Managing application access to certificates and keys

• US 9,386,451 B2
• Filed: 03/11/2013
• Issued: 07/05/2016
• Est. Priority Date: 01/29/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Ho, Alan Pak-Lun, Mueller, Michael J., Chin, Eugene
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US13/792,402
• Publication Number:
  US 20140215634A1
• Time in Patent Office: 1,212 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Plural modes of operation, each associated with a class attribute, may be established on a mobile device. The present application discloses a method of handling an application launch request, a computing device for carrying out the method and a computer readable medium for adapting a processor to carry out the method. The method includes receiving a launch request identifying an application that is to be launched, acquiring an identity for the application, acquiring a class for the application, labeling the application with the identity and the class and launching the application.

Claims

1. A method of handling attempted access to a store in a memory of a device, the method comprising:

receiving, at a computing device, from an application, a request for access to the store;

detecting an identity attribute for the application;

detecting a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the device;

basing a namespace of the application on the identity attribute for the application and the class attribute for the application;

determining that the application can access the store, wherein the determining that the application can access the store comprises determining that the store is in the namespace of the application; and

based on the determining, processing the request.

2. The method of claim 1 wherein the store comprises a certificate store.

3. The method of claim 1 wherein the store comprises a cryptographic key store.

4. The method of claim 1 wherein the processing comprises allowing the application access to the store.

5. The method of claim 4 wherein the processing comprises carrying out the request.

6. A computing device comprising:

a memory;

a processor adapted to;

receive, from an application, a request for access to a store;

detect an identity attribute for the application;

detect a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the computing device;

base a namespace of the application on the identity attribute for the application and the class attribute for the application;

determine that the application can access the store, wherein to determine that the application can access the store, the processor is adapted to determine that the store is in the namespace of the application; and

process the request based on the determining.

7. The computing device of claim 6 wherein the store comprises a certificate store.

8. The computing device of claim 6 wherein the store comprises a cryptographic key store.

9. The computing device of claim 6 wherein the processor is adapted to process the request by allowing the application access to the store.

10. The computing device of claim 9 wherein the processor is adapted to process the request by carrying out the request.

11. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause the processor to:

receive, from an application, a request for access to a store;

detect an identity attribute for the application;

detect a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the computing device;

base a namespace of the application on the identity attribute for the application and the class attribute for the application;

determine that the application can access the store, wherein to determine that the application can access the store, the instructions cause the processor to determine that the store is in the namespace of the application; and

process the request based on the determining.

12. The non-transitory computer-readable medium of claim 11 wherein the store comprises a certificate store.

13. The non-transitory computer-readable medium of claim 11 wherein the store comprises a cryptographic key store.

14. The non-transitory computer-readable medium of claim 11 wherein the instructions cause the processor to process the request by allowing the application access to the store.

15. The non-transitory computer-readable medium of claim 14 wherein the instructions cause the processor to process the request by carrying out the request.