Managing application access to certificates and keys

• US 10,460,086 B2
• Filed: 07/25/2013
• Issued: 10/29/2019
• Est. Priority Date: 01/29/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Ho, Alan Pak-Lun, Mueller, Michael Jonathan, Chin, Eugene
• Primary Examiner(s): Brandt, Christopher M
• Application Number:
  US13/950,948
• Publication Number:
  US 20140213217A1
• Time in Patent Office: 2,287 Days
• Field of Search: 726 21, 455411, 455418, 713165
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Plural modes of operation, each associated with a class attribute, may be established on a mobile device. The present application discloses a method of handling an application launch request, a computing device for carrying out the method and a computer readable medium for adapting a processor to carry out the method. The method includes receiving a launch request identifying an application that is to be launched, acquiring an identity for the application, acquiring a class for the application, labeling the application with the identity and the class and launching the application. The application'"'"'s identity and class may then be taken into consideration when processing a request to access a store or create a new store. Notably, an application may request access to a store managed by a certificate manager, rather than accessing the store directly. Conveniently, a resource manager may handle parsing of a file path to the store.

Claims

1. A method of handling, at a resource manager, a file system request for a data item in a store, the method comprising:

receiving, from an application, the file system request, the file system request specifying a path;

parsing the path to isolate a store identifier for the store;

detecting an identity for the application;

determining, based on the identity and the store identifier, that the store is in a namespace of the application, wherein the namespace comprises a list of all stores to which the application has access; and

responsive to the determining, obtaining the data item from a manager of the data item.

2. The method of claim 1 wherein the store comprises a certificate store.

3. The method of claim 1 wherein the store comprises a cryptographic key store.

4. The method of claim 1 further comprising parsing the path to isolate an identifier of the data item.

5. A computing device comprising:

a memory;

a processor adapted to execute a resource manager to;

receive, from an application, a file system request, the file system request specifying a path for a data item in a store;

parse the path to isolate a store identifier for the store;

detect an identity for the application;

determine, based on the identity and the store identifier, that the store is in a namespace of the application, wherein the namespace comprises a list of all stores to which the application has access; and

responsive to the determining, obtain the data item from a manager of the data item.

6. The computing device of claim 5 wherein the store comprises a certificate store.

7. The computing device of claim 5 wherein the store comprises a cryptographic key store.

8. The computing device of claim 5 wherein the processor is further adapted to execute the resource manager to parse the path to isolate the data item.

9. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause the processor to:

receive, from an application, a file system request, the file system request specifying a path for a data item in a store;

parse the path to isolate a store identifier for the store;

detect an identity for the application;

determine, based on the identity and the store identifier, that the store is in a namespace of the application, wherein the namespace comprises a list of all stores to which the application has access; and

responsive to the determining, obtain the data item from a manager of the data item.

10. The computer-readable medium of claim 9 wherein the store comprises a certificate store.

11. The computer-readable medium of claim 9 wherein the store comprises a cryptographic key store.

12. The computer-readable medium of claim 9 wherein the instructions further cause the processor to parse the path to isolate an identifier of the data item.

13. A method of handling access to a certificate or cryptographic key in a store, in a memory of a mobile device, managed by a certificate manager, the mobile device having a plurality of modes of operation and having a plurality of applications stored thereon, each application being labeled with an identity attribute and a class attribute, the class attribute being associated with a mode of operation of the mobile device, the method comprising:

downloading certificates and cryptographic keys from an enterprise server;

storing the certificates and cryptographic keys by initializing a respective certificate, cryptographic key store for each of the modes of operation of the device;

receiving, from an application, a file system request for access to one of the stores;

detecting an identity for the application;

detecting a class for the application;

determining, based on the identity and the class, whether the one of the stores is in a namespace of the application; and

based on the determining, allowing or denying the application access to the one of the stores.

14. The method of claim 13 wherein the request for access to the one of the stores specifies a path and the method further comprises parsing the path to isolate a store identifier.

15. The method of claim 13 wherein the request for access to the one of the stores specifies a path and the method further comprises parsing the path to isolate an identifier of a data item.

16. A computing device comprising:

a memory; and

a processor adapted to execute a resource manager to;

download certificates and cryptographic keys from an enterprise server;

store the certificates and cryptographic keys by initializing a respective certificate, cryptographic key store for each of a plurality of modes of operation of the computing device;

receive, from an application, a file system request for access to one of the stores;

detect an identity for the application;

detect a class for the application;

determine, based on the identity and the class, whether the one of the stores is in a namespace of the application; and

based on the determining, process the request allow or deny the application access to the one of the stores.

17. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause the processor to:

download certificates and cryptographic keys from an enterprise server;

store the certificates and cryptographic keys by initializing a respective certificate, cryptographic key store for each of a plurality of modes of operation of the computing device;

receive, from an application, a file system request for access to one of the stores;

detect an identity for the application;

detect a class for the application;

determine, based on the identity and the class, whether the one of the stores is in a namespace of the application; and

based on the determining, allow or deny the application access to the one of the stores.