Mobile application security system and method

• US 6,931,550 B2
• Filed: 01/10/2001
• Issued: 08/16/2005
• Est. Priority Date: 06/09/2000
• Status: Expired due to Fees

• Current Assignee: Aramira Corporation
• Original Assignee: Aramira Corporation
• Inventors: Rygaard, Christopher A.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US09/758,941
• Publication Number:
  US 20030037099A1
• Time in Patent Office: 1,679 Days
• Field of Search: 713/165, 713/161, 713/194, 713200-201, 709223-229, 709/232, 709/238, 709/246, 717/116, 717/108, 717126-127
• US Class Current: 726/23
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 9/4862 the task being a mobile agent, i.e. specifically designed to migrate
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The mobile application security system and method in accordance with the invention increases the overall level of security in using a mobile application. In a preferred embodiment, the system may use a client/server architecture wherein each host of a mobile application is treated as a client and a central computer is treated as the server. In operation, any time that a mobile application is going to jump between hosts, it must first pass through the central computer so that the central computer may perform various security checks. The security checks ensure that the security of the mobile application is not compromised and overcomes the above problems with typical mobile application systems.

Claims

1. A mobile application security system, comprising:

a central computer, in communication with a first host computer and a second host computer, the first and second host computers executing a mobile application that jumps between the first and second host computers during execution and passes through the central computer,

the central computer further comprising means for monitoring the security of the mobile application as the mobile application jumps between the first and second host computers

the means for monitoring further comprising, means for inspecting an access control list of the mobile application to determine if code of the mobile application is marked as immutable, and means for replacing immutable code with code known by the central computer to be safe.

2. A system, comprising:

a server, in communication with a first host computer and a second host computer, the first and second host computers executing a mobile application that jumps between the first and second host computers during execution, passing through the server, the server inspecting an access control list of the mobile application to determine if data of the mobile application is marked as immutable and replacing immutable data with data known by the central computer to be safe to monitor security of the mobile application as the mobile application jumps between the first and second host computers.

3. The system of claim 2, wherein the data of the mobile application is one from the group containing code, state data and itinerary data.

4. The system of claim 2, wherein the server saves immutable data when the mobile application has not been dispatched in the past and a host dispatching the mobile application is trusted.

5. The system of claim 2, wherein the server strips immutable data when the mobile application has not been dispatched in the past and a host dispatching the mobile application is not trusted.

6. The system of claim 2, wherein the server saves data not marked as immutable when a host dispatching the mobile application is trusted.

7. The system of claim 2, wherein the server replaces immutable data when the mobile application has been dispatched in the past.

8. The system of claim 2, wherein the server forwards the mobile application to a receiving host.

9. A method at a server, comprising:

monitoring security of a mobile application as the mobile application jumps between a first host and a second host including;

inspecting an access control list of the mobile application to determine if data of the mobile application is marked as immutable; and

replacing immutable data with data known to be safe.

10. The method of claim 9, wherein the data of the mobile application is one from the group containing code, state data and itinerary data.

11. The method of claim 9, further comprising:

saving immutable data when, the mobile application has not been dispatched in the past and a host dispatching the mobile application is trusted.

12. The method of claim 9, wherein replacing comprises replacing immutable data when the mobile application has not been dispatched in the past and a host dispatching the mobile application is not trusted.

13. The method of claim 9, further comprising:

saving data not marked as immutable when a host dispatching the mobile application is trusted.

14. The method of claim 9, wherein replacing comprises replacing immutable data when the mobile application has been dispatched in the past.

15. The method of claim 9, further comprising:

forwarding the mobile application to a receiving host.

16. A mobile application security system, comprising:

a central computer, in communication with a first host computer and a second host computer, the first and second host computers executing a mobile application that jumps between the first and second host computers during execution, passing through the central computer,

the central computer further comprising means for monitoring security of the mobile application as the mobile application jumps between the first and second host computers

the means for monitoring further comprising, means for inspecting an access control list of the mobile application to determine if state data of the mobile application is marked as immutable, and means for replacing immutable state data of the mobile application with state data known by the central computer to be safe.

17. A mobile application security system, comprising:

a central computer, in communication with a first host computer and a second host computer, the first and second host computers executing a mobile application that jumps between the first and second host computers during execution, passing through the central computer,

the central computer further comprising means for monitoring security of the mobile application as the mobile application jumps between the first and second host computers

the means for monitoring further comprising, means for inspecting an access control list of the mobile application to determine if itinerary data of the mobile application is marked as immutable, and means for replacing immutable itinerary data with itinerary data known by the central computer to be safe.

18. The system of claim 17, wherein the itinerary data comprises past historical itinerary data.

19. A mobile application security method, comprising:

receiving a mobile application at a central computer each time the mobile application is jumping between a first host and a second host; and

monitoring security of the mobile application as it jumps between the first and second hosts, including inspecting an access control list of the mobile application to determine if code of the mobile application is marked as immutable, and replacing immutable code with code known by the central computer to be safe.

20. A mobile application security method, comprising:

receiving a mobile application at a central computer each time the mobile application is jumping between a first host and a second host; and

monitoring security of the mobile application as it jumps between the first and second hosts, including inspecting an access control list of the mobile application to determine if state data of the mobile application is marked as immutable,

and replacing immutable state data with state data that is known by the central computer to be safe.

22. The method of claim 20, wherein the itinerary data comprises past historical itinerary data.

21. A mobile application security method, comprising:

receiving a mobile application at a central computer each time the mobile application is jumping between a first host and a second host; and

monitoring security of the mobile application as it jumps between the first and second hosts, including inspecting an access control list of the mobile application to determine if itinerary data of the mobile application is marked as immutable, and replacing immutable itinerary data with itinerary data known by the central computer to be safe.

23. A mobile application security method, comprising:

receiving a mobile application at a central computer each time the mobile application is jumping between a first host and a second host; and

monitoring security of the mobile application as it jumps between the first and second hosts, including

saving code of the mobile application when the code is marked as immutable, the mobile application has not been dispatched in the past and a host dispatching the mobile application is trusted,

stripping the code from the mobile application when the code is marked as immutable, the mobile application has not been dispatched in the past and the host dispatching the mobile application is not trusted,

replacing the code of the mobile application when the code is marked as immutable and the mobile application has been dispatched in the past, and

saving the code of the mobile application when the code is not marked as immutable.

24. A mobile application security system, comprising:

a central computer, in communication with a first host computer and a second host computer, the first and second host computers executing a mobile application that jumps between the first and second host computers during execution and passes through the central computer,

the central computer further comprising means for monitoring security of the mobile application as the mobile application jumps between the first and second host computers

the security monitoring means further comprising

means for saving code of the mobile application when the code is marked as immutable, the mobile application has not been dispatched in the past and a host dispatching the mobile application is trusted,

means for stripping the code from the mobile application when the code is marked as immutable, the mobile application has not been dispatched in the past and the host dispatching the mobile application is not trusted,

means for replacing the code of the mobile application when the code is marked as immutable and the mobile application has not been dispatched in the past, and

means for saving the code of the mobile application when the code is not marked as immutable.