Resource restriction systems and methods

Patent metadata

Field	Value
Publication number	US-9400688-B2
Application number	US-201414491970-A
Country	US
Kind code	B2
Filing date	Sep 19, 2014
Priority date	Aug 4, 2006
Publication date	Jul 26, 2016
Grant date	Jul 26, 2016

Abstract

Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.

First claim

What is claimed is:

1. A non-transitory machine readable medium storing a resource agent for execution outside of an operating system of a device by a set of processing units of the device, the resource agent comprising sets of instructions for:
at the resource agent executing outside the operating system, receiving a system call from the operating system;
determining whether the system call is subject to a resource restriction of at least one of a plurality of types of resource restriction;
when the system call is subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to cancel the system call; and
when the system call is not subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to allow the system call.

2. The non-transitory machine readable medium of claim 1 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an application path.

3. The non-transitory machine readable medium of claim 1 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an identifier associated with the resource.

4. The non-transitory machine readable medium of claim 1 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by a hash of a file associated with the resource.

5. The non-transitory machine readable medium of claim 1 , wherein the set of instructions for receiving the system call from the operating system comprises a set of instructions for communicating with the operating system through a privileged root-owned socket.

6. The non-transitory machine readable medium of claim 1 , wherein the system call is associated with a user, wherein the set of instructions for determining whether the system call is subject to a resource restriction comprises a set of instructions for examining a set of resource restrictions stored in a data store for the user.

7. For a resource agent for execution outside of an operating system of a device, a method comprising:
at the resource agent executing outside the operating system receiving a resource request from the operating system;
determining whether the resource request is subject to a resource restriction of at least one of a plurality of types of resource restriction;
when the resource request is subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to cancel the resource request; and
when the resource request is not subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to allow the resource request.

8. The method of claim 7 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an application path.

9. The method of claim 7 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an identifier associated with a resource.

10. The method of claim 7 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by a hash of a file associated with a resource.

11. The method of claim 7 , wherein receiving the resource request from the operating system comprises communicating with the operating system through a privileged root-owned socket.

12. The method of claim 7 , wherein the resource request is associated with a user, wherein determining whether the resource request is subject to a resource restriction comprises examining a set of resource restrictions stored in a data store for the user.

13. The method of claim 7 further comprising:
determining whether the resource request includes a system call identifier; and
when the resource request does not include a system call identifier, determining a system call identifier associated with the resource request.

14. The method of claim 7 further comprising:
determining whether the resource request includes a user identifier; and
when the resource request does not include a user identifier, determining a user identifier associated with the resource request.

15. An electronic device comprising:
a set of processing units for executing sets of instructions;
a non-transitory machine readable storage for storing a resource agent which when executed by at least one of the processing units executes outside an operating system of the electronic device, the resource agent comprising sets of instructions for:
at the resource agent executing outside the operating system receiving a system call from the operating system;
determining whether the system call is subject to a resource restriction of at least one of a plurality of types of resource restriction;
when the system call is subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to cancel the system call; and
when the system call is not subject to a resource restriction of at least one of the plurality of resource restriction types, causing the operating system to allow the system call.

16. The electronic device of claim 15 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an application path.

17. The electronic device of claim 15 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by an identifier associated with the resource.

18. The electronic device of claim 15 , wherein the plurality of resource restriction types comprises a type of resource restriction that is defined by a hash of a file associated with the resource.

19. The electronic device of claim 15 , wherein the set of instructions for receiving the system call from the operating system comprises a set of instructions for communicating with the operating system through a privileged root-owned socket.

20. The electronic device of claim 15 , wherein the system call is associated with a user, wherein the set of instructions for determining whether the system call is subject to a resource restriction comprises a set of instructions for examining a set of resource restrictions stored in a data store for the user.

Assignees

• Apple Inc
• Apple Inc

Inventors

• Mantere Iii Jussi-Pekka
• Maluta Alexander Tony
• Scalo John William
• Tyacke Eugene Ray
• Gaya Bruce
• Smith Michael John
• Kiehtreiber Peter
• Cooper Simon P

Classifications

• H04L63/104 Primary

  Grouping of entities · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F9/5005 Primary

  to service a request · CPC title

• G06F9/54

  Interprogram communication · CPC title

• G06F21/44

  Program or device authentication · CPC title