Secure Application Data Exchange via Entitlement Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data exchange methods between applications are insecure, leading to potential data theft and manipulation due to the lack of effective access control and valid entitlements, causing delays and resource inefficiencies, especially when provisioning profiles expire or change.
Innovation Solution
A computer-implemented method for secure data exchange between applications using key generation, encryption, and decryption processes, allowing only entitled applications to access shared keychains through a single sign-on process and client-authenticated transport layer security, thereby managing certificates and identities independently of provisioning profiles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications use keychains stored in shared memory locations for data exchange, then data exchange can occur between applications, but security is compromised due to lack of access control and entitlement verification
Solution Approach 1:
The patent segments the keychain access mechanism by introducing separate entitlements for different keychain items. Instead of a single shared keychain with unrestricted access, the system divides access rights into distinct segments (first entitlement for first keychain items, second entitlement for second keychain items), allowing selective access control while maintaining data exchange capability.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where the second application must verify the first application's entitlement before allowing access to keychain items. This intermediary check (checking whether the first application has the first entitlement) acts as a mediator between the data exchange need and security requirements, enabling secure communication without compromising either aspect.
2Ease of manufacture
If applications rely on provisioning profiles with limited validity periods, then certificate management is simplified, but frequent re-provisioning is required causing delays and resource inefficiency
Solution Approach 1:
The patent applies preliminary action by pre-establishing long-term trust relationships through code signing certificates with extended validity periods. Instead of relying on short-term provisioning profiles that require frequent renewal, the system performs the trust establishment action in advance with a durable certificate that remains valid for an extended period, eliminating the need for frequent re-provisioning and improving deployment efficiency.
3Productivity
If applications use code signing certificates with extended validity, then deployment efficiency improves, but the complexity of managing certificate lifecycles and entitlements increases
Solution Approach 1:
The patent segments the complex certificate management task into distinct, manageable components: code signing certificates for application distribution and separate entitlements for keychain access control. This segmentation allows each component to have a clear, limited scope (code signing for deployment, entitlements for access), making the overall management less complex despite using extended validity certificates.
Solution Approach 2:
The patent extracts the access control functionality from the certificate management system by introducing separate entitlements that are independent of the code signing certificates. This extraction allows the certificate validity period to be extended for deployment efficiency while the entitlements handle the fine-grained access control, separating the concerns and reducing overall management complexity.
Data Source
AI summary
A system, a method, and a computer program product for a data exchange are provided. A first application generates a first key for exchange of data between the first application and a second application. The first application stores the first key in a first memory location. The second application obtains the first key from the memory location. The second application generates a second key for exchange of data between the first application and the second application. The second application creates a data request that contains the second key and is encrypted using the first key. The encrypted request is provided to the first application. The first application provides the data identified in the data request to the second application. The data is encrypted by the first application using the second key prior to being provided to the second application. The second application decrypts the data using the second key.