System and method for application authorization

• US 7,805,755 B2
• Filed: 11/26/2004
• Issued: 09/28/2010
• Est. Priority Date: 05/03/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P., Brown, Michael S., Brown, Michael K., Kirkup, Michael G., Little, Herbert A.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Kaplan; Benjamin A
• Application Number:
  US10/996,406
• Publication Number:
  US 20050256878A1
• Time in Patent Office: 2,132 Days
• Field of Search: 726/6, 726/10, 726/17, 726/30, 713/156
• US Class Current: 726/10
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method and system for authorization of applications executing on a device having a key store. Applications obtain an application-level ticket to permit access to one or more key values located in the key store. Each ticket is securely associated with an application and being generated on the determination that the application is a trusted application. Tickets are potentially associated with one key value in the key store, with a subset of key values in the key store, or with all key values in the key store. Access to key values by an application is possible independently of a user providing a password for each such access.

Claims

1. A system for granting access to key store entries in a device, the device comprising one or more memory locations for storing one or more applications executable on the device, the system comprising:

a key store comprising the key store entries; and

a microprocessor configured to generate tickets, each ticket being associated with one or more applications and with one or more key store entries in the key store, each ticket comprising information to permit the one or more applications thus associated to carry out at least one of;

accessing secure locations, or

accessing security certificates,

each key store entry comprised in the key store being made available to at least one executing application on condition that a ticket exists that is associated with the application and with the key store entry.

2. The system of claim 1 in which the microprocessor generates tickets that are associated with an application by the ticket comprising a one-way hash value derived from one or more characteristics of the application.

3. The system of claim 1 wherein the microprocessor is configured to:

define a base ticket associated with the key store; and

generate, using the base ticket, further tickets associated with one or more applications and with one or more key store entries.

4. The system of claim 1 in which the microprocessor provides each ticket with a time stamp and which renders tickets invalid after a predetermined time period.

5. The system of claim 1 in which tickets comprise information to variably permit associated executing applications to further carry out at least one of the following actions:

add, delete or change key store entries in the key store, or

access security certificate status information.

6. The system of claim 1 in which the microprocessor maintains password information for the device.

7. The system of claim 1 in which the device is a handheld wireless communications device.

8. The system of claim 1, wherein the microprocessor is configured to generate tickets in response to a request from an application for access to the key store.

9. The system of claim 1 wherein each ticket is associated with all key store entries in the key store.

10. The system of claim 1, wherein access to one or more of the key store entries by the at least one executing applications normally requires password authorization, and wherein the key store entry is made available to the at least one executing application without requiring password authorization on the condition that a ticket exists that is associated with the application and with the key store entry.

11. A method for granting access to key store entries comprised in a key store in a device, the device comprising a microprocessor and one or more memory locations for storing one or more applications executable on the device, the method comprising the steps of:

the microprocessor generating tickets, each ticket being associated with one or more applications and with one or more key store entries in the key store, each ticket comprising information to permit the one or more applications thus associated to carry out at least one of;

accessing secure locations, or

accessing security certificates; and

the microprocessor granting an executing application access to a key store entry if a ticket exists that is associated with the application and with said key store entry.

12. The method of claim 11 in which the step of generating tickets comprises the step of carrying out a one-way hash operation based on one or more characteristics of the application to define the association of the ticket with the application.

13. The method of claim 11 in which the step of generating tickets comprises:

defining abuse ticket associated with the key store; and

generating, using the base ticket, further tickets associated with one or more applications and with one or more key store entries.

14. The method of claim 11 further comprising the step of providing each ticket with a time stamp and the step of rendering tickets invalid after a predetermined time period.

15. The method of claim 11, wherein tickets comprise information to variably permit associated applications to:

add, delete or change key store entries in the key store;

or

access security certificate status information.

16. The method of claim 11, further comprising the microprocessor receiving a request from an application for access to the key store.

17. The method of claim 11 wherein each ticket is associated with all key store entries in the key store.

18. The method of claim 11, wherein access to one or more of the key store entries by the executing application normally requires password authorization, and granting the executing application access to the key store entry comprises granting said access without requiring password authorization.

19. A computing device program product comprising a computer-readable medium storing computer program code, said computer program code adapted to be executed to perform a method on a device, the device comprising a key store, a microprocessor and one or more memory locations for storing one or more applications executable on the device, the method comprising:

the microprocessor generating tickets, each ticket being associated with one or more applications and with one or more key store entries in the key store, each ticket comprising information to permit the one or more applications thus associated to carry out at least one of;

accessing secure locations, or

accessing security certificates; and

the microprocessor granting an executing application access to a key store entry if a ticket exists that is associated with the application and with said key store entry.

20. The computing device program product of claim 19, wherein generating tickets comprises carrying out a one-way hash operation based on one or more characteristics of the application to define the association of the ticket with the application.

21. The computing device program product of claim 19, wherein generating tickets comprises:

defining a base ticket associated with the key store; and

generating, using the base ticket, further tickets associated with one or more applications and with one or more key store entries.

22. The computing device program product of claim 19, the method further comprising providing each ticket with a time stamp and the step of rendering tickets invalid after a predetermined time period.

23. The computing device program product of claim 19, wherein tickets comprise information to variably permit associated applications to:

add, delete or change key store entries in the key store;

or

access security certificate status information.