Sandboxing third party components

A method and apparatus of a device for security management by sandboxing third-party components is described. The device can determine whether a third-party component supports network access. If the third-party component supports network access, the device can request a user input regarding whether to restrict the network access of the component. The device can receive a user input to restrict network access of the third-party component. Upon receiving the user input to restrict network access, the device can construct a sandbox for the third-party component to restrict network access of the component and prevent the component from performing data exfiltration. Other embodiments are also described and claimed.

FIELD OF DISCLOSURE

This disclosure relates generally to the field of secure computing, and more particularly to sandboxing third party components.

BACKGROUND

Security concerns for all types of processor-based electronic devices, and particularly for computing devices, have become significant. While some concerns may relate to detrimental actions which may be undertaken by defective code implemented by such devices, the greater concerns relate to the ramifications of various types of attacks made upon such devices through malicious code, including code conventionally known in the field by a number of names, such as “viruses”, “worms”, “Trojan horses”, “spyware”, “malware”, and others. Many of these attacks are directed at computing devices, such as workstations, servers, desktop computers, notebook and handheld computers, and other similar devices. Many of these computing devices can run one or more application programs which a user may operate to perform a set of desired functions.

A number of methodologies have been used in an attempt to reduce or eliminate both the attacks and influence of malicious or defective code. Generally, these methodologies include detection, prevention, and mitigation. Specifically, these methodologies range from attempts to scan, identify, isolate, and possibly delete malicious code before it is introduced to the system or before it does harm (such as is the objective of anti-virus software, and the like), to restricting or containing the actions which may be taken by processes affected by malicious or defective code.

One method to protect a computing system is to sandbox a computer program to protect a computing system from a potentially malicious program. A sandbox is a mechanism utilized to separate a running computer program from other programs and/or computing resources. Some secure computing systems execute untrusted programs, or programs distributed by untrusted parties, in sandboxes. Sandbox restrictions limit the resources a computer program may access. An example of a sandbox environment is an applet that runs in a virtual machine or interpreter.

A virtual keyboard is a software application (e.g., a keyboard application) that allows a user to enter characters. A virtual keyboard can usually be operated with multiple input devices, which may include a touchscreen and a computer mouse. A component is a software package or module that can provide services to one or more applications. A system-wide component is a software package or module that can provide services to different applications in the system. For example, a keyboard application can be a system-wide component because it may be used by many different applications on a device. A first-party is an entity that provides the operating system, or an entity that provides the device hardware and the operating system. A third-party is an entity other than the provider of the operating system that creates an application program to run on the operating system. A third-party component is an application program that is provided by a third-party. A third-party component may not be trusted because it may increase the risk of security breaches. Furthermore, a third-party component may cause the user's privacy to be ignored or compromised, e.g. by conducting data mining on collected user data for commercial purposes.

SUMMARY OF THE DESCRIPTION

A method and apparatus of a device for security management by sandboxing third-party components is described. In an exemplary embodiment, the device can determine whether a third-party component supports network access. If the third-party component supports network access, the device can request a user input regarding whether to restrict the network access of the component. The device can receive a user input to restrict network access of the third-party component. In one embodiment, upon receiving the user input to restrict network access, the device can construct a sandbox for the third-party component to restrict network access of the component and prevent the component from performing data exfiltration. In one embodiment, the third-party component can be used by a user application to provide input data to the user application. In one embodiment, the third-party component is a system-wide third-party component.

The component can be, e.g. a third-party keyboard application, a third-party voice input application, a third-party drawing application, or a third-party motion sensing application. The component can be a third-party output application (e.g., a remote view application that can be used by other applications as their output interface). The component can also be a third-party optical instrument application (e.g., a third-party camera application or a third-party image scanner application). In one embodiment, the component can be a third-party system-wide component.

Other methods and apparatuses are also described. Machine-readable non-transitory media are also described and they include executable computer program instructions which when executed by a data processing system cause the data processing system to perform one or more methods described herein.

DETAILED DESCRIPTION

A method and apparatus of a device that performs security management by sandboxing third-party components is described. In the following description, numerous specific details are set forth to provide thorough explanation of embodiments of the present invention. It will be apparent, however, to one skilled in the art, that embodiments of the present invention may be practiced without these specific details. In other instances, well-known components, structures, and techniques have not been shown in detail in order not to obscure the understanding of this description.

