OUT-OF-BAND SPY DETECTION AND PREVENTION FOR PORTABLE WIRELESS SYSTEMS

摘要

Certain embodiments employ an “out-of-band” mechanism to remove the physical controls for activating input peripherals from a portable device operating system and instead controlled by a separate peripheral control domain, isolated from the operating system domain by a machine virtualization/isolation technology. No additional hardware may be required. An adjunct I/O virtualization mechanism may also be included to abstract the guarded input peripheral interfaces, such that all attempts to turn them on from within the operating system are automatically redirected by the I/O virtualization mechanism to the peripheral control domain. The peripheral control domain may then conduct a policy-driven decision process to either allow, disallow, or request manual/explicit authorization of an access attempts. Physical access may be performed within the peripheral control domain. Because the access control and physical activation of input peripherals occur out-of-band from the operating system, these security-critical operations may be immune to vulnerabilities in the portable operating system.

主权项

1. A portable computing device comprising:
at least one portable operating system domain; a peripheral control domain comprising a policy component for detecting and responding to an unauthorized attempt to activate an input peripheral; a machine virtualization mechanism that isolates the at least one operating system domain from the peripheral control domain; and an I/O virtualization mechanism configured to be interposed between the operating system domain and the peripheral control domain and configured to translate operating system-originated input peripheral access requests and responses.