Controlling mobile device access to secure data

• US 8,959,579 B2
• Filed: 09/30/2013
• Issued: 02/17/2015
• Est. Priority Date: 10/16/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Lang, Zhongmin, Desai, Nitin, Walker, James Robert
• Primary Examiner(s): PEARSON, DAVID J
• Application Number:
  US14/041,911
• Publication Number:
  US 20140108794A1
• Time in Patent Office: 505 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Various aspects of the disclosure relate to providing secure containers or data vaults for data of one or more managed applications. In some embodiments, each managed application may be assigned its own private data vault and/or may be assigned a shared data vault that is accessible to at least one other managed application. As the managed application executes, calls for access to the data may be intercepted and redirected to the secure containers. Data stored in a secure container may be encrypted according to a policy. Other aspects relate to deleting data from a secure container, such as via a selective wipe of data associated with a managed application. Further aspects relate to configuring and creating the secure containers, retrieving key information required to encrypt/decrypt the data stored in the secure containers, and publishing the managed applications, policy information and key information for download to a mobile device.

Claims

1. A method, comprising:

obtaining, by a mobile device, policy information via an access gateway through which a resource is accessible to a managed application of the mobile device, wherein the policy information defines that a private secure container and a shared secure container are to be used when the managed application is executing;

obtaining, via the access gateway, key information that includes one or more keys for encrypting or decrypting data of the private secure container or the shared secure container;

configuring the private secure container and the shared secure container based on the policy information, wherein the private secure container and the shared secure container are each a logical interface into which data is read from and written to in an encrypted form, wherein the private secure container is private to the managed application, and wherein the shared secure container is shared with at least one other managed application of the mobile device;

intercepting a read or write operation from the managed application while the managed application is executing on the mobile device, wherein the read or write operation comprises an application programming interface (API) call available via a file system of the mobile device, wherein the file system of the mobile device is different from both a file system of the private secure container and a file system of the shared secure container, and wherein the read or write operation indicates a type of data to be read or written;

determining, based on the policy information and the type of data to be read or written, whether to redirect the read or write operation to the shared secure container or the private secure container; and

based on the determining, redirecting the read or write operation to the private secure container or the shared secure container.

2. The method of claim 1, wherein configuring the shared secure container includes configuring the file system of the shared secure container and an access manager of the shared secure container, and wherein the method further comprises:

managing access to the shared secure container via a client agent installed on the mobile device.

3. The method of claim 1, wherein the private secure container is a private data vault that is accessible to only the managed application.

4. The method of claim 1, wherein the shared secure container is a shared data vault that is accessible only to the managed application and the at least one other managed application of the mobile device, wherein the policy information is assigned to the managed application and the at least one other managed application of the mobile device.

5. The method of claim 1, further comprising:

as part of a process of configuring the managed application such that the managed application is able to be executed in accordance with a management framework defined by the policy information;

determining that legacy data associated with an application of the mobile device that was executed not in accordance with the management framework is to be configured for the managed application;

responsive to determining that the legacy data is to be configured for the managed application, encrypting the legacy data, resulting in encrypted legacy data;

storing a first set of the encrypted legacy data in the private secure container; and

storing a second set of the encrypted legacy data in the shared secure container.

6. The method of claim 1, wherein the read or write operation includes a read operation of particular data, and the method further comprises:

retrieving an encrypted form of the particular data from the private secure container based on the file system of the private secure container and an access manager of the private secure container;

decrypting the encrypted form of the particular data, resulting in a decrypted form of the particular data, wherein said decrypting uses a key received via the access gateway; and

providing the decrypted form of the particular data to the managed application.

7. The method of claim 1, wherein the read or write operation includes a write operation of particular data, and the method further comprises:

encrypting the particular data, resulting in an encrypted form of the particular data, wherein said encrypting uses a key received via the access gateway; and

providing the encrypted form of the particular data for storage to the private secure container, said storage being based on the file system of the private secure container and an access manager of the private secure container.

8. The method of claim 1, further comprising initiating a configuration process for the managed application, and wherein the steps of claim 1 are performed responsive to said initiating.

9. The method of claim 1, further comprising:

configuring a policy-aware interception layer to perform said intercepting of the read or write operation.

