Patent Publication Number: US-8990920-B2

Title: Creating a virtual private network (VPN) for a single app on an internet-enabled device or system

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims priority under U.S.C. §119(e) to pending U.S. Provisional Application No. 61/640,799, filed May 1, 2012, entitled “RESTRICTING ACCESS TO A VPN BY A SINGLE PROCESS RUNNING ON A SYSTEM” by Blaisdell. This application is also a Continuation-in-Part which claims priority under 35 U.S.C. §120 to pending U.S. patent application Ser. No. 13/025,994, filed Feb. 11, 2011, entitled “SECURING AND MANAGING APPS ON A DEVICE” by Blaisdell. Both applications are hereby incorporated by reference in their entirety. 
    
    
     BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates to software, network communications, and mobile devices. More specifically, it relates to creating a virtual private network (VPN) between an app on a mobile device and a VPN gateway. 
     2. Description of the Related Art 
     Most mobile devices run multiple apps, many of which are personal or non-work related apps. However, some may be work-related apps that use confidential data and have to connect to a corporate VPN. It is becoming increasingly common for a mobile device, such as a tablet or smartphone, that belongs to an individual and has personal and work apps, to have a single, system-wide VPN connection that serves the entire device. Therefore, all apps on the device can potentially use this VPN tunnel. If any of the apps on the device have malware or have malicious intent, those apps may obtain access and communicate over a corporate VPN, thereby enabling the app to search for sensitive data, install malware, delete or corrupt data, and otherwise do harm to the corporate network and possibly to the mobile device. An entire corporate VPN gateway, connecting hundreds of its employees&#39; personal mobile devices, collectively running thousands of apps, may be in danger of being infected by malware from just one of those apps running on a single smartphone or tablet. 
     The attack surface created by a device-level VPN is unnecessarily high, and the risk be unacceptable to many organizations. As noted, industry standard practice with regard to VPNs is for a single VPN to serve an entire computing system (i.e., mobile device, laptop computer, and the like). This is desirable from an efficiency standpoint because the same VPN connection may be re-used by any app running on a device, assuming the VPN is turned on or enabled at the system level. However, when not all apps running on a computing system are trusted—as many are not—a “per-device” or system-level VPN creates significant risk. It allows anyone with access to the device and the ability to download an app to the device to also access the VPN. For example, an attacker with physical access to a device with an active VPN could attack the remote network (such as a corporate or government network) in a number of ways using malware in the app. Or an attacker who has planted malware on the device could make use of the VPN without downloading an app. 
     In light of these risks, it would be desirable to be able to implement a VPN for a single app which cannot be used by other apps, unless under specific, well-defined circumstances. Essentially, it would be desirable to have a “per-app VPN” capability on a device. For example, only a security wrapped application would be aware of a VPN tunnel and, generally, only that wrapped application or app could use it. This would limit the attack surface of the device and the VPN gateway to a single app, as opposed to the entire computing system. 
     SUMMARY OF THE INVENTION 
     In one aspect of the present invention, an Internet-enabled device, such as a smartphone, tablet, PC, wearable sensor, or household appliance, executes an application (or “app”) which has its own VPN connection with a VPN gateway device. That is, the app does not use the device-level or system VPN to connect with the gateway. The app, which in the described embodiment is security wrapped, is made more secure by having its own VPN tunnel with the gateway, wherein the VPN tunnel is not used by other apps running on the device. In another embodiment, certain apps in a federation or group of apps that are trusted may share a VPN connection. In either case, the conventional (or device-level) VPN connection is not used by the app(s). 
     In one embodiment, a VPN between the device and a gateway is implemented. During normal execution of an app, a system or app component in a sandbox makes a call to the device operating system. This call is re-directed to an IP stack in the sandbox. It is not received by the operating system and the device-level IP stack is not utilized. The IP stack in the sandbox builds an IP packet. The IP packet is encapsulated by a proxy or virtual IPsec module that operates in the sandbox. The IPsec module in the operating system of the device is not utilized. The encapsulated IPsec packet is transmitted by a virtual data link layer in the sandbox to a transport module in the operating system. In one embodiment, the transport module or layer is UDP. The virtual or proxy data link layer may be characterized as an interface between the IP stack in the sandbox and the operating system, specifically, an interface with the UDP module. The UDP module transmits the IPsec packet to the VPN gateway. Similarly, the UDP module in the operating system of the device receives IPsec packets (intended for the app) and transmits them to the virtual data link layer in the sandbox which passes them on to the IPsec module, which decrypts them and sends them up the IP stack in the sandbox. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       References are made to the accompanying drawings, which form a part of the description and in which are shown, by way of illustration, specific embodiments of the present invention: 
         FIG. 1A  is a block diagram showing an overview of the app control process of the present invention; 
         FIG. 1B  is a block diagram showing an alternative embodiment of an app control process of the present invention; 
         FIG. 2  is a block diagram showing components of an app security program in accordance with one embodiment of the present invention; 
         FIG. 3  is a flow diagram showing a process of making an app secure before downloading it on to a device in accordance with one embodiment of the present invention; 
         FIG. 4  is a flow diagram of a method performed in policy manager in accordance with one embodiment; 
         FIG. 5  is a flow diagram showing a process of a security-wrapped app executing on a handset or mobile device in accordance with one embodiment; 
         FIG. 6  is a system architecture diagram of the app security control system in accordance with one embodiment; 
         FIG. 7  is a block diagram showing components and modules in a mobile device needed for implementing a per-app VPN in accordance with one embodiment; 
         FIG. 8  is a flow diagram of a process of implementing an app VPN in accordance with one embodiment of the present invention; and 
         FIGS. 9A and 9B  are block diagrams of a computing system suitable for implementing various embodiments of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     Example embodiments of an application security process and system are described. These examples and embodiments are provided solely to add context and aid in the understanding of the invention. Thus, it will be apparent to one skilled in the art that the present invention may be practiced without some or all of the specific details described herein. In other instances, well-known concepts have not been described in detail in order to avoid unnecessarily obscuring the present invention. Other applications and examples are possible, such that the following examples, illustrations, and contexts should not be taken as definitive or limiting either in scope or setting. Although these embodiments are described in sufficient detail to enable one skilled in the art to practice the invention, these examples, illustrations, and contexts are not limiting, and other embodiments may be used and changes may be made without departing from the spirit and scope of the invention. 
