Systems and methods for enforcing access control policies on privileged accesses for mobile devices
Methods and systems described herein relate to enhancing security on a device by enforcing security and access control policies on privileged code execution.
1. A method of enforcing access control policies on privileged access of a mobile device, the method comprising:
taking a request made to service executing in user space of a computer processor by at least one application executing on the computer processor for permission to execute privileged code;
directing the request to a system service that governs access control for execution of the privileged code via an inter-process communications controller;
determining by the system service whether the application is permitted to execute the privileged code based upon one or more of an identity of the application, an identity of a user of the mobile device, a time of day, a location of the mobile device, or a configuration of the mobile device; and
permitting execution of the privileged code upon determining that the application is permitted to execute the privileged code.
2. The method of claim 1 , wherein the mobile device is one of a mobile phone, a tablet, a laptop, and a smartphone.
3. The method of claim 1 , wherein the inter-process communications controller communicates over an inter-process communications bus.
4. The method of claim 1 , wherein the method further comprises returning the determination to a system controller via an inter-process communications mechanism.
5. The method of claim 1 , wherein the method further comprises logging one or more of the determination, information regarding the application request, conditions used in making the determination, and a resulting action.
6. The method of claim 1 , wherein the processor resides on a mobile phone and is adapted to function whether or not the phone is in a jailbroken state.
7. A system for enforcing access control policies on privileged access of a mobile device, comprising:
an inter-process communication bus;
at least one inter-process communication controller to control execution of privileged code by an application, the inter-process communication controller in communication with the inter-process communication bus and the application, wherein the application is adapted to request permission, from the inter-process communication controller, to execute privileged code; and
at least one hardware processor adapted to provide a system service, wherein the system service is enabled to determine whether the privileged code may be executed based at least in part on one or more of an identity of the application, an identity of a user of the mobile device, a time of day, a location of the mobile device, or a configuration of the mobile device; and
a second inter-process communication controller enabled to communicate with an inter-process communication bus and the system service.
8. The system of claim 7 , wherein the mobile device is one of a mobile phone, a tablet, a laptop, and a smartphone.
9. The system of claim 7 , wherein the application is selected from the group consisting of a game, a utility, a phone application, a web browser, a music player, a tool, and an operating system.
10. The system of claim 7 , further comprising an inter-process communications firewall to enforce one or more rules governing communication with the application.
11. The system of claim 10 , wherein the inter-process communications firewall is an object-oriented firewall.
12. The system of claim 7 , wherein the first inter-process communications controller is adapted to communicate with one or more inter-process communications firewalls.
13. The system of claim 7 , wherein the at least one hardware processor is adapted to provide a plurality of inter-process communications firewalls on the mobile device.