Systems and methods for enforcing secure shared access on computing devices by context pinning
The disclosed computer-implemented method for enforcing secure shared access on computing devices by context pinning may include recording, on the computing device, one or more actions performed on one or more applications, determining, based on the recorded actions and applications, a context that defines permitted actions and applications for a guest user of the computing device, monitoring, based on the context, user activity on the computing device, detecting an activity that violates the context, and performing, in response to the detection, a security action. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for enforcing secure shared access on computing devices by context pinning, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
recording, on the computing device, one or more actions performed on one or more applications;
establishing a context that defines permitted actions and applications for a guest user of the computing device by defining the permitted actions and applications from the recorded actions and applications;
enabling, based on the established context, a context pinning mode on the computing device;
monitoring, based on the context, user activity on the computing device;
detecting an activity that violates the context; and
performing, in response to the detection, a security action.
2. The method of claim 1 , wherein the security action comprises at least one of locking the computing device, disabling the computing device, preventing the activity that violates the context from completing, and presenting a warning.
3. The method of claim 1 , wherein recording the one or more actions comprises recording at least one of screen metadata, container metadata, dialogue names, content change events, and state change events.
4. The method of claim 1 , wherein recording the one or more actions comprises recording mutation events based on monitoring an accessibility service event of an operating system of the computing device.
5. The method of claim 1 ,
wherein the context comprises a permit table of permitted mutation events;
wherein monitoring user activity further comprises detecting a mutation event based on the user activity; and
wherein detecting activity that violates the context further comprises determining that the mutation event is absent from the permit table.
6. The method of claim 1 , wherein recording the one or more actions further comprises:
presenting a floating widget;
receiving a first indication, via the floating widget, to begin recording user activity; and
receiving a second indication, via the floating widget, to cease recording.
7. The method of claim 1 , wherein determining the context further comprises incorporating a whitelist of permitted actions and applications.
8. The method of claim 1 , further comprising storing the context in a local database.
9. A system for enforcing secure shared access on computing devices by context pinning, the system comprising:
at least one physical processor;
physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
record, on a computing device, one or more actions performed on one or more applications;
establish a context that defines permitted actions and applications for a guest user of the computing device by defining the permitted actions and applications from the recorded actions and applications;
enable, based on the established context, a context pinning mode on the computing device;
monitor, based on the context, user activity on the computing device;
detect an activity that violates the context; and
perform, in response to the detection, a security action.
10. The system of claim 9 , wherein the security action comprises at least one of locking the computing device, disabling the computing device, preventing the activity that violates the context from completing, and presenting a warning.
11. The system of claim 9 , wherein the instructions for recording the one or more actions comprise instructions for recording at least one of screen metadata, container metadata, dialogue names, content change events, and state change events.
12. The system of claim 9 , wherein the instructions for recording the one or more actions comprise instructions for recording mutation events based on monitoring an accessibility service event of an operating system of the computing device.
13. The system of claim 9 ,
wherein the context comprises a permit table of permitted mutation events;
wherein the instructions for monitoring user activity further comprise instructions for detecting a mutation event based on the user activity; and
wherein the instructions for detecting activity that violates the context further comprise instructions for determining that the mutation event is absent from the permit table.
14. The system of claim 9 , wherein the instructions for recording the one or more actions further comprise instructions for:
presenting a floating widget;
receiving a first indication, via the floating widget, to begin recording user activity; and
receiving a second indication, via the floating widget, to cease recording.
15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
record, on the computing device, one or more actions performed on one or more applications;
establish a context that defines permitted actions and applications for a guest user of the computing device by defining the permitted actions and applications from the recorded actions and applications;
enable, based on the established context, a context pinning mode on the computing device;
monitor, based on the context, user activity on the computing device;
detect an activity that violates the context; and
perform, in response to the detection, a security action.
16. The non-transitory computer-readable medium of claim 15 , wherein the security action comprises at least one of locking the computing device, disabling the computing device, preventing the activity that violates the context from completing, and presenting a warning.
17. The non-transitory computer-readable medium of claim 15 , wherein the instructions for recording the one or more actions comprise instructions for recording at least one of screen metadata, container metadata, dialogue names, content change events, and state change events.
18. The non-transitory computer-readable medium of claim 15 , wherein the instructions for recording the one or more actions comprise instructions for recording mutation events based on monitoring an accessibility service event of an operating system of the computing device.
19. The non-transitory computer-readable medium of claim 15 ,
wherein the context comprises a permit table of permitted mutation events;
wherein the instructions for monitoring user activity further comprise instructions for detecting a mutation event based on the user activity; and
wherein the instructions for detecting activity that violates the context further comprise instructions for determining that the mutation event is absent from the permit table.
20. The non-transitory computer-readable medium of claim 15 , wherein the instructions for recording the one or more actions further comprise instructions for:
presenting a floating widget;
receiving a first indication, via the floating widget, to begin recording user activity; and
receiving a second indication, via the floating widget, to cease recording.