Patent Description:
As portable wireless devices - such as smartphones, tablets, automotive infotainment systems, and so-called "Internet of Things" sensor-based devices - gain in popularity and use, they are increasingly being targeted by cyber attackers, who use device wireless communications pathways to launch remote attacks against the device's operating system. Many such operating systems, for example, iOS, Linux, Windows, and Android, are extremely complicated and have a lengthy track record of containing numerous exploitable security vulnerabilities. One family of attack vectors attempts to surreptitiously activate the portable device's input peripherals - such as audio, wireless communications (Wi-Fi, Bluetooth, etc.), and cameras - to gather locally available/generated private information without proper authorization (i.e. spy).

Portable device operating systems employ a number of security controls aimed at preventing unauthorized manipulation of input peripherals; however, the vulnerabilities in the operating systems themselves may render such controls impotent, since an attacker can simply use one of these vulnerabilities to commandeer the operating system and disable or otherwise circumvent its security controls. <NPL>] relates to the limitations of credential-based authentication such as facial authentication. Facial authentication is one of the popular biometric authentication techniques and it consists of three phases: first, the photo is captured by hardware camera; second, the smartphone application retrieves the photo from hardware camera via OS; third, the smartphone application authenticates the user by sending the photo (or its extracted features) to remote services. To achieve the trusted facial authentication, all three phases should be secured. In this paper, we propose TrustFA. a TrustZone-assisted solution to secure all three phases in facial authentication on smartphone. We leverage the ARM TrustZone technique to capture the photo and collect the accelerometer data in TrustZone secure world. As all of the secure world memory, peripherals and interrupts are isolated from normal world legacy OS, attackers even with root privilege in legacy OS would not be able to break the authentication. <CIT> relates to a computing platform that is adapted for secure use of trusted user input. The computing platform comprises a user input device, a first isolated operating environment for execution of applications requiring use of trusted user input, a second isolated operating environment adapted for secure processing of information relating to a user, and a third isolated operating environment adapted for secure communication with the user input device. In this computing platform, no isolated operating environment can communicate with another isolated operating environment other than by a secure path therebetween. When an application executing in the first isolated operating environment requires provision of trusted user input, the user provides user input through the user input device to the third isolated operating environment. The user input is then provided to the second isolated operating environment, and the second isolated operating environment provides a service relating to the trusted user input as required by the application executing in the first operating environment. <CIT> disloses an example system that allows a camera enabled application, such as an augmented reality application, to run in a protected area may include a first device including a camera, the camera including a secure mode of operation and a display, an image processing module configured to convert image data from the camera to encoded data when the camera is in the secure mode and protect image data stored in the system, an encryption module configured to encrypt encoded data from the image processing module, and a protected audiovisual path mechanism configured to securely send augmented encoded data to the display.

By way of example, reference will now be made to the accompanying drawings.

The invention is defined by the attached independent claims. The dependent claims describe embodiments of the invention.

Further, certain figures in this specification are flow charts illustrating methods and systems. It will be understood that each block of these flow charts, and combinations of blocks in these flow charts, may be implemented by computer program instructions. These computer program instructions may be loaded onto a computer or other programmable apparatus to produce a machine, such that the instructions which execute on the computer or other programmable apparatus create structures for implementing the functions specified in the flow chart block or blocks. These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction structures which implement the function specified in the flow chart block or blocks. The computer program instructions may also be loaded onto a computer or other programmable apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow chart block or blocks.

Accordingly, blocks of the flow charts support combinations of structures for performing the specified functions and combinations of steps for performing the specified functions. It will also be understood that each block of the flow charts, and combinations of blocks in the flow charts, can be implemented by special purpose hardware-based computer systems which perform the specified functions or steps, or combinations of special purpose hardware and computer instructions.

For example, any number of computer programming languages, such as C, C++, C# (CSharp), Perl, Ada, Python, Pascal, SmallTalk, FORTRAN, assembly language, and the like, may be used to implement aspects of the present invention. Further, various programming approaches such as procedural, object-oriented or artificial intelligence techniques may be employed, depending on the requirements of each particular implementation. Compiler programs and/or virtual machine programs executed by computer systems generally translate higher level programming languages to generate sets of machine instructions that may be executed by one or more processors to perform a programmed function or set of functions.

The term "machine-readable medium" should be understood to include any structure that participates in providing data which may be read by an element of a computer system. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks and other persistent memory. Volatile media include dynamic random access memory (DRAM) and/or static random access memory (SRAM). Transmission media include cables, wires, and fibers, including the wires that comprise a system bus coupled to processor. Common forms of machine-readable media include, for example, a floppy disk, a flexible disk, a hard disk, a magnetic tape, any other magnetic medium, a CD-ROM, a DVD, any other optical medium.

