Provisioning an app on a device and implementing a keystore
A keystore is installed on a mobile app where the keystore is created and provisioned on a server, such as an app wrapping server, under the control of an enterprise. A generic (non-provisioned) wrapped app is installed on a device. The app prompts the user to enter a passphrase. When the user does this, an app keystore is created. It has a user section and a table of contents. The keystore files are hashed, creating “first” keystore hash values. The first keystore hash values are stored in the TOC. The TOC is then hashed, creating a TOC hash value. The passphrase entered by the user is then combined with the TOC hash value. This creates a “first” master passphrase for the keystore. The keystore is then transmitted to the device where it is installed in the generic (non-provisioned) wrapped app.
1. A method of installing a keystore in an app on a mobile device, the method comprising:
prompting a user to select a passphrase for the app;
creating an app keystore with a user section and a table of contents (“TOC”) on an app protection server;
hashing keystore files, thereby creating a first keystore files hash value on the app protection server;
storing first keystore files hash values in the TOC;
hashing the TOC, thereby creating a TOC hash value;
combining the passphrase with the TOC hash value;
creating a first master passphrase for the keystore created on the app protection server from the combined passphrase and the TOC hash value;
linking subsequent passphrase updates to a chain of trust including steps of said hashing of the TOC and said hashing of keystore files;
transmitting the keystore from the app protection server to the app on a device, wherein an attack surface of the app is reduced by having creation of the keystore on the app protection server; and
installing the keystore in the app.
2. A method as recited in claim 1 further comprising:
embedding user and device specific policy files into the user section of the app keystore on the app protection server.
3. A method as recited in claim 1 further comprising:
upon execution of the app on the device, hashing a user section of the TOC in the keystore creating a user section TOC hash value, wherein said hashing is done by the app.
4. A method as recited in claim 1 further comprising:
combining the passphrase with user section TOC hash value to create a second master passphrase.
5. A method as recited in claim 1 further comprising:
hashing the keystore, thereby creating a second keystore files hash value.
6. A method as recited in claim 5 further comprising:
comparing the second keystore files hash value with the first keystore files hash value.
7. A method as recited in claim 1 wherein a cleartext version of the TOC is maintained.
8. A method as recited in claim 1 further comprising:
initiating a challenge and response protocol.