The terms “server,” “client,” and “device” are intended to refer generally to data processing systems rather than specifically to a particular form factor for the server, client, and/or device.

A method and apparatus of a device that performs security management by sandboxing third-party components is described. In one embodiment, when a third-party component (e.g., a third-party keyboard application) is installed on a device, the device can determine whether the component supports network access. If the third-party component supports network access, the device can ask a user whether to restrict the network access of the component. In response to the user's request to restrict network access of the third-party component, the device can construct a sandbox for the component to restrict network access of the component.

FIG. 1is a block diagram of one embodiment of a device100that performs security management. In one embodiment, the device100can be a desktop computer, server, smartphone, laptop, personal digital assistant, music playing device, gaming device, or any other device that can execute multiple processes. InFIG. 1, device100includes an operating system105that is a set of software used to manage device hardware resources and provide common services for other running computer programs, such as application programs. The operating system105includes a security manager125. The operating system105manages several applications110. In one embodiment, the operating system105manages several running applications110by scheduling a processor of the device100to execute each of the running applications. As illustrated inFIG. 1, the applications110include several applications1-N.

In one embodiment, an application is a process that is an instance of an application program that is being executed. In this embodiment, the application may be an application program that is executing as a result of user input. In another embodiment, an application is a thread that is the smallest sequence of programmed instructions that can be managed independently by an operating system scheduler. In one embodiment, a thread is contained inside a process. Multiple threads can exist within the same process and share resources such as memory, while different processes do not share these resources. In one embodiment, a third-party component is a third-party application that provides services to other applications in the operating system105. In one embodiment, a third-party system-wide component is a third-party application that can provide services to several different applications in the operating system105.

The security manager125identifies and implements security policies for running applications, such as applications110. In one embodiment, the security manager125is part of the kernel of the operating system105. In another embodiment, the security manger125is outside of the kernel of the operating system105. The security manager125may sandbox an application to protect the application from a potentially malicious program. In one embodiment, the security manager125separates a running application from other applications and/or computing resources. In one embodiment, the security manager125constructs sandboxes for untrusted applications (e.g., third-party components) to limit the resources those applications may access.

The security manager125was described above for one embodiment of the invention. One of ordinary skill in the art will realize that in other embodiments, this module can be implemented differently. For instance, in one embodiment described above, this module is implemented as a software module. However, in another embodiment, this module might be implemented by hardware, which can be dedicated application specific hardware (e.g., an ASIC chip or component) or a general purpose chip (e.g., a microprocessor or FPGA).

FIG. 2Aillustrates an example of a third-party component being used by a user application210. Specifically, this figure shows a user interface200in which a third-party keyboard application220is being used by the user application210. In one embodiment, the third-party keyboard application220can be a third-party system-wide component as it may be used by several different applications (e.g., application that need user to input text) on the device. As illustrated inFIG. 2A, the user application210uses the third-party keyboard application220to input text into a text entry field215. In one embodiment, the keyboard application220only shows up on the user interface200when user tries to type text into the text entry field215.

The third-party keyboard application220may look like a part of the user application210, as illustrated inFIG. 2A. However, the keyboard application220and the user application210are two different applications.FIG. 2Billustrates a diagram205that shows the different applications involved in the scenario described inFIG. 2A. As illustrated inFIG. 2B, the user application210and the third-party keyboard application220are two separate applications. The two applications work together to type text into any text entry field for the user application210.

In one embodiment, the third-party keyboard application220sends user confirmed text225to the user application210. The user confirmed text225may not be the same as the text the user actually typed because the keyboard application may be able to predict a word or a set of words based on what the user has typed and the user will confirm the word or the set of words if the prediction is correct. In one embodiment, the user application210optionally sends back text prediction information212to the keyboard application220.

The user application210can be any application that has a text entry field (e.g., text entry field215in the user interface200). When a user tries to type text into the text entry field, the third-party keyboard application220is activated to collaborate with the user application210. The user application may choose to send its application data (including the confirmed text225it received from the keyboard application220) to a cloud server230or another device (not shown).

