Patent Application
20170373853
To provide a seamless and unified experience across different user sessions and different devices, many applications rely on maintaining a user profile for each user. A user profile is the collection of settings, customizations, add-ons, and other personalizations that a user has made or installed on their version of the application. In some cases, the user profiles also contain user names and passwords for certain websites to speed up logging in without the user having to remember that information each time they access the website in question. In this way, user profiles allow the user to have access to their saved, personal set of customizations for the next time they use the application. Moreover, this approach allows the user to have a seamless experience regardless of whether they are using the application on a work computer or from a personal device.
Furthermore, it is becoming increasingly common for users to use their own personal devices (such as a phone or a laptop) in order to access corporate data, a practice known as BYOD (Bring Your Own Device). However, in contrast to a managed environment in which the administrator has full control over any client devices and the applications running thereon, a personal device is unsecured and can potentially act as a vector for malware or other types of hostile or intrusive software to infect the corporate environment. If a user profile contains sensitive corporate or personal information, this could result in a potentially catastrophic data breach and presents a serious security concern.
User profiles of applications installed in a user environment, which may be compromised by malware, are managed to protect against such malware gaining access to sensitive data that may be contained in the user profiles. The method includes the steps of detecting, by a management agent of a user environment, a launch of an application within the user environment, verifying, by a filter driver, an identity of the application against a stored profile of the application, and responsive to determining that the identity of the application matches the stored profile of the application, importing, by the management agent, an encrypted user profile from a remote storage to local storage, decrypting, by the filter driver, the encrypted user profile, and providing the decrypted user profile to the application.
Further embodiments of the present invention include, without limitation, a non-transitory computer-readable storage medium that includes instructions for a processor to carry out the above method, and a computer system that includes a processor programmed to carry out the above method.
To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements disclosed in one embodiment may be beneficially utilized on other embodiments without specific recitation.
As depicted in
At step 202, the administrator selects the application to be profiled by providing to the application profiler the file system path of the executable of the application. At step 204, the application profiler computes a hash value of the executable of the application. For example, the hash value can be computed using the SHA-2 algorithm. Alternatively, the hash value can be computed using the MD5 algorithm or any other appropriate hash algorithm. At step 206, the application profiler checks whether the application has a digital certificate associated therewith. If not, the method proceeds to step 210.
At step 208, upon determining that the application has an associated digital certificate, the application profiler captures the certificate data. Certificate data contain information such as certificate issuer, the company that the certificate was issued to, expiration dates, and other information about the executable. At step 210, the application is executed inside the application profiler and, during this execution, application profiler captures the relevant settings and configurations of the application. At step 212, the application profiler captures the information about the file system path and the registry path used by the application to create and store user profiles. At step 214, the application profiler stores the information gathered in steps 204, 208, 210 and 212 into an .ini file associated with the application.
After step 304, the remaining steps of flow diagram 300 are executed by filter driver 110 when a particular application tries to access a user profile for that application. At step 306, filter driver 110 detects such an attempt by an application to access the user profile for that application. Filter driver 110 is able to detect such an attempt by reading the file system path used by the application to create and store user profiles from the .ini file associated with the application. Upon detection, at step 308, filter driver 110 computes the hash value of the executable of the application requesting access to the user profile. At step 309, filter driver 110 compares the hash value computed at step 308 with a hash value for the application stored in the .ini file.
At step 310, in response to determining that the hash value computed at step 308 differs from the stored hash value, filter driver 110 obtains certificate data associated with the application, if any. At step 311, filter driver 110 compares the certificate data obtained at step 310 with certificate data for the application stored in the .ini file.
At step 312, upon determining that either the hash value matches the stored hash value or the certificate data match the stored certificate data, blocks of the user profile are retrieved from local storage device 120 through file system driver 112 on a block-by-block basis and decrypted by filter driver 110. At step 314, filter driver 110 returns the decrypted user profile to the application.
If the hash value computed at step 308 differs from the stored hash value and the certificate data does not match the stored certificate data, flow diagram 300 is terminated without the user profile being returned to the application.
At step 408, in response to determining that the hash value computed at step 407 differs from the stored hash value, filter driver 110 obtains certificate data associated with the application, if any. At step 409, filter driver 110 compares the certificate data obtained at step 407 with certificate data for the application stored in the .ini file.
At step 410, upon determining that either the hash value matches the stored hash value or the certificate data match the stored certificate data, UEM agent 130 imports the encrypted user profile to local storage device 120. At step 412, blocks of the user profile are retrieved from local storage device 120 through file system driver 112 on a block-by-block basis and decrypted by filter driver 110. At step 414, filter driver 110 returns the decrypted user profile to the application.
The various embodiments described herein may employ various computer-implemented operations involving data stored in computer systems. For example, these operations may require physical manipulation of physical quantities usually, though not necessarily, these quantities may take the form of electrical or magnetic signals, where they or representations of them are capable of being stored, transferred, combined, compared, or otherwise manipulated. Further, such manipulations are often referred to in terms, such as producing, identifying, determining, or comparing. Any operations described herein that form part of one or more embodiments of the invention may be useful machine operations. In addition, one or more embodiments of the invention also relate to a device or an apparatus for performing these operations. The apparatus may be specially constructed for specific required purposes, or it may be a general purpose computer selectively activated or configured by a computer program stored in the computer. In particular, various general purpose machines may be used with computer programs written in accordance with the teachings herein, or it may be more convenient to construct a more specialized apparatus to perform the required operations.
The various embodiments described herein may be practiced with other computer system configurations including hand-held devices, microprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like.
One or more embodiments of the present invention may be implemented as one or more computer programs or as one or more computer program modules embodied in one or more computer readable media. The term computer readable medium refers to any data storage device that can store data which can thereafter be input to a computer system computer readable media may be based on any existing or subsequently developed technology for embodying computer programs in a manner that enables them to be read by a computer. Examples of a computer readable medium include a hard drive, network attached storage (NAS), read-only memory, random-access memory (e.g., a flash memory device), a CD (Compact Discs) CD-ROM, a CD-R, or a CD-RW, a DVD (Digital Versatile Disc), a magnetic tape, and other optical and non-optical data storage devices. The computer readable medium can also be distributed over a network coupled computer system so that the computer readable code is stored and executed in a distributed fashion.
Although one or more embodiments of the present invention have been described in some detail for clarity of understanding, it will be apparent that certain changes and modifications may be made within the scope of the claims. Accordingly, the described embodiments are to be considered as illustrative and not restrictive, and the scope of the claims is not to be limited to details given herein, but may be modified within the scope and equivalents of the claims. In the claims, elements and/or steps do not imply any particular order of operation, unless explicitly stated in the claims.
Plural instances may be provided for components, operations or structures described herein as a single instance. Finally, boundaries between various components, operations and data stores are somewhat arbitrary, and particular operations are illustrated in the context of specific illustrative configurations. Other allocations of functionality are envisioned and may fall within the scope of the invention(s). In general, structures and functionality presented as separate components in exemplary configurations may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements may fall within the scope of the appended claims.
