Secure inter-application communication with unmanaged applications using certificate enrollment
Disclosed are various approaches for secure inter-application communication with unmanaged applications using certificate enrollment. A certificate signing request can be received from an unmanaged application via an inter-application communication method supported by an operating system of a computing device, and an identity of the unmanaged application can be verified. The certificate signing request can be provided to a certifying authority, and a certificate can be received from the certifying authority. The certificate can be provided to the unmanaged application.
1. A system comprising:
a computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
receive a request from an unmanaged application for a certificate issued to the unmanaged application, wherein the certificate is scoped for inter-application communications involving the unmanaged application;
in response to receiving the request from the unmanaged application, verify an identity of the unmanaged application;
in response to verifying the identity of the unmanaged application, request a certifying authority for the certificate; and
upon receiving the certificate from the certifying authority, provide the certificate to the unmanaged application to enable the unmanaged application to authenticate with another application using the certificate to perform inter-application communications between the unmanaged application and the other application.
2. The system of claim 1 , wherein verifying the identity of the unmanaged application includes comparing data associated with a communication received from the unmanaged application, to data included in an allow list.
3. The system of claim 1 , wherein requesting the certifying authority for the certificate includes: signing a request for the certificate using a private key generated by the computing device and then transmitting the signed request to the certifying authority.
4. The system of claim 1 , wherein the certifying authority executes on the computing device, and wherein the machine-readable instructions stored in the memory, when executed by the processor, further cause the computing device to at least:
before requesting the certifying authority for the certificate, select the certifying authority based on the unmanaged application and the other application both executing on the computing device.
5. The system of claim 1 , wherein the certifying authority executes remotely from the computing device, and wherein the machine-readable instructions stored in the memory, when executed by the processor, further cause the computing device to at least:
before requesting the certifying authority for the certificate, select the certifying authority based on the unmanaged application and the other application executing on different computing devices.
6. The system of claim 1 , wherein the machine-readable instructions stored in the memory, when executed by the processor, further cause the computing device to at least:
after providing the certificate to the unmanaged application, query a certificate revocation service for certificates to revoke;
receive from the certificate revocation service in response to the query, metadata indicating to revoke the certificate; and
in response to receiving the metadata, revoke the certificate from being used by the unmanaged application to perform future inter-application communications.
7. The system of claim 1 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data with applications executing on the computing device.
8. The system of claim 1 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data with applications executing on a different computing device than the unmanaged application executes on.
9. The system of claim 1 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data of a type associated with the certificate, with the other application.
10. A method for enabling an unmanaged application to perform inter-application communications with another application, the method comprising:
receiving a request from the unmanaged application for a certificate issued to the unmanaged application, wherein the certificate is scoped for inter-application communications involving the unmanaged application;
in response to receiving the request from the unmanaged application, verifying, an identity of the unmanaged application;
in response to verifying the identity of the unmanaged application, requesting a certifying authority for the certificate; and
upon receiving the certificate from the certifying authority, providing the certificate to the unmanaged application to enable the unmanaged application to authenticate with the other application using the certificate to perform inter-application communications between the unmanaged application and the other application.
11. The method of claim 10 , wherein the certifying authority executes on the same computing device as the unmanaged application, the method further comprising:
before requesting the certifying authority for the certificate, selecting the certifying authority based on the unmanaged application and the other application executing on the same computing device.
12. The method of claim 10 , wherein the certifying authority executes remotely from a computing device on which the unmanaged application executes, the method further comprising:
before requesting the certifying authority for the certificate, selecting the certifying authority based on the unmanaged application and the other application executing on different computing devices.
13. The method of claim 10 , further comprising:
after providing the certificate to the unmanaged application, querying a certificate revocation service for certificates to revoke;
receiving from the certificate revocation service in response to the query, metadata indicating to revoke the certificate; and
in response to receiving the metadata, revoking the certificate from being used by the unmanaged application to perform future inter-application communications.
14. The method of claim 10 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data with applications executing on a different computing device than the unmanaged application executes on.
15. The method of claim 10 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data of a type associated with the certificate, with the other application.
16. A non-transitory, computer-readable medium comprising program instructions that, when executed by a processor of a computing device, cause the computing device to at least:
receive a request from an unmanaged application for a certificate issued to the unmanaged application, wherein the certificate is scoped for inter-application communications involving the unmanaged application;
in response to receiving the request from the unmanaged application, verify an identity of the unmanaged application;
in response to verifying the identity of the unmanaged application, request a certifying authority for the certificate; and
upon receiving the certificate from the certifying authority, provide the certificate to the unmanaged application to enable the unmanaged application to authenticate with another application using the certificate to perform inter-application communications between the unmanaged application and the other application.
17. The non-transitory, computer-readable medium of claim 16 , wherein verifying the identity of the unmanaged application includes comparing data associated with a communication received from the unmanaged application, to data included in an allow list.
18. The non-transitory, computer-readable medium of claim 16 , wherein requesting the certifying authority for the certificate includes: signing a request for the certificate using a private key generated by the computing device and then transmitting the signed request to the certifying authority.
19. The non-transitory, computer-readable medium of claim 16 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data with applications executing on the computing device.
20. The non-transitory, computer-readable medium of claim 16 , wherein based on the scope of the certificate, providing the certificate to the unmanaged application enables the unmanaged application to share data of a type associated with the certificate, with the other application.