APPLICATION ASSOCIATING BASED ON CRYPTOGRAPHIC IDENTIFICATION

• US 20090089796A1
• Filed: 10/01/2007
• Published: 04/02/2009
• Est. Priority Date: 10/01/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Bender, Christopher L., Turi, Andrew Robert
• Granted Patent: US 8,166,487 B2
• Time in Patent Office: Days
• US Class Current: 719/313
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes

Abstract

As each application is loaded for use by an operating system, a message handling application within the operating system associates the applications with relativity metrics for later use in handling interprocess messages. A cryptographic identifier associated with each application is verified and, based on the verifying, each application is associated with a relativity metric. The message handling application receives a message from an origin process. The message handling application then determines a destination process for the message, a relativity metric for the origin process, and a relativity metric for the destination process. Based on an analysis of the relativity metrics of the origin process and the destination process, the message handling application determines whether to forward the message to the destination process.

Claims

1. A method of associating applications with relativity metrics for later use in handling interprocess messages, said method comprising:

receiving a first executable file for a first application, said first executable file including a first cryptographic identifier;

verifying said first cryptographic identifier; and

associating, based on said verifying, said first application with a first relativity metric.

2. The method of claim 1 wherein said verifying involves use of a first public cryptographic key, and wherein said first public cryptographic key is associated with said first relativity metric.

3. The method of claim 1 wherein said associating comprises recording an association between said first application and said first relativity metric in a relativity metric correlation record.

4. The method of claim 1 further comprising:

receiving a second executable file for a second application, said second executable file including a second cryptographic identifier;

verifying said second cryptographic identifier; and

associating, based on said verifying said second cryptographic identifier, said second application with a second relativity metric.

5. The method of claim 4 wherein said verifying said second cryptographic identifier involves use of a second public cryptographic key, and wherein said second public cryptographic key is associated with said second relativity metric.

6. The method of claim 4 further comprising:

receiving a message from an origin process, said origin process associated with said first application;

determining a destination process for said message, said destination process associated with said second application;

determining that said first relativity metric is associated with said origin process;

determining that said second relativity metric is associated with said destination process;

analyzing whether, based on said first relativity metric and said second relativity metric, messages from said origin process are allowed to be passed to said destination process; and

passing said message to said destination process only if allowed based on said analyzing.

7. The method of claim 6 wherein said determining that said first relativity metric is associated with said origin process comprises:

determining that said origin process is associated with said first application; and

determining that said first application is associated with said first relativity rhetric.

8. The method of claim I wherein said verifying comprises:

providing said first application as input to a hash function to obtain a local digital signature;

decrypting said first cryptographic identifier to obtain a test digital signature;

comparing said local digital signature to said test digital signature; and

if said comparing indicates an equivalence, considering said first cryptographic identifier to have been verified.

9. An apparatus comprising:

a processor for executing a message handling application as part of an operating system, said message handling application adapted to;

receive a first executable file for a first application, said first executable file including a first cryptographic identifier;

verify said first cryptographic identifier; and

associate, based on said verifying, said first application with a first relativity metric.

10. The apparatus of claim 9 wherein said message handling application is further adapted to use a first public cryptographic key to verify said first cryptographic identifier, and wherein said first public cryptographic key is associated with said first relativity metric.

11. The apparatus of claim 9 wherein said message handling application is further adapted to associate said first application with said first relativity metric by recording an association between said first application and said first relativity metric in a relativity metric correlation record.

12. The apparatus of claim 9 wherein said message handling application is further adapted to:

receive a second executable file for a second application, said second executable file including a second cryptographic identifier;

verify said second cryptographic identifier; and

associate, based on said verifying said second cryptographic identifier, said second application with a second relativity metric.

13. The apparatus of claim 12 wherein said message handling application is further adapted to use a second public cryptographic key to verify said second cryptographic identifier, and wherein said second public cryptographic key is associated with said second relativity metric.

14. The apparatus of claim 12 wherein said message handling application is further adapted to:

receive a message from an origin process, said origin process associated with said first application;

determine a destination process for said message, said destination process associated with said second application;

determine that said first relativity metric is associated with said origin process;

determine that said second relativity metric is associated with said destination process;

analyze whether, based on said first relativity metric and said second relativity metric, messages from said origin process are allowed to be passed to said destination process; and

pass said message to said destination process only if allowed based on said analyzing.

15. The apparatus of claim 14 wherein said message handling application is further adapted to determine that said first relativity metric is associated with said origin process by:

determining that said origin process is associated with said first application; and

determining that said first application is associated with said first relativity metric.

