ACCESS CONTROL TO FILES BASED ON SOURCE INFORMATION
The present invention is a security tool for protection of data on a mobile computing device. The security tool provides a plurality of security policies to be enforced based on source information for the data and a location associated with a network environment in which a mobile device is operating. The security tool may be either located at the mobile computing device or at the server. The security tool includes a file access module for determining whether files are visible or accessible. The file access module comprises a tag generator, an association module, and a policy enforcement module. The tag generator creates source information for the file being accessed and the policy enforcement module determines what actions, if any, can be performed on the file and under what conditions such as location and network environment, type of file and other factors.
Latest Apple Patents:
- Techniques for NR cell/beam identification
- Quality-sparing code burn-in for video
- Sliding window for image keypoint detection and descriptor generation
- 5G new radio (NR) network controlled small gap (NCSG)
- Method of tracking a mobile device and method of generating a geometrical model of a real environment using a camera of a mobile device
This application claims the benefit of U.S. Provisional Patent Application No. 60/644,064, filed on Jan. 14, 2005, entitled “System and Method of Filtering Access Points Presented to a User and Locking onto an Access Point.” This application also claims the benefit of U.S. Provisional Patent Application No. 60/687,188, filed on Jun. 3, 2005, entitled “Access Control to Files Based on Source Information.” This application is a continuation-in-part of U.S. patent application Ser. No. 11/176,999, filed on Jul. 7, 2005, and entitled “System and Method for Filtering Access Points Presented to a User and Locking onto an Access Point.” This application is also a continuation-in-part of U.S. patent application Ser. No. 10/897,060, filed on Jul. 21, 2004, and entitled “Administration of Protection of Data Accessible by a Mobile Device.” This application is also a continuation-in-part of U.S. patent application Ser. No. 10/413,443, filed Apr. 11, 2003, and entitled “Administration of Protection of Data Accessible by a Mobile Device.” This application is also a continuation-in-part of U.S. patent application Ser. No. 10/377,265, filed Feb. 28, 2003, and entitled “Protection of Data Accessible by a Mobile Device.” All of the above applications are incorporated by reference herein in their entirety.
BACKGROUND OF THE INVENTION1. Field of Invention
This application relates to the field of security of data accessible by mobile devices. Mobile devices are using wired and wireless technologies to access networks at work, at home, or in public ‘hot spots.’ Those same mobile devices have documents, spreadsheets, e-mail, and other files with valuable company information if not valuable personal information in them.
2. Description of Related Art
The availability of wired and wireless network access points (NAP) allows mobile devices like laptop computers and personal digital assistants (PDAs) to enable users to be more mobile, providing access to corporate networks, e-mail, home networks and the Internet from anywhere. With the advent of the IEEE 802.11 standard for wireless communication, and other popular wireless technologies, software products that protect against unwanted access to information stored on mobile devices and corporate servers is highly desirable.
Traditional security architectures assume that the information assets being protected are ‘tethered’—wired to a particular network infrastructure such as a company's network infrastructure. But mobile users can pick up valuable corporate information, such as by copying files from a server to a laptop, and walk away from the corporate network, and connect to other networks with different security policies. Users with laptops and mobile devices want to take advantage of wireless technologies, to connect wherever they are—at work, at home, in the conference room of another company, at the airport, a hotel, a highway or at the coffee shop on the corner. The mobile device's network environment is constantly changing as the user moves about. Each environment has different needs in terms of security. Each environment presents different challenges to protect the information on the mobile device while allowing access to e-mail, the Internet, and company Virtual Private Networks (VPNs).
Personal firewalls are designed to deal with static environments. A personal firewall could be ideally suited for mobile users if users knew how to adapt their configuration for their particular mobile application. Unfortunately, security settings for one situation can compromise data security in another. The configuration of popular personal firewalls typically requires a level of expertise on how the technology actually works that average users do not possess. For example, if a user improperly configures a personal firewall to trust a foreign network, his files may be vulnerable to unauthorized malicious attacks on his computer.
Solutions that secure data in transit, for example a (VPN) connection from a corporate server to a mobile client device, do not protect the data once it is stored on the mobile device. For example, an executive could be retrieving sensitive files or emails from the corporate network, and the VPN will stop eavesdroppers from seeing the data in transit, but once the data is stored on the executive's mobile device, hackers in the parking lot could break into the mobile device and copy or maliciously alter the data. With the onset of new powerful mobile devices that can store corporate data, IT managers see their network perimeters having to extend to the new limits of these mobile wireless connections.
Thus, there is a need for simple to use, mobile-aware security tools providing different levels of security protection for different locations and/or security features. There is also a need for different levels of security based on source or labeling of the data.
SUMMARY OF INVENTIONThe present invention provides one or more embodiments of systems and methods for protecting data accessible by one or more mobile devices using security policies based upon criteria such as source information associated with the data and a location associated with a network environment in which each mobile device is operating. The present invention also provides an embodiment of a system and method for automatically labeling, tagging or creating source information for data or a file.
The system of the present invention includes a policy server for creating, maintaining and proliferating one or more security policies to mobile computing devices and servers. Each mobile computing device includes a security tool for enforcing security policies provided by the policy server. In a first embodiment of the present invention, security tool uses the source information and the location associated with a network environment in which each mobile device is operating to determine the accessibility of data. For example, based on the source information and current location associated with the mobile device, a file resident on the mobile device may be encrypted, may be hidden, may be transferable, may be partially accessible or fully accessible as required or recommended by a security policy. The security tool may be either located at the mobile computing device or at the server. The security tool includes a file access module for determining whether files are visible or accessible. The file access module comprises a tag generator, an association module, and a policy enforcement module. The tag generator creates source information for the file being accessed and the policy enforcement module determines what actions, if any, can be performed on the file and under what conditions such and location and network environment, type of file and other factors.
