Systems and methods to secure platform application services between platform client applications and platform services
Systems and methods to secure platform application services between platform client applications and platform services in an information handling system. The information handling system may include a client application that may transmit an application service request over an application services inter-process communication (IPC) channel. The information handling system may also include a server services application that may receive the application service request from the client application via the application services IPC channel. The server services application may query a publisher name of the client application and authenticate the client application based on the publisher name of the client application and a list of trusted client application publishers maintained by the server services application. When the client application is authenticated, the server services application may process the first application service request.
1. An information handling system, comprising:
a non-transitory memory media storing instructions;
a processor in communication with the non-transitory memory media to execute the instructions to perform operations comprising:
transmit, by a first client application, a first application service request over an application services inter-process communication (IPC) channel;
receive, by a server services application, the first application service request from the first client application via the application services IPC channel;
query, by the server services application, a publisher name of the first client application;
authenticate, by the server services application, the first client application, including:
determining that both i) a publisher name of a publisher of the first client application corresponds to a publisher identification in a list of trusted client applications maintained by the server services application and ii) an application name of the first client application corresponds to a particular name in a list of trusted client application names maintained by the server services application, the list of trusted application names associated with the publisher name of the first client application; and
when the first client application is authenticated, process, by the server services application, the first application service request.
2. The information handling system of claim 1 , the information handling system further comprising:
a network; and
an identity management system coupled to the network, wherein the server services application further configured to:
when the server services application starts:
request a master list of trusted client application publishers from the identity management system via the network;
receive the master list of trusted client application publishers from the identity management system;
verify integrity of the master list of trusted client application publishers; and
when the integrity of the master list of trusted client application publishers has been verified, save the master list of trusted client application publishers to the list of trusted client application publishers maintained by the server services application.
3. The information handling system of claim 2 , wherein the server services application further configured to:
when the verification of the integrity of the master list of trusted client application publishers fails:
determine whether a previous verified list of trusted client application publishers maintained by the server services application is available; and
when the previous verified list of trusted client application publishers is available, save the previous verified list of trusted client application publishers to the list of trusted client application publishers maintained by the server services application.
4. The information handling system of claim 2 , wherein the master list of trusted client application publishers is asymmetrically signed and the integrity of the master list of trusted client application publishers is verified using a public key within the server services application.
5. The information handling system of claim 1 , the information handling system further comprising:
a network; and
an identity management system coupled to the network, wherein the server services application further configured to:
determine whether a master list of trusted client application publishers at the identity management system has been updated; and
when the master list of trusted client application publishers has been updated:
request the updated master list of trusted client application publishers from the identity management system via the network;
receive the updated master list of trusted client application publishers from the identity management system;
verify integrity of the updated master list of trusted client application publishers; and
when the integrity of the updated master list of trusted client application publishers has been verified, update the list of trusted client application publishers maintained by the server services application with the master list of trusted client application publishers.
6. The information handling system of claim 1 , wherein the list of trusted client application publishers comprises at least one publisher identification.
7. The information handling system of claim 1 , wherein the server services application further comprises an application services constructor, and wherein the application services constructor performs the query of the publisher name of the first client application.
8. The information handling system of claim 1 , wherein the server services application comprises a universal windows platform (UWP) application, and wherein the first client application comprises a UWP application.
9. The information handling system of claim 1 , wherein the first application service request comprises one of:
a request to utilize a device specific application programming interfaces (APIs) of a device of the information handling system;
a request to access device capabilities of a device of the information handling system; and
a request to communicate with a second client application of the information handling system.
10. The information handling system of claim 9 , wherein the second client application is a 32-bit version of a windows (Win32) application.
11. The information handling system of claim 1 , wherein the server services application further configured to:
when the authentication of the first client application fails, the first application service request is denied.
12. The information handling system of claim 1 , the operations further comprising:
transmit, by a second client application, a second application service request over the IPC channel;
receive, by the server services application, the second application service request from the second client application via the application services IPC channel;
query, by the server services application, a publisher name of the second client application, wherein the publisher name of the first client application is the same as the publisher name of the second client application;
determine, by the server services application, that an application name of the second client application does not correspond to a specific name in the list of trusted client application names maintained by the server services application; and
in response to the determining that the application name of the second client application does not correspond to a specific name in the list of trusted client application names, denying, by the server services application, the second application service request.
13. A method, comprising:
transmitting, by a first client application of an information handling system, a first application service request over an application services inter-process communication (IPC) channel;
receiving, by a server services application of the information handling system, the first application service request from the first client application via the application services IPC channel;
querying, by the server services application, a publisher name of the first client application;
authenticating, by the server services application, the first client application including:
determining that both i) a publisher name of a publisher of the first client application corresponds to a publisher identification in a list of trusted client applications maintained by the server services application and ii) an application name of the first client application corresponds to a particular name in a list of trusted client application names maintained by the server services application, the list of trusted application names associated with the publisher name of the first client application; and
when the first client application is authenticated, processing, by the server services application, the first application service request.
14. The method of claim 13 , the method further comprising:
when the server services application is starting:
requesting a master list of trusted client application publishers from an identity management system coupled to the information handling system by a network;
receiving the master list of trusted client application publishers from the identity management system;
verifying integrity of the master list of trusted client application publishers; and
when the integrity of the master list of trusted client application publishers has been verified, saving the master list of trusted client application publishers to the list of trusted client application publishers maintained by the server services application.
15. The method of claim 14 , the method further comprising:
when the verification of the integrity of the master list of trusted client application publishers fails:
determining whether a previous verified list of trusted client application publishers maintained by the server services application is available; and
when the previous verified list of trusted client application publishers is available, saving the previous verified list of trusted client application publishers to the list of trusted client application publishers maintained by the server services application.
16. The method of claim 13 , the method further comprising:
determining, by the server services application, whether a master list of trusted client application publishers at an identity management system has been updated, wherein the identity management system coupled to the information handling system by a network; and
when the master list of trusted client application publishers has been updated:
requesting the updated master list of trusted client application publishers from the identity management system via the network;
receiving the updated master list of trusted client application publishers from the identity management system;
verifying integrity of the updated master list of trusted client application publishers; and
when the integrity of the updated master list of trusted client application publishers has been verified, updating the list of trusted client application publishers maintained by the server services application with the master list of trusted client application publishers, and
wherein the master list of trusted client application publishers is asymmetrically signed and the integrity of the master list of trusted client application publishers is verified using a public key within the server services application.
17. The method of claim 13 , wherein the server services application comprises a universal windows platform (UWP) application, and wherein the first client application comprises a UWP application.
18. The method of claim 13 , wherein the first application service request comprises one of:
a request to utilize a device specific application programming interfaces (APIs) of a device of the information handling system;
a request to access device capabilities of a device of the information handling system; and
a request to communicate with a second client application of the information handling system, and wherein the second client application is a 32-bit version of a windows (Win32) application.