INTRA-APPLICATION PERMISSIONS ON AN ELECTRONIC DEVICE

• US 20150339482A1
• Filed: 05/23/2014
• Published: 11/26/2015
• Est. Priority Date: 05/23/2014
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Blackberry Limited
• Inventors: Wurster, Glenn Daniel
• Granted Patent: US 9,489,524 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Various embodiments are provided in which intra-application permissions may be granted on an electronic device. An application may access data from another application if the application has the proper permission signed by a permissions server. In one embodiment, a request is received by a first application that is installed on a device. The request is from a second application for permission to access data associated with the first application. A permissions record for the second application may be stored in an application package of the second application. The first application may access the permissions record to determine whether the second application has permission to access the data associated with the first application. The first application may provide the second application with access to the data associated with the first application based, at least in part, on the permissions record stored in the application package of the second application.

Claims

1. A method comprising:

receiving, by a first application that is installed on a device, a request from a second application for permission to access data associated with the first application;

accessing a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which a permission is needed; and

verifying that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record.

2. The method of claim 1, wherein the permissions record for the second application is stored in an application package for the second application, the application package comprising an installation file associated with the second application, wherein the installation file is stored by an application installer of the device.

3. The method of claim 1, wherein the permissions record for the second application is stored in an application package for the second application, wherein said accessing the permissions record comprises requesting the permissions record using a file system path associated with the application package.

4. The method of claim 1, wherein the verifying comprises verifying that the second application has permission to access the data associated with the first application based, at least in part, on a first digital certificate used to verify authenticity of the second application that is stored in the permissions record.

5. The method of claim 4, wherein the receiving of the request occurs after the second application is installed on the device.

6. The method of claim 4, wherein the permissions record for the second application is stored in an application package for the second application, further comprising:

retrieving a copy of the first digital certificate that is used to authenticate the application package that includes the second application, wherein the retrieving is from a source that is different from the permissions record, and

wherein the verifying comprises,

verifying that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.

7. The method of claim 1, wherein the permissions record includes a permissions authority digital signature that is digitally signed with a permissions authority signing key in a permissions authority digital certificate of a permissions authority, wherein the method comprises:

accessing the permissions authority digital signature in the permissions record; and

verifying the permissions authority digital signature in the permissions record.

8. The method of claim 7, wherein the verifying that the second application has permission to access the data associated with the first application comprises verifying based, at least in part, on the verifying of the permissions authority digital signature.

9. The method of claim 1, wherein the verifying that the second application has permission to access the data associated with the first application comprises verifying without displaying a request for authorization to a user of the device.

10. The method of claim 1, wherein a first application signing key for validating the first application is different from a second application signing key for validating the second application.

11. An apparatus comprising:

a processor; and

a first application installed on the apparatus and executable on the processor, the first application configured to;

receive a request from a second application for permission to access data associated with the first application;

access a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which a permission is needed; and

verify that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record.

12. The apparatus of claim 11,

wherein the permissions record for the second application is stored in an application package for the second application,

wherein the application package comprises an installation file associated with the second application, wherein the installation file is stored by an application installer of the apparatus, and

wherein the first application configured to access the permissions record comprises the first application configured to request the permissions record associated with the application package.

13. The apparatus of claim 11, wherein the first application configured to verify comprises the first application configured to verify that the second application has permission to access the data associated with the first application based, at least in part, on a first digital certificate used to verify authenticity the second application that is stored in the permissions record.

14. The apparatus of claim 13, wherein the first application is configured to receive the request after the second application is installed on the apparatus.

15. The apparatus of claim 13,

wherein the first application is configured to retrieve a copy of the first digital certificate that is used to authenticate an application package that includes the second application, wherein the copy of the first digital certificate is from a source that is different from the permissions record, and

wherein the first application configured to verify comprises the first application configured to:

verify that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.

16. The apparatus of claim 11, wherein the permissions record includes a permissions authority digital signature that is digitally signed with a permissions authority signing key in a permissions authority digital certificate of a permissions authority, wherein the first application is configured to:

access the permissions authority digital signature in the permissions record; and

verify the permissions authority digital signature in the permissions record.

17. The apparatus of claim 16, wherein the first application configured to verify that the second application has permission to access the data associated with the first application comprises the first application configured to verify based, at least in part, on verification of the permissions authority digital signature.

18. The apparatus of claim 11, wherein the first application configured to verify that the second application has permission to access the data associated with the first application comprises the first application configured to verify without display of a request for authorization to a user of the apparatus.

19. The apparatus of claim 11, wherein a first application signing key for validation of the first application is different from a second application signing key for validation of the second application.

20. A non-transitory computer readable storage medium having computer usable program code embodied therewith, the computer usable program code comprising a computer usable program code that is part of a first application installed on a device, the computer usable program code configured to:

receive a request from a second application for a permission to access data associated with the first application;

access a permissions record for the second application, wherein the permissions record comprises an identification of the first application from which the permission is needed; and

verify that the second application has permission to access the data associated with the first application based, at least in part, on the permissions record.

21. The non-transitory computer readable storage medium of claim 20, wherein the computer usable program code configured to verify comprises computer usable program code configured to verify that the second application has permission to access the data associated with the first application based, at least in part, on a first digital certificate used to verify authenticity the second application that is stored in the permissions record.

22. The non-transitory computer readable storage medium of claim 21, wherein the computer usable program code is configured to receive the request after the second application is installed on the device.

23. The non-transitory computer readable storage medium of claim 21,

wherein the computer usable program code is configured to retrieve a copy of the first digital certificate that is used to authenticate an application package that includes the second application, wherein the copy of the first digital certificate is from a source that is different from the permissions record, and

wherein the computer usable program code configured to verify comprises computer usable program code configured to:

verify that the copy of the first digital certificate matches the first digital certificate stored in the permissions record.

24. The non-transitory computer readable storage medium of claim 20, wherein the permissions record includes a permissions authority digital signature that is digitally signed with a permissions authority signing key in a permissions authority digital certificate of a permissions authority, wherein the computer usable program code is configured to:

access the permissions authority digital signature in the permissions record; and

verify the permissions authority digital signature in the permissions record.

25. The non-transitory computer readable storage medium of claim 24, wherein the computer usable program code configured to verify that the second application has permission to access the data associated with the first application comprises computer usable program code configured to verify based, at least in part, on verification of the permissions authority digital signature.