Methods, systems and machine-readable media for providing security services
Systems, methods and machine-readable media for providing a security service are disclosed. The methods include receiving a modification of the application object code to allow the software application to transmit a request for the security service; retrieving the modified application object code corresponding to the software application from memory; receiving, via a processor, the request for the security service from the modified application object code; and providing, via the processor, the security service. The systems and machine-readable media performing operations according to the methods disclosed.
1. A method for providing a security service from a central application to another application on a computing device, the method comprising:
providing a first application configured to provide a security service on a computing device;
providing a second application on the computing device, the second application having original, post-compile object code;
modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement object code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.
2. The method of claim 1 , wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library introducing an additional load command, symbol replacement, pointer swizzling, and interposing.
3. The system method of claim 1 , further comprising:
generating, by the first application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications, channel, and
transmitting the security artifact from the first application to the second application in response to the requesting of the security service.
4. The method of claim 1 , wherein the original object code includes unsigned code.
5. The method of claim 1 , further comprising:
converting the original object code from a signed form to an unsigned form before the modifying; and
converting the replacement object code from an unsigned form to a signed form after the modifying.
6. The method of claim 1 , wherein the computing device is a mobile device.
7. The method of claim 1 , wherein the modifying includes modifying at least one of a programmatic interface, a class, an object, and a function.
8. The method of claim 1 , wherein the modifying of the original object code of the second application includes introducing the policy engine for ensuring compliance with multiple security policies.
9. The method of claim 1 , wherein the security policy is selected from the group consisting of data leakage prevention policy and an access control policy.
10. The method of claim 1 , further comprising:
transmitting from the first application the security policy to the second application for execution.
11. The method of claim 10 , wherein the security policy applies to at least one of a portion of the second application, a single software application, and a plurality of software applications.
12. The method of claim 1 , wherein the security policy is based on at least one factor selected from the group consisting of execution context, external events, explicit policy redefinition, and changing group and role membership.
13. The method of claim 1 , further comprising: introducing the policy engine from the second application into a third application by modifying object code of the third application.
14. The method of claim 1 , wherein data resulting from execution of the replacement object code is transmitted to the first application or the remote server.
15. The method of claim 1 , wherein the first application, responsive to the request for the security service, facilitates the security service if the software application is signed with a public key infrastructure (PKI) key.
16. The method of claim 15 , further comprising:
confirming, by the first application, that the second application and computing device have not been comprised; and
verifying a signature of the first application.
17. The method of claim 1 , wherein the security service provides a common key to the second application and a third application.
18. The method of claim 1 , wherein the first application is responsive to a registration request from the second application to establish application trust, the first application:
prompting a user to input an application registration passcode; and
generating a key to establish application trust using the application registration passcode to facilitate the security service provided by the first application to the second application.
19. The method of claim 18 , wherein the first application the key to the second application to allow the second application to transmit the request for the security service.
20. The method of claim 1 , further comprising:
generating an application data protection key, the application data protection key encrypted and decrypted by a corresponding data protection root key maintained with the first application.
21. The method of claim 20 , wherein the application data protection key performs at least one of encrypting and decrypting an object data protection key to facilitate data object transfer from a first software application to a second software application.
22. The method of claim 21 , further comprising:
generating a data-sharing key for encrypting the object data protection key prior to transferring the data object and the object data protection key from the first application to the second software application; or
generating a data-sharing key for decrypting the object data protection key after transferring the data object and the object data protection key from the first software application to the second software application.
23. The method of claim 21 , wherein at least one of the first application and the second application:
decrypts the object data protection key for the data object with the application data protection key of the first software application, and
encrypts the object data protection key for the data object with the application data protection key of the second software application.
24. The method of claim 1 , wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.
25. The method of claim 1 further comprising:
providing a third application on the computing device, the third application having original, post-compile object code; and
modifying the original object code of the third application to create replacement object code incorporating a policy engine configured to retrieve a second security policy and process a command that set the third application to an initial, unused state.
26. A machine-readable non-transitory storage medium embodying information indicative of instructions for causing one or more machines to perform the operations comprising:
providing a first application configured to provide a security service on a computing device;
providing a second application on the computing device, the second application having original, post-compile object code;
modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement object code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.
27. The medium of claim 26 , wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.
28. A computer system executing instructions in a computer program, the computer system comprising:
a processor; and
a memory operatively coupled with a processor, the processor executing program code from the memory comprising:
program code for providing a first application configured to provide a security service on a computing device;
program code for providing a second application on the computing device, the second application having original, post-compile object code;
program code for modifying, using at least one processor operatively coupled with a memory, the original object code of the second application to create replacement object code, the replacement object code configured for communication with the first application, the replacement code incorporating a policy engine configured to retrieve a security policy and process a command that sets the second application to an initial, unused state, wherein the security policy is retrieved from a server that is remote from the computing device.
29. The system of claim 28 , wherein the original object code is modified by at least one technique selected from the group consisting of introducing a dynamic library, introducing a static library, introducing an additional load command, symbol replacement, pointer swizzling, and interposing.
30. The system of claim 28 , further comprising:
generating, by the first application, a security artifact selected from the group consisting of authentication tokens, a key, a security credential, a single sign-on token, an identifier, a security policy, a security command, a security configuration, a session handle, a session token, and a secure communications channel, and
transmitting the security artifact from the first application to the second application in response to the requesting of the security service.
31. The system of claim 28 , wherein the policy engine of the replacement object code is configured to retrieve a security policy that applies to a single software application.
32. The system of claim 28 wherein the processor executes program code from the memory further comprising:
program code for providing a third application on the computing device, the third application having original, post-compile object code; and
program code for modifying the original object code of the third application to create replacement object code incorporating a policy engine configured to retrieve a second security policy and process a command that set the third application to an initial, unused state.