Managing application access to certificates and keys

• US 9,940,447 B2
• Filed: 07/04/2016
• Issued: 04/10/2018
• Est. Priority Date: 01/29/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Ho, Alan Pak-Lun, Mueller, Michael J., Chin, Eugene
• Primary Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US15/201,556
• Publication Number:
  US 20160314285A1
• Time in Patent Office: 645 Days
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Plural modes of operation, each associated with a class attribute, may be established on a mobile device. The present application discloses a method of handling an application launch request, a computing device for carrying out the method and a computer readable medium for adapting a processor to carry out the method. The method includes receiving a launch request identifying an application that is to be launched, acquiring an identity for the application, acquiring a class for the application, labeling the application with the identity and the class and launching the application.

Claims

1. A method of handling an application launch request at a computing device, the method comprising:

receiving a launch request for an application that is to be launched;

acquiring an identity attribute for the application;

labeling the application with the identity attribute;

acquiring a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the computing device;

labeling the application with the class attribute;

launching the application;

receiving, from the launched application, a request to create a store;

detecting the identity attribute for the application;

detecting the class attribute for the application;

creating one or more conditions to access the store, the creating based on the identity attribute and the class attribute; and

creating the store with the one or more conditions.

2. The method of claim 1 wherein the acquiring the identity attribute for the application comprises acquiring the identity attribute for the application from the launch request.

3. The method of claim 1 wherein the acquiring the class attribute for the application comprises acquiring the class attribute for the application from the launch request.

4. The method of claim 1 wherein the store comprises a certificate store.

5. The method of claim 1 wherein the store comprises a cryptographic key store.

6. The method of claim 1 wherein the one or more conditions comprise an indication of an identity attribute of an application with read access.

7. The method of claim 1 wherein the one or more conditions comprise an indication of an identity attribute of an application with write access.

8. A computing device comprising:

a memory; and

a processor adapted to;

receive a launch request identifying an application that is to be launched;

acquire an identity attribute for the application;

label the application with the identity attribute;

acquire a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the computing device;

label the application with the class attribute;

launch the application;

receive, from the launched application, a request to create a store;

detect the identity attribute for the application;

detect the class attribute for the application;

create one or more conditions to access the store, the creating based on

the identity attribute and the class attribute; and

create the store with the one or more conditions.

9. The computing device of claim 8 wherein the processor is adapted to acquire the identity attribute for the application from the launch request.

10. The computing device of claim 8 wherein the processor adapted to acquire the class attribute from the launch request.

11. The computing device of claim 8 wherein the store comprises a certificate store.

12. The computing device of claim 8 wherein the store comprises a cryptographic key store.

13. The computing device of claim 8 wherein the one or more conditions comprise an indication of an identity attribute of an application with read access.

14. The computing device of claim 8 wherein the one or more conditions comprise an indication of an identity attribute of an application with write access.

15. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause the processor to:

receive a launch request identifying an application that is to be launched;

acquire an identity attribute for the application;

label the application with the identity attribute;

acquire a class attribute for the application, wherein the class attribute for the application is associated with a mode of operation of the computing device;

label the application with the class attribute;

launch the application;

receive, from the launched application, a request to create a store;

detect the identity attribute for the launched application;

detect the class attribute for the launched application;

create one or more conditions to access the store, the creating based on the identity attribute and the class attribute; and

create the store with the one or more conditions.

16. The non-transitory computer-readable medium of claim 15 wherein the instructions cause the processor to acquire the identity attribute for the application from the launch request.

17. The non-transitory computer-readable medium of claim 15 wherein the instructions cause the processor to acquire the class attribute for the application from the launch request.

18. The non-transitory computer-readable medium of claim 15 wherein the store comprises a certificate store.

19. The non-transitory computer-readable medium of claim 15 wherein the store comprises a cryptographic key store.

20. The non-transitory computer-readable medium of claim 15 wherein the one or more conditions comprise an indication of an identity attribute of an application with read access.

21. The non-transitory computer-readable medium of claim 15 wherein the one or more conditions comprise an indication of an identity attribute of an application with write access.