Technologies for multi-factor security analysis and runtime control

Patent metadata

Field	Value
Publication number	US-9356969-B2
Application number	US-201414493814-A
Country	US
Kind code	B2
Filing date	Sep 23, 2014
Priority date	Sep 23, 2014
Publication date	May 31, 2016
Grant date	May 31, 2016

Abstract

Technologies for client-level web application runtime control and multi-factor security analysis by a computing device include receiving application code associated with a browser-based application from a web server. The computing device collects real-time data generated by at least one sensor of the computing device and performs a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code. Further, the computing device establishes a client-level web application runtime security policy associated with the browser-based application in response to performing the multi-factor security assessment and enforces the client-level web application runtime security policy.

First claim

The invention claimed is:

1. A computing device for client-level web application runtime control and multi-factor security analysis, the computing device comprising:
at least one sensor;
a browser to receive application code associated with a browser-based application from a web server; and
a web security module to (i) collect real-time data generated by the at least one sensor, (ii) perform a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code, (iii) determine whether the application code is modifiable to eliminate execution of impermissible code in response to an indication of the multi-factor security assessment that the application code includes the impermissible code, (iv) modify the application code in response to a determination that the application code is modifiable to eliminate the execution of the impermissible code, (v) establish a client-level web application runtime security policy associated with the browser-based application in response to the multi-factor security assessment, and (vi) enforce the client-level web application runtime security policy on the computing device,
wherein the client-level web application runtime security policy identifies at least one of hardware, firmware, or software access rules to be enforced on the computing device.

2. The computing device of claim 1 , wherein to collect the real-time data comprises to determine an impact of execution of the application code on the operation of computing device.

3. The computing device of claim 2 , wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on a parameter of the operation of the computing device unrelated to a maliciousness aspect of the application code.

4. The computing device of claim 2 , wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on concurrent execution of another application of the computing device different from the browser-based application.

5. The computing device of claim 2 , wherein to determine the impact of the execution of the application code comprises to determine an impact of execution of the application code on at least one of power consumption or latency of the computing device.

6. The computing device of claim 1 , wherein to collect the real-time data comprises to determine a real-time security threat level of a network of the computing device.

7. The computing device of claim 1 , wherein the at least one sensor comprises at least one of a hardware sensor or a software context source; and
wherein to collect the real-time data comprises to determine a context of the computing device based on data received from at least one of the hardware sensor or the software context source.

8. The computing device of claim 1 , wherein to collect the real-time data comprises to:
transmit the application code to a cloud server for remote simulation of the application code; and
receive security results from the cloud server in response to transmittal of the application code to the cloud server.

9. The computing device of claim 1 , further comprising a secure execution environment, wherein to collect the real-time data comprises to:
simulate execution of the application code in the secure execution environment; and
receive security results from the simulated execution of the application code.

10. The computing device of claim 1 , further comprising:
a browser security interface to generate machine-executable code for the application code and an access control map for the application code,
wherein to perform the multi-factor security assessment comprises to perform the multi-factor security assessment of the browser-based application as a function of the collected real-time data, the application code, and the access control map.

11. The computing device of claim 10 , wherein the access control map is generated as a function of at least one of (i) design time rules for the browser-based application that identify at least one of hardware, firmware, or software of the computing device that the browser-based application is configured to access and (ii) user configurations for the browser-based application that identify at least one of hardware, firmware, or software of the computing device that the browser-based application is configured to access.

12. The computing device of claim 1 , wherein to establish the client-level web application runtime security policy comprises to establish hardware access rules that identify which hardware of the computing device the browser-based application is authorized to access; and
wherein to enforce the established client-level web application runtime security policy comprises to restrict access to hardware of the computing device as a function of the hardware access rules.

13. The computing device of claim 1 , wherein to establish the client-level web application runtime security policy comprises to establish firmware access rules that identify which firmware of the computing device the browser-based application is authorized to access; and
wherein to enforce the established client-level web application runtime security policy comprises to restrict access to firmware of the computing device as a function of the firmware access rules.

14. The computing device of claim 1 , wherein to establish the client-level web application runtime security policy comprises to establish software access rules that identify which software of the computing device the browser-based application is authorized to access.

15. One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing device, cause the computing device to:
receive application code associated with a browser-based application from a web server;
generate real-time data with at least one sensor of the computing device;
collect the real-time data generated by the at least one sensor of the computing device;
perform a multi-factor security assessment of the browser-based application as a function of the collected real-time data and the application code;
determine whether the application code is modifiable to eliminate execution of impermissible code in response to an indication by the multi-factor security assessment that the application code includes the impermissible code;
modify the application code in response to a determination that the application code is modifiable to eliminate the execution of the impermissible code;
establish a client-level web application runtime security policy associated with the browser-based application in response to performing the multi-factor security assessment, wherein the client-level web application runtime security policy identifying at least one of hardware, firmware, or software access rules; and
enforce the client-level web application runtime security policy.

16. The one or more non-transitory machine-readable storage media of claim 15 , wherein to collect the real-time data comprises to determine an impact of execution of the application code on the operation of the computing device.

17. The one or more non-transitory machine-readable storage media of claim 15 , wherein to collect the real-time data comprises to determine a real-time security threat level of a network of the computing device.

18. The one or more non-transitory machine-readable storage media of claim 15

Assignees

• Li Hong
• Dewan Prashant
• Intel Corp

Inventors

• Li Hong
• Dewan Prashant

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L65/1045

  Proxies, e.g. for session initiation protocol [SIP] · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title