System and method for secure, policy-based access control for mobile computing devices
Systems and methods for secure, policy-based, access control and management of mobile computing devices, including policy decision enforcement mechanisms, device and private network presence testing, aspects of file system controls, policy set sanity checking algorithms, performance optimizations.
1. A system for hiding the adjudication for authorizing a client access request to a secure computing device resource, the system having hidden secure policy instructions, a hidden secure adjudication process and hidden secure condition and parameters for hidden permitted operations on the requested secure computing resource device, the system comprising:
a hardened and hidden policy decision server having a secure persistent memory for storing hierarchical sets of policy instructions and parameters, and having a processor for applying at least one set of the hierarchical sets of policy instructions and parameters to the client access request and computing an adjudicated decision of authorized access or denial of access based on hidden permitted operations on the requested secure computing device resource;
an encrypted back-channel for communicating the client access request to the policy decision server and for hiding the policy instructions, the adjudication process, and the conditions and parameters utilized by the processor in adjudicating the client access requests from the requesting client;
an agent, hidden from the requesting client and coupled to the policy decision server by the encrypted back-channel for transmitting client access requests, including additional parameters needed to access the secure computing device resource as required by the policy instructions, to the policy decision server; and
a policy enforcement server coupled to the agent for receiving adjudicated decisions from the policy decision server, secure computing device resource and having an intercepting server for intercepting client access requests, said policy enforcement server being coupled to the agent for transmitting the access requests thereto, and for receiving and transmitting policy decisions to the agent and for enforcing the adjudicated decision received from the agent.
2. The system of claim 1 , wherein the policy decision subsystem may securely modify, add or delete policy instructions.
3. The system of claim 1 , wherein the policy decision subsystem is resident on a different computing device apart from the policy enforcement subsystem.
4. The system of claim 1 wherein policy instructions are expressed in a policy object language, the system further including:
a policy compiler and code generator for compiling policy instructions written in the policy object language into executable code; and
an interface to transmit the policy instructions in executable code form produced by the policy compiler and code generator to the policy decision server.
5. The system of claim 1 , wherein the policy enforcement subsystem further includes a modification server for modifying a processing unit program counter, program register, machine instructions, or a functionally equivalent register to control subsequent actions following an allowance decision from the policy decision server.
6. A method for hiding the adjudication of client access to a secure computing device resource, having secure policy instructions for permitted operations on the requested resource, comprising the steps of:
securely intercepting a client access request to access the computing device resource to which the client has no access and transmitting the client access request to an agent;
transmitting the intercepted client access request to a policy decision server via an encrypted back-channel from the agent to a persistent memory;
transmitting policy instructions and parameters from the persistent memory to the policy-decision server via the encrypted back-channel;
transmitting a request for additional parameters as required by the policy instructions from the policy decision server to the agent via the encrypted back-channel;
transmitting the additional parameters needed to access the requested resource required by the policy instructions from the agent to the policy decision serve via the encrypted back-channel;
adjudicating the client access request at the policy decision server using the policy instructions for permitted operations on the requested resource;
transmitting to the agent via the encrypted back-channel the adjudicated decision to allow or deny access by the client to the requested resource;
enforcing the adjudicated decision received from the agent; and
transmitting the adjudicated decision to the requesting client via the agent.
7. The method of claim 6 wherein the policy decision server modifies, adds, or deletes policy instructions.
8. The method of claim 6 further including the steps of:
expressing the policy instructions in a policy object language;
compiling the policy instructions expressed in the policy object language into executable code; and
transmitting by secure encrypted back-channel the policy instructions in executable code form to the policy decision server.
9. The method of claim 6 wherein the policy enforcement server further includes modifying a processing unit program counter, program register, machine instructions, or a functionally equivalent register to control subsequent actions following an allowance decision from the policy decision server.