SECURE EXECUTION OF UNSECURED APPS ON A DEVICE

• US 20120304310A1
• Filed: 06/19/2012
• Published: 11/29/2012
• Est. Priority Date: 03/21/2011
• Status: Active Grant

• Current Assignee: Blue Cedar Networks, Inc.
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: BLAISDELL, James
• Granted Patent: US 8,769,305 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

An app is secured on a mobile device by being deconstructed or unbundled into multiple modules, where a module is a segment of app code that performs a particular function. It is then determined which modules from the multiple modules perform some type of security function, for example, a function dealing with confidential or security-related data. These modules, forming a group of modules, are loaded into a trusted execution environment. The app is then re-bundled so that it has the first plurality of modules and the second plurality of modules. The app executes in a manner where the high security functions execute so that break points cannot be inserted into the app code. The re-bundling is done automatically in an app security wrapping process. Security constraints are added to the app.

Claims

1. A method of securing an app on a mobile device, the method comprising:

unbundling an app into a first plurality of modules, wherein a module is a segment of app code for a particular function;

determining which module from the first plurality of modules perform high security functions, thereby creating a second plurality of modules;

loading the second plurality of modules performing the high security functions to a trusted execution environment; and

re-bundling the app so that the app has the first plurality of modules and the second plurality of modules;

executing the app wherein the high security functions execute so that break points cannot be inserted into the app code.

2. A method as recited in claim 1 wherein the re-bundling is done automatically in an app security wrapping process.

3. A method as recited in claim 1 further comprising:

adding security constraints to the app.

4. A method as recited in claim 3 further comprising:

inserting identifiers of one or more users into an app file, said one or more users being authorized to use the app.

5. A method as recited in claim 3 further comprising:

inserting identifiers of one or more devices into an app file, said one or more devices authorized to execute the app.

6. A method as recited in claim 1 further comprising:

storing a key in the trusted execution environment.

7. A method as recited in claim 1 further comprising:

utilizing a split-key share; and

causing a key share to expire using a data lease.