System and method for creating secure applications

• US 8,695,060 B2
• Filed: 09/25/2012
• Issued: 04/08/2014
• Est. Priority Date: 10/10/2011
• Status: Active Grant

• Current Assignee: OpenPeak LLC (Ni, Wang & Massand, PLLC)
• Original Assignee: OpenPeak Inc.
• Inventors: Krzyzanowski, Paul, Gittleman, Daniel, Dare, Robert M., Wade, Christopher Michael, Tan, Danilo, Brown, John R.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/626,470
• Publication Number:
  US 20130091543A1
• Time in Patent Office: 560 Days
• Field of Search: 726/1, 726 22- 33, 713/161, 713/165, 713/167, 713/187, 705 57- 59
• US Class Current: 726/1
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A method for generating a secure application is described herein. The method can include the steps of obtaining a target application and decomposing the target application into original files that contain predictable instructions. One or more predictable instructions in the original files may be identified. In addition, the target application may be modified to create the secure application by binding one or more intercepts to the target application. These intercepts can enable the modification of the predictable instructions in accordance with one or more policies such that the behavior of the secure application is different from the original behavior of the target application. Modification of the target application may be conducted without access to the source code of the target application.

Claims

1. A method for generating a secure application, comprising:

via a processor, obtaining a target application;

via a processor, decomposing the target application into original files that contain predictable instructions;

identifying one or more predictable instructions in the original files;

modifying the target application to create the secure application by binding one or more intercepts to the target application to enable the modification of the predictable instructions in accordance with one or more policies such that the behavior of the secure application is different from the original behavior of the target application, wherein the modification of the target application is conducted without access to the source code of the target application.

2. The method according to claim 1, further comprising repackaging the secure application such that the bound intercepts are integrated with the original files.

3. The method according to claim 1, wherein generating the secure application preserves the operating system interactions that were originally defined for the target application and an operating system for which the target application was designed.

4. The method according to claim 1, further comprising imposing a secure and unpredictable namespace on the interprocess communications of the target application as part of modifying the target application to prevent unauthorized access to the interprocess communications.

5. The method according to claim 4, wherein the imposition of the secure and unpredictable namespace prevents a non-secure application from accessing data associated with the secure application but allows secure applications to share data among each other.

6. The method according to claim 5, wherein the secure application is part of a secure partition and the non-secure application is part of a non-secure application.

7. The method according to claim 5, wherein preventing the non-secure application from accessing data associated with the secure application includes preventing the non-secure application from executing a copy and paste operation with respect to the data associated with the secure application.

8. The method according to claim 1, wherein the predictable instructions are byte codes and modifying the target application comprises programmatically injecting secure byte codes in the place of pre-existing byte codes, wherein the secure byte codes override the pre-existing byte codes.

9. The method according to claim 8, wherein a behavior of the target application associated with the pre-existing byte codes is still executed if a policy that is associated with the secure byte codes that override the pre-existing byte codes is satisfied.

10. The method according to claim 1, wherein the predictable instructions are references and wherein modifying the target application comprises programmatically injecting secure references in the place of pre-existing references, wherein the secure references override the pre-existing references.

11. The method according to claim 10, further comprising resetting a linking order to enable the secure references to take precedence over the pre-existing references such that the secure references override the pre-existing references.

12. The method according to claim 10, wherein a behavior of the target application associated with the pre-existing references is still executed if a policy that is associated with the secure references that override the pre-existing references is satisfied.

13. The method according to claim 1, further comprising publishing the secure application in an application repository.

14. The method according to claim 1, wherein the policies are static or dynamic policies, wherein dynamic policies may be modified following the creation of the secure application.

15. The method according to claim 1, wherein different policies may exist for different groups of computing devices in relation to the same secure application.

16. The method according to claim 1, wherein the original behavior of the target application is different from that of the secure application through management of the secure application and wherein management of the secure application includes one or more of the following:

preventing operation of the secure application during a predetermined time;

preventing operation of the secure application if a computing device on which the secure application is installed is located outside a predetermined location;

preventing operation of the secure application if the operation of the secure application would be in non-compliance with an imposed licensing model;

uninstalling a secure application;

or

deleting data that is associated with a secure application.

