Methods, systems and machine-readable media for providing security services

• US 9,563,772 B2
• Filed: 09/01/2015
• Issued: 02/07/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Boyer, John Jules Alexander, Ahmed, Ali Kamran, Shephard, Timothy Michael, Prabhu, Vinay, Tewari, Ruchir
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas
• Application Number:
  US14/842,608
• Publication Number:
  US 20150371045A1
• Time in Patent Office: 525 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

Systems, methods and machine-readable media for providing a security service are disclosed. The methods include receiving a modification of the application object code to allow the software application to transmit a request for the security service; retrieving the modified application object code corresponding to the software application from memory; receiving, via a processor, the request for the security service from the modified application object code; and providing, via the processor, the security service. The systems and machine-readable media performing operations according to the methods disclosed.

Claims

1. A method for providing a security service from a security manager application to a software application on a computing device, the method comprising:

providing a security manager application configured to provide a security service on a computing device, the computing device having at least one processor operatively coupled with a memory;

providing a software application on the computing device, the software application having original, post-compile object code; and

modifying the original object code of the software application to create replacement object code, the replacement object code configured for communication with the security manager application, the replacement object code comprising a policy engine configured to retrieve a security policy into the memory of the computing device and configured to process a command sent from a remote server that remotely locks the software application, disables the software application, or sets the software application to an initial, unused state.

2. The method of claim 1, wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library introducing an additional load command, symbol replacement, pointer swizzling, and interposing.

3. The method of claim 1, further comprising:

generating, by the security manager application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign-on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications channel, and

transmitting the security artifact from the security manager application to the software application in response to a request of the security service.

4. The method of claim 1, further comprising:

converting the original object code from a signed form to an unsigned form before the modifying; and

converting the replacement object code from an unsigned form to a signed form after the modifying.

5. The method of claim 1, wherein the computing device is a mobile device.

6. The method of claim 1, wherein the modifying includes modifying at least one of a programmatic interface, a class, an object, and a function.

7. The method of claim 1, wherein the security policy is retrieved from a server that is remote from the computing device.

8. The method of claim 1, wherein the security manager application, responsive to a request of the security service, facilitates the security service if the software application is signed with a public key infrastructure (PKI) key.

9. The method of claim 1, wherein the security manager application is responsive to a registration request from the software application to establish application trust, the security manager application:

prompting a user to input an application registration passcode; and

generating a key to establish application trust using the application registration passcode to facilitate the security service provided by the security manager application to the software application.

10. The method of claim 1, further comprising:

generating an application data protection key, the application data protection key encrypted and decrypted by a corresponding data protection root key maintained with the security manager application.

11. A machine-readable non-transitory storage medium embodying information indicative of instructions for providing a security service from a security manager application to a software application on a computing device, the instructions comprising:

providing a security manager application configured to provide a security service on a computing device, the computing device having at least one processor operatively coupled with a memory;

providing a software application on the computing device, the software application having original, post-compile object code; and

modifying the original object code of the software application to create replacement object code, the replacement object code configured for communication with the security manager application, the replacement object code comprising a policy engine configured to retrieve a security policy into the memory of the computing device and configured to process a command sent from a remote server that remotely locks the software application, disables the software application, or sets the software application to an initial, unused state.

12. The medium of claim 11, wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library introducing an additional load command, symbol replacement, pointer swizzling, and interposing.

13. The medium of claim 11, further comprising:

generating, by the security manager application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign-on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications channel, and

transmitting the security artifact from the security manager application to the software application in response to a request of the security service.

14. The medium of claim 11, further comprising:

converting the original object code from a signed form to an unsigned form before the modifying; and

converting the replacement object code from an unsigned form to a signed form after the modifying.

15. The medium of claim 11, wherein the security manager application is responsive to a registration request from the software application to establish application trust, the security manager application:

prompting a user to input an application registration passcode; and

generating a key to establish application trust using the application registration passcode to facilitate the security service provided by the security manager application to the software application.

16. A computer system executing instructions in a computer program for providing a security service from a security manager application to a software application on a computing device, the system comprising:

at least one processor; and

a memory operatively coupled with the processor, the processor executing program code from the memory comprising;

program code for providing a security manager application configured to provide a security service on a computing device, the computing device having at least one processor operatively coupled with a memory;

program code for providing a software application on the computing device, the software application having original, post-compile object code; and

program code for modifying the original object code of the software application to create replacement object code, the replacement object code configured for communication with the security manager application, the replacement object code comprising a policy engine configured to retrieve a security policy into the memory of the computing device and configured to process a command sent from a remote server that remotely locks the software application, disables the software application, or sets the software application to an initial, unused state.

17. The system of claim 16, wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library introducing an additional load command, symbol replacement, pointer swizzling, and interposing.

18. The system of claim 16, wherein the program code further comprises:

program code for generating, by the security manager application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign-on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications channel, and

program code for transmitting the security artifact from the security manager application to the software application in response to a request of the security service.

19. The system of claim 16, wherein the program code further comprises:

program code for converting the original object code from a signed form to an unsigned form before the modifying; and

program code for converting the replacement object code from an unsigned form to a signed form after the modifying.

20. The system of claim 16, wherein the security manager application is responsive to a registration request from the software application to establish application trust, the security manager application having program code comprising:

program code for prompting a user to input an application registration passcode; and

program code for generating a key to establish application trust using the application registration passcode to facilitate the security service provided by the security manager application to the software application.