The present invention also includes various methods for using source information to control access to data including a method for determining whether files are visible, a method for determining whether files are accessible, and a method for generating source information for in response to a file request.
The location “Work” 106 is an example of a location associated with a network environment maintained by a user's employer. In the illustrated example, a notebook computer 164 has a wired Ethernet connection 168 to the corporate server 112 of his or her employer. However, the notebook computer 164 may also communicate with the server 112 through a wireless NAP 162 as illustrated.
Another example of a location category is “Mobile” 102. For example, at an airport, a mobile device such as the illustrated notebook computer 122 accesses a network environment respectively through a wired connection 126 (in this example a T1 line) to a wired network access point 128. This wired network access point 128 may provide access to an Internet shopping site server 110 because the user desires to browse the site while waiting for departure. The notebook computer 122 and the personal digital assistant (PDA) 124 alternatively have a wireless connection to a wireless NAP 130, in this example an 802.11b connection through which they may communicate at the airport. Additionally, as discussed below, the security policy associated with the “Mobile” location may take into account the connection type of wired or wireless. In this example, the network environment provided at the airport does not match with a defined environment associated with a location such as “Work” 106 or “Home” 104 so “Mobile” 102 is assigned or associated with the PDA 124 and the notebook computer 122 as a default location.
The last location example is “Alternate” 108. In one example, a specific environment (e.g. an environment associated with a university computer lab or an environment associated with a type of network class) may be associated with “Alternate.” Similarly, a “Custom” or another named location may also be defined. In this example, the wireless network access point 172 is associated with a cellular base station providing network access through a General Packet Radio Services (GPRS) system, Global System for Mobile communication (GSM) system, third generation wireless 3G system or other kind of mobile wireless communication system. A PDA 174 communicates wirelessly to the NAP 172 for access to the network 120.
System OverviewWhile a plurality of file access modules 192 are shown in
The policy management module 236 manages security policies. One aspect of managing security policies is defining the policies. In this example, the policy management module 236 comprises instructions for establishing this pre-defined criteria based upon user input processed by the communicatively coupled user interface module 240. Defining policies includes the creation of policies and the modification of policies. Examples of aspects of a policy includes specification of rules and permissions (e.g. policy override), defining one or more locations associated with network environments, defining or identifying security features to be monitored, ports to be monitored, network services to be monitored, applications to be monitored, enforcement mechanisms to be put in place for a particular policy, level identification for a policy or policy aspect for flexibility (optional, recommended, mandatory, invisible), and feedback (e.g. custom error messages) to alert an administrator via a user interface screen using the server system 200 of certain conditions or to alert a client device user via a user interface screen of certain conditions.
There may be several layers of policies. There may be a base policy applicable to a group of entities. Examples of entities may be users or the mobile devices themselves. In these examples, the group may include one instance of an entity. The attributes of the base policy may be incorporated into other policies that add additional attributes. For example, a base policy for the group including engineers in the user interface design department may be allowed access to files on a certain disk drive. Another policy based on location that incorporates the attributes of the base policy may only allow access to encrypted versions of the files if a mobile device through which a UI design engineer is logged in is operating in a “Home” network location. The optional server policy setting module 238 is discussed below in the discussion of the client policy setting module 212 of
In one embodiment, the policy management module 236 is provided with an enterprise's existing group structures. The policy management module 236 compensates for a failing in the traditional makeup of groups. Since groups are not hierarchical, it is common for one person to be a member of several groups, and if each group has its own security policy, an issue arises as to how to determine which policy to apply to a particular user. The policy management module 236 inputs a prioritized list of groups from a memory location 242. According to one embodiment, the policy management module 236 searches the groups in priority order of the list. For example, if a person is a member of “engineering” and “executive staff,” that person will get the security policy for whichever of those two groups comes first in the prioritized list. There can be a default policy for users who are not members of any of the groups on the prioritized list. Further, there can be a highest priority group that always has the highest priority. An example of such a group is a “stolen mobile device” group that always has the highest priority, because it doesn't matter what other groups the device is associated with if the device is in the hands of a thief. According to another embodiment, a user who is a member of several groups can be granted the security policy for the group associated with the least privileges.
The policy distribution module 234 distributes security information to the one or more client mobile devices. The policy distribution module 234 has a communication interface or is communicatively coupled to the policy management module 236 for receiving notifications of updated security information. Examples of security information are versions of existing policies, policies, or software. An example of communication interface is a bus between a processor executing one or more of the modules and a memory controller responsible for memory reads/writes. Another example is one module reading a parameter stored in a memory location by another module. Of course, other communication interfaces known to those of ordinary skill in the art may also be used.
In this embodiment, the authorization module 232 authorizes a communication exchange between the client mobile device and the policy distribution or policy management modules. The authorization module 232 is a further safeguard against unauthorized or rogue mobile devices trying to hijack the security policies or corporate data. Various authorization protocols and techniques may be used. One example is a simple username and password verification scheme. Another example of a type of authorization protocol is a cryptographic authentication protocol. The authorization module 232 may also be used to authorize a communication exchange between the client system 201 and the remote diagnostics module 224.
