Establishing trust between containers

1. A method comprising:

registering, by a device, a first containerized application on the device with an access server, wherein the registering the first containerized application with the access server comprises:

generating a first public/private key and storing the first public/private key in a first keystore of the first containerized application on the device;

storing an intent encryption key (IEK) from the access server in a second keystore of the first containerized application on the device, wherein the second keystore of the first containerized application is different from the first keystore of the first containerized application;

encrypting the second keystore of the first containerized application using a public key of the generated first public/private key,

wherein the first keystore and the second keystore are accessible only by the first containerized application;

registering, by the device, a second containerized application on the device with the access server;

verifying that the first containerized application and the second containerized application are configured to exchange data; and

exchanging data between the first containerized application and the second containerized application registered with the access server.

2. The method according to claim 1 , further comprising receiving an intent encryption key (IEK), a root key and a session token from the access server.

3. The method according to claim 2 , wherein the registering the first containerized application with the access server further comprises:

creating a shared application list and adding identification information of the first containerized application to the shared application list; and

encrypting the shared application list.

4. The method according to claim 3 , wherein the shared application list is encrypted using the root key from the access server.

5. The method according to claim 3 , wherein the registering the second containerized application with the access server comprises:

generating a second public/private key and storing the second public/private key in a first keystore of the second containerized application;

storing the IEK from the access server in a second keystore of the second containerized application;

encrypting the second keystore of the second containerized application using a second public key of the generated second public/private key; and

decrypting the shared application list and adding identification information of the second containerized application to the shared application list.

6. The method according to claim 3 , wherein the access server is a Mobile Security Access Server (MSAS).

7. The method according to claim 3 , wherein the identification information of the first containerized application comprises a signature and a package name of the first containerized application.

8. The method according to claim 5 , wherein the identification information of the second containerized application comprises a signature and a package name of the second containerized application.

9. The method according to claim 5 , wherein verifying that the first containerized application and the second containerized application are configured to exchange data comprises determining, by the first containerized application, that a signature and package name of the second containerized application is on the shared application list.

10. The method according to claim 1 , wherein exchanging data between the first containerized application and the second containerized application comprises:

sending, by the first containerized application, an encrypted intent to the second containerized application; and

decrypting, by the second containerized application, the encrypted intent, using the IEK.

11. The method according to claim 10 , wherein the encrypted intent is an intent encrypted with a root key and a session token.

12. The method according to claim 11 , wherein the intent comprises a message package that indicates a description for an action or a topic.

13. The method according to claim 5 , wherein the shared application list is decrypted using the root key.

14. The method according to claim 5 , further comprising:

receiving, from the access server, an updated IEK;

authenticating the first containerized application with the access server; and

receiving, by the first containerized application, the updated IEK.

15. A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

registering, by a device, a first containerized application on the device with an access server, wherein the registering the first containerized application with the access server comprises:

generating a first public/private key and storing the first public/private key in a first keystore of the first containerized application on the device;

storing an intent encryption key (IEK) from the access server in a second keystore of the first containerized application on the device, wherein the second keystore of the first containerized application is different from the first keystore of the first containerized application;

encrypting the second keystore of the first containerized application using a public key of the generated first public/private key,

wherein the first keystore and the second keystore are accessible only by the first containerized application;

registering, by the device, a second containerized application on the device with the access server;

verifying that the first containerized application and the second containerized application are configured to exchange data; and

exchanging data between the first containerized application and the second containerized application registered with the access server.

16. The non-transitory computer-readable storage medium according to claim 15 , further comprising receiving an intent encryption key (IEK), a root key and a session token from the access server.

17. The non-transitory computer-readable storage medium according to claim 16 , wherein the registering the first containerized application with the access server further comprises:

creating a shared application list and adding identification information of the first containerized application to the shared application list; and

encrypting the shared application list.

18. The non-transitory computer-readable storage medium according to claim 17 , wherein the shared application list is encrypted using the root key from the access server.

19. The non-transitory computer-readable storage medium according to claim 17 , wherein the registering the second containerized application with the access server comprises:

generating a second public/private key and storing the second public/private key in a first keystore of the second containerized application;

storing the IEK from the access server in a second keystore of the second containerized application;

encrypting the second keystore of the second containerized application using a second public key of the generated second public/private key; and

decrypting the shared application list and adding identification information of the second containerized application to the shared application list.

20. A system comprising:

a memory; and

one or more processors coupled to the memory and configured to:

register a first containerized application on a device with an access server, wherein the registering the first containerized application with the access server comprises:

generate a first public/private key and storing the first public/private key in a first keystore of the first containerized application on the device;

store an intent encryption key (IEK) from the access server in a second keystore of the first containerized application on the device, wherein the second keystore of the first containerized application is different from the first keystore of the first containerized application;

encrypt the second keystore of the first containerized application using a public key of the generated first public/private key,

wherein the first keystore and the second keystore are accessible only by the first containerized application;

register a second containerized application on the device with the access server;

verify that the first containerized application and the second containerized application are configured to exchange data; and

exchange data between the first containerized application and the second containerized application registered with the access server.