     Methods and system for preventing device software applications from infecting or otherwise damaging a device, in particular, a mobile device, are described in the various figures. These types of applications, used often on a variety of mobile devices, such as smart phones, tablet computers, gaming devices, and portable computing devices are commonly referred to as “apps.” These apps may also be downloaded on to non-mobile devices, such as TVs, computers, automobiles, and other emerging smart device categories. Methods and systems described are not intended to be limited to operation on mobile devices. These device programs or apps have proliferated and are now very prevalent. Currently, apps are typically written in either Java or C. The methods and systems described herein may be applied to apps written in either or to apps written in other languages for different platforms. Most apps, if not all, have to communicate with the mobile device&#39;s operating system to get a specific service that the app needs in order to perform its intended function and this service is usually only available from the operating system. A common example of such a service used is GPS to get the location of the device which the app may need. However, because of this exposure, apps are a vulnerability for the device and pose a security and privacy risk for the user. Companies want to be able enforce a centralized policy to control and secure access to its data and software. This is also true for end users (i.e., individuals, home users, and the like). It enables enterprise IT departments to maintain governance of corporate data. The methods described below provide a centralized way to control security with respect to apps that are downloaded onto mobile devices, where the devices are either an employee&#39;s personal phone or an employer&#39;s phone, so that those apps do not pose a security threat. Various embodiments of the invention may also be used by parents and individuals (i.e., in home or non-work environments) to ensure that their personal mobile devices are safe from malware and may also be used to apply controls, such as on usage. Embodiments of the app control software of the present invention may also be used for mobile device data protection and back-up and for application-level telemetry. 
       FIG. 1A  is a block diagram showing an overview of the app control process of the present invention. It is a generic description of one process without being tied to a specific configuration or environment. An app  102  is provided by app provider  100  which can be any type of entity (individual, software developer, employer, etc.). It is generally unprotected and the only security surrounding it is provided by the operating system. The only shield and checking done on how it executes on the device once loaded is provided by the operating system. 
     The present invention enables additional security of the apps that is not provided by the device&#39;s operating system. A security application program  104  is applied to app  102 . Or the app  102  is input to program  104 , which may be supplied by a third-party app security provider. In one embodiment, security application program  104  has a policy manager and a policy wrapper which may be in different locations. They are described in greater detail in  FIG. 2 . Once security program  104  has been applied to app  102 , the app is wrapped with a security layer so that the device is protected. It is shown as secured app  106 . In one embodiment, secured app  106  is then downloaded onto a mobile device  108 , such as a smart phone or tablet computer, where it executes securely without risking damage to device  108 . Another benefit is that secured app  106  may also be managed by the company or other entity that is providing the app to the user, such as an employer providing the app to an employee. For example, if the user leaves the company, the company may automatically delete the app and any related data from the device. In another example, a parent may be able to limit the apps used by another person (e.g., a child) or to limit the amount of time, e.g., 10 minutes a day or limit which Web sites may be accessed by an app. Or, a parent is concerned that an app is leaking a child&#39;s location to unknown third parties. There may be numerous other examples. As noted,  FIG. 1A  is intended to show the general process of securing an app and downloading it onto a device. Note that in this embodiment, app  102  is not made secure from causing harm to the device after it is downloaded onto the device, but before. In another embodiment, the app is secured after it is downloaded onto the device, but before it can interact with the operating system. 
       FIG. 1B  is a block diagram showing an alternative embodiment. An unsecured app  110  (also supplied by an app provider) is downloaded onto mobile device  112 . In this embodiment, however, there may be a specially designed app on device  112  that blocks the actual installation of unsecured app  110 . The special app (not shown) redirects unsecured app  110  to an app security program  114 . The unsecured app  110  is wrapped in a security policy, the resulting app shown as secured app  116 . It is then downloaded and allowed to be installed on device  112  by the special app. In this manner, an individual or home user, for example, who wants to protect her phone from security threats posed by apps, can have apps made secure (wrapped) by a third-party service or by her mobile phone carrier, to mention only two examples, before they are downloaded on to her phone. It should be noted that this security wrapping can be done to an app regardless of where the user downloads the app from. It may also be noted that in  FIGS. 1A and 1B , the network and connections between the components and software are shown generically. The transmissions are primarily over the Internet (not shown) but may also be within a private network or both. 
