Adapting a mobile application to a partitioned environment

• US 10,114,932 B2
• Filed: 07/27/2016
• Issued: 10/30/2018
• Est. Priority Date: 11/03/2011
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Marion, Eric M., Sonawane, Nitin
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): McCoy, Richard A
• Application Number:
  US15/221,066
• Publication Number:
  US 20170011206A1
• Time in Patent Office: 825 Days
• Field of Search: None
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors

Abstract

Adapting a mobile or other application (“app”) to a partitioned environment is disclosed. In various embodiments, a “secure zone” or other logical partition is created and enforced at least in part by adapting a mobile or other app to behave in a manner required by and/or otherwise associated with the secure zone or other partition and which behavior is or in various embodiments may be different than a native behavior of the mobile or other app as designed and written by an application developer of the app.

Claims

1. A method of providing a secure partition, comprising:

receiving an indication that a first app is to be available to be used in a secure zone of a mobile device, wherein the indication comprises an attempt to install the first app to the secure zone, wherein the secure zone includes versions of one or more applications that exhibit a behavior associated with the secure zone;

determining that the first app is an unknown application and is not authorized to be installed in the secure zone; and

in response to the determination, modifying the first app to be an app that will not launch within the secure zone, wherein modifying the first app to be the app that will not launch within the secure zone includes changing a launcher component of the first app to be a launcher component that will not allow the app to launch; and

installing the modified first app, wherein the modified first app is a secure zone version of the first app.

2. The method of claim 1, wherein the secure zone version of the first app exhibits the behavior associated with the secure zone at least in part by invoking a replacement operating system component instead of a corresponding operating system component that the original version of the first app was configured to invoke.

3. The method of claim 1, wherein the secure zone version of the first app is generated at least in part by modifying or replacing one or more classes included in the first app.

4. The method of claim 3, wherein the secure zone version of the first app is generated at least in part by modifying one or more pointers included in the first app to point to said modified or replacement classes.

5. The method of claim 1, wherein the behavior associated with the secure zone includes storing app data in encrypted form.

6. The method of claim 1, wherein the behavior associated with the secure zone includes performing network communication via a virtual private network or other secure connection.

7. The method of claim 1, wherein the behavior associated with the secure zone includes storing cut or copied app data in a replacement clipboard component.

8. The method of claim 7, wherein the replacement clipboard component is configured to provide access to content only to the one or more applications associated with the secure zone.

9. The method of claim 1, further comprising receiving a password associated with the secure zone and allowing access to the one or more applications associated with the secure zone, without requiring reentry of the password when a user switches from using one of the one or more applications in the secure zone to using another of the one or more applications in the secure zone.

10. The method of claim 9, further comprising requiring password reentry if a no activity timer associated with the secure zone has expired.

11. The method of claim 1, wherein a secure zone version of an application of the one or more applications is configured to make app content available to one or more of the other applications associated with the secure zone at least in part by invoking an agent to back up the app content to a shared storage location.

12. The method of claim 11, wherein the one or more applications are configured to access the app content at least in part by invoking the agent to recover the app content from the shared storage location.

13. The method of claim 1, further comprising providing one or more replacement operating system components configured to hide one or more resources from the one or more applications associated with the secure zone.

14. The method of claim 13, wherein the one or more resources include one or more of the following:

a set of contacts, an address book, a camera, a non-secure network connection, an unencrypted file.

15. The method of claim 1, wherein the secure zone version of the first app is generated at least in part by analyzing execution of the first app in a controlled test environment to observe one or more behaviors of the first app that are to be modified.

16. The method of claim 1, wherein the one or more applications executed in the secure zone store corresponding content data in a secure zone app data storage that is accessible to the plurality of apps in the secure zone.

17. The method of claim 1, wherein the secure zone version of the first app is generated at least in part by sending a request to a remote compliance server.

18. The method of claim 17, wherein the remote compliance server is configured to generate the secure zone version of the first app.

19. A system for providing a secure partition, comprising:

a processor configured to;

receive an indication that a first app is to be available to be used in a secure zone of a mobile device, wherein the indication comprises an attempt to install the first app to the secure zone;

determine that the first app is an unknown application and not authorized to be installed in the secure zone;

in response to the determination, modify the first app to be an app that will not launch within the secure zone, wherein to modify the first app to be the app that will not launch within the secure zone includes changing a launcher component of the first app to be a launcher component that will not allow the app to launch; and

installing the modified first app; and

a memory coupled to the processor and configured to provide the processor with instructions.

20. A computer program product to provide a secure partition, the computer program product being embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:

receiving an indication that a first app is to be available to be used in a secure zone of a mobile device, wherein the indication comprises an attempt to install the first app to the secure zone;

determining that the first app is unknown and not authorized to be installed in the secure zone;

in response to the determination modifying the first app to be an app that will not launch within the secure zone, wherein modifying the first app to be the app that will not launch within the secure zone includes changing a launcher component of the first app to be a launcher component that will not allow the app to launch; and

installing the modified first app.