Secured application package files for mobile computing devices

An ANDROID application package (APK) file for an application is repackaged into a secured APK file to protect a Dalvik executable (DEX) file of the application. The DEX file is encrypted to generate an encrypted DEX file that is included in the secured APK file along with a stub DEX file. The secured APK file is received in a mobile computing device where the stub DEX file is started to start a wrapper Activity. The wrapper Activity replaces an APK class loader of a mobile operating system of the mobile computing device with a decryptor class loader. The decryptor class loader decrypts the encrypted DEX file to recover the DEX file, and loads classes of the DEX file into a Dalvik virtual machine. The original Activity of the application is then started to provide the functionality of the application in the mobile computing device.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for securing application package files for mobile computing devices.

2. Description of the Background Art

Mobile operating systems are designed to be suitable for computers that are constrained in terms of memory and processor speed. The ANDROID operating system is a popular mobile operating system employed in mobile computing devices, including mobile phones and tablets. Application programs for the ANDROID operating system come in a file referred to as the ANDROID application package (APK) file. A problem with the APK file is that it is relatively easy to decompile to identify system application programming interface (API) call sequences. This makes the APK file vulnerable to reverse engineering for malicious, copying, and other purposes.

Code obfuscation has been employed to make applications in APK files difficult to reverse engineer. For example, the PROGUARD software tool may be employed to obfuscate JAVA code used in APK files. However, while code obfuscation makes the APK file harder to read, the APK file may still be readily decompiled to show the system calls employed by the application.

SUMMARY

In one embodiment, a computer-implemented method comprises receiving a secured application package file in a mobile computing device, the secured application package file comprising an encrypted Dalvik executable (DEX) file and a decryptor class loader. A class loader of a mobile operating system of the mobile computing device is replaced with the decryptor class loader. The decryptor class loader is used to decrypt the encrypted DEX file to recover a DEX file. The decryptor class loader, instead of the class loader of the mobile operating system, is used to load classes of the DEX file into a Dalvik virtual machine of the mobile operating system.

In another embodiment, a system comprises a computer system configured to unpack an application package file, to encrypt a first Dalvik executable (DEX) file of the application package file to generate an encrypted DEX file, and to include the encrypted DEX file, a second DEX file, and resource files of the application package file into a secured application package file; and a mobile computing device configured to receive the secured application package file, to execute the second DEX file to launch a decryptor class loader, to execute the decryptor class loader to decrypt the encrypted DEX file to recover the first DEX file, to execute the decryptor class loader to load classes of the first DEX file into a Dalvik virtual machine, and to execute the classes of the first DEX file in the Dalvik virtual machine.

DETAILED DESCRIPTION

Referring now toFIG. 1, there is shown a schematic diagram of a computer100that may be employed with embodiments of the present invention. The computer100may be employed as any of the computers described below. The computer100may have fewer or more components to meet the needs of a particular application. The computer100may include a processor101. The computer100may have one or more buses103coupling its various components. The computer100may include one or more user input devices102(e.g., touch screen, keyboard, mouse), one or more data storage devices106(e.g., hard drive, optical disk, USB memory), a display monitor104(e.g., LCD, flat panel monitor, CRT), a communications interface105(e.g., network adapter, modem, cellular interface), and a main memory108(e.g., RAM). The communications interface105may be coupled to a computer network109, which in this example includes the Internet.

The computer100is a particular machine as programmed with software modules110. The software modules110comprise computer-readable program code stored non-transitory in the main memory108for execution by the processor101. For example, the software modules110may comprise a repackaging module211, an APK file212, and a secured APK file220when the computer100is employed as a customer computer system210(seeFIG. 2). As another example, the software modules110may comprise an ANDROID operating system251and the secured APK file220when the computer100is employed as an ANDROID device250.

The computer100may be configured to perform method steps by executing the software modules110. The software modules110may be loaded from the data storage device106to the main memory108. The software modules110may also be made available on other computer-readable storage medium including optical disk, flash drive, and other memory devices.

FIG. 2shows a system200for securing application package files for mobile computing devices in accordance with an embodiment of the present invention. The system200may comprise a customer computer system210and one or more mobile computing devices running a mobile operating system. In the example ofFIG. 2, the mobile computing device is an ANDROID device250running an ANDROID operating system251. Accordingly, the use of the terms “object,” “method”, and “class” in the context of computer-readable program code in this disclosure refers to the use of those terms in object oriented programming (OOP) and the JAVA programming language in general.