       FIG. 2  is a block diagram showing components of an app security program in accordance with one embodiment of the present invention. In one embodiment, the security program has two major components, a policy manager and a policy wrapper. A policy manager  202  accepts input from an administrator or other individual who is responsible for setting security for the mobile device. The person may be referred to as the governor since he is governing the security of the one or more mobile devices. The security policy may be set using various user interface screens. There are numerous examples of policies, including geo-fencing (e.g., the app can only be used in a building) and others. The service provider or the entity providing the app security program may also provide default policy and security settings which may be useful for home users. Examples of policy settings are described below. Policy input  204  is inputted into policy manager  202 . Policy manager  202  takes the input/settings from the governor and creates policies or meta-data  206 . The format or form of meta-data  206  can vary. They essentially reflect the policy settings from the governor. 
     Metadata (policies)  206  may be used as input to a policy wrapper  208 . In one embodiment, this component of the program takes the policies and uses them to secure an app  210  by wrapping it. Wrapper  208  receives an app  210  from a handheld device  212 . In one embodiment, wrapper  208  receives a copy of an app  210  instead of the original app  214  that was downloaded onto phone  212  (see  FIG. 1B  above). Here the handheld device  212  user attempts to download an unsecured app  216  from an app provider  218 . In the scenario in described in  FIG. 1A , it may operate on the app itself instead of a copy. This may be the case where a market place or app store offers customers a secured version of the app along with an unsecured version (or only offer the secured version). A secured version  220  (security-wrapped version) is returned from policy wrapper  208  to device  212 . 
     Metadata  206  may also be used to update a local policy file (an existing policy that is already on the device). A local policy file is used to update policy parameters residing on device  212 . For example, in the case of “geofencing” (i.e., restricting use of an app to an certain physical areas) it is likely that the GPS locations controlled by the governor will change over time. When such a change occurs, the new policies can be applied in two different ways. One is to generate a new policy and apply it to the original app (i.e., wrap the app with the new policy). Another way is to allow dynamic configuration based on a local policy data file with the “variable” part of the policy encrypted/signed inside it. For example, an IT person may want the ability to override a configuration on a device directly through an IT app residing on the device for diagnostic purposes. 
     In one embodiment policies have two components: a fixed part and a variable part. The fixed part is the content described in the policy file (e.g., “protect the GPS at certain times of day”). The variable part typically is provided by the governor through a console (e.g. “what are the times when the GPS should be protected?”). The variable part can change without applying a new policy. 
     Policy designers can choose to forego the variable component of the policy and basically “embed” all data or content statically in the policy file. In this case, the console does not have any way to customize the policy. 
     If the policy designer chooses to include some variable component in the policy, when changes are made to the variable data (on the console), a new data file could be sent to the device to reflect the latest changes. Such a file would be encrypted/signed (to prevent a malicious app circumventing the policy), downloaded to the device, and used by the app security code on the device to apply the new data to the appropriate policy. 
     Such changes and updates may be done by local policy update component  222  at runtime. This component creates updated policy parameters on device  212 . Thereafter, wrapped app  220  will use the updated policy parameters. 
     In one embodiment, policy manager  202  and policy wrapper  208  are components in the same app security program and may operate on the same computer. In other embodiments, the manager and wrapper components may be on separate computers. For example, the policy manager  202  may be on a server at one site and the policy wrapper  208  may be on a computer at another site and may be managed by a different entity or the same entity. Collectively the manager and wrapper form the app security program which, in one embodiment, is operated by a security service provider. It may also be provided by an enterprise, such as a company, employer, business partner, and the like, or by a mobile phone carrier. 
       FIG. 3  is a flow diagram showing a process of making an app secure before downloading it on to a device in accordance with one embodiment of the present invention. At step  302  a copy or clone of the app that is to be secured is made on the device. In one embodiment, this may be done on the mobile device itself or may be done off the device, for example, on components on the Internet, in the cloud, on an enterprise&#39;s server or on a carrier server. The user may be an individual, an employee of a company or other entity. As is known in the field, an app may be obtained in a number of ways, most typically from an app store or an app market, or directly from the app developer or provider or in any suitable manner. By making a copy, the original app is preserved giving the user an option to use either the secured or unsecured version and also protects the user&#39;s ability to use the app if something goes wrong with the app control process. Note that in one embodiment, the app is not yet downloaded on to the phone. In one embodiment, the methods described below are performed on separate computing devices. In another embodiment, the process may be performed on a mobile device, but the app is only executed on the device after the process is complete and the app has been made secure. 
     At step  304  the app is decapsulated. Most, if not all, apps have digital signatures signed by the author/developer. At step  304 , as part of the decapsulation, the digital signature is removed from the app. This may be done using techniques known in the art. Decrypting the app may also be performed at this step. These and other steps provide the core object code of the app which may now be operated on by the app control program. The nature and specifics of this operation may depend on the mobile device&#39;s operating system. 