The file access module 250a is coupled to the authorization module 232 and the policy management module 236 by bus 252. The file access module provide sources information to the policy management module 236 so that policies can be modified based on the source information for the file requested in addition to location information about the mobile computing device 201. The file access module 250a, its components and operations are described in more detail below with reference to
The remote diagnostics module 224 is illustrated in the context of a server 200 in
The remote diagnostics module 224 comprises three modules or sub-modules: a monitoring module 226, a diagnosis module 228, and a diagnosis distribution module 230. The monitoring module 226 receives diagnostic information such as events or audit logs from a client device and stores the information in a data object (242) for the client device. In one embodiment, a client diagnostics module (e.g.
The diagnosis module 228 analyzes diagnostic information stored for the mobile device. For example the diagnosis module 228 may perform analysis according to pre-stored diagnostic programs or according to an interactive user environment or a combination of the two. The diagnosis module 228 may provide a repair to a problem in the client device, determine that a trend is occurring for the device, or determine that preventive maintenance is to be scheduled for the client device. In one example, the diagnosis module 228 initiates requests to the client mobile device for additional information. The additional information may be based on input received via the user interface module 240 or according to a pre-stored diagnosis method. In one embodiment, the diagnosis module 228 provides requested information to the user interface module 240 responsive to user input. In another embodiment, the diagnosis module 228 may provide requested information transmitted via the diagnostics distribution module 230 over the network 204 to the client mobile device responsive to requests received at a user interface module on the client device (e.g.
Either the monitoring module 226 or the diagnosis module 228 may initiate tests and/or queries to determine the readiness or robustness of the existing client device population. Trends may be noted. Again, these tests may be run during a connection with a device without requiring user intervention.
The remote diagnostics module 224 may also probe a particular client to verify its status. For example, client configuration information may be retrieved such as the current version of the security policy software components on the client device, the current policy settings on the device, and attributes in accordance with those settings, for example, which ports are blocked. This information may be stored for later assistance in a diagnostics situation or for use with a current diagnostics situation.
In the system embodiment of
-
- Ability to see the tray icon
- Ability to shut down the service
- Ability to go to unmanaged mode
- Ability to go to self-managed mode
- Ability to change to a different policy server, or get a policy from another server in the same enterprise
- Ability to not pull down new policies when they are available
- Ability to get software updates directly from a vendor
- Ability to launch the settings application
- Ability to modify visual settings
- Ability to modify feedback levels
- Ability to see/modify server-defined global objects (for each type of object)
- Ability to create new global objects (for each type of object)
- Ability to see/modify global objects in the policy (for each type of object)
- Ability to change the global objects used in the policy (for each type of object)
- Ability to remove adapters from the policy.
Some examples of permissions specific to locations are as follows: - Ability to manually switch to a location
- Ability to override a location.
- Ability to manually switch to a different location
- Ability to change enforcement mechanisms.
In one embodiment, in setting the permissions, for flexibility, a permission setting or a level of identification for each of the permissions may also be set. Some examples of these possible settings or levels are as follows:
-
- Modifiable: The user has permission to modify the setting freely.
- Recommended: The user has permission to modify the setting, but the application will recommend the policy's default.
- Mandatory: The user does not have permission to modify the setting.
- Hidden: The user does not have permission to view or modify the setting.
The policy management module 236 determines whether the security information is to be encrypted. If not, the policy management module 236 stores the security policy. If it is to be encrypted, the policy is encrypted. Similarly the policy management module 236 may also encrypted other types of security information such as software updates before they are stored. For example, the security policy may be stored as a data object in a memory 242 accessible via an internal enterprise network. In another example, security policies may be included in XML documents that may themselves be encrypted. In an alternate embodiment, the policy management module 236 may store the policy unencrypted, the policy distribution module 234 makes the determination of whether encryption applies to the policy or other security information, and the policy distribution module 234 encrypts the security information before distributing it. Additionally, in the embodiment of
-
- User Name
- Group
- Connection state, which is one of:
- Connected
- Last connected time
- Never connected
- Policy for this user
- Policy version for this user
- Software version for this user
- Current enforcement mechanisms
- Diagnostic level, including diagnostic options available in the client settings
- Diagnostic information
- Auditing level
- Auditing information
- Locations Previously Detected
The information may be organized in a data object stored in a memory 242 accessible to the server computer system.
Through a user interface, a system administrator provides input indicating actions to be taken with respect to managing clients. In the embodiment of
-
- Remove this client device from the current list of connected client devices (although the client device is re-added the next time he connects).
- Change auditing level (to one of the options described below).
- Change the diagnostic level.
- View the diagnostic or event log for this client device.
- Reassign this client device to another group.
- Define Properties (e.g. required hardware, required software, data accessibility rights, data visibility rights.)
The authorization module 245 provides authorization information to the authorization module 232 of the server 200 to establish communication exchanges with the client mobile device for the exchange of security information or diagnostic information or both. The client diagnostics module 246 collects diagnostic information that is sent to the remote diagnostics module 224 of the server system embodiment 200.