The customer computer system210may comprise one or more computers configured to generate a secured application package file. In one embodiment, the customer computer system210includes a repackaging module211, one or more APK files212, and one or more secured APK files220. The repackaging module211may comprise computer-readable program code for generating a secured application package file, which in the example ofFIG. 2comprises a secured APK file220. The APK file212may comprise a conventional APK file of an application program (“application”) for the ANDROID operating system. In one embodiment, the repackaging module211is configured to repackage an APK file212into a secured APK file220. The repackaging module211may be implemented as a command line software tool. The customer computer system210is so named because it may be operated by a customer of a computer security vendor, such as Trend Micro, Inc., to protect the customer's applications included in application package files from reverse engineering.

In the example ofFIG. 2, a secured APK file220comprises a manifest221, a signature222, resource files223, a stub Dalvik executable (DEX) file224, an encrypted DEX file225, a native library226, and a configuration file227.

The manifest221may include extensions, package related data, and other information generally included in a manifest of an APK file. In the example ofFIG. 2, the manifest221comprises the manifest of the APK file212and may include a reference to the wrapper Activity228. The signature222comprises the digital signature of the provider of the secured APK file220. The resource files223comprise additional files that the application uses, and in this example includes the resource files223of the APK file212.

Generally speaking, in the ANDROID operating system, a DEX file comprises computer-readable program code that performs the general function of an application. A typical APK file has a DEX file. In the example ofFIG. 2, the DEX file of the secured APK file220is a stub DEX file224, which comprises an Activity referred to herein as a “wrapper Activity”228. The wrapper Activity228comprises an Activity of the ANDROID operating system251. In the ANDROID operating system, an Activity is a process of the application. The Activity228is so named because it wraps around or encapsulates the original Activity of the application of the APK file212. In one embodiment, the wrapper Activity228is intended to replace the original class loader of Activity of the ANDROID operating system251with the decryptor class loader229upon execution to decrypt the encrypted DEX file225, and to start the original Activity of the application by reading the configuration file227.

In one embodiment, the encrypted DEX file225comprises the original DEX file of the APK file212(“original DEX file”) but encrypted by the repackaging module211to prevent reverse engineering. That is, encryption of the original DEX file prevents it from being read even when the secured APK file220is unpacked. However, once encrypted, the original DEX file no longer conforms to the standard DEX format and thus can no longer be executed by the Dalvik virtual machine of the ANDROID operating system251.

The decryptor class loader229may comprise computer-readable program code for loading classes into the Dalvik virtual machine of the ANDROID operating system251. In one embodiment, the decryptor class loader229is a native implementation that uses the JAVA Native Interface (JNI) of the JAVA programming language. The decryptor class loader229may be configured to decrypt the encrypted DEX file225to recover the original DEX file of the APK212and to load the classes of the original DEX file into the Dalvik virtual machine of the ANDROID operating system251. As can be appreciated, the classes of the original DEX file include the original Activities of the application. The secured APK file220thus allows the application to run as if the application was still packaged in the APK file212.

In one embodiment, the native library226comprises the classes of the decryptor class loader229. The wrapper Activity228may also be implemented in native code using the native library226. The classes of the decryptor class loader229allow for decryption of the encrypted DEX file225to recover the original DEX file and to load the classes of the original DEX file into the Dalvik virtual machine for execution. In other words, the decryptor class loader229may comprise computer-readable program code for decrypting encrypted computer-readable program code of the application to recover the original computer-readable program code of the application, and to load the original computer-readable program code of the application into the virtual machine for execution by the virtual machine. The configuration file227comprises information that allows the stub DEX file224to identify which main Activity to load upon execution. In the example ofFIG. 2, the configuration file227indicates to the stub DEX file224to load the wrapper Activity228as the main Activity.

In an example operation, the APK file212comprises a package file of an application for the ANDROID operating system251. The repackaging module211parses the contents of the APK file212(arrow201) to generate the secured APK file220using the contents of the APK file212(arrow202). The customer computer system210forwards the secured APK file220to the ANDROID device250(arrow203). The customer computer system210may forward the secured APK file220directly to the ANDROID device250, by way of an ANDROID app store, or by way of another computer system.

The device250may comprise an ANDROID mobile phone, tablet, or other mobile computing devices that run the ANDROID operating system. In the device250, the stub DEX file executes to run the wrapper Activity228. The wrapper Activity228replaces the original class loader of Activity of the ANDROID operating system251with the decryptor class loader229. The decryptor class loader229decrypts the encrypted DEX file of the APK file212to recover the original DEX file, and loads the classes of the original DEX file into the Dalvik virtual machine of the ANDROID operating system251, thereby allowing the application to run in the device250. Advantageously, the application cannot be reverse engineered in the device250because its original DEX file is in encrypted state prior to being loaded into the Dalvik virtual machine.