     There are several examples of operating systems for smart phones such as iOS (for the iPhone), Android (used on handsets from various manufacturers), Windows Mobile 7, Web O/S, Palm, and others. At step  306 , the core object code app may be either disassembled or decompiled to obtain the executable object code. For example, it can be either “native code” (CPU instructions) or bytecode (virtual machine instructions, such as Java or .Net). In one embodiment, this may be more of a modification process if the device runs iOS where the disassembly is closer to a process of locating and substituting certain links and terms. However, in general, the disassembly process to obtain the object code of an app after it has been decapsulated may be done using techniques known in the art, such as using disassemblers. 
     At step  308  the app object code is augmented with object code from the app security program. For example, this object code may include class files which are replaced with class files from the security program. The object code generally provides an interface to the mobile device operating system. The app control security program object code is derived, in part, from the policy/meta-data described above. In the case of iOS, the operation is different in that a ‘locate and substitute’ process occurs rather than an object code replacement. This takes into consideration an interrupt approach that iOS&#39;s uses. Generally, the app security program goes through the assembly language code. The specific items located are Software Interrupts (SWIs) within the object code and which are replaced with a branch to an app control security program layer which may then determine what further actions to take, such as making the request, enhancing the results, and others, as described below. 
     At step  310 , after substitution of the object code (or substitutions of SWIs) has been made, the app security program prepares the security wrapped app for execution on the mobile device. The object code substituted into the app by the security program generally provides a bridge or connection between the app and the mobile device operating system. The security program class files may be described as wrapping around the operating system class files. The app security program class files are generated based on the policies created earlier (by input from the governor). The app is essentially re-wired for execution on the handset. It is re-wired to use the app security program layer in addition to the security provided by the mobile device operating system layer. That is, the secured app may still be subject to the security provisions of the operating system. In one embodiment, certain cosmetic changes may also be made to the app, such as changing the icon for the app to reflect that it is secured. By doing this, the user can be sure that when the app icon appears on the handset screen that the secured version of the app will be executed. The app has now essentially been re-factored or re-programmed by the security program. 
     At step  312  the app is signed with a new key, for example, with the key of the service provider or the key of the enterprise providing the secured app. The re-factored, secured version of the app is returned to the handset device. In another embodiment, the app is wrapped with the security layer on the phone. At step  314 , in one embodiment, the original, unsecured copy of the app is deleted from the handset device. This may be done by the secured version of the app once it is downloaded onto the handset. In other embodiments, this is not done and both versions remain on the mobile device. At this stage the process is complete. 
       FIG. 4  is a flow diagram of a method performed in policy manager  202  in accordance with one embodiment. At step  402  the governor or other security policy individual is enabled to define, generate, and create security policies. This may be a network administrator for an enterprise deciding a vast array of mobile device security policies for hundreds of employees using dozens of enterprise apps (specifically for work) that may be downloaded on hundreds or thousands of mobile devices. On the other end of the spectrum, it may be a parent who is setting security policy for three or four apps downloaded by her child on a new mobile device. Other examples include preventing or squashing a gaming app using GPS, preventing an app from using a microphone on the device to record or eavesdrop on a conversation, among many others. In either case, the governor may take into consideration the category of the app, the type and nature of app, the author, the age-appropriateness, and numerous other factors. For example, has the same author written any other apps that may have been classified as malware or posed a security threat to the device. It may determine whether there are other apps by the same author. It is at this stage that the governor decides which rules to apply for each app. In one embodiment, this is done off-line by the governor. That is, it may be done using user interfaces on a home computer or on an enterprise network computer used by an administrator where security templates provided by the security program service provider (essentially default templates) may be used or very specific rules may be set using the templates. 
     At step  404  the security data input at step  402  is used by the app control security program to create the actual policies. At step  406  the app control security program object code is generated based on the input from the governor regarding security policies created at step  404 . The governor or service provider may also update existing security policies if needed. As described above, the object code may be used to enhance certain original object code obtained from the disassembled app. The enhancement code is inserted to adjust security and privacy settings for an app in order to protect the enterprise and end user. The original app&#39;s behavior is altered which allows the governor to control how the app behaves. For example, if an app stores sensitive account information in the clear (i.e., un-encrypted), the behavior could be changed so that all information the app creates is stored in encrypted form and which can only be accessed by that app given that the key to the stored, persistent data would be unique to the app. In many instances the enhancement code can improve the apps performance since the code is optimized for a particular use scenario. 
       FIG. 5  is a flow diagram showing a process of a security-wrapped app executing on a handset or mobile device in accordance with one embodiment. At step  502  the behavior of the app when the app executes or immediately before it executes on the device is altered or modified. For example, behavior modification may include authentication during app initialization; e.g. smart/CAC card, or password challenge. Some apps, as originally designed, may not require a password for security, however, a secured version of an app which has been modified may require that the user enter a password. At step  504  the secured app executes on the mobile device by the user activating it (e.g., tapping on the icon if the device has a touch screen). Upon execution of the app, in one embodiment, control can take one of four options. As is known in the art, when an app executes, it makes calls or requests to the device operating system in order to carry out its functions. In many cases these calls may be harmless or pose no significant security threat to the phone or device. If this is the case, the call may be allowed to pass to the operating system as shown in step  506 . Here the call is made to the device operating system and the app executes in a normal manner. 