As shown in <FIG>, certain embodiments employ an "out-of-band" mechanism in which the physical controls for activating input peripherals are removed from the portable device operating system domain <NUM> and placed instead under the control of a separate peripheral control domain <NUM>, isolated from the general-purpose operating system domain <NUM> by a security kernel. The security kernel may employ machine virtualization <NUM> techniques that enable the peripheral control domain <NUM> to run alongside, but securely isolated from the general-purpose portable operating system <NUM> on the same general-purpose microprocessor <NUM> that would be used in a system that lacks the above features. No additional hardware may be required to implement the foregoing embodiments. An adjunct I/O virtualization mechanism <NUM> may also be included to abstract the guarded input peripheral interfaces, such that all attempts to turn them on from within the general-purpose operating system <NUM> are automatically redirected by the I/O virtualization mechanism <NUM> to the peripheral control domain <NUM>. The peripheral control domain <NUM> may then conduct a policy-driven decision process via peripheral access policy module <NUM> to either allow, disallow, or request manual/explicit authorization of these access attempts. If access is permitted, such physical access may be performed by physical peripheral access module <NUM> within the peripheral control domain <NUM> and not within the general-purpose operating system domain <NUM>. Because the access control and physical activation of input peripherals occur out-of-band from the operating system <NUM>, these security-critical operations may be immune to vulnerabilities in the portable operating system <NUM>.

In certain embodiments, the I/O manipulation mechanisms described in this disclosure do not impact the user experience; nothing in the user interface or in the behavior of general-purpose operating system application software is changed.

In certain embodiments, a portable computing device is disclosed comprising: at least one portable operating system domain; a peripheral control domain; a machine virtualization mechanism that isolates the at least one operating system domain from the peripheral control domain; and an I/O virtualization mechanism configured interposed between the operating system domain and the peripheral control domain and configured to translate operating system-originated input peripheral access requests and responses. The peripheral control domain may comprise: a physical peripheral control component; and a policy component for deciding how to handle input peripheral requests originating from the operating system. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may utilize ARM TrustZone. The machine virtualization mechanism may comprise a micro kernel. The machine virtualization mechanism may comprises a separation kernel. The policy component may be configured to perform a local, autonomous decision regarding whether to allow input peripheral access based at least in part on at least one detectable condition. The at least one detectable condition may comprise at least one of a geolocation, one or more fixed policy settings, and an active connection to a trusted network. The policy component may be configured to request a user input to grant permission to access the input peripheral and the machine virtualization mechanism may be configured to render the portable operating system unable to overwrite or corrupt the input request process if the user input does not grant access. The policy component may receive a decision from a remote system. The remote system may comprise one of a manual control system or an automated control system. The policy component may record in an audit log all attempts to access input peripherals. The audit log may be locally stored within the portable device. The audit log may be transmitted to the remote system. The device may further comprise an input / data generation peripheral comprising at least one of: an audio device, a Bluetooth module, a near-field communications (NFC) module, a Wi-Fi module, a camera, a sensor, a global positioning system module, a ZigBee module and an IEEE <NUM>. <NUM> module. The I/O virtualization mechanism may comprise: one or more alternative virtualized controls that mimic one or more operating system peripheral controls for interfacing with the operating system. The I/O virtualization mechanism may comprise: a logical communications interface between the operating system domain and the peripheral control module domain for translating control requests and responses. The I/O virtualization mechanism may comprise at least one microprocessor trap to detect an attempt to access at least one physical peripheral. The machine virtualization mechanism may be configured to transfer control to the peripheral control module based on the detected attempt.

In certain embodiments, a portable computing device is disclosed comprising: at least one portable operating system module; a peripheral control module; a machine virtualization module that isolates the at least one operating system module from the peripheral control module; and an I/O virtualization module interposed between the operating system module and the peripheral control module and configured to translate operating system-originated input peripheral access requests and responses. The peripheral control module may comprise: a physical peripheral control module; and a policy module for deciding how to handle input peripheral requests originating from the operating system module. The machine virtualization module may comprise a Type-<NUM> hypervisor. The machine virtualization module may comprise a Type-<NUM> hypervisor. The machine virtualization module may utilize ARM TrustZone. The machine virtualization module may comprise one of a microkernel and a separation kernel. The policy module may be configured to perform a local, autonomous decision regarding whether to allow input peripheral access based at least in part on at least one detectable condition. The at least one detectable condition may comprise at least one of a geolocation, one or more fixed policy settings, and an active connection to a trusted network. The policy module may be configured to request a user input to grant permission to access the input peripheral and the machine virtualization module may be configured to render the portable operating system unable to overwrite or corrupt the input request process if the user input does not grant access. The policy module may receive a decision from a remote system. The remote system may comprise one of a manual control system or an automated control system. The policy module may record in an audit log all attempts to access input peripherals. The audit log may be locally stored within the portable device. The audit log may be transmitted to the remote system. The device may further comprise an input / data generation peripheral comprising at least one of: an audio device, a Bluetooth module, a near-field communications (NFC) module, a Wi-Fi module, a camera, a sensor, a global positioning system module, a ZigBee module and an IEEE <NUM>. <NUM> module. The I/O virtualization module may comprise: one or more alternative virtualized controls that mimic one or more operating system peripheral controls for interfacing to the operating system. The I/O virtualization module may comprise: a logical communications interface between the operating system module and the peripheral control module for translating control requests and responses. The I/O virtualization module may comprise at least one microprocessor trap to detect an attempt to access physical peripherals. The machine virtualization module may be configured to transfer control to the peripheral control module based on the detected attempt.

