MOBILE APPLICATION MANAGEMENT FRAMEWORK

• US 20130340048A1
• Filed: 06/14/2013
• Published: 12/19/2013
• Est. Priority Date: 06/18/2012
• Status: Active Grant

• Current Assignee: Infosys Limited
• Original Assignee: Infosys Limited
• Inventors: Sebastian, Sony, Kalyanasundaram, Rajesh, Shankavaram, Sudharshan
• Granted Patent: US 9,325,683 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

An intermediate gateway is positioned between a client device and a mobile application service provider. The intermediate gateway can assist in securing and managing accesses from a mobile application on the client device to the mobile application service provider. The intermediate gateway can store a client device identification associated with the client device, which can be used to authenticate the client device. Other parameters can also be used in device authentication.

Claims

1. A method of authenticating a client device, comprising:

receiving a request from a mobile application on the client device to access a mobile application service provider, the request including a device identification and user credentials and being received by an intermediate gateway positioned between the client device and the mobile application service provider;

transmitting at least the user credentials to the mobile application service provider for authentication;

receiving, at the intermediate gateway, an indication that the user credentials were authenticated;

in response to the authentication, storing the device identification for future authentications of the mobile application by the intermediate gateway.

2. The method of claim 1, further including transmitting to the client device an authentication code to be used by the client device to complete authentication.

3. The method of claim 1, further including searching a database by the intermediate gateway to determine if the device identification has already been authenticated.

4. The method of claim 1, further including generating a device certificate for storing on the client device and for use in subsequent authentications.

5. The method of claim 3, further including transmitting the request to the mobile application service provider after the client device is authenticated.

6. The method of claim 1, further including blocking the request from the client device to access the mobile application service provider due to failing the authentication.

7. The method of claim 1, sending, from the intermediate gateway, a request to erase data associated with the mobile application.

8. The method of claim 1, further including either requesting the client device to update the mobile application or forcing the client device to update the mobile application prior to accessing the mobile application service provider, if an upgrade is designated as mandatory by the mobile application service provider.

9. The method of claim 1, further including checking a GPS-based location of the client device and transmitting the request to the mobile application service provider only if the GPS-location matches a location authentication algorithm.

10. The method of claim 1, further including tracking usage statistics using the intermediate gateway.

11. The method of claim 10, wherein the usage statistics include one or more of the following:

platform type, platform version, mobile application name, mobile application version, or a number of people using the mobile application.

12. The method of claim 1, wherein the intermediate gateway can only control data associated with the mobile application on the client device, and not the client device itself.

13. The method of claim 1, wherein the client device is in an environment wherein a business cannot control the client device.

14. A computer-readable storage having instructions stored thereon for executing a method according to claim 1.

15. A system for authenticating a client device, comprising:

an application for installation on the client device that includes a security library, the security library having instructions therein for allowing an intermediate gateway to control data associated with the application;

an application service provider for receiving requests from the application over a network and that responds to the received requests; and

the intermediate gateway positioned between the client device and the application service provider for authenticating the client device when the application attempts to access the application service provider.

16. The system of claim 15, wherein the intermediate gateway can erase sensitive data associated with the application and stored on the client device.

17. The system of claim 15, wherein the intermediate gateway includes a database of device identifications.

18. The system of claim 15, wherein the intermediate gateway is for generating a certificate to be stored on the client device and used when accessing the application service provider.

19. A computer-readable storage having instructions thereon for executing a method of authenticating a client device, the method comprising:

registering the client device including receiving a request from a mobile application on the client device for registration, requesting authorization from a mobile application service provider and storing a device identification of the client device on an intermediate gateway positioned between the client device and the mobile application service provider;

generating a device certificate to be stored on the client device;

upon receiving a request from the client device to access the mobile application service provider, comparing a received device identification against a stored device identification and validating the received request using the comparison;

transmitting the validated received request from the client device to the mobile application service provider.

20. The method of claim 19, further including receiving a request from the client device to deregister itself from the intermediate gateway.

21. The computer-readable storage of claim 19, wherein the intermediate gateway is coupled between multiple client devices and multiple mobile application service providers.

22. The computer-readable storage of claim 19, further including storing transactions from the client device to the mobile application service provider in the intermediate gateway for tracking of transactions over a period of time.