In one embodiment, the third-party keyboard application220is prohibited from sending its private data to the cloud server230or235, or other devices (not shown). In one embodiment, the keyboard application220is prohibited from sending its private data to an associated application240if the associated application240will forward the data to the cloud server235or another device (not shown). The associated application240is an application that is connected to the keyboard application220, but does not invoke the main functionality (e.g., text inputting) of the keyboard application220.

In one embodiment, the device can prevent the third-party keyboard application220from sending its private data to the cloud servers230or235, or the associated application240by constructing a restrictive sandbox for the keyboard application220. The sandbox of the keyboard application220can restrict network access or otherwise prevent data exfiltration by the keyboard application220. Data exfiltration means taking data out of a secured container or environment. In one embodiment, the device constructs the restrictive sandbox for the keyboard application220by default. In another embodiment, the device constructs the restrictive sandbox only when a user requests it.

The scenario described above inFIGS. 2A and 2Bis for one embodiment of the disclosure. One of ordinary skill in the art will realize that, instead of the third-party keyboard application220, other third-party components may be used by the user application210in other embodiments. Those third-party components may include a third-party voice input application, a third-party drawing application, a third-party motion sensing application, a third-party output application (e.g., a remote view application that can be used by other applications as their output interface), or a third-party optical instrument application (e.g., a third-party camera application or a third-party image scanner application).

FIG. 3illustrates a flowchart of one embodiment of a process300to perform security management on a device by sandboxing a third-party component. In one embodiment, the third-party component is a keyboard application. In one embodiment, the third-party component can be a third-party system-wide component as it may be used by several different applications on the device. For example, a keyboard application may be used by several different applications to input text. In one embodiment, the security manager125described inFIG. 1above executes process300to perform security management. In one embodiment, process300is invoked when a third-party application is installed on the device.

InFIG. 3, process300begins by determining (at block305) whether an installed application is a third-party component. In one embodiment, a third party component can be a third-party keyboard application. In another embodiment, a third party component can be a third-party voice input application, a third-party drawing application, a third-party motion sensing application, a third-party output application (e.g., a remote view application that can be used by other applications as their output interface), or a third-party optical instrument application (e.g., a third-party camera application or a third-party image scanner application). In one embodiment, a third-party component can be a third-party system-wide component as it may be used by several different applications on the device. For example, a third-party keyboard application may be used by several different applications to input text.

If the installed third-party application is not a third-party component, process300terminates. In one embodiment, the operating system constructs a sandbox with normal resource access rights for the third-party application if it is not a third-party component. If it is determined (at block305) that the installed application is a third-party component, process300determines (at block310) whether the third-party component supports network access. In one embodiment, an application supports network access when it is able to send its private data to a cloud server or another device. If the third-party component supports network access, process300asks (at block315) a user whether to restrict network access of the third-party component. In one embodiment, restricting network access of an application is done to prevent the application from performing data exfiltration, which takes private data out of a secured container or environment. If it is determined (at block310) that the third-party component does not support network access, process300proceeds to block330.

At block320, process300receives a user input regarding whether to restrict network access of the third-party component. At block325, process325determines whether the user input is a request to restrict network access of the third-party component. If the user does not want to restrict network access of the third-party component, process300terminates. In one embodiment, the operating system constructs a sandbox with normal resource access rights for the third-party component if the user does not want to restrict network access of the component.

If it is determined (at block325) that the user wants to restrict network access of the third-party component, process300restricts the third-party component with respect to network access by constructing a restrictive sandbox for the component. In one embodiment, the restrictive sandbox can make sure that the third-party component cannot access networking resources of the system. In one embodiment, the restrictive sandbox can prevent the third-party component from performing data exfiltration. One of ordinary skill in the art will recognize that in addition to preventing network access by the third-party component, the restrictive sandbox can also prevent the component from accessing other resources in order to prevent data exfiltration. For example and in one embodiment, the restrictive sandbox can prevent the third-party component from accessing volatile memory (e.g., DRAM) in the system. In one embodiment, the restrictive sandbox can prevent the third-party component from accessing non-volatile memory (e.g., hard drive, flash memory) in the system. In one embodiment, the restrictive sandbox can prevent the third-party component from accessing inter-process communication (IPC) resources (e.g., file, messages, sockets, shared memory, pipe, semaphore, shared memory, etc.).

