System and method for application usage controls through policy enforcement

Patent metadata

Field	Value
Publication number	US-9882909-B2
Application number	US-201615094746-A
Country	US
Kind code	B2
Filing date	Apr 8, 2016
Priority date	Dec 16, 2012
Publication date	Jan 30, 2018
Grant date	Jan 30, 2018

Abstract

A method includes a particular user application, without operating system kernel access, performing the operations of: identifying a set of applications that a user has permission to access, receiving a request to a access a particular application of the set of applications, and causing execution of the particular application.

First claim

What is claimed is:

1. A non-transitory computer readable medium comprising instructions which, when executed, causes a hardware processor to:
display, by a workspace application, a set of applications that a user has permission to access at a current time, wherein each application of the set of applications includes policy enforcer instructions that apply a time-fencing policy that locks the application if the application is not supposed to be used at the current time;
responsive to a request to access a first application of the set of displayed applications, determine, by the workspace application, whether the user has permission to access the first application based on the current time and a location of a workspace device executing the first application;
assign, based on the policy enforcer instructions, a unique identifier to the first application;
cause, by the workspace application, the policy enforcer instructions in the first application to intercept system calls and framework calls on the first application and replace symbols for the intercepted system calls in an in-memory symbol table with predefined symbols and the framework calls with predefined calls; and
cause, by the workspace application, execution of the first application following the interception of and the replacement in the system calls and framework calls on the first application.

2. The non-transitory computer readable medium of claim 1 , comprising instructions to cause the policy enforcer instructions to control behavior of the first application based on the predefined symbols.

3. The non-transitory computer readable medium of claim 1 , comprising instructions to receive the request to access the first application.

4. The non-transitory computer readable medium of claim 1 , including instructions to provide, by the workspace application, to the user, an option to select an application to access from the set of displayed applications.

5. The non-transitory computer readable medium of claim 4 , including instructions to:
display at least one or more icons representing the set of applications that the user has permission to access.

6. The non-transitory computer readable medium of claim 1 , wherein the policy enforcer instructions are included in a dynamic load library of the first application.

7. The non-transitory computer readable medium of claim 6 , wherein the dynamic load library is a part of a binary executable application of the first application.

8. The non-transitory computer readable medium of claim 1 , comprising instructions to modify, based on the unique identifier, a set of links associated with the first application.

9. The non-transitory computer readable medium of claim 1 , comprising instructions to associate, based on the unique identifier, a set of document types to be permitted for use with the first application.

10. The non-transitory computer readable medium of claim 1 comprising instructions to modify, based on the policy enforcer instructions, a setting of the first application, wherein the setting corresponds to a non-executable file associated with the first application and is selected from a group consisting of permissions, privileges, configuration files, and resource files.

11. The non-transitory computer readable medium of claim 1 , wherein the policy enforcer instructions to intercept the system calls and the framework calls include instructions to intercept functions that are part of an interface based on a corresponding object being passed as a parameter and without use of a class name for the interface.

12. The non-transitory computer readable medium of claim 1 , wherein the locked application is not displayed.

13. A device comprising:
a hardware processor; and
a memory including instructions which, when executed, causes the hardware processor to:
display, by a workspace application, a set of applications that a user has permission to access at a current time, wherein each application of the set of applications includes policy enforcer instructions that apply a time-fencing policy that locks the application from being displayed if the application is not supposed to be used at the current time;
responsive to receipt of a request to access a first application in the set of applications, determine, by the workspace application, whether the user has permission to access the first application based on the current time at a location of a workspace device executing the first application;
assign, based on the policy enforcer instructions, a unique identifier to the first application;
cause, by the workspace application, the policy enforcer instructions in the first application to intercept system calls and framework calls on the first application and replace symbols for the intercepted system calls in an in-memory symbol table with predefined symbols and the framework calls with predefined calls to enable the policy enforcer instructions to control behavior of the first application; and
cause, by the workspace application, execution of the first application following the interception of and the replacement in the system calls and the framework calls on the first application.

14. The device of claim 13 , wherein the workspace application is sandboxed without kernel access for an operating system of a workspace device that the workspace application runs on.

15. The device of claim 14 , wherein the workspace device is a wireless device.

16. A method, comprising:
wrapping a first application to include policy enforcer instructions in the first application;
receiving a request from a user to access the first application at a current time, wherein the policy enforcer instructions of the first application apply a time-fencing policy that locks the first application if the first application is not supposed to be used by the user at the current time;
responsive to the request, determining whether the user has permission to access the first application based on the current time and a location of a device executing the first application;
assigning, based on the policy enforcer instructions, a unique identifier to the first application;
causing the policy enforcer instructions in the first application to intercept system calls and framework calls on the first application;
causing the policy enforcer instructions in the first application to replace symbols for the intercepted system calls in an in-memory symbol table with predefined symbols and the framework calls with predefined calls; and
causing execution of the first application following the interception of and the replacement in the system calls and framework calls on the first application.

17. The method of claim 16 , wherein the wrapping includes binary instrumentation of the first application.

18. The method of claim 17 , wherein the binary instrumentation includes insertion of the policy enforcer instructions into the first application.

19. The method of claim 16 , wherein the first application is sandboxed without access to an operating system (OS) of a mobile device on which the first application runs.

20. The method of claim 16 , wherein the policy enforcer instructions control the behavior of the first application by restricting options for the user based on security policies.

Assignees

• Aruba Networks Inc

Inventors

• Awan Asif
• Kshirsagar Shekhar
• Kumar Chetan
• Agarwal Deepak
• Maradani Suman
• Babu Sunil G V

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04W12/08 Primary

  Access security · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title