     If the security layer or wrapper around the app detects that the app is making a request that may pose a security threat to the device, the app security layer may enhance or modify the request before it is passed to the operating system or other software or hardware component in the phone. This is shown at step  508 . In one embodiment, the governor determines which calls are permissible by examining the one or more policies. For example, the governor may determine that all data should be saved in encrypted form. In another example, the governor may decide that only a select group of trusted apps should have data on a soldier&#39;s GPS coordinate. In one embodiment, there is no runtime logic to determine what is safe, a potential threat, or an actual threat; it is essentially pre-declared by the governor in the policy created at step  404  above. In another embodiment, there may be some runtime logic. For example, an app may be trying to send out expensive SMS text messages. The app control program may determine this and block the app from sending more than a certain number of text messages, for example, it may limit it to transmission of one message. The enhancement may be adding something new, such as a password requirement. In another example, if the call is to save data on the mobile device memory, the secured app may actually back up the data to a storage area in the cloud or on the Internet (i.e., off the device). In another example, the data related to the call may be encrypted. 
     At step  510  the secured app may determine that the call is an actual threat and should be dealt with in a more severe manner than at step  508 . For example, it may have decided that based on the policy for an app, that if a camera on the device is accessed while in a secure building (e.g., the Pentagon), the app should immediately be terminated. Merely enhancing the request may not be sufficient in this case. At step  510 , the request may not be allowed to proceed to the operating system or any other component of the device. However, in one embodiment, a response is returned to the app, but that response is intentionally not accurate or correct. It is essentially an obfuscated response. For example, it may be a GPS coordinate that is not the actual physical coordinate of the device (e.g., the device is in California, but the GPS coordinate that is returned to the app is a coordinate in Nebraska). This may be desirable when apps are used by children. Other examples may be returning bad or garbled data results if an app that should only run within a restrictive environment (e.g., a secure office area) is determined to be running outside that environment (e.g., at home). In this example, the app may be partially crippled so that the app can only access unclassified data and wherein classified information is nullified. In another example, when a user is attempting to paste or copy sensitive data from a classified app to a non-classified app, the app control program may change the copy of the data that is being pasted to garbage or essentially make it meaningless. After either steps  506 ,  508 , or  510  have completed, the security-wrapped app continues execution on the mobile device at step  514 . 
     At step  512  the security layer around the app has determined that the call being made by the app or that the app execution behavior in general poses too high a security threat level to the mobile device. In this extreme case, the security layer decides to terminate execution of the app and/or delete the app. For example, the app may be using too many resources on the phone, such as bandwidth, or is making too many high-risk calls to the operating system thereby over-exposing the mobile device. In this case, the app can simply be deleted from the phone or the app may be terminated. The user may not be able to re-execute it or re-install it. For example, an employee may not install that app again on the company phone because it was exposing sensitive company data. Or it may be determined that an app is secretly collecting data on the phone or installing malware. 
       FIG. 6  is a system architecture diagram of the app security control system in accordance with one embodiment. A trigger manager component  602  handles two events, one for generating a new policy  604  and another for updating policy parameters  606 . Such events can be triggered by various systems. For example, a console administrator or governor might apply a new policy to all devices (a manual operation). Or a network monitoring application, after detecting suspicious traffic originating from a device (or app), could push a new policy that would prevent a user/device/app from accessing network resources (an example of an automated operation). The various systems or entities that have the authority to change/update polices, do so through the trigger manager  602 . 
     New policy output  604  is input to a policy definition file  608  which may be generated at runtime and may include various types of code and extensions, for example, specific to the app control service provider, or to the app/user/device the policy applies to. Policy definition file  608  is input to a policy compiler  610  which has two outputs. One output is a wrapper definition file  612 . This file is input to an app wrapper component  614 . App wrapper component  614  is responsible for generating secure app by injecting custom binary code (native or bytecode) into an app, downloaded directly, for example, from an app store. Or the app could be an app the user downloaded on to his device, and then uploaded to an “AppControl” server. 
     App wrapper component  614  may have three inputs: apps from one or more app stores  616 , certificate key management data from identity management component  618 , and hardened components  620 . Key management data is used to tie the identities of the user, device, and the app, and ensure that any operation subject to policy control can be tied to a specific user/device/app. This also ensures that a wrapped application can only be run on a specific device to prevent a malicious app from circumventing policies and hardened components  620  (for example “Device security framework”). The output from app wrapper  614  is a wrapped app  622  which is downloaded or installed onto mobile device  624  via the device&#39;s controller  626 . Device controller  626  responsibilities include: download app from the app wrapper; ensure that app running on the devices are appropriately wrapped apps (e.g., app wrapped for user 1  should not be installed/run on device for user 2 ); report list/version of installed applications to allow the management console to control policies for each device/user/application; and download policy parameters when appropriate. Wrapped app  622  resides on device  624  coupled with policy parameters  628 . 
     Returning now to policy compiler  610 , the other output is a runtime policy definition file  630 . This file is input to a runtime policy compiler  632  which also accepts as input policy parameters  606  (specified by the management console, or other subsystems). Output from compiler  632  is a device runtime policy file  634 . This file  634  is downloaded onto device  624  as shown as policy parameters  628 , and is used to customize the policies applied to wrapped app  622 . 