One of ordinary skill in the art will recognize that process300is a conceptual representation of the operations used to perform security management. The specific operations of process300may not be performed in the exact order shown and described. The specific operations may not be performed in one continuous series of operations, and different specific operations may be performed in different embodiments. For example, operations in blocks315-325may be skipped, so that upon the determination that the third-party component supports network access, a sandbox that restricts network access of the third-party component is constructed for the component without seeking authorization from the user. Furthermore, process300could be implemented using several sub-processes, or as part of a larger macro process.

FIG. 4illustrates a detailed diagram of sandboxing a third-party component. Specifically, this figure illustrates a detailed diagram of the sandboxing of the user application210and the keyboard application220described inFIG. 2Babove. In one embodiment, the third-party component can be a third-party system-wide component as it may be used by several different applications on the device. For example, a keyboard application220may be used by several different applications to input text. In one embodiment, the security manager125described in relation toFIG. 1above facilitates the sandboxing of the applications. As shown inFIG. 4, a user application sandbox410is constructed for the user application210and a third-party component sandbox420is constructed for the keyboard application220. In one embodiment, the third-party component sandbox420is constructed as a result of the operations described in block330ofFIG. 3above.

The user application210has unrestricted access to its private data412and system resource415. In one embodiment, system resource415includes most of the system resources (e.g., networking) that a regular application is entitled to access. Because of the user application sandbox410, the user application210cannot access data or system resources outside of the user application sandbox410.

The keyboard application220has unrestricted access to its private data422and system resource425. The private data422may include the sequence of the keys typed, the text that the keyboard application220predicted, past typing pattern of the user for particular words, and a dictionary of words used by the user before. The system resource425is a white list of system resources that are explicitly allowed for the keyboard application220to access. If a system resource is not listed in the system resource425, the keyboard application220cannot access the system resource. In one embodiment, system resource425does not include networking resources or any other resources that may cause data exfiltration. For example and in one embodiment, system resource425does not include access to volatile memory (e.g., DRAM) in the system. In one embodiment, system resource425does not include access to non-volatile memory (e.g., hard drive, flash memory) in the system. In one embodiment, system resource425does not include access to inter-process communication (IPC) resources (e.g., file, messages, sockets, shared memory, pipe, semaphore, shared memory, etc.). Data exfiltration means the private data422of keyboard application220leaking outside of the third-party component sandbox420. Because of the third-party component sandbox420, the keyboard application220cannot access data or system resources outside of the third-party component sandbox420.

Because of sandboxing, the user application210cannot access the private data422of the keyboard application, and the keyboard application220cannot access the private data412of the user application210. The only data exchange channel between the two applications is the keyboard application220sending confirmed text225to the user application210and optionally receiving prediction information212back. The keyboard application220is not allowed to send its private data422to the user application210or any other application or device outside of the third-party component sandbox420because of the limited system resource425it can access.

FIG. 5shows one example of a data processing system500, which may be used with one embodiment of the present invention. For example, the system500may be implemented including a device100as shown inFIG. 1. Note that whileFIG. 5illustrates various components of a device, it is not intended to represent any particular architecture or manner of interconnecting the components as such details are not germane to the present invention. It will also be appreciated that network computers and other data processing systems or other consumer electronic devices, which have fewer components or perhaps more components, may also be used with the present invention.

As shown inFIG. 5, the device500, which is a form of a data processing system, includes a bus503which is coupled to a microprocessor(s)505and a ROM (Read Only Memory)507and volatile RAM509and a non-volatile memory511. The microprocessor505may retrieve the instructions from the memories507,509,511and execute the instructions to perform operations described above. The bus503interconnects these various components together and also interconnects these components505,507,509, and511to a display controller and display device513and to peripheral devices such as input/output (I/O) devices515which may be mice, keyboards, modems, network interfaces, printers and other devices which are well known in the art. Typically, the input/output devices515are coupled to the system through input/output controllers510. The volatile RAM (Random Access Memory)509is typically implemented as dynamic RAM (DRAM), which requires power continually in order to refresh or maintain the data in the memory.

The non-volatile memory511is typically a magnetic hard drive or a magnetic optical drive or an optical drive or a DVD RAM or a flash memory or other types of memory systems, which maintain data (e.g., large amounts of data) even after power is removed from the system. Typically, the non-volatile memory511will also be a random access memory although this is not required. WhileFIG. 5shows that the non-volatile memory511is a local device coupled directly to the rest of the components in the data processing system, it will be appreciated that the present invention may utilize a non-volatile memory which is remote from the system, such as a network storage device which is coupled to the data processing system through a network interface such as a modem, an Ethernet interface or a wireless network. The bus503may include one or more buses connected to each other through various bridges, controllers and/or adapters as is well known in the art.

