Methods, systems and machine-readable media for providing security services

• US 9,129,112 B2
• Filed: 03/15/2013
• Issued: 09/08/2015
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Boyer, John Jules Alexander, Ahmed, Ali Kamran, Shephard, Tim, Prabhu, Vinay, Tewari, Ruchir
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US13/841,498
• Publication Number:
  US 20140282833A1
• Time in Patent Office: 907 Days
• Field of Search: 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

Systems, methods and machine-readable media for providing a security service are disclosed. The methods include receiving a modification of the application object code to allow the software application to transmit a request for the security service; retrieving the modified application object code corresponding to the software application from memory; receiving, via a processor, the request for the security service from the modified application object code; and providing, via the processor, the security service. The systems and machine-readable media performing operations according to the methods disclosed.

Claims

1. A method for providing a security service from a central application to another application on a computing device, the method comprising:

providing a first application configured to provide a security service on a computing device;

providing a second application on the computing device, the second application having original, post-compile object code;

modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement object code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.

2. The method of claim 1, wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library introducing an additional load command, symbol replacement, pointer swizzling, and interposing.

3. The system method of claim 1, further comprising:

generating, by the first application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications, channel, and

transmitting the security artifact from the first application to the second application in response to the requesting of the security service.

4. The method of claim 1, wherein the original object code includes unsigned code.

5. The method of claim 1, further comprising:

converting the original object code from a signed form to an unsigned form before the modifying; and

converting the replacement object code from an unsigned form to a signed form after the modifying.

6. The method of claim 1, wherein the computing device is a mobile device.

7. The method of claim 1, wherein the modifying includes modifying at least one of a programmatic interface, a class, an object, and a function.

8. The method of claim 1, wherein the modifying of the original object code of the second application includes introducing the policy engine for ensuring compliance with multiple security policies.

9. The method of claim 1, wherein the security policy is selected from the group consisting of data leakage prevention policy and an access control policy.

10. The method of claim 1, further comprising:

transmitting from the first application the security policy to the second application for execution.

11. The method of claim 10, wherein the security policy applies to at least one of a portion of the second application, a single software application, and a plurality of software applications.

12. The method of claim 1, wherein the security policy is based on at least one factor selected from the group consisting of execution context, external events, explicit policy redefinition, and changing group and role membership.

13. The method of claim 1, further comprising:

introducing the policy engine from the second application into a third application by modifying object code of the third application.

14. The method of claim 1, wherein data resulting from execution of the replacement object code is transmitted to the first application or the remote server.

15. The method of claim 1, wherein the first application, responsive to the request for the security service, facilitates the security service if the software application is signed with a public key infrastructure (PKI) key.

16. The method of claim 15, further comprising:

confirming, by the first application, that the second application and computing device have not been comprised; and

verifying a signature of the first application.

17. The method of claim 1, wherein the security service provides a common key to the second application and a third application.

18. The method of claim 1, wherein the first application is responsive to a registration request from the second application to establish application trust, the first application:

prompting a user to input an application registration passcode; and

generating a key to establish application trust using the application registration passcode to facilitate the security service provided by the first application to the second application.

19. The method of claim 18, wherein the first application the key to the second application to allow the second application to transmit the request for the security service.

20. The method of claim 1, further comprising:

generating an application data protection key, the application data protection key encrypted and decrypted by a corresponding data protection root key maintained with the first application.

21. The method of claim 20, wherein the application data protection key performs at least one of encrypting and decrypting an object data protection key to facilitate data object transfer from a first software application to a second software application.

22. The method of claim 21, further comprising:

generating a data-sharing key for encrypting the object data protection key prior to transferring the data object and the object data protection key from the first application to the second software application;

or

generating a data-sharing key for decrypting the object data protection key after transferring the data object and the object data protection key from the first software application to the second software application.

23. The method of claim 21, wherein at least one of the first application and the second application:

decrypts the object data protection key for the data object with the application data protection key of the first software application, and

encrypts the object data protection key for the data object with the application data protection key of the second software application.

24. The method of claim 1, wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.

25. The method of claim 1 further comprising:

providing a third application on the computing device, the third application having original, post-compile object code; and

modifying the original object code of the third application to create replacement object code incorporating a policy engine configured to retrieve a second security policy and process a command that set the third application to an initial, unused state.

26. A machine-readable non-transitory storage medium embodying information indicative of instructions for causing one or more machines to perform the operations comprising:

providing a first application configured to provide a security service on a computing device;

providing a second application on the computing device, the second application having original, post-compile object code;

modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement object code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.

27. The medium of claim 26, wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.

28. A computer system executing instructions in a computer program, the computer system comprising:

a processor; and

a memory operatively coupled with a processor, the processor executing program code from the memory comprising;

program code for providing a first application configured to provide a security service on a computing device;

program code for providing a second application on the computing device, the second application having original, post-compile object code;

program code for modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.

29. The system of claim 28, wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library, introducing an additional load command, symbol replacement, pointer swizzling, and interposing.

30. The system of claim 28, further comprising:

generating, by the first application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign-on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications channel, and

transmitting the security artifact from the first application to the second application in response to the requesting of the security service.

31. The system of claim 28, wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.

32. The system of claim 28 wherein the processor executes program code from the memory further comprising:

program code for providing a third application on the computing device, the third application having original, post-compile object code; and

program code for modifying the original object code of the third application to create replacement object code incorporating a policy engine configured to retrieve a second security policy and process a command that set the third application to an initial, unused state.