In one embodiment, the location detection module 208 receives network parameters from network 204 and detects or determines the location associated with the current network environment based upon criteria defined in a downloaded policy from the server system 200. In this example, the policy setting module 212 receives, installs and updates the security information including security policies and/or software updates received from the policy management module 236 via the policy distribution module 234 over the network connection 204. The policy setting module 212 may define criteria or if permissions set by the policy management module 236 allow, supplemental policy definitions or customization of policy definitions based upon user input processed by the mobile device user interface module 218. Similarly, if operating in a standalone mode not under the control of the server system, the policy setting module 212 defines an aspect of a policy such as location criteria or security features criteria based upon user input processed by user interface module 218.
In this embodiment, memory locations 216, including indicators of security features and/or location indicators, have a communication interface (e.g. a bus between a processor executing one or more of the modules and a memory controller responsible for memory reads/writes) to the location detection module 208, the security features determination module 210, the policy setting module 212, the policy enforcement control module 214, the authorization module 245, the client diagnostics module 246 and the file access module 250b. The location detection module 208 has a communication interface to the policy setting module 212. In the embodiment, the policy setting module 212 determines a security policy based upon the location detected by the location detection module 208 and communicated via a communication interface. In one example of the communication interface, the policy setting module 212 may read a current location indicator 216 updated in a memory location 216 by the location detection module 208. The policy setting module 212 may then read the location indicator 216 periodically or responsive to a notification message from the location detection module 208. In another example, the location detection module 208 may pass the currently detected location to the policy setting module 212 as a parameter in a message. Of course, other communication interfaces known to those of ordinary skill in the art for use in notifying the policy setting module 212 of the current location may also be used.
In another embodiment, the policy setting module 212 determines a security policy based upon source information as will be described in more detail below with reference to
In an alternate embodiment, an optional server policy setting module 238 may operate on a server computer system such as the one illustrated in
The policy setting module 212 also has a communication interface to a policy enforcement module 214. The policy enforcement module 214 comprises instructions for enforcing the security policy currently set by the policy setting module 212. The policy enforcement module 214 comprises instructions for one or more enforcement mechanisms associated with a security policy. Again, in an alternate embodiment, an optional server policy enforcement module 244 in a server computer system 200 with which the client device has a network connection 204 may send instructions to the mobile device for the enforcement of a security policy as determined by the optional server policy setting module 238 for the local device on the server side.
In this embodiment, a user interface module 218 has a communication interface to one or more of these modules 208, 210, 212, 214, 245, and 246. In one embodiment, the user interface module 218 receives input from a user input device such as a keyboard, mouse, or touchpad, and causes user interfaces to be displayed for use by a user for establishing criteria for defining an aspect of a security policy as allowed by permissions associated with the policy or when operating in a standalone mode not under the control of the server system 200.
The system 201 further comprises a security features module 210 for determining whether one or more security features have an activity status of inactive or active in a communication session between the mobile device and another computer. An example of a security feature is a connection type of wired or wireless. In one example, this connection type may be indicated by the association of the port over which data is communicated with a wireless or wired network adapter or network interface card (NIC). In another example, this connection type may be indicated by the association of a local IP address with data communicated over a wireless or wired network adapter or network interface card (NIC). In other embodiments, policies may be set based on particular features besides simply connection type. For example, a different security policy may be applied for different brands of NICs or particular classes (e.g. 802.3, 802.11a, 802.11b, GPRS, GSM) of NICs. Furthermore, different security policies may be assigned based on the operating system employed or the version of the operating system because different systems or versions provide different security features. Furthermore, different policies may be employed based on the security features (e.g. a firewall) provided by different types of network access points (NAP). Additionally, the presence or absence of upgraded NIC support for enhanced security protocols (e.g. 802.11i), or the presence or absence of security software such as virtual private network (VPN), or antivirus software, or intrusion-detection software may be the basis for setting different policies on a particular port, network adapter or data.
As with the location detection module 208, the security features module 210 has a communication interface to the policy setting module 212 in this embodiment as well as the memory locations 216. An activity status indicator field for the feature stored in the memory locations 216 may indicate the activity status of active or inactive for a security feature. The policy setting module 212 may be notified of the active features via the communication interface implemented in the same manner described in any one of the examples discussed above with respect to the location detection module 208 or in any manner known to those of ordinary skill in the art.
The policy setting module 212 communicates the current security policy to the policy enforcement control module 214 via a communication interface implemented in the same manner described in any one of the examples discussed above with respect to the location detection module 208 or in any manner known to those of ordinary skill in the art. The policy enforcement module 214 comprises one or more enforcement mechanism modules as specified by the policy. For example, in a communication session between the mobile device and another computer in which data is being transferred over a wireless connection, based on this connection type, in one example, the enforcement module 214 may prevent certain files from being transferred over the wireless connection as opposed to the cases in which the data is being transferred over a wired connection, or the case in which 802.11i cryptography is being used over the wireless connection. Again, in an alternate embodiment the optional server policy enforcement module 244 may operate as part of a separate computer system that transfers commands over a network to the mobile device. In the illustrated embodiment of
-
- Verify that correct files are in correct locations.
- Verify (e.g. checksum) all files to verify no corruption.
- Verify time/date stamps for correct versions.
- Check for outdated installation (INF, PNF) files.
- Verify that all registry entries are correct and correct any errors found. For example, it is verified whether the indications of the installation of the network interface cards (NICs) is accurate.
Examples of other tasks that the client diagnostics module 246 may perform to provide diagnostic information to the remote diagnostics module 224 on the server computer system 200 include enabling and disabling advanced debugging and sending debugging output to the server computer system 200. For example, enabling and disabling advanced debugging includes turning on system event logging with options including which parameters to log, when to log, etc. and allowing a debug version of a system component to be installed. In this example, the system event log or portions of it and any special debug output files that debug components generate are sent to the remote diagnostics module 224 on the server.