17. The method according to claim 1, wherein the original behavior of the target application is different from that of the secure application through security features and wherein the security features of the secure application include one or more of the following:

encrypting data that the secure application writes to storage;

locking or deleting the secure application if a computing device on which the secure application is installed has been offline or disconnected from a network for more than a predetermined amount of time;

locking or deleting the secure application if an authentication associated with launching the secure application has been incorrectly presented more than a predetermined number of times;

enabling or disabling the ability of the secure application to write data to or retrieve data from external storage;

requiring reentry of an authentication if the secure application has been inactive after launch for greater than a predetermined amount of time;

forcing an authentication to be entered prior to operation of the secure application;

preventing operation of the secure application unless an authentication associated with the secure application meets predefined criteria;

preventing operation of the secure application if a privileges check determines that an unauthorized modification has been performed on a computing device on which the secure application is installed;

or

muting notifications from the secure application.

18. The method according to claim 1, wherein the original behavior of the target application is different from that of the secure application through previously-unavailable functional features and wherein the previously-unavailable functional features of the secure application include one or more of the following:

enabling the secure application to store data at an external location;

replacing an existing video source for the secure application with a new video source, wherein a new video source at least includes input from a display of a computing device;

or

enabling the interaction of a new input/output device with the secure application, wherein the new input/output device at least includes a mouse.

19. The method according to claim 1, wherein modifying the target application to create the secure application applies to multiple target applications to create multiple corresponding secure applications such that the multiple secure applications operate in a substantially similar fashion with respect to the modification and wherein the multiple secure applications are related to one another.

20. A method for generating a secure application, comprising:

via a processor, receiving a pre-compiled target application;

identifying predictable instructions in the target application;

via a processor, configuring the target application with respect to the predictable instructions to enable selective behavior modification of the target application, thereby creating the secure application;

wherein the configuration is performed without access to the source code of the target application and preserves the normal functions and application programming interfaces of an operating system for which the target application was designed.

21. The method according to claim 20, wherein configuring the target application comprises imposing one or more intercepts on the predictable instructions of the target application.

22. The method according to claim 21, wherein the predictable instructions are non-secure byte codes and imposing the intercepts on the predictable instructions comprises programmatically injecting secure byte codes in the place of the non-secure byte codes.

23. The method according to claim 21, wherein the predictable instructions are non-secure references and imposing the intercepts on the predictable instructions comprises programmatically injecting secure references in the place of the non-secure references.

24. The method according to claim 20, further comprising automatically interceding in calls to data sharing or data storage application programming interfaces to ensure that data associated with the secure application is processed in a secure fashion, wherein interceding in the calls to data sharing or data storage application programming interfaces is part of the behavior modification.

25. The method according to claim 20, further comprising encapsulating the target application as part of the configuration to restrict access to the interprocess communications associated with the secure application.

26. The method according to claim 20, wherein the behavior modification comprises one or more of the following:

preventing operation of the secure application during a predetermined time;

preventing operation of the secure application if a computing device on which the secure application is installed is located outside a predetermined location;

preventing operation of the secure application if the operation of the secure application would be in non-compliance with an imposed licensing model;

uninstalling a secure application;

or

deleting data that is associated with a secure application.

27. The method according to claim 20, wherein the behavior modification comprises one or more of the following:

encrypting data that the secure application writes to storage;

locking or deleting the secure application if a computing device on which the secure application is installed has been offline or disconnected from a network for more than a predetermined amount of time;

locking or deleting the secure application if an authentication associated with launching the secure application has been incorrectly presented more than a predetermined number of times;

enabling or disabling the ability of the secure application to write data to or retrieve data from external storage;

requiring reentry of an authentication if the secure application has been inactive after launch for greater than a predetermined amount of time;

forcing an authentication to be entered prior to operation of the secure application;

preventing operation of the secure application unless an authentication associated with the secure application meets predefined criteria;

preventing operation of the secure application if a privileges check determines that an unauthorized modification has been performed on a computing device on which the secure application is installed;

or

muting notifications from the secure application.

28. The method according to claim 20, wherein the behavior modification comprises one or more of the following:

enabling the secure application to store data at an external location;

replacing an existing video source for the secure application with a new video source, wherein the new video source at least includes input from a display of a computing device;

or

enabling the interaction of a new input/output device with the secure application, wherein the new input/output device at least includes a mouse.

29. A method of generating a secure application, comprising:

via a processor, obtaining a target application;

via a processor, decomposing the target application into files that contain predictable instructions;

identifying one or more predictable instructions in the files; and

modifying the target application to create the secure application by binding one or more intercepts to the target application to enable the modification of the predictable instructions such that the behavior of the secure application is capable of being different from that of the target application;

wherein modifying the target application to create the secure application maintains the pre-existing functionality of the target application and changing the behavior of the secure application from the behavior of the target application includes selectively controlling the execution of the pre-existing functionality.

