Application access permissions in supervised zone
A computer stores, within a single user account, multiple supervised computing resources and multiple additional computing resources. The multiple supervised computing resources are associated with a security policy. The computer executes a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources. The computer executes, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources. The computer applies rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application.
1. A method comprising:
storing, at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy, wherein the multiple supervised computing resources reside within a supervised zone, the supervised zone comprising a portion of data associated with a native computing environment of the computing machine;
executing a first instance of a specified application externally to the supervised zone, wherein the first instance has read access and has write access to data outside the supervised zone, wherein the first instance lacks read access and lacks write access to data stored within the supervised zone; and
executing, simultaneously with the first instance, a second instance of the specified application within the supervised zone, wherein the second instance has read access and lacks write access to data outside the supervised zone, wherein the second instance has read access and has write access to data stored within the supervised zone, wherein the second instance runs separately and distinctly from the first instance, wherein:
the second instance of the specified application accesses a network via a supervised network interface, the security policy specifying networks or subnets accessible via the supervised network interface,
the supervised network interface isolates domain name system (DNS) traffic associated with the supervised zone,
the first instance of the specified application accesses the network via a native network interface of the computing machine and not via the supervised network interface, and
the supervised network interface restricts the multiple additional resources, residing externally to the supervised zone, from accessing network resources associated with the supervised zone.
2. The method of claim 1 , wherein the additional computing resources comprise personal computing resources, wherein the supervised computing resources comprise organizational computing resources, wherein the multiple supervised computing resources and the multiple additional computing resources comprise files or applications.
3. The method of claim 1 , wherein:
the first instance of the specified application accesses a Component Object Model (COM) of the computing machine, and
the second instance of the specified application accesses an emulated COM of the supervised zone that is different from the COM of the computing machine.
4. The method of claim 1 , wherein:
the first instance of the specified application accesses, for interprocess communication, a remote procedure call (RPC) subsystem of the computing machine, and
the second instance of the specified application accesses, for interprocess communication, an emulated RPC subsystem of the supervised zone that is different from the RPC subsystem of the computing machine.
5. The method of claim 1 , wherein:
the first instance of the specified application accesses common app platform application programming interfaces (APIs) available to universal applications of the computing machine,
the second instance of the specified application accesses emulated common app platform APIs available to universal applications on the supervised zone that is different from the common app platform APIs available to universal applications of the computing machine.
6. The method of claim 1 , wherein:
the first instance of the specified application accesses common app platform application programming interfaces (APIs) available to universal applications of the computing machine,
the second instance of the specified application accesses emulated common app platform APIs available to universal applications of the supervised zone that is different from the common app platform APIs available to universal applications features of the computing machine,
the common app platform features comprise at least one of: Shell Infrastructure Host (sihost), State Repository Service, Background Task Infrastructure, User Manager Service, Azure Active Directory (AAD) Broker, and Windows Credentials Manager,
the Background Task Infrastructure comprises Host Activity Manager, and
the User Manager Service comprises Application Activation Manager and View Manager.
7. The method of claim 1 , wherein:
the computing machine stores, externally to the supervised zone, a set of global objects,
the computing machine stores, within the supervised zone, an emulated set of global objects emulating the set of global objects,
the first instance of the specified application accesses the set of global objects, and
the second instance of the specified application accesses the emulated set of global objects.
8. The method of claim 1 , wherein:
the computing machine stores, externally to the supervised zone, a computing machine registry representing settings comprising of hardware device configurations, installed application settings, and operating system settings,
the computing machine stores, within the supervised zone, an emulated registry emulating the computing machine registry for applications executing within the supervised zone,
the first instance of the specified application accesses the computing machine registry, and
the second instance of the specified application accesses the emulated registry.
9. The method of claim 1 , wherein:
the specified application is a file manager application,
the first instance is for access to files from the multiple additional computing resources, and
the second instance is for access to files from the multiple supervised computing resources and read-only access to the multiple additional computing resources.
