SECURE FILE PROCESSING

• US 20100011447A1
• Filed: 07/14/2008
• Published: 01/14/2010
• Est. Priority Date: 07/14/2008
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Jothimani, Premkumar
• Granted Patent: US 8,448,255 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Apparatus, systems, and methods may operate to receive requests to securely process files on an untrusted client. Additional activity may include transparently redirecting file management operations associated with applications running on the untrusted client to file content associated with the files, where the file content is located in a sandbox on the untrusted client, where the sandbox is inaccessible to the applications. A data store, shared across the applications, may be used to share information associated with the file content. Additional apparatus, systems, and methods are disclosed.

Claims

1. An apparatus, comprising:

a memory to store an untrusted client process; and

a processor to receive a request to securely process files on the untrusted client process, to transparently redirect a file management operation associated with applications running on the untrusted client process to file content associated with the files, the file content located in an untrusted client sandbox inaccessible to the applications, and to share information associated with the file content using a data store shared across the applications.

2. The apparatus of claim 1, wherein the memory is to store the data store having encrypted keys for encrypting data to store as the file content, and decrypting the file content.

3. The apparatus of claim 1, wherein the processor is to execute a process to load a sandbox access library to hook into the applications responsive to receiving the request.

4. A system, comprising:

a memory to store an untrusted client process;

a processor to receive a request to securely process files on the untrusted client process, to transparently redirect a file management operation associated with applications running on the untrusted client process to file content associated with the files, the file content located in an untrusted client sandbox inaccessible to the applications, and to share information associated with the file content using a data store shared across the applications; and

a server to establish a secure network communications link with the untrusted client process.

5. The system of claim 4, comprising:

a plurality of networked clients to house a plurality of untrusted client processes, including the untrusted client process.

6. The system of claim 4, wherein the server is to store a sandbox access library, and to download the sandbox access library to the untrusted client process responsive to the request.

7. A method, comprising:

receiving a request to securely process files on an untrusted client;

transparently redirecting a file management operation associated with applications running on the untrusted client to file content associated with the files, the file content located in an untrusted client sandbox inaccessible to the applications; and

sharing information associated with the file content using a data store shared across the applications.

8. The method of claim 7, wherein transparently redirecting comprises:

executing the file management operation on the file content, wherein the file management operation is associated with a requested path pointing to at least one empty file included in the files.

9. The method of claim 7, comprising:

rejecting the file management operation when the file management operation includes a path that points directly to the sandbox.

10. The method of claim 7, comprising:

accessing the data store using information associated with the file management operation to locate the file content in the sandbox.

11. The method of claim 10, comprising:

encrypting data to store as the file content when the file management operation comprises a write system call.

12. The method of claim 10, comprising:

decrypting the file content when the file management operation comprises a read system call.

13. The method of claim 7, comprising:

establishing a communications link as part of a virtual private network (VPN), responsive to receiving the request.

14. The method of claim 7, wherein receiving the request comprises:

receiving at least one of a request to establish a communications link between the untrusted client and a secure network, or a user interface request.

15. The method of claim 7, comprising:

terminating transparently redirecting the file management operation responsive to at least one of closing a communications link between the untrusted client and a secure network, or receiving a user interface request.

16. The method of claim 15, comprising:

purging information in the data store and the sandbox responsive to terminating transparently redirecting the file management operation.

17. A method, comprising:

establishing a virtual private network (VPN) secure sockets layer (SSL) communications link between an untrusted client and a secure network;

creating a sandbox to securely store file content associated with empty files accessible to applications on the untrusted client, the file content in the sandbox being inaccessible to the applications;

transparently redirecting a file management operation associated with the applications from the empty files to the file content; and

sharing information associated with the empty files using a data store shared across the applications.

18. The method of claim 17, comprising:

accessing at least one of an encrypted encryption key or an encrypted decryption key stored in the data store to process the file content in order to encrypt data to store as the file content, or to decrypt the file content, respectively.

19. The method of claim 17, comprising:

assigning a randomly assigned name to a file in the sandbox associated with the file content; and

inserting a record into the data store, the record including the randomly assigned name and a name of one of the empty files.

20. The method of claim 17, comprising:

searching the data store using information associated with the file management operation to locate the file content in the sandbox; and

returning a file handle pointing to a file in the sandbox that contains at least a portion of the file content.

21. The method of claim 17, comprising:

setting a delete flag in the data store when the file management operation comprises a delete call, the delete flag being associated with an entry in the data store corresponding to the file content;

purging at least a portion of the file content without removing the entry from the data store; and

deleting one of the empty files.

22. The method of claim 17, comprising:

decrementing a reference count in the data store when the file management operation comprises a close call; and

removing an entry for a file in the sandbox comprising a portion of the file content when the reference count reaches zero and a delete flag in the data store associated with the entry is set.

23. The method of claim 17, comprising:

loading a sandbox access library to be hooked into the applications in response to establishing the VPN SSL communications link or a user interface request.