Granted Patent B1

US 10,803,167 · App. 15/899,384 · Granted Oct 13, 2020

Abstract

Claims (53)

1. A computer-implemented method for executing application launchers, at least a portion of the method being performed by a computing device comprising at least one hardware processor, the method comprising:

creating a security sandbox within an operating system environment, wherein the security sandbox is configured to intercept system calls by swapping a package name with an identifier that corresponds to the security sandbox so as to conceal the security sandbox from an outside of the operating system environment and prevent a leakage of a target application identifier;

executing an original application launcher within the security sandbox; and

registering the security sandbox as a new application launcher within the operating system environment such that:

the original application launcher is still available to a user through the security sandbox; and

the security sandbox supplements the original application launcher by providing a virtualization layer of protection for the user that overlays from the operating system environment by controlling the original application launcher executing in the security sandbox and performing a security action distinct from functionality of the original application launcher.

2. The computer-implemented method of claim 1 , wherein the security sandbox is configured to obey a set of rules that the operating system environment imposes on applications to register as a new application launcher.

3. The computer-implemented method of claim 1 , wherein the security sandbox substantially omits any application launcher functionality beyond that provided by the original application launcher.

4. The computer-implemented method of claim 1 , wherein the original application launcher comprises one of:

a factory default application launcher provided by the operating system environment; and

a third-party substitute application launcher that the user downloaded.

5. The computer-implemented method of claim 1 , wherein the security sandbox inherits at least some application launcher functionality of the original application launcher.

6. The computer-implemented method of claim 1 , wherein registering the security sandbox as the new application launcher within the operating system environment enables the security sandbox to:

intercept an attempted action to be performed by the original application launcher;

apply a security policy against the attempted action to evaluate whether to allow the attempted action to be performed; and

selectively block the attempted action based on the security policy.

7. The computer-implemented method of claim 1 , wherein the security sandbox simulates execution of the original application launcher in a non-sandboxed operating system environment.

8. The computer-implemented method of claim 1 , wherein the security sandbox includes a set of programming hooks that are located at a location of at least one of:

a file access function for interacting with storage; and

a binder function for interacting with services.

9. The computer-implemented method of claim 1 , wherein executing the original application launcher within the security sandbox comprises loading the original application launcher into a process space of the security sandbox using a class loader.

10. The computer-implemented method of claim 1 , further comprising:

creating a proxy activity that serves as a container for the original application launcher;

registering the proxy activity as a home application launcher within the operating system environment; and

upon launching the proxy activity, rebinding the security sandbox to the proxy activity.

11. A system for sandboxing application launchers, the system comprising:

a creation module, stored in memory, that creates a security sandbox within an operating system environment, wherein the security sandbox is configured to intercept system calls by swapping a package name with an identifier that corresponds to the security sandbox so as to conceal the security sandbox from an outside of the operating system environment and prevent a leakage of a target application identifier;

an execution module, stored in memory, that executes an original application launcher within the security sandbox;

a registration module, stored in memory, that registers the security sandbox as a new application launcher within the operating system environment such that:

the original application launcher is still available to a user through the security sandbox; and

the security sandbox supplements the original application launcher by providing a virtualization layer of protection for the user that overlays from the operating system environment by controlling the original application launcher executing in the security sandbox and performing a security action distinct from functionality of the original application launcher; and

at least one physical processor configured to execute the creation module, the execution module, and the registration module.

12. The system of claim 11 , wherein the security sandbox is configured to obey a set of rules that the operating system environment imposes on applications to register as a new application launcher.

13. The system of claim 11 , wherein the security sandbox substantially omits any application launcher functionality beyond that provided by the original application launcher.

14. The system of claim 11 , wherein the original application launcher comprises one of:

a factory default application launcher provided by the operating system environment; and

a third-party substitute application launcher that the user downloaded.

15. The system of claim 11 , wherein the security sandbox inherits at least some application launcher functionality of the original application launcher.

16. The system of claim 11 , wherein the registration module registers the security sandbox as the new application launcher within the operating system environment in a manner that enables the security sandbox to:

intercept an attempted action to be performed by the original application launcher;

apply a security policy against the attempted action to evaluate whether to allow the attempted action to be performed; and

selectively block the attempted action based on the security policy.

17. The system of claim 11 , wherein the security sandbox simulates execution of the original application launcher in a non-sandboxed operating system environment.

18. The system of claim 11 , wherein the security sandbox includes a set of programming hooks that are located at a location of at least one of:

a file access function for interacting with storage; and

a binder function for interacting with services.

19. The system of claim 11 , wherein the execution module executes the original application launcher within the security sandbox by loading the original application launcher into a process space of the security sandbox using a class loader.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one hardware processor of a computing device, cause the computing device to:

create a security sandbox within an operating system environment, wherein the security sandbox is configured to intercept system calls by swapping a package name with an identifier that corresponds to the security sandbox so as to conceal the security sandbox from an outside of the operating system environment and prevent a leakage of a target application identifier;

execute an original application launcher within the security sandbox; and

register the security sandbox as a new application launcher within the operating system environment such that:

the original application launcher is still available to a user through the security sandbox; and

the security sandbox supplements the original application launcher by providing a virtualization layer of protection for the user that overlays from the operating system environment by controlling the original application launcher executing in the security sandbox and performing a security action distinct from functionality of the original application launcher.

Assignments (6)