In certain embodiments, a method of domain isolation is disclosed, comprising: receiving an input peripheral access request from at least one portable device operating system; and performing a local, autonomous decision whether to allow input peripheral access based at least in part on at least one detectable condition, wherein the at least one portable device operating system is isolated from a peripheral access module domain by a machine virtualization module. The peripheral access module domain may comprise: a physical peripheral control module; and a policy module for deciding how to handle input peripheral requests originating from the operating system. The machine virtualization module may comprise a Type-<NUM> hypervisor. The machine virtualization module may comprise a Type-<NUM> hypervisor. The machine virtualization module may utilize ARM TrustZone. The machine virtualization module may utilize ARM TrustZone. The machine virtualization module may comprise one of a microkernel and a separation kernel. The at least one detectable condition may comprise at least one of a geolocation, one or more fixed policy settings, and an active connection to a trusted network. The method may further comprise: requesting a user input whether to allow the input peripheral access; and selectively permitting access to the input peripheral based at least in part on the user input. Selectively permitting access may comprise rendering the operating system unable to overwrite the input request process if the user input does not provide permission to access the input peripheral. The method may further comprise: providing one or more alternative virtualized controls that mimic one or more operating system peripheral controls for interfacing to the operating system. The method may further comprise: translating at least one control request and at least one response via a logical communications interface between the operating system domain and the peripheral control module domain. The method may further comprise: detecting an attempt to access at least one physical peripheral; and transferring control of the at least one physical peripheral to the peripheral access module domain.

As shown in <FIG>, in certain embodiments, virtualization mechanisms used to defend against spying can also be used by attackers <NUM> as a means to execute spying attacks more effectively. In certain embodiments, attack methods may use the forgoing virtualization mechanisms to surreptitiously activate input peripherals without the user's knowledge or authorization. In certain embodiments, a virtualized network interface may be employed in which all network traffic transiting the portable wireless system is routed through a remote control component <NUM> within the peripheral control domain <NUM>. This remote control component <NUM> may be used by an attacker to communicate remotely with the portable device to send it peripheral activation commands. The remote control component <NUM> can then activate peripherals via the physical peripheral access module <NUM> without the user or general-purpose operating system's knowledge or authorization. All other network traffic is passed through as normal and expected to the general-purpose operating system domain <NUM>.

In certain embodiments, a method of gaining remote access to a mobile device peripheral is disclosed, comprising: receiving data at a mobile device, the mobile device comprising: at least one portable operating system module; a peripheral control module; a machine virtualization module that isolates the at least one operating system module from the peripheral control module; and an I/O virtualization mechanism interposed between the operating system module and the peripheral control module; determining whether the data comprises a remote control command to a peripheral device; and performing a selected one of: executing the remote control command via the peripheral control module without forwarding the command to the operating system if the data comprises a remote control command to a peripheral device; or passing the data to the operating system if the data does not comprise a remote control command to a peripheral device. The peripheral control module may comprise: a physical peripheral control component; and a policy component for deciding how to handle input peripheral requests originating from the operating system. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may utilize ARM TrustZone. The machine virtualization mechanism may comprise one of a microkernel and a separation kernel. The method may further comprise: providing one or more alternative virtualized controls that mimic one or more operating system peripheral controls for interfacing to the operating system. The method may further comprise: translating at least one control request and at least one response via a logical communications interface between the operating system module and the peripheral control module. The method may further comprise: detecting an attempt to access at least one physical peripheral; and transferring control of the at least one physical peripheral to said peripheral control module.

In certain embodiments, a method of gaining remote access to a mobile device peripheral is disclosed, comprising: installing a peripheral control module on a mobile device having at least one operating system; installing a machine virtualization module on the mobile device that isolates the operating system module from the peripheral control module; and installing an I/O virtualization mechanism on the mobile device, wherein the I/O virtualization mechanism is interposed between the operating system module and the peripheral control module; receiving data at the mobile device; determining whether the data comprises a remote control command to a peripheral device; and performing a selected one of: executing the remote control command via the peripheral control module without forwarding the command to the operating system if the data comprises a remote control command to a peripheral device; or passing the data to the operating system if the data does not comprise a remote control command to a peripheral device. The peripheral control module may comprise: a physical peripheral control component; and a policy component for deciding how to handle input peripheral requests originating from the operating system. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may comprise a Type-<NUM> hypervisor. The machine virtualization mechanism may utilize ARM TrustZone. The machine virtualization mechanism may comprise one of a microkernel and a separation kernel.