10. The method of claim 1 , further comprising:
accessing, via a file explorer of the computing machine, a request to open a selected file, wherein the file explorer executes externally to the supervised zone, wherein the file has an associated application, wherein the file explorer provides access to both files external to the supervised zone and files internal to the supervised zone;
determining whether the selected file is from among the multiple supervised computing resources;
upon determining that the selected file is from among the multiple supervised computing resources: opening the selected file using an instance of the associated application executing within with the supervised zone; and
upon determining that the selected file is not from among the multiple supervised computing resources: opening the selected file using an instance of the associated application not executing within the supervised zone.
11. The method of claim 1 , wherein an operating system of the computing machine lacks access to the multiple supervised computing resources from outside the supervised zone.
12. The method of claim 1 , wherein a security program is able to access both the supervised zone and the unsupervised zone, wherein the security program comprises one or more of an antivirus program, an anti-malware program or a security auditing tool.
13. The method of claim 12 , further comprising:
identifying a program as the security program based on a data structure storing known security programs and a digital signature associated with the program; and
in response to the digital signature being associated with one of the known security programs in the data structures: transmitting, to a driver of the computing machine, a message indicating that the program is to be able to access both the supervised zone and the unsupervised zone.
14. The method of claim 1 , further comprising:
accessing, using a restricted instance of the specified application executing in a restricted zone, an unsecure computing resource;
blocking access, by the restricted instance of the specified application, to any and all of the multiple supervised computing resources and any and all of the multiple additional computing resources.
15. The method of claim 14 , wherein a security program is able to access the supervised zone, the unsupervised zone, and the restricted zone, wherein the security program comprises one or more of an antivirus program, an anti-malware program or a security auditing tool.
16. The method of claim 15 , further comprising:
identifying the unsecure computing resource based on the unsecure computing resource residing in a download memory region, a memory region associated with attachments for an email application, or a memory region associated with a web browser.
17. The method of claim 16 , wherein the download memory region comprises a download folder, wherein the memory region associated with the web browser comprises the download folder, wherein the memory region associated with the attachments for the email application comprises an attachment folder.
18. The method of claim 1 , further comprising:
opening, via the second instance, an additional application or webpage different from the specified application; and
executing the additional application or webpage within the supervised zone, wherein the additional application or webpage has read access and lacks write access to data outside the supervised zone, wherein the additional application or webpage has read access and has write access to data stored within the supervised zone.
19. A non-transitory machine-readable medium storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy, wherein the multiple supervised computing resources reside within a supervised zone, the supervised zone comprising a portion of data associated with a native computing environment of the computing machine;
executing a first instance of a specified application externally to the supervised zone, wherein the first instance has read access and has write access to data outside the supervised zone, wherein the first instance lacks read access and lacks write access to data stored within the supervised zone; and
executing, simultaneously with the first instance, a second instance of the specified application within the supervised zone, wherein the second instance has read access and lacks write access to data outside the supervised zone, wherein the second instance has read access and has write access to data stored within the supervised zone, wherein the second instance runs separately and distinctly from the first instance, wherein:
the first instance of the specified application accesses a Component Object Model (COM) of the computing machine, and
the second instance of the specified application accesses an emulated COM of the supervised zone that is different from the COM of the computing machine.
20. A system comprising:
processing circuitry; and
a memory storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy, wherein the multiple supervised computing resources reside within a supervised zone, the supervised zone comprising a portion of data associated with a native computing environment of the computing machine;
executing a first instance of a specified application externally to the supervised zone, wherein the first instance has read access and has write access to data outside the supervised zone, wherein the first instance lacks read access and lacks write access to data stored within the supervised zone; and
executing, simultaneously with the first instance, a second instance of the specified application within the supervised zone, wherein the second instance has read access and lacks write access to data outside the supervised zone, wherein the second instance has read access and has write access to data stored within the supervised zone, wherein the second instance runs separately and distinctly from the first instance, wherein:
the first instance of the specified application accesses a Component Object Model (COM) of the computing machine, and
the second instance of the specified application accesses an emulated COM of the supervised zone that is different from the COM of the computing machine.