Application Wrapper Intercepting API Calls for Enterprise Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for application wrapping, particularly in enterprise environments, are limited in their ability to support commercially developed mobile applications without developer involvement, lacking effective license management and security policy enforcement.
Innovation Solution
A method involving the interposition of a wrapper on pre-built applications, which decompiles, searches for string patterns, and replaces them to intercept system events or API calls, allowing for additional functionality to be added without modifying the original application code, enabling control over distribution, usage, and security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If application wrapping is applied to pre-built commercial applications without developer involvement, then ease of deployment and license management is improved, but the ability to modify application behavior and enforce security policies is limited
Solution Approach 1:
The patent introduces a wrapper as an intermediary layer between the commercial application and the operating system. This wrapper intercepts system calls and API calls, allowing security policies and license management to be enforced without modifying the original application code. The wrapper acts as a mediator that can control and monitor application behavior while maintaining the application's original functionality.
Solution Approach 2:
The patent segments the application control mechanism by separating the original application code from the security enforcement layer. The wrapper is deployed as a separate component that can be independently configured and managed, allowing enterprise administrators to enforce policies without requiring changes to the underlying commercial application.
2Reliability
If decompiling and string pattern replacement is used to interpose a wrapper, then additional security functionality is added, but application complexity and processing overhead increase
Solution Approach 1:
The patent performs decompiling and string pattern replacement in advance during the wrapper deployment phase, before the application runs in production. The wrapper is pre-configured with the necessary security policies and interceptors, so that during runtime, the additional processing overhead is minimized to simple call interception and policy enforcement rather than complex analysis.
3Reliability
If a wrapper layer is added to control application operation, then security policy enforcement is improved, but the original application performance and execution speed may deteriorate
Solution Approach 1:
The wrapper implements a feedback mechanism where system calls are intercepted, checked against security policies, and then either allowed to proceed or blocked. This feedback loop enables security enforcement without requiring complete re-implementation of application logic, maintaining reasonable performance by only processing necessary security checks.
Data Source
AI summary
A method of administering a computing system, including a plurality of computing devices. The method includes selecting an application for download to a computing device, prior to downloading the application, decompiling the application, searching for string patterns in the decompiled application, replacing the string patterns in the decompiled application with another string pattern, the another string pattern being configured to intercept at least one of a system event or an Application Programming Interface (API) call, and associating logic with the application. The logic is configured to interact with the application via the at least one system event or API call, the logic is configured to provide additional functions to the application, the logic is configured to be shared between the application and at least one other application, and the logic is stored separate from the application.