SYSTEMS AND METHODS FOR SECURE FILE PORTABILITY BETWEEN MOBILE APPLICATIONS ON A MOBILE DEVICE

• US 20130332723A1
• Filed: 02/25/2013
• Published: 12/12/2013
• Est. Priority Date: 05/23/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Tan, Simon, Yao, Rico, Maynard, David, Cung, Don
• Granted Patent: US 9,027,108 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Systems and methods for secure file portability between mobile applications in a cloud-based environment or cloud-based collaboration and file sharing environment. In one embodiment, a server-based key generation service generates an encryption key that is unique to each file transfer transaction between mobile applications accessed via a mobile device. Data packages leaving a mobile application are then encrypted using the encryption key to provide secure file portability between mobile applications. In another embodiment, a background service triggered by a mobile application detects when a user is logged out of the mobile application and revalidates the user session with the mobile application to maintain portability of files between mobile applications. The background service presents a minimal user interface to get the user'"'"'s credentials for the mobile application, without the user having to switch to the mobile application, and obtains an authentication token from a remote server using the user'"'"'s credentials.

Claims

1. A method for maintaining data portability between mobile applications, including a first mobile application and a second mobile application, in a data sharing environment on a mobile device, comprising:

detecting expiration of an authentication token associated with a user and the first mobile application;

presenting a user interface to obtain information identifying the user without the user having to switch from the second mobile application to the first mobile application;

requesting a new authentication token from a host server associated with the first mobile application; and

authenticating the user with the first mobile application using the new authentication token from the host server to allow upload of one or more files from the second mobile application to the first mobile application.

2. The method of claim 1, further comprising:

maintaining a connection to the host server associated with the first mobile application.

3. The method of claim 2, wherein a service started by the first mobile application runs in the background of the operating system to maintain the connection to the host server and request the new authentication token from the host server.

4. The method of claim 1, wherein the new authentication token is generated at the host server using at least some of the information identifying the user received from the mobile device.

5. The method of claim 1, wherein the first mobile application provides access to a cloud-based storage service that is hosted on the host server.

6. The method of claim 1, wherein the second mobile application allows the user to open and modify one or more files.

7. The method of claim 1, wherein the one or more files are new versions of one or more files received from the first mobile application for opening and editing using the second mobile application.

8. A mobile device providing data portability between mobile applications, comprising:

a memory;

a first application and a second application stored in the memory;

the first application including processor-executable instructions to;

start a service in the background to keep a user session with the first application alive, wherein the service detects the end of a user session with the first application and requests an authentication token from the remote server to revalidate the user session;

receive a user request to open a file in a second application;

securely encrypt and transfer the file to the second application;

the second application including processor-executable instructions to;

obtain the file transferred by the first application;

receive modifications to the file from a user;

securely encrypt and transfer the modified file to the first application, wherein the user session with the first application is kept alive by the service during a period of user inactivity in the first application.

9. The mobile device of claim 8, wherein the first mobile application provides access to a cloud-based storage service that is hosted on the host server.

10. The mobile device of claim 8, wherein the first application includes processor-executable instructions to:

generate and display a user interface to obtain information identifying the user without the user having to switch from the second mobile application to the first mobile application.

11. A method for secure file portability between mobile applications on a mobile device, comprising:

receiving a plurality of transaction requests to transfer files between the mobile applications on the mobile device;

for each transaction request,

obtaining an encryption key from a host server;

encrypting a file associated with the transaction request with the encryption key; and

executing the transaction request by transferring the encrypted file from a first mobile application to a second mobile application.

12. The method of claim 11, wherein encrypting the file includes encrypting data streams of the file and transferring the encrypted file includes transferring the encrypted data streams.

13. The method of claim 11, wherein the host server is associated with one of the first mobile application and the second mobile application.

14. The method of claim 11, wherein the first mobile application is one of an application providing access to a cloud-based storage service provided by the host server or an application for viewing and modifying files.

15. The method of claim 11, further comprising:

sending the encryption key to the second mobile application for decrypting the encrypted file.

16. The method of claim 11, wherein the second mobile application obtains a decryption key from the host server for decrypting the encrypted file.

17. A mobile device providing secure file portability between mobile applications on the mobile device, comprising:

an inter-application transaction request detector module stored in a memory of the mobile device and configured to;

receive a transaction request from a first mobile application, wherein the transaction request is for transfer of one or more files from the first mobile application to a second mobile application;

a key request module stored in the memory of the mobile device and configured to;

request an encryption key from a host server associated with the first mobile application; and

encrypt a file associated with the transaction request with the encryption key.

18. The mobile device of claim 17, further comprising a module for executing the transaction request by transferring the encrypted file from the first mobile application to the second mobile application.

19. The mobile device of claim 17, wherein the first mobile application is a cloud-based collaboration platform application and the second mobile application is an application for opening and editing files.

20. The mobile device of claim 17, wherein the key request module requests an encryption key from the host server on a per transaction basis.

21. A server-based key generation method for secure file portability between mobile applications on a mobile device, comprising:

receiving a request for an encryption key from a mobile application on the mobile device;

evaluating the request to determine whether the request meets a condition for generating an encryption key;

generating an encryption key if the request meets the condition for generating the encryption key; and

sending the encryption key to the requesting mobile application on the mobile device for encryption of one or more files.

22. The method of claim 21, further comprising sending the encryption key to a target mobile application for decrypting the one or more files received from the requesting mobile application.

23. The method of claim 22, wherein the sending is in response to a request for a decryption key from the target mobile application.

24. The method of claim 23, wherein the requesting mobile application is a cloud-based collaboration platform application and the target application is an application for opening and editing the one or more files.

25. The method of claim 21, wherein the condition includes generating an encryption key when the request is associated with a unique file transfer transaction.

26. The method of claim 21, wherein the condition includes generating an encryption key when the request is associated with a first file transfer transaction with a target mobile application.