App Policy Engine for Mobile Device Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices lack effective security measures to control application access to network interfaces, allowing malicious applications to bypass VPN clients and expose devices to potential threats by connecting to unauthorized wireless networks without user permission.
Innovation Solution
Integration of an app policy engine with the mobile device's operating system kernel to enforce access policies by verifying digital certificates from trusted certificate authorities, restricting application execution and network interface access, and managing privileges to prevent unauthorized access to sensitive interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are allowed to access network interfaces without restriction, then application functionality and ease of operation are improved, but device security and reliability deteriorate due to malicious applications bypassing VPN clients and connecting to unauthorized networks
Solution Approach 1:
The patent introduces a policy engine as an intermediary component between applications and network interfaces. This policy engine evaluates access requests from applications against predefined policies and controls whether applications can connect to network interfaces, thereby preventing malicious applications from bypassing security measures while allowing legitimate applications to function normally.
Solution Approach 2:
The patent implements preliminary security checks by requiring applications to obtain access tokens from the policy engine before they can access network interfaces. This preliminary action of policy evaluation and token issuance occurs before actual network access, ensuring that malicious applications are blocked in advance rather than allowing unrestricted access and dealing with security issues afterward.
2Reliability
If a policy engine is integrated into the operating system kernel, then device security and access control are improved, but device complexity increases due to kernel-level integration and certificate verification mechanisms
Solution Approach 1:
The patent merges the policy engine directly into the operating system kernel, combining security policy evaluation, certificate verification, and access control functions into a single integrated kernel-level component. This merging reduces the need for separate user-space security mechanisms and leverages the kernel's inherent authority to enforce security policies effectively.
Solution Approach 2:
The policy engine implements self-service mechanisms by automatically evaluating access requests, verifying application certificates against trusted certificate authorities, and making access decisions without requiring manual user intervention. The system autonomously manages security policies and enforces access control, reducing the burden on users while maintaining high security standards.
3Object-affected harmful factors
If digital certificate verification is implemented for all applications, then security against malicious code is improved, but processing time and operational complexity increase
Solution Approach 1:
The patent performs certificate verification as a preliminary action during application installation or first-time execution. By verifying certificates in advance and caching the verification results, the system avoids repeated verification overhead during normal operation, thus protecting against malicious code while minimizing time loss during routine application execution.
Solution Approach 2:
The policy engine implements self-service by automatically managing the certificate verification process without requiring user involvement. It autonomously checks application certificates against trusted certificate authorities stored in the device, makes access decisions based on verification results, and enforces policies without user intervention, thereby maintaining security while reducing operational complexity.
Data Source
AI summary
Methods, articles of manufacture, and apparatus to perform policy configuration for mobile device applications are disclosed. A disclosed example method includes determining whether a digital certificate associated with a application executable on a mobile device has been signed by a first trusted certificate authority, the first trusted certificate authority being included in a list of trusted certificate authorities hard-coded in the mobile device, and when the digital certificate is determined to have been signed by the first trusted certificate authority, configuring the application for execution on the mobile device based on an access privilege indicating a physical interface of the mobile device the application is permitted to access, and execution configuration information associated with the application.