SECUREDINTER-APPLICATION COMMUNICATION IN MOBILE DEVICES

• US 20160381002A1
• Filed: 09/12/2016
• Published: 12/29/2016
• Est. Priority Date: 10/01/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Liu, Qingqing, Desai, Sachin, Fischer, Ronald
• Granted Patent: US 10,148,640 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/06 Authentication

Abstract

This disclosure describes a method for accessing network resources which includes receiving by a first application in a mobile computing device sign-in information from a user and enabling the user to sign in to a second application with the first application to access network resources from a resource server based on (a) a first application identification (ID) of the second application, (b) the user authorizing the second application to the resource server, and (c) receiving an authorization grant from the resource server to enable the second application to access the network resources, the mobile computing device coupled with the resource server via a network.

Claims

1. A computer-implemented method for accessing network resources using single sign-in information, comprising:

receiving by a first application in a mobile computing device sign-in information from a user; and

enabling the user to sign in to a second application with the first application to allow the second application to access network resources on behalf of the user from a resource server based on (a) a first application identification (ID) of the second application, (b) the user authorizing the second application to the resource server, and (c) receiving an access token from the resource server to allow the second application to access the network resources, the mobile computing device coupled with the resource server via a network.

2. The method of claim 1, wherein the first application ID is associated with an application distribution server where the second application is downloaded from, the mobile computing device coupled with the application distribution server via the network.

3. The method of claim 2, further comprising communicating the first application ID to a verification server to verify that the second application is a trusted application, the mobile computing device coupled with the verification server via the network.

4. The method of claim 2, wherein the second application is configured to generate an encryption key pair including a public key and a private key, and wherein the public key is communicated to the first application along with a second application identification (ID) assigned to the second application by the resource server during registration of the second application with the resource server.

5. The method of claim 4, further comprising:

submitting a request, by the first application, for an authorization from the resource server, wherein the request includes (a) the second application ID assigned to the second application and the public key, and (b) a redirect link to an entry point in the second application; and

receiving, by the first application, an authorization grant from the resource server based on the second application ID having been verified by the resource server.

6. The method of claim 5, further comprising:

receiving, by the first application, an authorization by the user to authorize the second application to access the resources from the resource server on behalf of the user; and

communicating, by the first application, the authorization by the user and the authorization grant to the resource server.

7. The method of claim 6, further comprising:

receiving, by the first application, an access token from the resource server, the access token to be used by the second application to access the resources in the resource server on behalf of the user;

encrypting, by the first application, the access token using the public key received from the second application; and

communicating the encrypted access token, by the first application, to the second application.

8. The method of claim 7, further comprising:

decrypting the encrypted access token, by the second application, using the private key to generate a decrypted access token;

using the decrypted access token, by the second application, to access the network resources from the resource server; and

delivering the network resources, by the second application, to the user.

9. The method of claim 8, wherein communication between the first application and the second application is based on an inter-process communication (IPC) protocol.

10. A computer program product, comprising a computer usable medium having a computer readable program code embodied therein, the computer readable program code adapted to be executed to implement a method comprising:

receiving by a first application in a mobile computing device sign-in information from a user; and

enabling the user to sign in to a second application with the first application to access network resources from a resource server based on (a) a first application identification (ID) of the second application, (b) the user authorizing the second application to the resource server, and (c) receiving an access token from the resource server to enable the second application to access the network resources, the mobile computing device coupled with the resource server via a network.

11. The computer program product of claim 10, wherein the first application ID is associated with an application distribution server where the second application is downloaded from, the mobile computing device coupled with the application distribution server via the network.

12. The computer program product of claim 11, further comprising communicating the first application ID to a verification server to verify that the second application is a trusted application, the mobile computing device coupled with the verification server via the network.

13. The computer program product of claim 12, wherein the second application is configured to generate an encryption key pair including a public key and a private key, and wherein the public key is communicated to the first application along with a second application identification (ID) assigned to the second application by the resource server during registration of the second application with the resource server.

14. The computer program product of claim 13, further comprising:

submitting a request, by the first application, for an authorization from the resource server, wherein the request includes (a) the second application ID assigned to the second application and the public key, and (b) a redirect link to an entry point in the second application;

receiving, by the first application, an authorization grant from the resource server based on the second application ID having been verified by the resource server.

receiving, by the first application, an authorization by the user to authorize the second application to access the resources from the resource server on behalf of the user; and

communicating, by the first application, the authorization by the user and the authorization grant to the resource server.

15. The computer program product of claim 14 further comprising:

receiving, by the first application, an access token from the resource server, the access token to be used by the second application to access the resources in the resource server on behalf of the user;

encrypting, by the first application, the access token using the public key received from the second application; and

communicating the encrypted access token, by the first application, to the second application.

16. The computer program product of claim 15, further comprising:

decrypting the encrypted access token, by the second application, using the private key to generate a decrypted access token;

using the decrypted access token, by the second application, to access the network resources from the resource server; and

delivering the network resources, by the second application, to the user.