System and method for creating a secure channel for inter-application communication based on intents

• US 9,117,087 B2
• Filed: 02/25/2013
• Issued: 08/25/2015
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Box Incorporated
• Original Assignee: Box Incorporated
• Inventors: Tan, Simon, Maynard, David, Yao, Rico, Cung, Don
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): PLECHA, THADDEUS J
• Application Number:
  US13/776,535
• Publication Number:
  US 20140068779A1
• Time in Patent Office: 911 Days
• Field of Search: 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 40/166 Editing, e.g. inserting or deleting
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

System and method for creating a secure channel for inter-application communication based on the messaging system called Intents in the Android OS are disclosed. In one embodiment, an application for accessing a cloud-based storage platform triggers the broadcast of a custom Intent to all applications on a mobile device to detect an authorized application that is capable of interacting with the application. Once an authorized application is chosen, the application opens a secure channel for communication with the authorized application and passes encrypted data stream to the to the secure channel for access by the authorized application.

Claims

1. A method of providing a channel for securely transferring data between applications on a mobile device, the method comprising:

detecting one or more qualified applications on the mobile device that are qualified to interact with a cloud communication application on the mobile device, wherein the cloud communication application provides access to a cloud-based platform providing file storage and collaboration services;

providing a channel for communication between the cloud communication application and at least one qualified application of the one or more qualified applications,

wherein providing the channel includes establishing a secure storage area on the mobile device that is inaccessible by the applications on the mobile device with the exception of the cloud communication application and the one or more qualified applications,

wherein any data transferred via the channel is encrypted, and

wherein the at least one qualified application is selected from the one or more qualified applications to receive a file based on user input;

transferring, from the cloud communication application to the at least one qualified application, the file in encrypted form via the channel, wherein the cloud communication application receives the file from the cloud-based platform providing file storage and collaboration services;

allowing subsequent manipulation of the transferred file by the at least one qualified application;

receiving, by the cloud communication application, a new version of the file from the at least one qualified application via the channel; and

uploading, by the cloud communication application, the new version of the file to the cloud-based platform providing file storage and collaboration services.

2. The method of claim 1, further comprising:

triggering, by the cloud communication application, a broadcast of an encoded message to the applications on the mobile device for detecting the one or more qualified applications.

3. The method of claim 2, wherein the one or more qualified applications are configured to receive the broadcast.

4. The method of claim 2, further comprising:

receiving, from the one or more qualified applications, a response to the encoded message, wherein the encoded message is decoded at the one or more qualified applications.

5. The method of claim 1, wherein the secure storage area is an internal storage area on the mobile device.

6. The method of claim 1, wherein the secure storage area is an external storage area on the mobile device.

7. The method of claim 1, wherein the file that is transferred in encrypted form from the cloud communication application to the receiving application is encrypted using an encryption key that is specific to the receiving application, wherein the encryption key is usable for encrypting files that are subsequently transferred from the cloud communication application to the receiving application.

8. The method of claim 1, wherein the file that is transferred in encrypted form from the cloud communication application to the receiving application is encrypted using an encryption key that is specific to each transaction with the receiving application, wherein the transfer of the file from the cloud communication application to the receiving application via the channel comprises a transaction with the receiving application.

9. A system for providing a secure channel for transferring data between applications on a mobile device, the system comprising:

a processor; and

a memory unit having instructions stored thereon which when executed by the processor, causes the processor to;

trigger, by a cloud communication application, a broadcast of an encoded message to multiple applications on the mobile device to detect one or more authorized applications;

select an authorized application from the one or more authorized applications;

open, by the cloud communication application, the secure channel for communication with the authorized application on the mobile device; and

transfer, by the cloud communication application, a file in encrypted form to the authorized application via the secure channel on the mobile device, wherein the file is downloaded from a cloud-based server associated with the cloud communication application and wherein the file is subsequently manipulated using the authorized application;

receive, by the cloud communication application from the authorized application via the secure channel, a new version of the file; and

upload, by the cloud communication application, the new version of the file to the cloud-based server,

wherein the secure channel is established by allocating a secure storage area on the mobile device that is inaccessible by the applications on the mobile device with the exception of the cloud communication application and the one or more authorized applications, and

wherein any data transferred via the channel is encrypted.

10. The system of claim 9, wherein the cloud-based server provides a collaboration or file sharing service.

11. The system of claim 9, wherein the authorized application recognizes the encoded message.

12. A non-transitory computer-readable medium storing instructions, which when executed by one or more processors of a computing system, causes the computing system to:

trigger a broadcast of an encoded message to applications on the computing system;

detect one or more authorized applications that recognize and respond to the encoded message;

receive a selection of an authorized application from the one or more authorized applications;

open, by a cloud communication application, a secure channel for communication with the authorized application on the computing system;

receive, by the cloud communication application, one or more files from a cloud-based server providing storage and collaboration services;

transfer, by the cloud communication application, the one or more files in encrypted form to the authorized application via the secure channel to enable the authorized application to manipulate the one or more files;

receive, by the cloud communication application, a new version of the one or more files from the authorized application via the channel, the new version of the one or more files including changes made by a user to the one or more files using the authorized application; and

upload, by the cloud communication application, the new version of the one or more files to the cloud server providing file storage and collaboration services,

wherein the secure channel is established by allocating a secure storage area on the computing device that is inaccessible by the applications on the computing system with the exception of the cloud communication application and the one or more authorized applications, and

wherein any data transferred via the channel is encrypted.

13. The computer-readable medium of claim 12, wherein the broadcast is triggered by the cloud communication application.

14. The computer-readable medium of claim 12, wherein the one or more files that are transferred to the authorized application via the secure channel in encrypted form are encrypted using an encryption key that is specific to the authorized application, and wherein the encryption key is usable for encrypting files that are subsequently transferred to the authorized application.

15. The computer-readable medium of claim 12, wherein the one or more files that are transferred to the authorized application via the secure channel in encrypted form are encrypted using an encryption key that is specific to each transaction with the authorized application, and wherein transferring of the one or more files to the authorized application comprises a transaction.

16. A mobile device implementing a secure channel for transferring one or more files between mobile applications on the mobile device, comprising:

one or more processors;

a memory unit having instructions stored thereon, which when executed by the one or more processors, causes the mobile device to;

detect one or more receiving applications qualified to interact with a cloud communication application, wherein the cloud communication application provides access to a cloud-based platform server;

provide the secure channel for communication between the cloud communication application and a selected receiving application from the detected one or more receiving applications on the mobile device; and

transfer, from the cloud communication application to the receiving application, the one or more files in encrypted form via the secure channel, wherein the one or more files are received by the cloud communication application from the cloud-based platform server; and

allow the transferred one or more files to be subsequently decrypted and manipulated at the receiving application;

receive, by the cloud communication application, a new version of the one or more files in encrypted form from the receiving application via the secure channel; and

uploading, by the cloud communication application, the new version of the one or more files to the cloud-based platform server,

wherein providing the secure channel comprises the cloud communication application establishing a secure storage area on the mobile device that is inaccessible to the applications on the mobile device except the cloud communication application and the one or more receiving applications, and

wherein any data transferred via the secure channel is encrypted.

17. The mobile device of claim 16, wherein the processor is further configured to broadcast a custom Intent to all applications on the mobile device for detecting the one or more receiving applications, wherein the mobile device is based on the Android operating system.