SECURING AND MANAGING APPS ON A DEVICE

• US 20120210443A1
• Filed: 02/11/2011
• Published: 08/16/2012
• Est. Priority Date: 02/11/2011
• Status: Active Grant

• Current Assignee: Blue Cedar Networks, Inc.
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: Blaisdell, James, Vally, Jean-Max
• Granted Patent: US 8,549,656 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Apps are secured or security-wrapped either before they are downloaded onto a device, such as a smartphone or tablet device, or after they are downloaded but before they are allowed to access the device operating system and cause any potential damage to the device. An app provider, such as an employer or a cellphone provider, can secure its apps before consumers download an app from their app store or marketplace. The app is secured before it is allowed to access the operating system of the device, thereby preventing the app from malicious behavior. Core object code of the app is obtained and the digital signature is removed. App object code is substituted with security program object code, thereby creating a security-wrapped app. The security-wrapped app is prepared for execution on the device and is re-signed with a new key.

Claims

1. A method of securing an app for execution on a device using a security program, the method comprising:

obtaining core object code of the app, wherein a digital signature is removed from the app;

substituting app object code with security program object code, thereby creating a security-wrapped app;

preparing the security-wrapped app for execution on the device; and

re-signing the security-wrapped app with a new key,

wherein a centralized policy to control and secure access to data is implemented on the device.

2. A method as recited in claim 1 further comprising decompiling the app using the security program thereby obtaining executable code.

3. A method as recited in claim 1 further comprising disassembling the app using the security program, thereby obtaining executable code.

4. A method as recited in claim 1 further comprising:

applying a security program to the app.

5. A method as recited in claim 1 wherein said obtaining core object code and substituting app object code is done before the app interacts with an operating system of the device.

6. A method as recited in claim 5 further comprising:

blocking interaction with the operating system.

7. A method as recited in claim 5 further comprising:

redirecting the app to a security program off the device.

8. A method as recited in claim 5 further comprising:

ensuring that the security-wrapped app can run on the device and not on another device.

9. A method as recited in claim 1 further comprising making a copy of the app.

10. A method as recited in claim 9 further comprising:

deleting an original app from the device.

11. A method as recited in claim 9 further comprising:

reverting to an original app if a malfunction occurs while securing the app on the device.

12. A method as recited in claim 1 further comprising:

applying security program object code to operating system object code, wherein the security program object code is derived from policies.

13. A method as recited in claim 1 further comprising:

changing an icon representing the app on a display of the device to show that the app is secured.

14. A method as recited in claim 1 further comprising:

wrapping the app with a security layer before downloading the app.

15. A method as recited in claim 1 wherein the security-wrapped app implements an app policy.

16. A method as recited in claim 1 wherein the app policy includes one or more of limiting app execution time on the device, limiting the total number of apps on the device;

and limiting where the app may execute.

17. A method of preventing an app from damaging a device, the method comprising:

executing a security-wrapped app on the device;

applying a security check to a call made by the security-wrapped app to an operating system of the device; and

based on said application of security check to said call, performing one of

(a) allowing the call to pass to the operating system;

(b) enhancing the call;

(c) blocking the call; and

(d) terminating the security-wrapped app,

wherein a policy to control and secure access to data is implemented on the device.

18. A method as recited in claim 17 wherein terminating the app further comprises:

automatically deleting the app from the device.

19. A method as recited in claim 17 wherein the security-wrapped app implements a policy, wherein the policy may include one or more of limiting app execution time on the device, limiting the total number of apps on the device;

and limiting where the app may execute.

20. A method as recited in claim 17 wherein blocking the call further comprises:

performing one of providing an obfuscated response to the call and providing partial data such that any classified data is kept confidential.

21. A method as recited in claim 17 wherein enhancing the call further comprises:

encrypting data that is saved on the device.

22. A method as recited in claim 17 wherein the app is exposed to existing filtering infrastructure to allow for inspection and control of app communications.

23. A method as recited in claim 22 wherein the filtering infrastructure includes IDS, IPS, and Web filtering.