Dividing a data processing device into separate security domains
View Patent ↗This invention provides secure, policy-based separation of data and applications on computer, especially personal computers that operate in different environments, such as those including personal applications and corporate applications, so that both types of applications can run simultaneously while complying with all required policies. The invention enables employees to use their personal devices for work purposes, or work devices for personal purposes. The secure, policy-based separation is created by dividing the data processing device into two or more “domains,” each with its own policies. These policies may be configured by the device owner, an IT department, or other data or application owner.
1. A method for use of a computer device in two or more data security domains, the method comprising:
associating a first computer data processing device application with a first domain that is defined according to an external policy;
bounding a first loader application to the first computer data processing device application, wherein the first loader application is configured to intercept and mediate requests between the first computer data processing device application and an operating system according to specifications of the external policy of the first domain without modifying the first computer data processing device application and without requiring operating system privileges, and the first loader application is located logically between the first computer data processing device application and the operating system;
associating a first virtual private network (“VPN”) client application with the first domain;
binding a second loader application to the first VPN client application, wherein the second loader application is configured to moderate activity of the first VPN client application according to specifications of the external policy of the first domain; and
in response to network data packets being in accordance with specifications of policies of the first domain at a first domain import-export policy enforcement point between first computer data processing device application and the first VPN client application, exchanging the network data packets from the first computer data processing device application to the first VPN client application.
2. The method of claim 1 , further comprising:
sending network data packets from the first computer data processing device application to the first domain import-export policy enforcement point;
verifying at the first domain import-export policy enforcement point that the network data packets conform to the specifications of the policies of the first domain;
responsive to the network data packets conforming to the specifications, sending normal network data packets from the first domain import-export policy enforcement point to the first VPN client application;
encrypting the network data packets by the first VPN client application; and
sending the encrypted network data packets to a VPN server.
3. The method of claim 2 , further comprising:
decrypting the encrypted network data packets by the VPN server;
sending the network data packets to a web server;
sending a response from the web server to the VPN server;
encrypting the response by the VPN server;
sending the encrypted response to the first VPN client application;
decrypting the encrypted response by the first VPN client application; and
sending the response from the first VPN client application to the first computer data processing device application.
4. The method of claim 3 , wherein:
the network data packets are sent from the first computer data processing device application to the first VPN client application through a virtual network interface;
the encrypted network data packets are sent from the first VPN client application through a hardware network interface; and
the encrypted response is sent from the VPN server to the first VPN client application through the hardware network interface and a virtual network interface.
5. The method of claim 4 , further comprising associating a second computer data processing device application with a second domain defined according to a second external policy, wherein the second domain has different security protocols and permissions than the first domain.
6. The method of claim 1 , further comprising:
associating a second VPN client application to a second domain,
binding the second VPN client application to a third loader application, wherein the first domain import-export policy enforcement point is in communication with the first VPN client application and the second VPN client application;
determining an address in a packet header of the network data packets received at the first domain import-export policy enforcement point; and
exchanging the network data packets to the first VPN client application or the second VPN client application based on the address in the packet headers.
7. The method of claim 6 , wherein the first domain import-export policy enforcement point supports the first VPN client application or the second VPN client application simultaneously.
8. The method of claim 1 , further comprising:
sending non-domain network data packets from a non-domain computer data processing device application to the first domain import-export policy enforcement point, wherein the non-domain computer data processing device applications is unassociated with any domain;
verifying by the first domain import-export policy enforcement point that the non-domain network data packets conform to the specifications of the policies of the first domain; and
sending the non-domain network data packets from the first domain import-export policy enforcement point to the first VPN client application.
9. The method of claim 8 , further comprising:
intercepting the non-domain network data packets by the second loader application as the non-domain network data packets arrive through a file descriptor; and
sending the non-domain network data packets through a network socket created by the second loader application to a web server over a public internet.
10. The method of claim 9 , wherein:
the non-domain network data packets are sent from the second VPN client application to the web server through a hardware network interface; and
the sending the non-domain network data packets over the public internet bypasses the VPN client.
11. A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations for use of a computer device in two or more data security domains, the operations comprising:
associating a first computer data processing device application with a first domain that is defined according to an external policy;
bounding a first loader application to the first computer data processing device application, wherein the first loader application is configured to intercept and mediate requests between the first computer data processing device application and an operating system according to specifications of the external policy of the first domain without modifying the first computer data processing device application and without requiring operating system privileges, and the first loader application is located logically between the first computer data processing device application and the operating system;
associating a first virtual private network (“VPN”) client application with the first domain;
binding a second loader application to the first VPN client application, wherein the second loader application is configured to moderate activity of the VPN client application according to specifications of the external policy of the first domain; and
in response to network data packets being in accordance with specifications of policies of the first domain at a first domain import-export policy enforcement point between first computer data processing device application and the first VPN client application, exchanging the network data packets from the first computer data processing device application to the first VPN client application.
12. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:
sending network data packets from the first computer data processing device application to the first domain import-export policy enforcement point;
verifying at the first domain import-export policy enforcement point that the network data packets conform to the specifications of the policies of the first domain;
responsive to the network data packets conforming to the specifications, sending normal network data packets from the first domain import-export policy enforcement point to the first VPN client application;
encrypting the network data packets by the first VPN client application; and
sending the encrypted network data packets to a VPN server.
13. The non-transitory computer-readable medium of claim 12 , wherein the operations further comprise:
decrypting the encrypted network data packets by the VPN server;
sending the network data packets to a web server;
sending a response from the web server to the VPN server;
encrypting the response by the VPN server;
sending the encrypted response to the first VPN client application;
decrypting the encrypted response by the first VPN client application; and
sending the response from the first VPN client application to the first computer data processing device application.
14. The non-transitory computer-readable medium of claim 13 , wherein:
the network data packets are sent from the first computer data processing device application to the first VPN client application through a virtual network interface;
the encrypted network data packets are sent from the first VPN client application through a hardware network interface; and
the encrypted response is sent from the VPN server to the first VPN client application through the hardware network interface and a virtual network interface.
15. The non-transitory computer-readable medium of claim 14 , wherein:
the operations further comprise associating a second computer data processing device application with a second domain defined according to a second external policy; and
the second domain has different security protocols and permissions than the first domain.
16. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:
associating a second VPN client application to a second domain,
binding the second VPN client application to a third loader application, wherein the first domain import-export policy enforcement point is in communication with the first VPN client application and the second VPN client application;
determining an address in a packet header of the network data packets received at the first domain import-export policy enforcement point; and
exchanging the network data packets to the first VPN client application or the second VPN client application based on the address in the packet headers.
17. The non-transitory computer-readable medium of claim 16 , wherein the first domain import-export policy enforcement point supports the first VPN client application or the second VPN client application simultaneously.
18. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:
sending non-domain network data packets from a non-domain computer data processing device application to the first domain import-export policy enforcement point, wherein the non-domain computer data processing device applications is unassociated with any domain;
verifying by the first domain import-export policy enforcement point that the non-domain network data packets conform to the specifications of the policies of the first domain; and
sending the non-domain network data packets from the first domain import-export policy enforcement point to the first VPN client application.
19. The non-transitory computer-readable medium of claim 18 , wherein the operations further comprise:
intercepting the non-domain network data packets by the second loader application as the non-domain network data packets arrive through a file descriptor; and
sending the non-domain network data packets through a network socket created by the second loader application to a web server over a public internet.
20. The non-transitory computer-readable medium of claim 19 , wherein:
the non-domain network data packets are sent from the second VPN client application to the web server through a hardware network interface; and
the sending the non-domain network data packets over the public internet bypasses the VPN client.