Containerized Application IPC Bypass for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The blurring of personal and business device boundaries in the BYOD environment poses security risks due to the interchangeability of devices for professional and private purposes, with existing Mobile Application Management (MAM) solutions struggling to manage data access and security effectively, particularly in interacting with the Inter-Process Communication (IPC) subsystem.
Innovation Solution
A method using a container application to manage sub-applications by receiving communications through a first service programming interface (SPI) and retransmitting them via a second SPI that bypasses the IPC framework, ensuring secure data access and management without direct hooks into the mobile platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are allowed to expose interfaces via the IPC subsystem to maintain functionality, then application functionality is preserved, but security risks increase due to potential data leakage through malicious invocation
Solution Approach 1:
The MAM component acts as an intermediary layer between applications and the IPC subsystem. It intercepts IPC calls, validates them against security policies, and forwards approved calls while blocking malicious ones. This mediator approach allows functionality to be preserved through legitimate calls while security risks are mitigated through policy-based filtering.
Solution Approach 2:
The system segments communication pathways into trusted and untrusted routes. By dividing the IPC communication flow into interceptable segments, the MAM component can selectively allow or block specific communication patterns, enabling fine-grained control over which application interfaces are accessible and under what conditions.
2Reliability
If the MAM component intercepts calls at the IPC level to secure communication, then data security is improved, but device complexity increases due to required direct hooks into the mobile platform
Solution Approach 1:
The MAM component is designed as a universal solution that works across multiple applications and IPC communication patterns without requiring application-specific modifications. By implementing a general-purpose interception mechanism at the MAM layer, the system achieves broad security coverage while avoiding the complexity of custom hooks for each application or platform-specific implementation details.
3Reliability
If completely disabling application interfaces is implemented to ensure security, then data security is improved, but application functionality is lost as crucial interfaces become inaccessible
Solution Approach 1:
The system dynamically controls interface accessibility based on security policies and context rather than statically disabling all interfaces. The MAM component evaluates each IPC call against configurable security rules, allowing legitimate functionality to proceed while blocking only those calls that violate security policies. This dynamic approach ensures both security and functionality are maintained.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of managing access to a plurality of applications capable of executing within a container provisioned on a computing device. The method comprises the steps of: receiving, at a first communications interface of the container, a first communication for execution by a first application in the plurality of applications capable of executing within the container, wherein the communication is received from an on-device process via a first communication pathway using an inter-process communication (IPC) framework provided by an operating system executing on the computing device; sending, from the first communications interface of the container, the communication to a second communications interface of the first application via a second communication pathway provided by the container, wherein the second communication pathway bypasses the IPC framework; receiving, at the first communications interface of the container, a response to the first communication from the second communications interface of the first application via the second communication pathway; and sending, the response from the first communications interface of the container to the on-device process via the first communication pathway.