In certain embodiments, the security-kernel may inform a local user of the input peripheral access attempt and requests approval by using a dialog box on the portable device touch screen. This graphical interface may run on the security-kernel (within the peripheral control domain or yet another domain isolated from the general-purpose operating system domain) and the entire display and touch input system may be virtualized so that this authorization interaction also occurs out-of-band from the portable operating system and may therefore be immune to its vulnerabilities.

<FIG> is an exemplary diagram of a computing device <NUM> that may be used to implement aspects of certain embodiments of the present invention. Computing device <NUM> may include a bus <NUM>, one or more processors <NUM>, a main memory <NUM>, a read-only memory (ROM) <NUM>, a storage device <NUM>, one or more input devices <NUM>, one or more output devices <NUM>, and a communication interface <NUM>. Bus <NUM> may include one or more conductors that permit communication among the components of computing device <NUM>.

Processor <NUM> may include any type of conventional processor, microprocessor, or processing logic that interprets and executes instructions. Main memory <NUM> may include a random-access memory (RAM) or another type of dynamic storage device that stores information and instructions for execution by processor <NUM>. ROM <NUM> may include a conventional ROM device or another type of static storage device that stores static information and instructions for use by processor <NUM>. Storage device <NUM> may include a magnetic and/or optical recording medium and its corresponding drive.

Input device(s) <NUM> may include one or more conventional mechanisms that permit a user to input information to computing device <NUM>, such as a keyboard, a mouse, a pen, a stylus, handwriting recognition, voice recognition, biometric mechanisms, and the like. Output device(s) <NUM> may include one or more conventional mechanisms that output information to the user, including a display, a projector, an A/V receiver, a printer, a speaker, and the like. Communication interface <NUM> may include any transceiver-like mechanism that enables computing device/server <NUM> to communicate with other devices and/or systems. For example, communication interface <NUM> may include mechanisms for communicating with another device or system via a network.

As described in detail above, computing device <NUM> may perform operations based on software instructions that may be read into memory <NUM> from another computer-readable medium, such as data storage device <NUM>, or from another device via communication interface <NUM>. The software instructions contained in memory <NUM> cause processor <NUM> to perform processes described below. Alternatively, hardwired circuitry may be used in place of or in combination with software instructions to implement processes consistent with the present invention. Thus, various implementations are not limited to any specific combination of hardware circuitry and software.

A web browser comprising a web browser user interface may be used to display information (such as textual and graphical information) on the computing device <NUM>. The web browser may comprise any type of visual display capable of displaying information received via a network, such as Microsoft's Internet Explorer browser, Netscape's Navigator browser, Mozilla's Firefox browser, PalmSource's Web Browser, Google's Chrome browser or any other commercially available or customized browsing or other application software capable of communicating with the network. The computing device <NUM> may also include a browser assistant. The browser assistant may include a plug-in, an applet, a dynamic link library (DLL), or a similar executable object or process. Further, the browser assistant may be a toolbar, software button, or menu that provides an extension to the web browser. Alternatively, the browser assistant may be a part of the web browser, in which case the browser would implement the functionality of the browser assistant.

The browser and/or the browser assistant may act as an intermediary between the user and the computing device <NUM> and/or the network. For example, source data or other information received from devices connected to the network may be output via the browser. Also, both the browser and the browser assistant are capable of performing operations on the received source information prior to outputting the source information. Further, the browser and/or the browser assistant may receive user input and transmit the inputted data to devices connected to the network.

Claim 1:
A method of gaining remote access to a mobile device peripheral, comprising:
receiving data at a mobile device, the mobile device comprising:
at least one portable operating system module;
a peripheral control module;
a remote control component within the peripheral control module;
a machine virtualization mechanism (<NUM>) that isolates the at least one operating system (<NUM>) module from the peripheral control module; and
an I/O virtualization mechanism (<NUM>) interposed between the operating system (<NUM>) module and the peripheral control module (<NUM>);
determining whether the received data comprises a remote control command to the mobile device peripheral; and
performing a selected one of:
executing the remote control command via the peripheral control module (<NUM>) without forwarding the command to the operating system (<NUM>) if the received data comprises a remote control command to the mobile device peripheral;
or passing the received data to the operating system (<NUM>) if the received data does not comprise a remote control command to the mobile device peripheral,
wherein a virtualized network interface is employed in which all network traffic transiting the mobile device is routed through the remote control component within the peripheral control module.