30. A method of restricting access to an application, comprising:

via a processor, obtaining a target application that is designed to conduct interprocess communications with a non-secure framework;

imposing a namespace for interprocess communications on the target application during a securitization process to create a first secure application, wherein the namespace is integrated with a secure framework to permit the secure framework to process interprocess communications that are associated with the first secure application and that conform to the namespace and wherein the non-secure framework is unable to process the interprocess communications associated with the first secure application that conform to the namespace; and

via a processor, permitting a second secure application that conducts interprocess communications that conform to the namespace to share data with the first secure application.

31. The method according to claim 30, wherein the secure framework is part of a secure partition that includes the first and second secure applications.

32. The method according to claim 30, further comprising registering the first secure application with the secure framework to identify which interprocess communications the first secure application may process from the secure framework.

33. The method according to claim 30, wherein the non-secure framework is part of a non-secure partition that includes non-secure applications and the non-secure applications are not permitted to retrieve data from the first or second secure applications.

34. The method according to claim 30, wherein imposing the namespace for interprocess communications is based on existing constants associated with the non-secure framework.

35. A system for generating a secure application, comprising:

a disassembler that is configured to receive and decompose a target application into original files that contain predictable instructions; and

a securitization processor that is configured to;

identify one or more predictable instructions in the original files of the target application; and

modify the target application to create the secure application by binding one or more intercepts to be target application such that the behavior of the secure application is capable of being different from that of the target application;

wherein the securitization processor modifies the target application without access to the source code of the target application.

36. The system according to claim 35, wherein the bound intercepts are integrated with the original files.

37. The system according to claim 35, wherein the securitization agent processor is further configured to preserve operating system interactions that were originally defined for the target application and an operating system for which the target application was designed.

38. The system according to claim 35, wherein the securitization processor is further configured to impose a secure and unpredictable namespace on the interprocess communications of the target application to prevent unauthorized access to the interprocess communications of the secure application.

39. The system according to claim 38, wherein the unauthorized access includes a non-secure application attempting to retrieve data associated with the secure application.

40. The system according to claim 38, wherein the namespace permits secure applications to share data among each other.

41. The system according to claim 35, wherein the securitization processor is a mapping engine and the predictable instructions are byte codes and wherein the mapping engine is configured to programmatically inject secure byte codes in the place of pre-existing byte codes, wherein the secure byte codes override the pre-existing byte codes.

42. The system according to 41, wherein a behavior of the target application associated with the pre-existing byte codes is still performed if a policy that is associated with the secure byte codes is satisfied.

43. The system according to claim 35, wherein the securitization processor is a linker and the predictable instructions are references and wherein the linker is configured to programmatically inject secure references in the place of pre-existing references such that the secure references take priority over the pre-existing references.

44. The system according to claim 43, wherein the linker is further configured to reset a linking order to enable the secure references to have the priority over the pre-existing references.

45. The system according to claim 43, wherein a behavior of the target application associated with the pre-existing references is still performed if a policy that is associated with the secure references that override the pre-existing references is satisfied.

46. The system according to claim 35, wherein the behavior of the secure application that is different from that of the target application is based on a policy.

47. The system according to claim 46, wherein the policy is static or dynamic, wherein a dynamic policy may be modified following the creation of the secure application.

48. The system according to claim 47, wherein a first policy associated with a secure application may exist for a first group of computing devices and a second policy associated with the secure application may exist for a second group of computing devices.

49. The system according to claim 35, wherein the behavior of the secure application that is different from that of the target application includes one or more of the following:

preventing operation of the secure application during a predetermined time;

preventing operation of the secure application if a computing device on which the secure application is installed is located outside a predetermined location;

preventing operation of the secure application if the operation of the secure application would be in non-compliance with an imposed licensing model;

uninstalling a secure application;

or

deleting data that is associated with a secure application.

50. The system according to claim 35, wherein the behavior of the secure application that is different from that of the target application includes one or more of the following:

encrypting data that the secure application writes to storage;

locking or deleting the secure application if a computing device on which the secure application is installed has been offline or disconnected from a network for more than a predetermined amount of time;

locking or deleting the secure application if an authentication associated with launching the secure application has been incorrectly presented more than a predetermined number of times;

enabling or disabling the ability of the secure application to write data to or retrieve data from external storage;

requiring reentry of an authentication if the secure application has been inactive after launch for greater than a predetermined amount of time;

forcing an authentication to be entered prior to operation of the secure application;

preventing operation of the secure application unless an authentication associated with the secure application meets predefined criteria;

preventing operation of the secure application if a privileges check determines that an unauthorized modification has been performed on a computing device on which the secure application is installed;

or

muting notifications from the secure application.