     Described below are various use cases and capabilities of the app control security program of the present invention. One use case involves the separation of work life and personal life on a mobile phone. There are apps for the user&#39;s personal use and apps that the user&#39;s employer (or a business partner of the employer) may have provided and the apps operate on the same phone, which is often the user&#39;s personal phone. The governor who determines security of the apps that need to be secured on the user&#39;s phone may block copy/paste operations between apps (such as e-mail apps). The governor may set policies for the work-related apps that perform selective wipes of apps and associated files. User location-based policies may also control where certain apps may execute. Examples of levels of protection because of malware are denying access to contacts, denying transmission of SMS without consent, and the like. 
     Another example of a use case is app control. Using the present invention, white and black listing of apps may be implemented, as well as full deletion of apps according to the policies set by a governor. An app may be ‘sandboxed’ to protect the other apps, software, and hardware of the device. Other capabilities may include identity-based control of apps or services and highly granular control over app behavior. Trojan identification is another use case that can be implemented with the app security program. For example, each app and content may be encrypted to prevent rogue apps from gaining access to and stealing confidential data on the phone. The security program may also be able to identify anomalous system call behavior of an app to identify malicious Trojan apps that act outside of their published intent. 
     Another use case is back-up and recovery of app data in which IT security administrators and governors have data revision control and can implement app and device content migration through back-up and restore operations. In another use case is network traffic monitoring. The app on the mobile device may be brought under the visibility of existing enterprise IDS/IPS/Web filtering infrastructure to allow for inspection and control of app communications. The app security program can also integrate with third-party DNS services, such as Symantec&#39;s DNS service to identify malware. All app communications may be encrypted, including communications at the mobile phone service provider. Other use cases include session continuity, consumer privacy (e.g., GPS obfuscation, implementing safe DNSs), and intercepting payment/transaction messages from the mobile device (i.e., operating in the middle of mobile commerce streams). 
     In one embodiment, the app security service is offered by a third-party service provider, for example, to make apps used by end-users or individuals (i.e., users not associated with an employer or enterprise). For example, a parent may want to obfuscate the GPS of a child&#39;s phone because the parent does not want a social network site, such as Facebook, to know where the child is, essentially disabling GPS. In another embodiment, an app store, operated by a wireless phone carrier (e.g., Verizon, AT&amp;T) may offer a secured app for an extra charge or premium. A customer of the carrier can download the secured app from the marketplace or online store instead of the unsecured version by paying an extra amount. In another embodiment, an enterprise may have its own app store for its employees, partners, and the like, where users can only download secured versions of the apps (which may be referred to as “hard” apps). These apps may have many of the security features described above as defined by a governor (security administrator) at the enterprise, such as blocking copying and pasting e-mail or corporate data, killing an app from the user&#39;s phone if the user leaves the company, and so on. A mobile phone carrier&#39;s DNS can typically access any site, but the app security program can block a mobile device browser so that it can access only a safe DNS (e.g., Symantec&#39;s DNS) from where only safe Web sites may be accessed. In another embodiment, the app security program provider can work with the mobile device manufacturer to incorporate the app security program or functionality into the hardware and software operations of the device. In this embodiment, described below, a user can download an unsecured app and make is secured on the phone or device itself before executing and does not have to access a third-party service to have the app secured or ensure that the app is secured before being downloaded onto the device. 
     As can be seen from various embodiments described above, the security of the mobile device extends beyond the device itself and is applied directly to the apps that are downloaded onto the device. Companies and other entities are able to take advantage of apps more freely without having to worry about the security risks, such as data leakage or malware infection of the company&#39;s enterprise IT system. Companies can maintain governance of its corporate data. 
     In another aspect of the present invention, a VPN is created and utilized by individual apps on a device. That is, an app has a VPN tunnel to communicate with, for example, a corporate VPN gateway. This VPN tunnel is used only between the single app on the device and the VPN gateway. In one embodiment, each security wrapped app has its own IP stack or, more generally, VPN stack. Methods and systems for creating a VPN tunnel for a specific wrapped app on a device are described in  FIGS. 7 and 8 . 
     As noted above, conventionally, a VPN tunnel is built (on the client/device side) on top of the system UDP or TCP modules, which in turn communicate with the VPN gateway. In the described embodiment, the device may be a smartphone, tablet, or other mobile device. In other embodiments, the device may be a PC or a laptop. It may also be a wearable device, such as a watch, goggles, or other nomadic Internet-enabled computing device. In yet other embodiments, the device may be any Internet-enabled appliance or system. Examples include cars that have Internet access, household appliances (refrigerators, washers, etc.), or HVAC, home heating/AC systems, or security systems. As noted, the described embodiment uses mobile devices where users download apps. However, the present invention may also be used in other embodiments and contexts. 
