Accessibility API Interception for Isolated App Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for mobile devices are ineffective in controlling access to content from applications executing in isolated environments, as they lack the ability to receive and process data from such applications, posing challenges in filtering out unwanted content such as undesirable links or phishing attempts.
Innovation Solution
A security application uses an accessibility API to intercept data from user applications, generate templates based on the intercepted content, and classify it into categories, thereby controlling access by restricting or blocking undesirable content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an isolated environment (sandbox) is used to execute user applications, then security protection against malicious applications is improved, but the ability to access and analyze data from other applications deteriorates
Solution Approach 1:
The patent introduces an accessibility service as an intermediary component that operates outside the isolated environment. This service intercepts and processes data from applications within the sandbox, then provides processed information to the security application. The intermediary enables the security application to analyze content without directly accessing the isolated environment, thus maintaining security boundaries while enabling data analysis through the mediating accessibility service layer.
2Adaptability or versatility
If authorizations are granted to read data of other applications, then the ability to filter unwanted content is improved, but the isolation principle and security model deteriorate
Solution Approach 1:
The accessibility service acts as a mediator that obtains data from applications without requiring direct authorization for the security application to access that data. The service layer handles the data extraction and processing, allowing content filtering functionality while preserving the isolation model. The security application analyzes content through the accessibility service's processed output rather than directly accessing other applications' data.
Solution Approach 2:
The patent replaces the traditional mechanical authorization model (where the security application would need direct permissions to access other applications' data) with an information-based system. The accessibility service transforms raw application data into processed information that can be analyzed by the security application without requiring direct data access permissions. This substitution enables content filtering while maintaining the isolation principle.
3Reliability
If no authorizations are provided for reading other applications' data, then the isolated environment security model is maintained, but the effectiveness of security applications in detecting harmful content deteriorates
Solution Approach 1:
The accessibility service serves as an intermediary that bridges the gap between the isolated environment and the security application. It captures data from applications within the sandbox, processes this data into analyzable formats, and makes it available to the security application without compromising the isolation model. This intermediary approach enables the detection of harmful content while preserving security model integrity.
Solution Approach 2:
The patent substitutes the traditional direct-access security model with an information-mediated model. Instead of requiring the security application to directly access and read other applications' data (which would break isolation), the system uses the accessibility service to transform application data into processed information that can be analyzed for harmful content. This substitution maintains security model integrity while enabling effective threat detection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are system and methods for controlling access to content from a user application executing in an isolated environment on a user device. An exemplary method includes intercepting, by a security application, data relating to content in a graphical user interface of the user application using an accessibility application programming interface (API) exposed by an operating system of the user device, and generating a first template associated with the content based on the intercepted data. The template specifies a pattern of elements of the graphical user interface. The method further includes determining a category of the content based on a comparison of the first template with a plurality of previously generated templates; and controlling access to the content of the graphical user interface based on the determined category.