application, execution of the second application.

10. A device comprising:
at least one hardware processor;
a memory on which stored instructions that are to cause the at least one hardware processor to:
identify, by a particular user application, a first set of one or more applications that a user has permission to access, the first set of one or more applications being selected from a plurality of applications and wherein each application of the first set of one or more applications comprises a policy enforcer code that automatically applies one or more security policies to control behavior of the application;
provide, by the particular user application to a user, an option to select at least one application of the first set of applications;
receive, by the particular user application from the user, a request to access a first application in the first set of one or more applications;
responsive at least to receipt of the request cause, by the particular user application, the policy enforcer code in the first application to intercept system calls and framework calls on the first application and replace symbols for the intercepted system calls in an in-memory symbol table with predefined symbols and the framework calls with predefined calls to enable the policy encoder code to control behavior of the first application; and
cause, by the particular user application, execution of the first application following interception and modification of the at least one system calls and the framework calls on the first application.

11. The device of claim 10 , wherein the particular user application does not have kernel access for an Operating System executing on a same device as the particular user application.

12. The device of claim 10 , wherein to identify the first set of applications that the user has permission to access, the instructions are to cause the at least one hardware processor to at least one of:
determine, by the particular user applic

Assignees

• Aruba Networks Inc

Inventors

• Awan Asif
• Kshirsagar Shekhar
• Kumar Chetan
• Agarwal Deepak
• Maradani Suman
• Babu Sunil G V

Classifications

• H04W12/08 Primary

  Access security · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title