Second Embodiment of Server and Mobile/Client DevicesThe client side system embodiment comprises a policy engine 332 operating in application space having a communication interface to management tool 316 of the operating system, a communication interface to a file filter 324 operating in the kernel space that controls access to the file system 326, a communication interface to a user interface module 302, and also having a communication interface to a packet filter engine 318 operating within a driver 334. In this example, the driver 334 is an NDIS intermediate driver 334 operating within the kernel of the operating system of the mobile device.
The policy engine 332 further comprises a diagnostics module 344, a rule processing module 308, Rules 340 and representative examples of rules subsets, packet rules 310 and file rules 312. In addition to the packet filter engine 318, the driver 334 further comprises an application filter 322, in this example, implemented as a transport driver interface (TDI) filter 322 and a VPN module 320 embodied here as a VPN Lite 320 implementation discussed below. The TDI filter 322 comprises a communication interface with the packet rules subset 310 and the file rules 312 subset in this example. It also communicates with the packet filter engine 318 as part of the driver 334. The TDI filter 322 further comprises a communication interface with a Windows Socket (WinSock) layer 328 in application space. The Winsock layer implemented in this example as a Windows socket filter and communicates with one or more applications 330 in application space.
In this embodiment, network environment location detection is performed by the policy engine 332, in accordance with rules implementing one or more location detection tests in the Rules set 340, based on network parameters obtained by the NDIS driver for OSI layers 2-5, and by the TDI filter 322 for OSI layers 6 and 7. For example, the WinSock 328 captures information about network applications starting and stopping and what ports the applications will be using. This information is provided to the filter 318 and the policy engine 332 to provide application awareness. Furthermore, the policy engine 332, in accordance with the current security policy, provides rules with respect to applications. For example, the policy engine 332 may provide a list of which applications can or cannot access the network, as well as the target IP addresses and ports that they are or are not allowed to use. The policy engine 332 then enforces the current policy in accordance with these rules applicable to applications.
In this example, WinSock 328 is used to determine which application (e.g. browser e-mail application such as Outlook Exchange®) is accessing the network and what networking services the application will be using. An example of an application's network service usage could include Outlook Express opening a specific set of Winsock ports, each using a separate protocol and target I.P. address. The WinSock 328 will pass this information to the packet filter engine 318, which then informs the policy engine 332 using an event signaling mechanism. An example of an event signaling mechanism is to use named events to signal the policy engine 332 that some event has occurred.
Filtering of specific applications provides further resolution for location detection and enforcement mechanisms. The context of Microsoft® Networking provides an example of the benefits of such a filter. Several applications such as Exchange and Microsoft® File Sharing can and do use the same TCP and UDP ports. The NDIS filter driver 334 cannot determine which application is active based solely on TCP and UDP ports. The NDIS filter driver will act on the low level information i.e. TCP or UDP port numbers. When the packet arrives at the TDI layer 322, the TDI filter driver 322 determines based on one or more application parameters for which Microsoft Networking application a packet is destined and if the packet should be forwarded or filtered. For example, the TDI filter 322 provides to the driver, via IOCTL calls, “sessions” which provide information about applications opening ports for sending, listening (receiving), and details such as what protocol is being used and the target IP address of sent packets. Once the application closes the Winsock port, the TDI filter 322 can inform the packet driver that the session is now closed. These sessions allow the driver to be able to detect what incoming and outgoing packets should be allowed through the system and which packets should be forwarded or filtered.
A benefit of this embodiment is that it allows the NDIS filter driver 334 to do low level filtering based on port or protocol information and not have the overhead of application specific parsing. A modular approach to packet and application filtering is allowed.
The policy engine 332 also has a communication interface to management tools 316 of the operating system. The management tools 316 provide information to the policy engine 332 such as the types of adapters connected to the mobile device and specific information about each of them such as their brand name. The policy engine 332 also receives from the management tools 316 the local IP address associated with each adapter. Additionally management tools 316 alert the policy engine 332 that applications are running. For example, a process table maintained by the operating system may be monitored and notifications sent by the management tools 316 to the policy engine 332. For example, it may be determined whether 802.11i wired equivalency protection (WEP) software is running on a network adapter card through which wireless data is being sent and received. In this way, the policy engine 332 determines which security features are available in a system.
The policy engine 332 may create a security policy that is not inconsistent with the policies downloaded from the policy server 350. Additionally, modification and local management of policies as allowed, for example in accordance with permissions of policies set by the policy server 350. The Policy Engine 332 receives user input and sends output via a communication interface with the user interface module 302 to display and change policy settings responsive to user input.
Rules 340 comprise rules that define one or more security policies to be enforced by the policy engine 332. The policy engine 332 comprises a rule processing module 308 which executes tasks in accordance with determinations to be made as set by the rules for the current security policy and for directing the appropriate results dictated by the rules of the current policy.
In one embodiment, rules are pairings of logically grouped conditions with results. The following are examples of conditions, which may be connected by logical operators:
Check for the existence of a registry key
Check for a registry value
Check for the existence of a file
Check for a currently running application
Check for a currently running service
Check for the existence of network environment settings (includes a list of environments)
Verify that specified applications are running
Verify that specified protocols are enabled
Verify that specified VPN is running
The following are examples of results:
Can/Can't use the network
Can/Can't use the machine
Locked in to a certain location
Can/Can't access the file
Can/Can't use the application
Only transfer encrypted version of file.