51. The system according to claim 35, wherein the behavior of the secure application that is different from that of the target application includes one or more of the following:

enabling the secure application to store data at an external location;

replacing an existing video source for the secure application with a new video source, wherein the new video source at least includes input from a display of a computing device;

or

enabling the interaction of a new input/output device with the secure application, wherein the new input/output device at least includes a mouse.

52. The system according to claim 35, wherein the securitization processor is further configured to modify multiple target applications to create multiple corresponding secure applications and the multiple secure applications are related to one another.

53. A system for creating a secure application, comprising:

a disassembler that is configured to receive a target application and make available predictable instructions of the target application; and

a securitization processor that is configured to;

identify at least some of the predictable instructions; and

configure the target application with respect to the identified predictable instructions to enable selective behavior modification of the target application, thereby creating the secure application;

wherein the securitization processor is able to configure the target application without access to the source code of the target application and to preserve the normal functions and application programming interfaces of an operating system for which the target application was designed.

54. The system according to claim 53, wherein the securitization processor is capable of configuring the target application by imposing one or more intercepts on the identified predictable instructions of the target application.

55. The system according to claim 54, wherein the predictable instructions are non-secure byte codes and the securitization processor is further configured to programmatically inject secure byte codes in the place of the non-secure byte codes.

56. The system according to claim 54, wherein the predictable instructions are non-secure references and the securitization processor is further configured to programmatically inject secure references in the place of the non-secure references.

57. The system according to claim 53, wherein the securitization processor is further able to configure the target application by encapsulating the secure application to restrict access to the interprocess communications associated with the secure application.

58. The system according to claim 53, wherein the disassembler is further configured to receive the target application from a non-secure application repository and the secure application is sent to a secure application repository.

59. A system for creating a secure application, comprising:

a disassembler that is configured to receive a target application and decompose the target application into files that contain predictable instructions of the target application; and

a securitization processor that is configured to;

identify at least some of the predictable instructions; and

modify the target application to create the secure application by binding one or more intercepts to the target application to enable the modification of the predictable instructions such that the behavior of the secure application is capable of being different from the original behavior of the target application;

wherein the securitization processor is further configured to maintain pre-existing functionality of the target application and change the behavior of the secure application from the original behavior of the target application by enabling selective control of the execution of the pre-existing functionality.

60. A system for restricting access to an application, comprising:

a disassembler that is configured to obtain a target application that is designed to conduct interprocess communications with a non-secure framework; and

a securitization processor that is configured to;

impose a namespace for interprocess communications on the target application during a securitization process to create a first secure application, wherein the namespace is to be integrated with a secure framework to permit the secure framework to process interprocess communications that are associated with the first secure application and that conform to the namespace and wherein the non-secure framework will be unable to process the interprocess communications associated with the first secure application that conform to the namespace;

wherein a second secure application that conducts interprocess communications that conform to the namespace will be permitted to share data with the first secure application.

61. The system according to claim 60, wherein the secure framework is part of a secure partition that will include the first and second secure applications.

62. The system according to claim 60, wherein the non-secure framework is part of a non-secure partition that includes non-secure applications and the non-secure applications will not be permitted to retrieve data from the first or second secure applications.

63. A computing device, comprising:

an input device that is configured to receive a request to activate a secure application that is installed on the computing device, wherein the secure application was created from a target application having a first set of functions associated with a first application behavior and the secure application has a second set of functions that are imposed on the first set of functions and that are associated with a second application behavior; and

a processing unit, wherein the processing unit is configured to;

receive a request to activate the secure application;

force the secure application to override the first application behavior with the second application behavior, wherein the second application behavior takes priority over the first application behavior; and

execute the secure application to cause the secure application to perform the second application behavior.

64. The computing device according to claim 63, wherein the processing unit is further configured to selectively permit the secure application to engage in the first application behavior.

65. The computing device according to claim 64, wherein the processing unit is configured to selectively permit the secure application to engage in the first application behavior by selectively permitting the secure application to engage in the first application behavior if predetermined criteria associated with the operation of the secure application are met.

66. The computing device according to claim 65, wherein the predetermined criteria are based on a policy.