Secure execution of enterprise applications on mobile devices

• US 9,183,380 B2
• Filed: 10/10/2012
• Issued: 11/10/2015
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed, DeBenning, Thomas H., Datoo, Ahmed, Andre, Olivier, Abdullah, Shafaq
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US13/649,024
• Publication Number:
  US 20140007222A1
• Time in Patent Office: 1,126 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/029 : Location-based management or tracking services

Abstract

A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user'"'"'s position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.

Claims

1. A method comprising:

installing a secure launcher on a mobile device, the secure launcher being separate from a general launcher included within an operating system of the mobile device, the general launcher providing functionality for launching non-enterprise applications installed on the mobile device;

installing an enterprise application on the mobile device, the enterprise application including functionality for accessing an enterprise system;

modifying the enterprise application by replacing a request for the general launcher included within the operating system of the mobile device with a request for the secure launcher, the request for the secure launcher causing the enterprise application to be launched using the secure launcher, wherein the secure launcher enforces an authentication policy in which a user must enter valid authentication information when launching the enterprise application;

installing, on the mobile device, a secure virtual machine that is separate from a virtual machine of the operating system of the mobile device; and

configuring the mobile device such that the enterprise application, but none of the non-enterprise applications, runs within the secure virtual machine.

2. The method of claim 1, wherein the secure virtual machine includes functionality for enforcing an enterprise data encryption policy in which data stored on the mobile device by the enterprise application is encrypted.

3. The method of claim 1, comprising:

installing on the mobile device executable code that is configured to create a secure container on the mobile device and to use the secure container to store documents output by the enterprise application, the secure container being separate from a storage space used by the non-enterprise applications to store data.

4. The method of claim 1, comprising:

installing on the mobile device executable code that is configured to create an application tunnel for enabling the enterprise application to securely communicate over a network with the enterprise system, the application tunnel being specific to the enterprise application.

5. The method of claim 1, comprising:

modifying the enterprise application using an application modification utility, before installation of the enterprise application on the mobile device, to configure the enterprise application to use an encryption library to encrypt data stored on the mobile device.

6. A mobile device comprising a processor and a memory, the mobile device having installed thereon:

a plurality of enterprise applications configured to communicate over a network with an enterprise system; and

a secure launcher associated with a user interface for launching at least one enterprise application of the plurality of enterprise applications on the mobile device, the secure launcher being separate from a general launcher used to launch non-enterprise applications on the mobile device, the general launcher being a part of an operating system of the mobile device and the secure launcher being separate from the operating system; and

a secure virtual machine separate from a virtual machine of the operating system, wherein the mobile device is configured such that the at least one enterprise application is executed by the secure virtual machine and such that the non-enterprise applications are executed by the operating system'"'"'s virtual machine,

wherein at least one enterprise application of the plurality of enterprise applications is modified by replacing a request for the general launcher used to launch non-enterprise applications on the mobile device with a request for the secure launcher, the request for the secure launcher causing the at least one enterprise application to be launched using the secure launcher,

wherein the secure launcher requests authentication information from a user of the mobile device when the user initiates a launch of the at least one enterprise application, and wherein the secure launcher is configured to block execution of the at least one enterprise application when the user fails to provide valid authentication information.

7. The mobile device of claim 6, wherein the user interface of the secure launcher includes a persistent display element that is displayed across a plurality of screens of the mobile device, the persistent display element enabling a user to selectively expose an arrangement of enterprise application icons each respectively associated with an enterprise application of the plurality of enterprise applications, each enterprise application icon of the arrangement of enterprise application icons being selectable to initiate launching of a corresponding enterprise application, the arrangement of enterprise application icons being separate from an arrangement of application icons for launching non-enterprise applications.

8. The mobile device of claim 7, wherein the arrangement of application icons comprises a rotatable wheel display element that is rotatable via a swipe operation to expose and conceal at least some enterprise application icons of the arrangement of enterprise application icons that are positioned along the wheel display element.

9. The mobile device of claim 6, wherein the secure virtual machine comprises functionality for causing data stored in the memory of the mobile device by the at least one enterprise application to be encrypted.

10. The mobile device of claim 6, wherein the secure launcher is configured to launch the secure virtual machine, and to cause the at least one enterprise application selected by a user to be executed by the secure virtual machine.

11. The mobile device of claim 6, wherein the secure launcher is configured to perform a selective wipe operation in which data associated with the at least one enterprise application is deleted from the mobile device without deleting data associated with the non-enterprise applications.

12. The mobile device of claim 6, wherein the mobile device has installed thereon an enterprise agent component that communicates with the enterprise system, the enterprise agent component including executable code for creating application tunnels for enabling the at least one enterprise application to communicate over the network with the enterprise system, each application tunnel being specific to a particular enterprise application of the plurality of enterprise applications.

13. The mobile device of claim 12, wherein the enterprise agent component is configured to collect, and to report to a mobile device management component of the enterprise system, information that identifies the non-enterprise applications installed on the mobile device.

14. The mobile device of claim 11, the mobile device having installed thereon executable code configured to create a secure container on the mobile device and to use the secure container to store documents output by the at least one enterprise application, the secure container being separate from a storage space used by the non-enterprise applications to store data.

20. The mobile device of claim 11, wherein the selective wipe operation is performed in response to the mobile device receiving a threshold number of consecutive invalid entries of the authentication information.

15. A method of providing a secure environment for execution of enterprise applications on a mobile device that includes non-enterprise applications installed thereon, the method comprising:

installing a secure virtual machine on the mobile device, the secure virtual machine being separate from a virtual machine included within an operating system of the mobile device;

installing a secure launcher on the mobile device, the secure launcher being separate from a general launcher included within the operating system of the mobile device, wherein the secure launcher enforces an authentication policy in which a user of the mobile device must enter valid authentication information when launching an enterprise application installed on the mobile device;

configuring the enterprise application to use the secure launcher by replacing a request for the general launcher with a request for the secure launcher; and

configuring the enterprise application, but none of the non-enterprise applications, to run in the secure virtual machine, whereby the non-enterprise applications use the virtual machine included within the operating system;

wherein the secure virtual machine includes functionality for implementing an encryption policy in which data stored on the mobile device by the at least one enterprise application is encrypted.

16. The method of claim 15, wherein the secure virtual machine includes functionality for creating an application tunnel between the mobile device and an enterprise system, and for using the application tunnel for communications between the enterprise application and the enterprise system.

17. The method of claim 15, comprising:

including a reference in the at least one enterprise application to the secure virtual machine.

18. The method of claim 15, wherein the secure virtual machine comprises a special code library comprising code for encrypting and decrypting data.

19. The method of claim 15, wherein the secure virtual machine uses a set of code libraries in place of a set of corresponding code libraries of the operating system.

21. The method of claim 15, comprising:

installing on the mobile device executable code configured to create a secure container on the mobile device and to use the secure container to store documents output by the enterprise application, the secure container being separate from a storage space used by the non-enterprise applications to store data.