DIVIDING A DATA PROCESSING DEVICE INTO SEPARATE SECURITY DOMAINS
This invention provides secure, policy-based separation of data and applications on computer, especially personal computers that operate in different environments, such as those including personal applications and corporate applications, so that both types of applications can run simultaneously while complying with all required policies. The invention enables employees to use their personal devices for work purposes, or work devices for personal purposes. The secure, policy-based separation is created by dividing the data processing device into two or more “domains,” each with its own policies. These policies may be configured by the device owner, an IT department, or other data or application owner.
1 . (canceled)
2 . A device configured for virtual private network (VPN) routing on an application-by-application basis in two or more security domains, the device comprising:
an operating system;
a computer data processing device application that is associated with a security domain defined according to an external policy, wherein the computer data processing device application is configured to access a web server via a domain virtual private network (VPN) connection;
a VPN client application, wherein the VPN client application is configured to control encryption and protocol requirements of the domain VPN connection;
a first loader application bound to the computer data processing device application, wherein the first loader application is configured to intercept and mediate requests between the computer data processing device application and the operating system according to specifications of the external policy of the security domain;
a second loader application bound to the VPN client application, wherein the second loader application is configured to moderate activity of the VPN client application according to specifications of the external policy of the security domain; and
a VPN dispatcher between computer data processing device application and the VPN client application, wherein the VPN dispatcher is configured to
verify that received network data packets conform to the specifications of the policy of the security domain; and
exchange the network data packets from the computer data processing device application to the VPN client application in response to the network data packets being in accordance with specifications of the policy of the security domain.
3 . The device of claim 2 , wherein the VPN dispatcher is configured to exchange the network data packets with one or both of the first and second loader applications using file descriptors.
4 . The device of claim 2 , wherein:
the network data packets are encrypted by a VPN server from which the network data packets are communicated; and
the VPN dispatcher has access only to network headers of each of the network data packets.
5 . The device of claim 2 , wherein the first loader application is configured to:
receive a broadcast alert or a unicast alert from one or both of the VPN dispatcher and the second loader application; and
responsive to the alert, block network access to the computer data processing device application.
6 . The device of claim 2 , wherein the second loader application is configured to intercept the network data packets through a file descriptor and send the network data packets through a network socket created by the second loader application.
7 . The device of claim 2 , wherein:
the computer data processing device application is a first computer data processing device application;
the device further comprises a second computer data processing application that is not included in the security domain; and
the VPN dispatcher is configured to receive additional network data packets communicated by the second computer data processing application, determine that the additional network data packets are not involved in the domain VPN connection, and communicate the additional network data packets to a virtual network interface responsive to a determination that the additional network data packets are not involved in the domain VPN connection.
8 . The device of claim 2 , wherein:
the policy for the security domain requires that network data packets are communicated between the first loader application and a corporate VPN server; and
the first loader application is configured to request establishment of the domain VPN connection; and
the establishment of the domain VPN connection causes the VPN dispatcher to run, which starts the second loader application and enables operation of the computer data processing device application.
9 . The device of claim 2 , wherein the first loader application is configured to intercept and mediate requests without modifying the computer data processing device application and without requiring operating system privileges.
10 . The device of claim 2 , wherein the first loader application is located logically between the computer data processing device application and the operating system.
11 . The device of claim 2 , wherein the VPN dispatcher is implemented in:
a kernel mode of the device as part of a virtual interface,
network services, or
a portion of the operating system.
12 . The device of claim 2 , wherein:
the domain VPN connection is a first domain VPN connection;
the computer data processing device application is a first computer data processing device application;
the VPN client application is a first VPN client application;
the security domain is a first security domain;
the device comprises a second computer data processing device application associated with a second security domain, a third loader application bound to the second computer data processing device application, a second VPN application configured to establish a second domain VPN connection according to a second policy of a second security domain, and a fourth loader application bound to the second VPN application; and
the VPN dispatcher is further configured to route the network data packets through the first VPN connection to the first computer data processing device application or the second computer data processing device application via the second VPN connection based on the first and the second policies of the first and the second security domains.
13 . The device of claim 12 , wherein the VPN dispatcher supports the first VPN client application or the second VPN client application simultaneously.
14 . The device of claim 2 , further comprising a kernel mode and a user mode, wherein the second loader application, the VPN dispatcher, the first loader application, the VPN client application; and the computer data processing device application are included in the user mode.