Intra-application permissions on an electronic device

• US 9,489,524 B2
• Filed: 05/23/2014
• Issued: 11/08/2016
• Est. Priority Date: 05/23/2014
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Blackberry Limited
• Inventors: Wurster, Glenn Daniel
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US14/286,798
• Publication Number:
  US 20150339482A1
• Time in Patent Office: 900 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Various embodiments are provided in which intra-application permissions may be granted on an electronic device. An application may access data from another application if the application has the proper permission signed by a permissions server. In one embodiment, a request is received by a first application that is installed on a device. The request is from a second application for permission to access data associated with the first application. A permissions record for the second application may be stored in an application package of the second application. The first application may access the permissions record to determine whether the second application has permission to access the data associated with the first application. The first application may provide the second application with access to the data associated with the first application based, at least in part, on the permissions record stored in the application package of the second application.

Claims

1. A method comprising:

receiving, by a first application that is installed on a device, a request from a second application for permission to access data associated with the first application;

accessing a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which a permission is needed and a first digital certificate used to verify authenticity of the second application;

verifying that the permissions record is signed by an authorized permissions authority unit configured to validate contents of the permissions record; and

verifying that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record in response to verifying that the permissions record is signed by the authorized permissions authority unit.

2. The method of claim 1, wherein the permissions record for the second application is stored in an application package for the second application, the application package comprising an installation file associated with the second application, wherein the installation file is stored by an application installer of the device.

3. The method of claim 1, wherein the permissions record for the second application is stored in an application package for the second application, wherein said accessing the permissions record comprises requesting the permissions record using a file system path associated with the application package.

4. The method of claim 1, wherein the verifying comprises verifying that the second application has permission to access the data associated with the first application based, at least in part, on the first digital certificate used to verify authenticity of the second application that is stored in the permissions record.

5. The method of claim 4, wherein the receiving of the request occurs after the second application is installed on the device.

6. The method of claim 4, wherein the permissions record for the second application is stored in an application package for the second application, further comprising:

retrieving a copy of the first digital certificate that is used to authenticate the application package that includes the second application, wherein the retrieving is from a source that is different from the permissions record, and

wherein the verifying comprises,

verifying that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.

7. The method of claim 1, wherein the verifying that the second application has permission to access the data associated with the first application comprises verifying without displaying a request for authorization to a user of the device.

8. The method of claim 1, wherein a first application signing key for validating the first application is different from a second application signing key for validating the second application.

9. An apparatus comprising:

a processor; and

a first application installed on the apparatus and executable on the processor, the first application configured to;

receive a request from a second application for permission to access data associated with the first application;

access a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which a permission is needed and a first digital certificate used to verify authenticity of the second application;

verify that the permissions record is signed by an authorized permissions authority unit configured to validate the contents of the permissions record; and

verify that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record in response to verifying whether the permissions record is signed by the authorized permissions authority unit.

10. The apparatus of claim 9,

wherein the permissions record for the second application is stored in an application package for the second application,

wherein the application package comprises an installation file associated with the second application, wherein the installation file is stored by an application installer of the apparatus, and

wherein the first application configured to access the permissions record comprises the first application configured to request the permissions record associated with the application package.

11. The apparatus of claim 9, wherein the first application configured to verify comprises the first application configured to verify that the second application has permission to access the data associated with the first application based, at least in part, on the first digital certificate used to verify authenticity of the second application that is stored in the permissions record.

12. The apparatus of claim 11, wherein the first application is configured to receive the request after the second application is installed on the apparatus.

13. The apparatus of claim 11,

wherein the first application is configured to retrieve a copy of the first digital certificate that is used to authenticate an application package that includes the second application, wherein the copy of the first digital certificate is from a source that is different from the permissions record, and

wherein the first application configured to verify comprises the first application configured to:

verify that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.

14. The apparatus of claim 9, wherein the first application configured to verify that the second application has permission to access the data associated with the first application comprises the first application configured to verify without display of a request for authorization to a user of the apparatus.

15. The apparatus of claim 9, wherein a first application signing key for validation of the first application is different from a second application signing key for validation of the second application.

16. A non-transitory computer readable storage medium having computer usable program code embodied therewith, the computer usable program code comprising a computer usable program code that is part of a first application installed on a device, the computer usable program code configured to:

receive a request from a second application for a permission to access data associated with the first application;

access a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which the permission is needed and a first digital certificate used to verify authenticity of the second application;

verify that the permissions record is signed by an authorized permissions authority unit configured to validate the contents of the permissions record, and

verify that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record in response to verifying that the permissions record is signed by the authorized permissions authority unit.

17. The non-transitory computer readable storage medium of claim 16, wherein the computer usable program code configured to verify comprises computer usable program code configured to verify that the second application has permission to access the data associated with the first application based, at least in part, on the first digital certificate used to verify authenticity of the second application that is stored in the permissions record.

18. The non-transitory computer readable storage medium of claim 17, wherein the computer usable program code is configured to receive the request after the second application is installed on the device.

19. The non-transitory computer readable storage medium of claim 17,

wherein the computer usable program code is configured to retrieve a copy of the first digital certificate that is used to authenticate an application package that includes the second application, wherein the copy of the first digital certificate is from a source that is different from the permissions record, and

wherein the computer usable program code configured to verify comprises computer usable program code configured to:

verify that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.