Sandboxed App File Access via Security-Scoped Bookmarks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for computing devices lack a unified and systemic approach to allow persistent access to resources outside a restricted environment, especially when the resources are renamed or moved, leading to issues with malicious code accessing sensitive system resources.
Innovation Solution
Implementing a sandboxed environment with a resource manager that uses bookmarks or identifiers to allow applications to access files and folders persistently, even after the application has been terminated, by creating a security-scoped bookmark that can be reused without further user interaction, ensuring only authorized access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a sandboxed environment restricts application access to files and folders, then security is improved, but persistent access to resources after application termination is lost when files are renamed or moved
Solution Approach 1:
The patent introduces bookmarks as intermediary objects that mediate between the sandboxed application and the file system. These bookmarks contain encoded path information that allows the application to access files even when the files are moved or renamed, resolving the contradiction between security restriction and persistent access capability
Solution Approach 2:
The system performs preliminary actions by creating bookmarks during application execution that encode file location information. These bookmarks are stored and can be used later to restore access to files even after the application has terminated, preparing the access mechanism in advance before the file might be moved or renamed
2Ease of operation
If applications can access files outside sandboxed environment, then ease of operation is improved, but risk of malicious code accessing sensitive system resources increases
Solution Approach 1:
The resource manager acts as an intermediary between the application and the file system, validating bookmark-based access requests. This intermediary layer enables easy file access through bookmarks while simultaneously preventing malicious code from accessing sensitive system resources by enforcing security policies on all access attempts
Solution Approach 2:
The patent applies different access qualities to different files and folders through the bookmark mechanism. Each bookmark is specifically tailored to grant access to particular files or folders that the application needs, rather than providing blanket access. This localized access control enables ease of operation for authorized files while maintaining security against unauthorized access to sensitive resources
Data Source
AI summary
Methods, systems, and machine-readable storage medium are described wherein identifiers are used to allow access to files or folders in a restricted operating environment. One embodiment provides a process comprising receiving a selection of a resource managed by a restricted operating environment; requesting from a resource manager of the restricted operating environment, in response to the selection, a location identifier associated with the resource; receiving, in response to the request, a bookmark and a digest, wherein the digest is a cryptographically derived version of the bookmark and the bookmark is to enable retrieval of the resource on a storage device; and storing the bookmark and the digest in the restricted operating environment to indicate trust of the resource.