FIG. 3shows a flow diagram of a computer-implemented method300of creating a secured application package file in accordance with an embodiment of the present invention. As its name implies, an application package file is a file that includes not only the file of the application, but also other files that are employed or work with the application. In the case of the ANDROID operating system, an APK file is essentially an archive file containing the executable file of the application (i.e., the DEX file of the application), the resource files needed by the application to run, and other files. The method300is explained with reference to the components of the system200ofFIG. 2for illustration purposes only. The method300may be performed by the repackaging module211.

In the example ofFIG. 3, the secured application package file is a secured APK file220and the original application package file is an APK file212. The repackaging module211unpacks the APK file212(step301) to allow access to the files archived in the APK file212, including access to the original DEX file of the application. The manifest of the APK file212is modified to insert a reference to the wrapper Activity228(step302). The repackaging module211generates the encrypted DEX file225by encrypting the original DEX file, which comprises the original classes of the application as included in the APK file212(step303). The repackaging module211copies the resource files223and raw data from the APK212to the secured APK file220(step304). The repackaging module211may copy resource files and raw data from the APK file212to the secured file220without modification. The repackaging module211adds the stub DEX file224comprising the wrapper Activity228and the configuration file227to the secured APK file220(step305). The repackaging module211adds the native library226comprising the JNI implementation of the decryptor class loader229to the secured APK file220(step306). The repackaging module211packages the secured APK file220to include the manifest221, the signature222, the resource files223, the stub DEX file224, the encrypted DEX file225, the native library226, and the configuration file227. The secured APK file220may be provided to a mobile computing device running the ANDROID operating system, such as the ANDROID device250. The ANDROID device250may receive the secured APK file220directly from the customer computer system210, another computer system, or an ANDROID app store, for example.

FIG. 4shows a flow diagram of a computer-implemented method400of executing a secured application package file in a mobile computing device in accordance with an embodiment of the present invention. The method400is explained with reference to the components of the system200ofFIG. 2for illustration purposes only. The method400may be performed by the ANDROID device250, with the steps402,403,407, and408by executing the wrapper Activity228, and the steps404-406by executing the decryptor class loader229.

The method400begins when the wrapper Activity228is started (step401), such as when the application associated with the secured APK file220is selected by the user for execution. When the wrapper Activity228executes, it replaces the APK class loader normally employed by the ANDROID operating system251to load classes with the decryptor class loader229(step402).

The decryptor class loader229consults the configuration file227to determine the main Activity to be loaded, which in this case is the original Activity of the APK file212(“original Activity”). The decryptor class loader229loads the original Activity into the Dalvik virtual machine of the ANDROID operating system251(step403). In one embodiment, the decryptor class loader229loads the original Activity by receiving the decryption key for decrypting the encrypted DEX file225(step404), decrypting the encrypted DEX file225to recover the original DEX file of the APK file212(step405), and loading the classes of the original DEX file into the Dalvik virtual machine of the ANDROID operating system251(step406). The decryptor class loader229may receive the decryption key locally or from a remote server computer system, for example. By decrypting the encrypted DEX file225to recover the original DEX file and loading the classes of the original DEX file, the decryptor class loader229allows the functions of the application to be executed by the Dalvik virtual machine.

The wrapper Activity228builds an intent object for the classes loaded by the decryptor class loader229(step407). The wrapper Activity228then starts the original Activity (step408). The wrapper Activity thereafter ends (step409). As can be appreciated, the original Activity now executes as intended by the developer of the APK file212, while being protected from reverse engineering by the secured APK file220. That is, decompiling the secured APK file220does not reveal the contents, more particularly the system calls, employed by the application because of the encryption of the original DEX file. The application is thus secured from reverse engineering while still allowing the application to execute normally.

Embodiments of the present invention may be employed to perform other security functions in mobile computing devices, not just to protect applications from reverse engineering. For example, the decryptor class loader229may also replace one or more original classes of the original DEX file with security classes. The security classes may be configured to hook critical function calls, such as SMS sender (in the case of anti-premium service abuse), for monitoring and evaluation.

Methods and systems for generating and executing secured application package files for mobile computing devices running mobile operating systems have been disclosed. While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.