Examples of subsets of rules are illustrated in
One example of an enforcement mechanism is referred to as stateful filtering. In one example, a security policy is called a type of shield or is referred to as a particular type of shield level. The state may hereafter be referred to as the shield state or shield.
If the filtering is performed on a packet basis, it is referred to as stateful packet filtering. In stateful packet filtering, a packet filter such as the packet filter engine 318 as its name suggests filters packets based on a state set by the currently enforced policy with respect to a parameter. Examples of such a parameter include source IP addresses (for received packets) or target IP addresses (for sent packets), port numbers, port types or a port group. A port group is a list of ports that are used by a particular application, network service or function. For example, a port group can be created that includes all the ports for a particular instant messaging application, or for all supported instant messaging applications, or for all applications used internally at a company. Examples of port groups that may be selected for processing by a policy include web surfing ports, gaming ports, FTP and SMTP ports, file sharing and network ports, and anti-virus updates and administration ports. A port group can contain individual port items or other port groups.
In this example, we discuss a version of stateful filtering called adaptive port blocking. In this example, there are rules comprising a mapping between a set of ports, port types, and actions. The ports are the actual port numbers, the port types enumerate the possible port types e.g. UDP, TCP, IP, or Ethertype, and the actions are what is to be done with this particular port e.g. filter, forward, or inform. The inform action will post an event to the policy engine 332 when a packet is sent or received on the specified port. Filter and forward action control the sending and receiving of packets on the specified port.
In one example, a policy is in effect that each port is in one of three modes: open, closed, or stateful. When the port is open, all traffic (both incoming and outgoing) on that port is permitted to flow through the packet filter. When the port is closed, all traffic on that port is blocked (both incoming and outgoing). When the port is stateful, all outgoing traffic on that port is permitted to flow through the packet filter, and incoming responses to that outgoing traffic are allowed back through, but unsolicited incoming traffic is blocked. In another example, incoming and outgoing traffic may be blocked on a basis, examples of which are a network service or an application.
In the system embodiment illustrated in
The policy engine 332 will pass the rules to the packet filter engine 318 as commands using the existing IOCTL interface. In one example, the policy engine determines based upon its current rules which ports or range of ports should do stateful filtering. These rules are then passed to the packet filter engine 318 by an IOCTL command. In another example, the policy engine 332 determines that rules of the current security policy do not support certain applications accessing a network. These rules are passed to the packet filter engine 318 as well as the TDI filter 322 for application specific filtering. The policy engine 332 may also pass rules about application-specific network access to the TDI filter 322 via an IOCTL interface.
Each component of the system may also provide health checks on the others. For example, the policy engine 332, the file filter 324, and the packet filter engine 318 report whether any of the other services have been disabled or removed from the system to the diagnostics module 344. This information may be relayed to the policy server 350 as it indicates a possible compromise of the protective system. The policy server 350 in that case provides diagnostic support information to the diagnostics module 344.
Stateful packet filtering deals with packets with different types of addresses. Outgoing packets have three different types of addresses: directed, multicast, or broadcast. Directed addresses are specific devices. Broadcast packets are typically used to obtain network configuration information whereas multicast packets are used for group applications such as NetMeeting®.
To establish session state information with a directed address is straightforward. The IP address and the port number are recorded in a session control block. When the remote responds the receive side of the filter engine will forward the packet because a session control block will exist for that particular session.
When the outgoing packet is a multicast packet there is a problem. Multicast packets are sent to a group; however, a multicast address is not used as a source address. Hence any replies to the outgoing multicast will have directed addresses in the source IP address. In this case the filter engine will examine the port to determine a response to a given multicast packet. When a response to the specified port is found a session control block will be completed i.e. the source address of this incoming packet will be used as the remote address for this particular session. However, more than one remote may respond to a given multicast packet, which will require a session control block be created for that particular remote. The broadcast packets may be handled in the same manner as the multicast.
The file rules subset 312 have a communications interface such as an IOCTL interface with a file filter 324 having a communication control interface with a file system 326. The file filter 324 may implement one or more filter related enforcement mechanisms. A policy may protect files based on the location in which they are created and/or modified as well as the location in which the mobile device is operating. The policy specifies a set of locations in which the files are to be made available, and whenever the mobile device is not operating in one of those locations, those files are unavailable. In another embodiment, policies may require that files be encrypted only if they were copied from certain network drives.
One reason for requiring that all files created and/or modified in one of the specified locations is so that copies of sensitive files or data derived from the sensitive files are also protected. Specific mechanisms for protecting the files include file hiding and file encryption.
When the mobile device is operating in one of the specified locations, the files can be located (e.g., they are not hidden). When the mobile device is operating in some other location, the files are hidden. One purpose of this mechanism is to prevent the user from accidentally revealing the contents of sensitive files while in locations where access to those files is not authorized.
One mechanism for hiding the files is to simply mark them “hidden” in their Windows properties pages, and to cache the access control list (ACL) on the file and then modify the permissions to deny all access by non-administrators. Other versions may use the file-system filter to more effectively render the files unavailable. Another way of protecting files is by preventing them from being opened.
In one embodiment, files that are subject to location-based protection by the policy are always stored encrypted. When the mobile device is associated with one of the specified locations, the files can be decrypted. When the mobile device is associated with some other location, the files cannot be decrypted. This mechanism provides a benefit of preventing unauthorized persons who may have stolen the device from gaining access to sensitive files.