16. The apparatus of claim 9 wherein said message handling application is further adapted to verify said first cryptographic identifier by:

providing said first application as input to a hash function to obtain a local digital signature;

decrypting said first cryptographic identifier to obtain a test digital signature;

comparing said local digital signature to said test digital signature; and

if said comparing indicates an equivalence, considering said first cryptographic identifier to have been verified.

17. A computer readable medium containing computer-executable instructions that, when performed by a processor, cause said processor to execute a message handling application as part of an operating system, said message handling application being adapted to:

receive a first executable file for a first application, said first executable file including a first cryptographic identifier;

verify said first cryptographic identifier; and

associate, based on said verifying, said first application with a first relativity metric.

18. The computer readable medium of claim 17 wherein said message handling application is further adapted to use a first public cryptographic key to verify said first cryptographic identifier, and wherein said first public cryptographic key is associated with said first relativity metric.

19. The computer readable medium of claim 17 wherein said message handling application is further adapted to associate said first application with said first relativity metric by recording an association between said first application and said first relativity metric in a relativity metric correlation record.

20. The computer readable medium of claim 17 wherein said message handling application is further adapted to:

receive a second executable file for a second application, said second executable file including a second cryptographic identifier;

verify said second cryptographic identifier; and

associate, based on said verifying said second cryptographic identifier, said second application with a second relativity metric.

21. The computer readable medium of claim 20 wherein said message handling application is further adapted to use a second public cryptographic key to verify said second cryptographic identifier, and wherein said second public cryptographic key is associated with said second relativity metric.

22. The computer readable medium of claim 20 wherein said message handling application is further adapted to:

receive a message from an origin process, said origin process associated with said first application;

determine a destination process for said message, said destination process associated with said second application;

determine that said first relativity metric is associated with said origin process;

determine that said second relativity metric is associated with said destination process;

analyze whether, based on said first relativity metric and said second relativity metric, messages from said origin process are allowed to be passed to said destination process; and

pass said message to said destination process only if allowed based on said analyzing.

23. The computer readable medium of claim 22 wherein said message handling application is further adapted to determine that said first relativity metric is associated with said origin process by:

determining that said origin process is associated with said first application; and

determining that said first application is associated with said first relativity metric.

24. A method of associating applications with relativity metrics and handling interprocess messages, said method comprising:

receiving a first executable file for a first application, said first executable file including a first cryptographic identifier;

verifying said first cryptographic identifier, wherein said verifying involves use of a first public cryptographic key, and wherein said first public cryptographic key is associated with a first relativity metric;

associating, based on said verifying, said first application with said first relativity metric;

receiving a second executable file for a second application, said second executable file including a second cryptographic identifier;

verifying said second cryptographic identifier, wherein said verifying said second cryptographic identifier involves use of a second public cryptographic key, and wherein said second public cryptographic key is associated with a second relativity metric;

associating, based on said verifying said second cryptographic identifier, said second application with said second relativity metric,

receiving a message from an origin process, said origin process associated with said first application;

determining a destination process for said message, said destination process associated with said second application;

determining that said first relativity metric is associated with said origin process;

determining that said second relativity metric is associated with said destination process;

analyzing whether, based on said first relativity metric and said second relativity metric, messages from said origin process are allowed to be passed to said destination process; and

passing said message to said destination process only if allowed based on said analyzing.

25. A mobile communication device comprising:

a processor for executing a message handling application as part of an operating system, said message handling application being adapted to;

receive a first executable file for a first application, said first executable file including a first cryptographic identifier;

verify said first cryptographic identifier, wherein said verifying involves use of a first public cryptographic key, and wherein said first public cryptographic key is associated with a first relativity metric;

associate, based on said verifying, said first application with said first relativity metric;

receive a second executable file for a second application, said second executable file including a second cryptographic identifier;

verify said second cryptographic identifier, wherein said verifying said second cryptographic identifier involves use of a second public cryptographic key, and wherein said second public cryptographic key is associated with a second relativity metric;

associate, based on said verifying said second cryptographic identifier, said second application with said second relativity metric,

receive a message from an origin process, said origin process associated with said first application;

determine a destination process for said message, said destination process associated with said second application;

determine that said first relativity metric is associated with said origin process;

determine that said second relativity metric is associated with said destination process;

analyze whether, based on said first relativity metric and said second relativity metric, messages from said origin process are allowed to be passed to said destination process; and

pass said message to said destination process only if allowed based on said analyzing.