     Generally, there is software on the device, such as a smartphone, tablet, PC, or other Internet-enabled device, that allows it to make a VPN connection to a gateway device. However, the described embodiment provides a more compartmentalized way of creating and utilizing a VPN tunnel on the device that is more secure. In one embodiment, each wrapped app has its own VPN tunnel. In another embodiment, some or all apps in a federation of apps on a device have the option of sharing one VPN tunnel. A secure form of IPC may be used to communicate between the processes in the case of a “federated” application. As described in more detail below, IPSec packets may be built for each wrapped app (each wrapped app operating in its own sandbox, that is, outside the device operating system). The IP packets are transmitted via a proxy or virtual data link layer (part of the app VPN stack) to a native UDP module in the operating system. From there it is transmitted to a VPN gateway. As noted above, the device may also be a PC. For example, a PC running a wrapped version of Microsoft Outlook may have its own VPN tunnel from the PC to the gateway 
     In order to establish a VPN tunnel, an initial step is to create only packet types that a typical operating system makes available to applications. For example, to connect to an IP-based VPN, an application can use TCP or UDP packets. In the described embodiment, the app IP stack uses UDP packets. Generally, it should not use “raw” IP packets (without a specific Layer 4 protocol), because such packets are typically reserved by operating systems so that only privileged applications may send or receive them. A per-app VPN, as described in various embodiments of the present invention, is not required to be a privileged process on the device. NAT traversal of IPsec packets is enabled using UDP protocol (as described in RFC 3947 and RFC 3984), rather than raw IP packets. 
     In order for an app to send data through a VPN tunnel to a gateway, the app must be able to build IP packets which are then encapsulated using VPN software on the device. The IP packets are built using an IP stack. This software typically resides in the operating system of the device. Therefore, in order for a per-app VPN to operate, in one embodiment, the app makes use of an IP or VPN stack that is used to build a tunnel that is only used between the single application and the gateway. That is, in one embodiment, it is not used by other apps. This stack may also be referred to as a per-app IP stack, in the app sandbox. The goal being to generally replicate operating system functionality in the sandbox. 
     In order for any IP stack to access an outside network, it uses software referred to as data link interface (also known as Layer 2, per the TCP/IP and OSI networking models). In one embodiment of the present invention, and as shown in  FIG. 7 , this data link interface is implemented as a proxy (or virtual) data link interface to an underlying operating system&#39;s (native) IP stack. In one embodiment, given that only UDP packets are sent and received, this proxy data link interface supports sending and receiving UDP traffic via the native operating system&#39;s IP/VPN stack and the per-app IP/VPN stack. An IPsec module decrypts the inbound traffic coming from the virtual data-link layer, and encrypts the outbound traffic from the per-app IP stack. 
     IPsec is typically implemented as a “bump in the [IP] stack”, and is integrated into an operating system&#39;s IP stack. In one embodiment, IPsec is implemented in the per-app IP stack instead. As noted, a proxy or virtual data link interface for IPsec is defined in the per-app IP stack. The IPsec encapsulates traffic (IP packets) built through the per-app IP stack and routes the traffic via the proxy data link interface, in one embodiment, to a UDP module in the native operating system space. 
       FIG. 7  is a block diagram showing components and modules in a mobile device needed for implementing a per-app VPN in accordance with one embodiment. Shown are the two relevant memory spaces on a mobile device  702 : a sandbox area  704  containing components of a wrapped app, system components, and an IP/VPN stack, and a device operating system space  706 . Also shown, external to mobile device  702 , is a VPN gateway component  708 . As noted above, embodiments of the present invention involve creating and implementing an IP stack for a security wrapped app in sandbox area  704 . 
     An IP stack  710  has some of the conventional layers of a TCP/IP stack, such as network layer and transport layer. Above IP stack  710  is an HTTP proxy or sockets layer  712 . Two components in app IP stack  710  are IPsec  714  and proxy data link layer  716 . Virtual data link layer  716  functions as an IP interface to between virtual IPsec  714  and native UDP module  722 . The combination of virtual IPsec  714 , virtual data link layer  716 , and IP stack  710  may also be referred to as a “per-app VPN” stack. The primary goal of the per-app VPN stack of the present invention is to replicate operations and functionality that take place in native operating system  706 . Components for a single app and any system components reside in sandbox area  704 . However, for illustration, only one app component  718  and one system component  720  are shown. 
     Native operating system  706  contains several components, including a system-level or native IP stack (not shown). One of the modules in operating system space  706  needed for the present invention is a UDP module  722 . As noted, IPsec packets are transmitted from mobile device  702  to VPN gateway  708  using UDP. In other embodiments, TCP may be used. Data packets for the security wrapped app are also received from VPN gateway device  708  at UDP module  722  and relayed to proxy data link layer  716 . 
       FIG. 8  is a flow diagram of a process of implementing an app VPN in accordance with one embodiment of the present invention. A security-wrapped app in sandbox  704  executes in a normal manner and in the process makes calls to the device operating system, some of which require communication over a VPN. This occurs at step  802 . In one embodiment, those calls are re-directed to app IP stack  710  at step  804 . In one embodiment, The interfaces that are exposed to the application (and app and system components, boxes  718  and  720 ) through HTTP proxy layer box  712  mirror the corresponding interfaces provided by operating system  706 . 