One mechanism for encrypting the files is to simply mark them “encrypted” in their properties pages, and to rely on the file hiding feature (see above) to stop the files from being decrypted in an unauthorized location. Other versions may use the file-system filter to more effectively encrypt the files in a way that does not depend on the operating system to prevent them from being decrypted in an unauthorized location.
Policies can have rules controlling the use of VPNs. For example, a rule can require that when the VPN is in use, all other ports are closed. This prevents hackers near the user from co-opting the user's device and coming in to the corporate network over the user's VPN connection. In one embodiment, a lightweight web-based VPN is used that allows traffic from selected applications (e.g., email) to be encrypted with Transport Layer Security (TLS).
In one embodiment, a VPN Lite 320 having a communication interface with the packet filter engine 318 establishes a TLS-encrypted, authenticated connection with the server, and then sends and receives traffic over this connection. The TDI filter 322 diverts the outgoing traffic from the application to a VPN client piece 320, and incoming traffic from the VPN client piece 320 to the application.
In one implementation example in accordance with the present invention a layer is inserted into the Winsock environment, which opens up a Transport Layer Security (TLS) or Secure Socket Layer (SSL) socket to the VPN server, and tunnels all application network traffic through that connection to the VPN server. The applications are unaware that the VPN is active. The VPN has a very small footprint, since TLS is included in Windows®. In this example, using the Winsock Environment, all communication between client and server is routed through a secure channel. Unlike current clientless VPNs, all existing applications are supported.
As seen in the embodiment of
The diagnostics module 344 of the policy engine 332 performs similar functions discussed with respect to the client diagnostics module 246 of
In one embodiment, policy documents are XML documents. XML allows great flexibility in design, usage, and enhancement of policies. Using the flexibility of XML as the means to distribute enterprise wide policies simplifies the complex problem of distributing and enforcing enterprise wide policies. Policies are defined by the enterprise including but not limited to program usage, network access, hardware restrictions, VPN access, data access, and many other policies. The definition of these policies is performed at the enterprise level using XML schemas and documents. The policies may then be distributed to the enterprise clients via various forms of data transfer. Furthermore, the policies may also be protected from hacking by encryption or signatures (i.e. XKMS, XMLDSIG, XMLENC, or proprietary encryptions). The policy is then enforced on the client by a process that can interpret the policy distributed by the enterprise. This approach allows a policy to be extensible and easily changed by the administrator. Furthermore, policy management, compilation and interpretation are performed by policy aware application interfaces. Also, the administrator can configure elements of the policy such that they are configurable by the end user. In one example, the XML schema or XSD is derived from the standard XML schema http://www.w3.org/2001/XMLSchema (May 2001). In this example, a schema defines one set of types that is used by both the server (group) and the client policies. Policies may be signed to ensure integrity. Additionally individual policy elements will be signed to ensure integrity of policy enforcement.
In one embodiment, a very thin client host application resides on a client mobile device. For example, it may be part of the policy setting module 212 for the embodiment of
For example, assume version vX.01 of a product supports two types of security policies. For version X.02 it is necessary to implement a third type of security policy. The implementation and associated behaviors of the policy would be described within XML and published to the clients via the policy server. Clients running vX.01 would then effectively be upgraded without user intervention. In another example, this approach could be used for instantiating portions of an application to clients in a cafeteria style—e.g. they want features 1, 2, 3, 6, 8 and not 4, 5, 7. If the client requires a change to their implementation, they change their menu selections and implementation and behaviors are pushed to their respective client instances.
File Access ModuleA key aspect of the present invention is an ability to control access to files whether stored on the network at any of the servers or stored on the mobile client device. Such control over access includes whether they are stored on the mobile computing device, as well as whether they can be transferred from the mobile computing device, under what conditions and what ports or media. The present invention advantageously uses “source information” about the file or data being accessed in addition to location of the mobile device to dynamically establish a security protocol for that file and determine whether the file is visible and/or accessible.
Referring now to
Referring now to
The tag generator 502 has an input and an output and is coupled to work with the controller 508 to determine the source information for the file being accessed. The tag generator 502 is responsive to a file request or access, and in response generates a tag, label or record 400 as has been described above with reference to
The association module 504 has an input and an output, and is coupled to bus 252. The association module 504 works with the controller 508 to manage the name space and ensure that tags are unique for the files. In one embodiment, the association module creates a unique identification number that is provides to the tag generator 502 to ensure that each record created for file access or visibility is unique. The association module 504 also manages the relationships of the records to the files such that is the files are modified, moved or otherwise altered, the corresponding records are modified and invalidated if necessary.
The server version of the file access module 250a also optionally includes the file request log 506. The file request log 506 is maintained and updated by the controller 508. The file request log 506 is coupled to bus 252 to receive updates as to which files are accessed, read and written. In one embodiment, the file access log 506 records which files were accessed, to which client 201 they were sent or accessed by, and the tag or label that was provided to the client 201. The file request log 506 is shown as being in memory of the file access module 250a, but those skilled in the art will recognize that it is advantageous to store all or part of the file request log 506 on a non-volatile storage medium. If a breach in security is later detected, the file request log 506 can be used forensically to help determine the source of the file, the instances when the file was transferred or accessed, and possible clients and servers that are not enforcing a security policy correctly. The file request log 506 would be reviewed to perform such analysis whether it was programmatically or manually.