FIG. 6shows an example of another data processing system600which may be used with one embodiment of the present invention. For example, system600may be implemented as a device100as shown inFIG. 1. The data processing system600shown inFIG. 6includes a processing system611, which may be one or more microprocessors, or which may be a system on a chip integrated circuit, and the system also includes memory601for storing data and programs for execution by the processing system. The system600also includes an audio input/output subsystem605, which may include a microphone and a speaker, for example, for playing back music or providing telephone functionality through the speaker and microphone.

A display controller and display device609provide a visual user interface for the user; this digital interface may include a graphical user interface which is similar to that shown on a Macintosh computer when running OS X operating system software, or Apple iPhone when running the iOS operating system, etc. The system600also includes one or more wireless transceivers603to communicate with another data processing system, such as the system600ofFIG. 6. A wireless transceiver may be a WLAN transceiver, an infrared transceiver, a Bluetooth transceiver, and/or a wireless cellular telephony transceiver. It will be appreciated that additional components, not shown, may also be part of the system600in certain embodiments, and in certain embodiments fewer components than shown inFIG. 6may also be used in a data processing system. The system600further includes one or more communication ports617to communicate with another data processing system, such as the system inFIG. 5. The communication port may be a USB port, Firewire port, Bluetooth interface, etc.

The data processing system600also includes one or more input devices613, which are provided to allow a user to provide input to the system. These input devices may be a keypad or a keyboard or a touch panel or a multi touch panel. The data processing system600also includes an optional input/output device615which may be a connector for a dock. It will be appreciated that one or more buses, not shown, may be used to interconnect the various components as is well known in the art. The data processing system shown inFIG. 6may be a handheld device or a personal digital assistant (PDA), or a cellular telephone with PDA like functionality, or a handheld device which includes a cellular telephone, or a media player, such as an iPod, or devices which combine aspects or functions of these devices, such as a media player combined with a PDA and a cellular telephone in one device or an embedded device or other consumer electronic devices. In other embodiments, the data processing system600may be a network computer or an embedded processing device within another device, or other types of data processing systems, which have fewer components or perhaps more components than that shown inFIG. 6.

At least certain embodiments of the inventions may be part of a digital media player, such as a portable music and/or video media player, which may include a media processing system to present the media, a storage device to store the media and may further include a radio frequency (RF) transceiver (e.g., an RF transceiver for a cellular telephone) coupled with an antenna system and the media processing system. In certain embodiments, media stored on a remote storage device may be transmitted to the media player through the RF transceiver. The media may be, for example, one or more of music or other audio, still pictures, or motion pictures.

The portable media player may include a media selection device, such as a click wheel input device on an iPod® or iPod Nano® media player from Apple, Inc. of Cupertino, Calif., a touch screen input device, pushbutton device, movable pointing input device or other input device. The media selection device may be used to select the media stored on the storage device and/or the remote storage device. The portable media player may, in at least certain embodiments, include a display device which is coupled to the media processing system to display titles or other indicators of media being selected through the input device and being presented, either through a speaker or earphone(s), or on the display device, or on both display device and a speaker or earphone(s). Examples of a portable media player are described in U.S. Pat. No. 7,345,671 and U.S. Pat. No. 7,627,343, both of which are incorporated herein by reference.

The present invention also relates to an apparatus for performing the operations described herein. This apparatus may be specially constructed for the required purpose, or it may comprise a general-purpose device selectively activated or reconfigured by a computer program stored in the device. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), RAMs, EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a device bus.

A machine readable medium includes any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer). For example, a machine readable medium includes read only memory (“ROM”); random access memory (“RAM”); magnetic disk storage media; optical storage media; flash memory devices; etc.

It should be kept in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the above discussion, it is appreciated that throughout the description, discussions utilizing terms such as “receiving,” “determining,” “requesting,” “constructing,” or the like, refer to the action and processes of a device, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the device's registers and memories into other data similarly represented as physical quantities within the device memories or registers or other such information storage, transmission or display devices.