Management framework for applications using passcode-based encryption
Systems herein allow an email application to manage passcode-based encryption (“PBE”) operations on an operating system (OS) that deletes a user passcode from memory. The email application can utilize a lock safe component that implements OS lifecycle classes. The lock safe component can receive an OS event, such as an activity, fragment, service, or SyncManager event. Before causing the email application to handle the OS event, the lock safe component can check whether the user passcode exists in memory. If it does not, the lock safe component can queue services for later operation once the passcode exists. Likewise, the lock safe component can cause the email application to prompt for the user passcode before a user interface (“UI”) performs activities or fragments, and pass state information to the email application for performing the activities or fragments.
1. A system for managing an email application executing on a mobile device that utilizes passcode-based encryption, comprising:
a non-transitory, computer-readable medium that contains instructions;
a memory that stores a local encrypted database; and
a processor that executes the instructions to perform stages comprising:
executing an email application that utilizes the local encrypted database that is unlocked by a key generated based on a user passcode, wherein the user passcode is separate from a user device login;
storing the user passcode in the memory;
receiving, at a lock safe component, an operating system (OS) event relating to an activity or service to execute at the email application, wherein the lock safe component implements at least one class of the OS and the OS calls a method of the implemented class to send the OS event;
determining, by the lock safe component, that the user passcode no longer exists in the memory; and
preventing, by the lock safe component, the email application from accessing the local encrypted database until the user passcode exists in the memory.
2. The system of claim 1 , the stages further comprising:
maintaining a queue of OS events for execution at a later time when the user passcode exists in the memory.
3. The system of claim 2 , wherein the lock safe component includes lock safe versions of broadcast receivers and services of the OS, wherein the lock safe versions intercept a callback to the email application and schedules the OS event in the queue.
4. The system of claim 1 , wherein the lock safe component implements an activity or fragment class of the OS that checks whether the user passcode is present before calling an alternate version of an OS lifecycle method.
5. The system of claim 4 , wherein the lock safe component declares final a protected lifecycle method of the activity or fragment class.
6. The system of claim 1 , wherein the lock safe component causes the email application to prompt for the user passcode and forwards state information to the email application, wherein the email application presents a user interface as determined by the state information after the user passcode is received.
7. The system of claim 1 , the stages further comprising:
monitoring whether the email application has lost access to the user passcode;
based on detecting access is lost, disabling a synchronization service in the email application that receives sync messages from the OS;
indicating to the OS to not restart the synchronization service;
storing a first sync message in a queue, the first sync message being received by the lock safe component; and
in response to accessing the user passcode, launching the first sync message from the queue and indicating to the OS to restart the service.
8. A method for managing an email application executing on a mobile device that utilizes passcode-based encryption, comprising:
receiving a user passcode for generating a key to decrypt a local encrypted database, wherein the user passcode is separate from a user device login;
storing the user passcode in a memory;
receiving, at a lock safe component, an operating system (OS) event relating to an activity or service to execute at the email application, wherein the lock safe component implements at least one class of the OS and the OS calls a method of the implemented class to send the OS event;
determining, by the lock safe component, that the user passcode no longer exists in the memory; and
preventing, by the lock safe component, the email application from relying on data from the local encrypted database in response to the OS event until the user passcode exists in the memory.
9. The method of claim 8 , further comprising:
maintaining a queue of OS events for execution at a later time when the user passcode exists in the memory.
10. The method of claim 9 , wherein the lock safe component includes lock safe versions of broadcast receivers and services of the OS, wherein the lock safe versions intercept a callback to the email application and schedule the OS event in the queue.
11. The method of claim 8 , wherein the lock safe component implements an activity or fragment class of the OS that checks whether the user passcode is present before calling an alternate version of an OS lifecycle method.
12. The method of claim 11 , wherein the lock safe component declares final a protected lifecycle method of the activity or fragment class.
13. The method of claim 8 , wherein the lock safe component causes the email application to prompt for the user passcode and forwards state information to the email application, wherein the email application presents a user interface as determined by the state information after the user passcode is received.
14. The method of claim 8 , further comprising:
monitoring whether the email application has lost access to the user passcode;
based on detecting access is lost, disabling a synchronization service in the email application receives synch messages from the OS;
indicating to the OS to not restart the synchronization service;
storing a first synch message in a queue, the first synch message being received by the lock safe component; and
in response to accessing the user passcode, launching the first synch message from the queue and indicating to the OS to restart the service.
15. A non-transitory, computer-readable medium containing instructions for managing an email application executing on a mobile device that utilizes passcode-based encryption, the instructions causing a processor to execute stages comprising:
receiving a user passcode for generating a key to decrypt a local encrypted database, wherein the user passcode is separate from a user device login;
storing the user passcode in a memory;
receiving, at a lock safe component, an operating system (OS) event relating to an activity or service to execute at the email application, wherein the lock safe component implements at least one class of the OS and the OS calls a method of the implemented class to send the OS event;
determining, by the lock safe component, that the user passcode no longer exists in the memory; and
preventing, by the lock safe component, the email application from relying on data from the local encrypted database in response to the OS event until the user passcode exists in the memory.
16. The non-transitory, computer-readable medium of claim 15 , the stages further comprising:
maintaining a queue of OS events for execution at a later time when the user passcode exists in the memory.
17. The non-transitory, computer-readable medium of claim 16 , wherein the lock safe component includes lock safe versions of broadcast receivers and services of the OS, wherein the lock safe versions intercept a callback to the email application and schedule the OS event in the queue.
18. The non-transitory, computer-readable medium of claim 15 , wherein the lock safe component implements an activity or fragment class of the OS that checks whether the user passcode is present before calling an alternate version of an OS lifecycle method, wherein the lock safe component declares final a protected lifecycle method of the activity or fragment class.
19. The non-transitory, computer-readable medium of claim 15 , wherein the lock safe component causes the email application to prompt for the user passcode and forwards state information to the email application, wherein the email application presents a user interface as determined by the state information after the user passcode is received.
20. The non-transitory, computer-readable medium of claim 15 , the stages further comprising:
monitoring whether the email application has lost access to the user passcode;
based on detecting access is lost, disabling a synchronization service in the email application receives synch messages from the OS;
indicating to the OS to not restart the synchronization service;
storing a first synch message in a queue, the first synch message being received by the lock safe component; and
in response to accessing the user passcode, launching the first synch message from the queue and indicating to the OS to restart the service.