10. An apparatus, comprising:

at least one processor; and

memory storing executable instructions configured to, when executed by the at least one processor, cause the apparatus to;

obtain policy information via an access gateway through which a resource is accessible to a managed application of the apparatus, wherein the policy information defines that a private secure container and a shared secure container are to be used when the managed application is executing;

obtain, via the access gateway, key information that includes one or more keys for encrypting or decrypting data of the private secure container or the shared secure container;

configure the private secure container and the shared secure container based on the policy information, wherein the private secure container and the shared secure container are each a logical interface into which data is read from and written to in an encrypted form, wherein the private secure container is private to the managed application, and wherein the shared secure container is shared with at least one other managed application of the apparatus;

intercept a read or write operation from the managed application while the managed application is executing on the apparatus, wherein the read or write operation comprises an application programming interface (API) call available via a file system of the apparatus, wherein the file system of the apparatus is different from both a file system of the private secure container and a file system of the shared secure container, and wherein the read or write operation indicates a type of data to be read or written;

determine, based on the policy information and the type of data to read or written, whether to redirect the read or write operation to the shared secure container or the private secure container; and

based on the determining, redirect the read or write operation to the private secure container or the shared secure container.

11. The apparatus of claim 10, wherein configuring the shared secure container includes configuring the file system of the shared secure container and an access manager of the shared secure container, and wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

manage access to the shared secure container via a client agent installed on the apparatus.

12. The apparatus of claim 10, wherein the shared secure container is a shared data vault that is accessible only to the managed application and the at least one other managed application of the apparatus, wherein the policy information is assigned to the managed application and the at least one other managed application of the apparatus.

13. The apparatus of claim 10, wherein the read or write operation includes a read operation of particular data, and wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

retrieve an encrypted form of the particular data from the private secure container based on the file system of the private secure container and an access manager of the private secure container;

decrypt the encrypted form of the particular data, resulting in a decrypted form of the particular data, wherein said decrypting uses a key received via the access gateway; and

provide the decrypted form of the particular data to the managed application.

14. The apparatus of claim 10, wherein the read or write operation includes a write operation of particular data, and wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

encrypt the particular data, resulting in an encrypted form of the particular data, wherein said encrypting uses a key received via the access gateway; and

provide the encrypted form of the particular data for storage to the private secure container, said storage being based on the file system of the private secure container and an access manager of the private secure container.

15. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to initiate a configuration process for the managed application, and wherein the steps of claim 10 are performed responsive to said initiating.

16. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

configure a policy-aware interception layer to perform said intercepting of the read or write operation.

17. One or more non-transitory computer-readable media storing instructions configured to, when executed, cause a computing device to:

obtain policy information via an access gateway through which a resource is accessible to a managed application of the computing device, wherein the policy information defines that a private secure container and a shared secure container are to be used when the managed application is executing;

obtain, via the access gateway, key information that includes one or more keys for encrypting or decrypting data of the private secure container or the shared secure container;

configure the private secure container and the shared secure container based on the policy information, wherein the private secure container and the shared secure container are each a logical interface into which data is read from and written to in an encrypted form, wherein the private secure container is private to the managed application, and wherein the shared secure container is shared with at least one other managed application of the computing device;

intercept a read or write operation from the managed application while the managed application is executing on the computing device, wherein the read or write operation comprises an application programming interface (API) call available via a file system of the computing device, wherein the file system of the computing device is different from both a file system of the private secure container and a file system of the shared secure container, and wherein the read or write operation indicates a type of data to be read or written;

determine, based on the policy information and the type of data to be read or written, whether to redirect the read or write operation to the shared secure container or the private secure container; and

based on the determining, redirect the read or write operation to the private secure container or the shared secure container.

18. The one or more non-transitory computer-readable media of claim 17, wherein the instructions are configured to, when executed, cause the computing device to initiate a configuration process for the managed application, and wherein the steps of claim 17 are performed responsive to said initiating.

19. The one or more non-transitory computer-readable media of claim 17, wherein the instructions are configured to, when executed, cause the computing device to:

configure a policy-aware interception layer to perform said intercepting of the read or write operation.

20. The one or more non-transitory computer-readable media of claim 17, wherein the read or write operation includes a read operation of particular data, and wherein the instructions are configured to, when executed, cause said at least one computing device to:

retrieve an encrypted form of the particular data from the private secure container based on the file system of the private secure container and an access manager of the private secure container;

decrypt the encrypted form of the particular data, resulting in a decrypted form of the particular data, wherein said decrypting uses a key received via the access gateway; and

provide the decrypted form of the particular data to the managed application.