Contextual virtual machines for application quarantine and assessment method and system
Described are embodiments that provide for the use of multiple quarantine partitions and/or multi-partition spaces (e.g., virtual machines) for initially installing and running downloaded content. The downloaded content can be run securely in the quarantine partitions and/or multi-partition spaces. Each quarantine partition and/or multi-partition space can be configured differently with different capabilities. Based on the configuration and capabilities of the quarantine partitions and/or multi-partition spaces, the downloaded content may have limited capabilities to access secure data, applications, or other code limiting the damage that the content can potentially cause.
1. A system, comprising:
a non-transitory computer readable medium operable to store computer executable instructions;
a processor in communication with the computer readable medium, the processor operable to execute the computer executable instructions to perform operations comprising:
installing a same downloaded content in a plurality of multi-partition space quarantine partitions for a plurality of virtual machines stored in the computer readable medium of a computing device, wherein a first one of the plurality of multi-partition space quarantine partitions comprises a first set of capabilities that is more restrictive than a second one of the plurality of multi-partition space quarantine partitions;
executing the downloaded content in the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions;
monitoring execution of the downloaded content in the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions to generate monitored information; and
storing the monitored information of the downloaded content in the computer readable medium.
2. The system as defined in claim 1 , wherein the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions runs in a first and second virtual machine respectively, wherein the first virtual machine is associated with a first user context, wherein the second virtual machine is associated with a second user context that is a different user context of the same user.
3. The system as defined in claim 2 , wherein the system further comprises determining the first user context before the installing.
4. The system as defined in claim 1 , wherein the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions runs in a first and second virtual machine respectively, wherein the first virtual machine is associated with a first user context and the second virtual machine is associated with a second user context, wherein of the first and second virtual machines are associated with a different set of boundary conditions, and wherein the system further comprises:
determining from the stored monitored information whether the downloaded content has requested access beyond the first set of capabilities.
5. The system as defined in claim 4 , wherein, in response to determining that the stored monitored information indicates that an application has requested access beyond the first set of capabilities, preventing the downloaded content from being installed in a host operating system.
6. The system as defined in claim 4 , wherein in response to determining that the stored monitored information indicates that the downloaded content has requested access beyond the first set of capabilities, prompting a user for approval to install the application in a host operating system.
7. The system as defined in claim 4 , wherein the first virtual machine does not allow the downloaded content to access some information.
8. The system as defined in claim 4 , wherein the first virtual machine provides limited responses to the downloaded content in response to requests by the downloaded content to access information that requires access beyond the first set of capabilities.
9. The system as defined in claim 1 , wherein during execution, in response to a request to access information that requires access beyond the first set of capabilities, displaying an approval prompt to receive input regarding allowance of access to the information that requires access beyond the first set of capabilities.
10. A method for executing an application on a mobile device,
the method comprising:
determining a first user context of a user of the mobile device;
installing downloaded content in a plurality of multi-partition space quarantine partitions for a plurality of virtual machines stored in a computer readable medium of the mobile device, wherein a first one of the plurality of multi-partition space quarantine partitions is associated with the first user context and a second one of the plurality of multi-partition space quarantine partitions is associated with a different user context of the user;
executing the downloaded content in the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions;
monitoring execution of the downloaded content in the first one of the plurality of multi-partition space quarantine partitions and the second one of the plurality of multi-partition space quarantine partitions to generate monitored information; and
storing the monitored information of the downloaded content in a computer readable medium.
11. The method as defined in claim 10 , wherein the determining comprises receiving input identifying the first user context.
12. The method as defined in claim 10 , wherein the determining comprises evaluating one or more of: a current time, a current location, and a current activity.
13. The method as defined in claim 10 , wherein the monitoring occurs for a predetermined period of time.
14. The method as defined in claim 13 , further comprising:
receiving an indication of the predetermined period of time prior to the monitoring step.
15. The method as defined in claim 10 , wherein the first one of the plurality of multi-partition space quarantine partitions provides limited responses to the downloaded content in response to requests by the downloaded content to access information that requires access beyond capabilities of the first at least one of a quarantine partition and a multi-partition space.
16. The method as defined in claim 14 , wherein the first one of the plurality of multi-partition space quarantine partitions runs in a first virtual machine and comprises a first set of capabilities that is more restrictive than a second set of capabilities of the second one of the plurality of multi-partition space quarantine partitions.
17. A non-transitory computer readable medium including computer executable instructions stored onto the computer readable medium which, when executed by one or more processors of a computer, causes the computer to perform operations comprising:
determining a first user context;
installing a downloaded content in a first plurality of multi-partition space quarantine partitions for a first plurality of virtual machines stored in a computer readable medium of the computer, wherein a first one of the plurality of the multi-partition space of quarantine partitions is associated with the first context;
executing the first downloaded content in the first one of the plurality of the multi-partition space of quarantine partitions;
monitoring execution of the first downloaded content in the first one of the plurality of the multi-partition space of quarantine partitions;
storing first monitored information of the first downloaded content in a computer readable medium;
determining a second user context;
installing a second downloaded content in a second one of the plurality of multi-partition space quarantine partitions stored in the computer readable medium, wherein the second one of the plurality of multi-partition space quarantine partitions is associated with the second user context, wherein the first one of the plurality of multi-partition space quarantine partitions comprises a first set of capabilities that is more restrictive than a second set of capabilities of the second one of the plurality of multi-partition space quarantine partitions;
executing the second downloaded content in the second one of the plurality of multi-partition space quarantine partitions;
monitoring execution of the second downloaded content in the second one of the plurality of multi-partition space quarantine partitions; and
storing second monitored information of the second downloaded content in the storage medium.
18. The computer readable medium as defined in claim 17 , wherein in response to determining that the first stored monitored information indicates a behavior that would go beyond the capabilities of the first one of the plurality of multi-partition space quarantine partitions, preventing the first downloaded content from being permanently installed.
19. The computer readable medium as defined in claim 17 , wherein in response to determining that the first stored monitored information indicates a behavior that requires access beyond the first set of capabilities, displaying an approval prompt to receive input regarding allowance of access to the information that requires access beyond the first set of capabilities.
20. The computer readable medium as defined in claim 17 , wherein in response to determining that the second stored monitored information indicates a behavior that requires access beyond the second set of capabilities, displaying an approval prompt to receive input regarding allowance of access to the information that requires access beyond the second set of capabilities.