     At step  806  the app IP stack builds IPsec packets in a conventional manner. This would normally be done by the system/native IP stack as a result of an app or system component in the sandbox making a call to the operating system. IP packets are then encapsulated using IPsec in the app VPN stack. At step  808  a proxy data link layer, also part of the app VPN stack, transmits packets to a UDP module in the system/native IP stack. In other embodiments, where an SSL VPN is implemented, the packets may be transmitted to a TCP module. As noted, the proxy (virtual) data link layer functions as an interface between the app IP stack and the system native stack, specifically the UDP module. The IPsec module can be described as a virtual IPsec interface. This interface together with the virtual data link interface functions to get IP packets down through the app VPN stack and out through the native UDP module to the VPN gateway. 
     It may be noted that this is possible by virtue of using network address translation (NAT). As is known in the art, this technique allows an entity to allocate “private” IP addresses which are mapped to public IP addresses. The private IP addresses are never seen by the public. Traditional NAT approaches are able to rewrite an IP packet and then send it to a different, private address. 
     As noted above, by configuring a particular application with its own VPN tunnel, one could configure the app security wrapping server to restrict access to network resources so that the app can only access the specific resources it needs. If HTTP proxy  712  is listening on a TCP port provided by operating system  706 , other applications could potentially connect to that TCP port. In one embodiment, HTTP proxy layer  712  implements techniques to prevent other applications on the device from accessing the HTTP proxy. In one embodiment, the system determines if a connection to the HTTP proxy layer  712  came from the current process (i.e., the wrapped, host app), for example by looking through all the file descriptors in the current process and checking with the kernel to determine if any of file descriptors made the connection to HTTP proxy layer  712 . If the authenticity of a group or federation of apps can be validated and establish communication between those apps, in one embodiment, the federated apps can share a single VPN tunnel. Although this would lower the number of concurrent VPN tunnels needed for a device, it may detract from some of the advantages described above, such as configuring a server to restrict access to network resources such that the app can only access the specific resources it needs. 
     As such, in one embodiment, only the specific security wrapped app can connect to the VPN tunnel that is created by that app&#39;s VPN stack. This prevents another malicious app or any other malware on the device from stating that the HTTP proxy for another app is also the proxy for the malicious app, thereby preventing the malicious app from using the wrapped app&#39;s VPN. In another embodiment, a VPN tunnel created by a security wrapped app may be shared by other wrapped apps in the same federation or group as the app that created the VPN. 
     In another embodiment, a device user may need a VPN to gain any type of access or connectivity at all (e.g., if the user is working abroad in a country with restrictive Internet access), the user can access a device-level VPN to gain initial full-internet access, and then use a per-app VPN to gain corporate access. 
     Another advantage of tying a single application to a VPN tunnel is the ability to restrict, at the VPN gateway, the network resources that the application has access to, by using a different “configuration profile” (i.e., VPN group) per application. 
       FIGS. 9A and 9B  illustrate a computing system  900  suitable for implementing embodiments of the present invention.  FIG. 9A  shows one possible physical form of the computing system. Of course, the computing system may have many physical forms including an integrated circuit, a printed circuit board, a small handheld device (such as a mobile telephone, handset or PDA), a personal computer or a super computer. Computing system  900  includes a monitor  902 , a display  904 , a housing  906 , a disk drive  908 , a keyboard  910  and a mouse  912 . Disk  914  is a computer-readable medium used to transfer data to and from computer system  900 . 
       FIG. 9B  is an example of a block diagram for computing system  900 . Attached to system bus  920  are a wide variety of subsystems. Processor(s)  922  (also referred to as central processing units, or CPUs) are coupled to storage devices including memory  924 . Memory  924  includes random access memory (RAM) and read-only memory (ROM). As is well known in the art, ROM acts to transfer data and instructions uni-directionally to the CPU and RAM is used typically to transfer data and instructions in a bi-directional manner. Both of these types of memories may include any suitable of the computer-readable media described below. A fixed disk  926  is also coupled bi-directionally to CPU  922 ; it provides additional data storage capacity and may also include any of the computer-readable media described below. Fixed disk  926  may be used to store programs, data and the like and is typically a secondary storage medium (such as a hard disk) that is slower than primary storage. It will be appreciated that the information retained within fixed disk  926 , may, in appropriate cases, be incorporated in standard fashion as virtual memory in memory  924 . Removable disk  914  may take the form of any of the computer-readable media described below. 
     CPU  922  is also coupled to a variety of input/output devices such as display  904 , keyboard  910 , mouse  912  and speakers  930 . In general, an input/output device may be any of: video displays, track balls, mice, keyboards, microphones, touch-sensitive displays, transducer card readers, magnetic or paper tape readers, tablets, styluses, voice or handwriting recognizers, biometrics readers, or other computers. CPU  922  optionally may be coupled to another computer or telecommunications network using network interface  940 . With such a network interface, it is contemplated that the CPU might receive information from the network, or might output information to the network in the course of performing the above-described method steps. Furthermore, method embodiments of the present invention may execute solely upon CPU  922  or may execute over a network such as the Internet in conjunction with a remote CPU that shares a portion of the processing. 
     Although illustrative embodiments and applications of this invention are shown and described herein, many variations and modifications are possible which remain within the concept, scope, and spirit of the invention, and these variations would become clear to those of ordinary skill in the art after perusal of this application. Accordingly, the embodiments described are to be considered as illustrative and not restrictive, and the invention is not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.