Systems and methods for secure file portability between mobile applications on a mobile device

• US 9,027,108 B2
• Filed: 02/25/2013
• Issued: 05/05/2015
• Est. Priority Date: 05/23/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Tan, Simon, Yao, Rico, Cung, Don, Maynard, David Scott
• Primary Examiner(s): PEARSON, DAVID J
• Application Number:
  US13/776,358
• Publication Number:
  US 20130332723A1
• Time in Patent Office: 799 Days
• Field of Search: None
• US Class Current: 726/9
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Systems and methods for secure file portability between mobile applications in a cloud-based environment or cloud-based collaboration and file sharing environment. In one embodiment, a server-based key generation service generates an encryption key that is unique to each file transfer transaction between mobile applications accessed via a mobile device. Data packages leaving a mobile application are then encrypted using the encryption key to provide secure file portability between mobile applications. In another embodiment, a background service triggered by a mobile application detects when a user is logged out of the mobile application and revalidates the user session with the mobile application to maintain portability of files between mobile applications. The background service presents a minimal user interface to get the user'"'"'s credentials for the mobile application, without the user having to switch to the mobile application, and obtains an authentication token from a remote server using the user'"'"'s credentials.

Claims

1. A method for maintaining data portability between mobile applications, including a first mobile application and a second mobile application, in a data sharing environment on a mobile device, comprising:

detecting expiration of an authentication token associated with a user and the first mobile application;

presenting a user interface to obtain information identifying the user to authenticate the user without the user having to switch from the second mobile application to the first mobile application to enter login credentials for authentication;

requesting a new authentication token from a host server associated with the first mobile application; and

authenticating the user with the first mobile application using the new authentication token from the host server to allow direct upload of one or more files from the second mobile application to the first mobile application, wherein the one or more files are received by the second mobile application from the first mobile application in response to a user request identifying the second mobile application as a recipient of the one or more files.

2. The method of claim 1, further comprising:

maintaining a connection to the host server associated with the first mobile application.

3. The method of claim 2, wherein a service started by the first mobile application runs in the background of the operating system to maintain the connection to the host server and request the new authentication token from the host server.

4. The method of claim 1, wherein the new authentication token is generated at the host server using at least some of the information identifying the user received from the mobile device.

5. The method of claim 1, wherein the first mobile application provides access to a cloud-based storage service that is hosted on the host server.

6. The method of claim 1, wherein the second mobile application allows the user to open and modify one or more files.

7. The method of claim 1, wherein the one or more files are new versions of one or more files received from the first mobile application for opening and editing using the second mobile application.

8. A mobile device providing data portability between mobile applications, comprising:

a memory;

a first application and a second application stored in the memory;

the first application including processor-executable instructions to;

start a service in the background to keep a user session with the first application alive, wherein the service detects the end of a user session with the first application and requests an authentication token from the remote server to revalidate the user session;

receive a user request to open a file in a second application;

securely encrypt and transfer the file to the second application;

the second application including processor-executable instructions to;

receive the file transferred by the first application;

decrypt the file;

receive modifications to the file from a user;

securely encrypt and transfer the modified file to the first application, wherein the user session with the first application is kept alive by the service during a period of user inactivity in the first application.

9. The mobile device of claim 8, wherein the first mobile application provides access to a cloud-based storage service that is hosted on the host server.

10. The mobile device of claim 8, wherein the first application includes processor-executable instructions to:

generate and display a user interface to obtain information identifying the user without the user having to switch from the second mobile application to the first mobile application.

11. A method for secure file portability between mobile applications on a mobile device, comprising:

receiving multiple transaction requests to transfer files between a first mobile applications and a second mobile application on the mobile device;

for each transaction request,

requesting an encryption key from a host server, wherein the encryption key is requested by the respective first mobile application or the second mobile application making the transaction request;

encrypting a file associated with the transaction request with the encryption key;

executing the transaction request by transferring the encrypted file from the first mobile application to the second mobile application or vice versa; and

wherein the first mobile application is one of an application providing access to a cloud-based storage service provided by the host server or an application for viewing and modifying files.

12. The method of claim 11, wherein encrypting the file includes encrypting data streams of the file and transferring the encrypted file includes transferring the encrypted data streams.

13. The method of claim 11, wherein the host server is associated with one of the first mobile application and the second mobile application.

14. The method of claim 11, further comprising:

sending the encryption key to the second mobile application for decrypting the encrypted file.

15. The method of claim 11, wherein the second mobile application obtains a decryption key from the host server for decrypting the encrypted file.

16. A mobile device providing secure file portability between mobile applications on the mobile device, comprising:

an inter-application transaction request detector module stored in a memory of the mobile device and configured to;

receive a transaction request from a first mobile application, wherein the transaction request is for a transfer of one or more files from the first mobile application to a second mobile application;

a key request module stored in the memory of the mobile device and configured to;

request an encryption key from a host server associated with the first mobile application; and

encrypt a file associated with the transaction request with the encryption key;

a module configured to;

execute the transaction request by transferring the encrypted file from the first mobile application to the second mobile application;

wherein one of the first and second mobile applications is a cloud-based collaboration platform application and the other of the first and second mobile applications is an application for opening and editing files.

17. The mobile device of claim 16, wherein the key request module is further configured to encrypt a predefined number of files per transaction request.

18. The mobile device of claim 16, wherein the key request module requests an encryption key from the host server on a per transaction basis.

19. A server-based key generation method for secure file portability between mobile applications on a mobile device, comprising:

receiving a request for an encryption key from a mobile application on the mobile device;

evaluating the request to determine whether the request meets a condition for generating an encryption key;

wherein the condition specifies generating the encryption key when the request is associated with a file transfer transaction between the requesting mobile application and a target mobile application occurring for the first time;

generating an encryption key if the request meets the condition for generating the encryption key; and

sending the encryption key to the requesting mobile application on the mobile device for encryption of one or more files associated with the file transfer transaction;

wherein the mobile application is one of a cloud-based collaboration platform application or application for opening and editing files.

20. The method of claim 19, further comprising sending the encryption key to the target mobile application for decrypting the one or more files received from the requesting mobile application.

21. The method of claim 20, wherein the sending is in response to a request for a decryption key from the target mobile application.

22. The method of claim 21, wherein the requesting mobile application is the cloud-based collaboration platform application and the target application is an application for opening and editing the one or more files.

23. The method of claim 19, wherein the same encryption key is used to encrypt one or more files associated with a subsequent file transfer transaction occurring within a predefined time period of the file transfer transaction occurring for the first time.

24. A non-transitory machine-readable storage medium storing instructions which when executed by a mobile device causes the mobile device to perform a method of maintaining data portability between mobile applications, including a first mobile application and a second mobile application, in a data sharing environment on the mobile device, comprising:

instructions for detecting expiration of an authentication token associated with a user and the first mobile application;

instructions for presenting a user interface to obtain information identifying the user to authenticate the user without the user having to switch from the second mobile application to the first mobile application to enter login credentials for authentication;

instructions for requesting a new authentication token from a host server associated with the first mobile application; and

instructions for authenticating the user with the first mobile application using the new authentication token from the host server to allow direct upload of one or more files from the second mobile application to the first mobile application, wherein the one or more files are received by the second mobile application from the first mobile application in response to a user request identifying the second mobile application as a recipient of the one or more files.

25. The machine-readable storage medium of claim 24, further comprising:

instructions for maintaining a connection to the host server associated with the first mobile application.

26. The machine-readable storage medium of claim 24, wherein a service started by the first mobile application runs in the background of the operating system to maintain the connection to the host server and request the new authentication token from the host server.