System and method for creating secure applications

• US 9,135,418 B2
• Filed: 02/25/2014
• Issued: 09/15/2015
• Est. Priority Date: 10/10/2011
• Status: Active Grant

• Current Assignee: OpenPeak LLC (Ni, Wang & Massand, PLLC)
• Original Assignee: OpenPeak Inc.
• Inventors: Krzyzanowski, Paul, Gittleman, Daniel, Dare, Robert M, Wade, Christopher Michael, Tan, Danilo, Brown, John R.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/189,709
• Publication Number:
  US 20140317679A1
• Time in Patent Office: 567 Days
• Field of Search: 726/1, 726 22- 26, 726 30- 33, 713/161, 713/165, 713/167, 713/187, 705 57- 59
• US Class Current: 1/1
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A method for generating a secure application is described herein. The method can include the steps of obtaining a target application and decomposing the target application into original files that contain predictable instructions. One or more predictable instructions in the original files may be identified. In addition, the target application may be modified to create the secure application by binding one or more intercepts to the target application. These intercepts can enable the modification of the predictable instructions in accordance with one or more policies such that the behavior of the secure application is different from the original behavior of the target application. Modification of the target application may be conducted without access to the source code of the target application.

Claims

1. A method of operating a secure application, comprising:

receiving a request to activate the secure application through an input device, wherein the secure application was created from a target application having a first set of functions associated with a first application behavior and the secure application has a second set of functions that are imposed on the first set of functions and that are associated with a second application behavior;

in response to the receipt of the request, forcing the secure application to override the first application behavior with the second application behavior, wherein the second application behavior takes priority over the first application behavior; and

via a processing unit, performing the second application behavior.

2. The method according to claim 1, further comprising selectively permitting the secure application to engage in the first application behavior.

3. The method according to claim 2, wherein selectively permitting the secure application to engage in the first application behavior comprises selectively permitting the secure application to engage in the first application behavior if predetermined criteria associated with the operation of the secure application are met.

4. The method according to claim 3, wherein the predetermined criteria are based on a policy.

5. The method according to claim 1, wherein the secure application is encapsulated to prevent data sharing with a non-secure application.

6. The method according to claim 1, wherein the secure application is received from a secure application repository that offers a plurality of secure applications for download to computing devices.

7. The method according to claim 1, wherein the second application behavior is the enforcement of a password or personal identification number (PIN) such that a user is required to enter the password or PIN before being granted access to the secure application.

8. The method according to claim 7, further comprising applying a grace period to the secure application such that the requirement for the user to provide the password or PIN is selectively waived.

9. A method of generating a secure application, comprising:

via a processor;

receiving a target application that is designed to interact with an operating system;

configuring the target application by imposing one or more intercepts on the target application, wherein the imposition of the intercepts converts the target application into a secure application that maintains the interaction with the operating system; and

repackaging the secure application such that the intercepts are integrated with the secure application and are inseparable from the secure application.

10. The method according to claim 9, wherein at least some of the imposed intercepts are associated with one or more policies that affect the behavior of the secure application and the behavior of the secure application is modified from the original behavior of the target application.

11. The method according to claim 9, wherein configuring the target application by imposing one or more intercepts comprises replacing references of the target application with references to a library or inserting secure references in the target application to replace non-secure references of the target application.

12. The method according to claim 9, wherein the intercepts imposed on the target application to generate the secure application are selected from default intercepts to be applied to predetermined target applications on a group basis.

13. The method according to claim 9, wherein configuring the target application is conducted without access to the source code of the target application.

14. The method according to claim 9, further comprising publishing the repacked secure application in a secure application repository.

15. The method according to claim 9, wherein the conversion of the target application to the secure application maintains the availability of the application programming interfaces (API) associated with the operating system such that a developer of the target application is enabled to make use of the APIs of the operating system.

16. A method of remotely managing a secure application, comprising:

selecting a secure application installed on a computing device, wherein the secure application was created from a target application by imposing one or more intercepts on the target application; and

remotely managing the secure application by enforcing one or more policies against the secure application installed on the computing device such that the behavior of the secure application is modified from and overrides the original behavior of the target application.

17. The method according to claim 16, wherein remotely managing the secure application by enforcing the policies comprises remotely managing the secure application by enforcing the policies against the secure application on an individual or group basis.

18. The method according to claim 16, wherein remotely managing the secure application by enforcing the policies comprises remotely managing the secure application by enforcing the following policies:

preventing operation of the secure application during a predetermined time;

preventing operation of the secure application if the computing device is located outside a predetermined location;

preventing operation of the secure application if the operation of the secure application would be in non-compliance of an imposed licensing model;

uninstalling the secure application;

or

deleting data associated with the secure application.

19. The method according to claim 16, wherein the secure application is part of a secure partition of the computing device that prevents non-secure applications from communicating with the secure application.

20. The method according to claim 16, wherein remotely managing the secure application does not interfere with personal data belonging to a user of the computing device, wherein the personal data is installed on the computing device.