The controller 508 is of a conventional type and is coupled to the bus 252 for communication and interaction with the tag generator 502, the association module 504, the file request log 506 and the server 200. In particular, the controller 508 works with the authorization module 232 and the policy management module 236 of the server 200. For example, the authorization module 232 may only provide the file and access if they have security software with an appropriate policy on the client device, or if they have the security features operable at the client to allow access and transfer of the file. As has noted above, a key feature of the present invention is to use both the source information and the location information to determine the appropriate security policy and enforce it upon the mobile client devices.
The file access module 250b also includes source date storage 530. The source data storage 530 can be used to store tags or labels created by the tag generator 522 at the mobile client device 201. In one embodiment, the tags are created and stored at the mobile client device 201 in the source data storage 530 for use repeatedly in determining whether a file should be made visible or accessible. Such tags can be re-used for as long as the files or data are stored on the on the mobile client device 201. In an alternate embodiment, no such source date storage 530 is needed because the tag generator 522 generates the source information on the fly as the requests for file access or visibility are received. The source data storage 530 is coupled by the bus 254 to the controller 528 and to the policy setting module 212 and the policy enforcement module 214.
The methods described below with reference to
Referring now to
Referring now to
The method 710 begins in step 1002 by determining whether the policy adjusted for source and location information allows the file to be deleted. If so the method continues in step 1004 to permit the user to delete the file. If not the method continues to determine 1006 whether the policy adjusted for source and location information allows the file to be opened. If so, method continues to permit 1008 the user to open the file and view the data. If not the method continues step 1010 to determine whether the policy adjusted for source and location information allows the file to be sent via email. If so, the method permits 1012 the user to email the file. In steps 1014, 1016 the method determines whether file transfer using a file transfer protocol is allowable, and permits if it is. Similarly, the method test and allow if permissible access via universal serial bus, an infrared interface, a serial interface and a parallel interface in step 1018, 1020, 1022 and 1024.
The foregoing description of the embodiments of the present invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the present invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the present invention be limited not by this detailed description, but rather by the claims of this application. As will be understood by those familiar with the art, the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, routines, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the present invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, routines, features, attributes, methodologies and other aspects of the present invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component, an example of which is a module, of the present invention is implemented as software, the component can be implemented as a standalone program, as part of a larger program, as a plurality of separate programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of ordinary skill in the art of computer programming.
Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. For example, one embodiment of the present invention is applicable to ad hoc peer-to-peer connections. Access using such connections could be allowed based on key length. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the present invention, which is set forth in the following claims.
Claims
1-21. (canceled)
22. A method for providing security to a mobile device, comprising:
- automatically detecting a location of a mobile device; and
- implementing on the mobile device a first security policy when the mobile device is located in a first location, and implementing on the mobile device a second security policy when the mobile device is located in a second location.
23. The method of claim 22, comprising pre-configuring security policies for a plurality of locations.
24. The method of claim 23, wherein the plurality of locations comprises a home, a work, an alternate, or a custom location.
25. The method of claim 23, wherein the plurality of security policies are stored on a memory of the mobile device.
26. The method of claim 23, wherein the plurality of security policies are accessed over a network connection.
27. The method of claim 22, further comprising implementing on the mobile device a third security policy when the mobile device is located in a third location.
28. The method of claim 22, wherein the location of the mobile device is detected based on one or more parameters received from a network connection.
29. The method of claim 28, wherein one of the parameters is an Internet Protocol address.
30. The method of claim 22, wherein the mobile device continues to detect the location of the mobile device and applies an appropriate policy automatically when a location of the mobile device changes.
31. The method of claim 28, wherein the network connection is a wireless network connection.
32. The method of claim 22, further comprising:
- determining whether one or more security features have an activity status of inactive or active; and
- determining the current security policy based upon the activity status of the one or more security features as well as the detected location.
33. A mobile device comprising:
- a memory storing a plurality of locations, each location associated with a security policy;
- a processor configured to:
- automatically detect a location of a mobile device; and
- implement on the mobile device a first security policy when the mobile device is located in a first location, and implement on the mobile device a second security policy when the mobile device is located in a second location.
34. The mobile device of claim 33, wherein the mobile device is configured to connect to a network wirelessly.
35. The mobile device of claim 33, wherein the plurality of locations comprises a home, a work, an alternate, or a custom location.
36. The mobile device of claim 33, wherein the processor is configured to implement on the mobile device a third security policy when the mobile device is located in a third location.
37. The mobile device of claim 33, wherein the location of the mobile device is detected based on one or more parameters received from a network connection.
38. The mobile device of claim 37, wherein one of the parameters is an Internet Protocol address.
39. The mobile device of claim 33, wherein the processor is configured to continuously detect the location of the mobile device and apply an appropriate policy automatically when a location of the mobile device changes.
40. The mobile device of claim 34, wherein the processor is further configured to:
- determine whether one or more security features have an activity status of inactive or active; and
- determine the current security policy based upon the activity status of the one or more security features as well as the detected location.
Type: Application
Filed: Feb 7, 2014
Publication Date: Jun 9, 2016
Applicant: Apple Inc. (Cupertino, CA)
Inventors: Peter BOUCHER (Orem, UT), Michael WRIGHT (Sandy, UT), Tim CRANNY (Omaha, NE), Gabe NAULT (Draper, UT), Merrill SMITH (Riverton, UT)
Application Number: 14/175,640
