System, method, and computer program for conditionally implementing protected content

A system, method, and computer program product are provided for conditionally implementing protected content. In use, protected content is identified. Additionally, one or more elements associated with the protected content are verified. Further, the protected content is conditionally implemented, based on the verifying.

FIELD OF THE INVENTION

The present invention relates to protecting content, and more particularly to conditionally implementing protected content.

BACKGROUND

Developing applications that execute on a multitude of different devices and different operating systems is a goal of many developers. For example, web based hybrid applications that execute web content in web runtime may be used in order to enable application access via a web based interface. Unfortunately, conventional methods for implementing content in this manner have exhibited various limitations.

For example, current technology may not be able to ensure the security of applications that are being implemented utilizing a web based interface or any web based application code. For example, applications may be copied and code may be reverse engineered, and sensitive application data may be compromised. There is thus a need for addressing these and/or other issues associated with the prior art.

SUMMARY

A system, method, and computer program product are provided for conditionally implementing protected content. In use, protected content is identified. Additionally, one or more elements associated with the protected content are verified. Further, the protected content is conditionally implemented, based on the verifying.

DETAILED DESCRIPTION

FIG. 1illustrates a network architecture100, in accordance with one possible embodiment. As shown, at least one network102is provided. In the context of the present network architecture100, the network102may take any form including, but not limited to a telecommunications network, a local area network (LAN), a wireless network, a wide area network (WAN) such as the Internet, peer-to-peer network, cable network, etc. While only one network is shown, it should be understood that two or more similar or different networks102may be provided.

Coupled to the network102is a plurality of devices. For example, a server computer104and an end user computer106may be coupled to the network102for communication purposes. Such end user computer106may include a desktop computer, lap-top computer, and/or any other type of logic. Still yet, various other devices may be coupled to the network102including a personal digital assistant (PDA) device108, a mobile phone device110, a television112, etc.

FIG. 2illustrates an exemplary system200, in accordance with one embodiment. As an option, the system200may be implemented in the context of any of the devices of the network architecture100ofFIG. 1. Of course, the system200may be implemented in any desired environment.

As shown, a system200is provided including at least one central processor201which is connected to a communication bus202. The system200also includes main memory204[e.g. random access memory (RAM), etc.]. The system200also includes a graphics processor206and a display208.

The system200may also include a secondary storage210. The secondary storage210includes, for example, a hard disk drive and/or a removable storage drive, representing a floppy disk drive, a magnetic tape drive, a compact disk drive, etc. The removable storage drive reads from and/or writes to a removable storage unit in a well known manner.

Computer programs, or computer control logic algorithms, may be stored in the main memory204, the secondary storage210, and/or any other memory, for that matter. Such computer programs, when executed, enable the system200to perform various functions (to be set forth below, for example). Memory204, storage210and/or any other storage are possible examples of tangible computer-readable media.

FIG. 3illustrates a method300for conditionally implementing protected content, in accordance with one embodiment. As an option, the method300may be carried out in the context of the details ofFIGS. 1and/or2. Of course, however, the method300may be carried out in any desired environment. Further, the aforementioned definitions may equally apply to the description below.

As shown in operation302, protected content is identified. In one embodiment, the protected content may be identified in response to a request for the content. For example, the protected content may be identified in response to a request from a runtime module to run the protected content. In another example, the protected content may be identified in response to validating the request from the runtime module.

For example, the request from the runtime module may include a protocol request such as a hypertext transfer protocol (HTTP) request or a hypertext transfer protocol secure (HTTPS) request that may include an access token. Of course, however, the protocol request may include any protocol supported by the regular web runtime. In another example, the access token may be set at the runtime module by a validation module, utilizing a native application programming interface (API) implemented within the runtime module. In yet another example, the protected content may be identified in response to the validation of the access token within the HTTP request. For instance, the access token within the HTTP request may be validated utilizing a validation module before the protected content is identified.

Additionally, in one embodiment, the protected content may be associated with one or more applications. For example, the protected content may include application code that performs one or more actions when executed (e.g., when executed in a runtime environment, etc.). In another example, the protected content may include mobile application code (e.g., HTML5 mobile application code, etc.). In another embodiment, the protected content may include one or more plain text files.

Further, in one embodiment, the protected content may include one or more security measures. For example, the protected content may include one or more signatures (e.g., developer signatures, etc.). In another embodiment, the protected content may include one or more permissions. For example, the protected content may include one or more code permissions defined by the developer, where such code permissions may be associated with one or more of the protected content and additional components accessed by the protected content when the protected content is run.

Further still, in one embodiment, the protected content may be identified by accessing (e.g., reading, etc.) the protected content from a local data store (e.g., a local database, etc.). In another embodiment, the protected content may be identified by accessing the protected content from a non-local data store (e.g., a non-local networked database, etc.) via one or more means (e.g., a computer network, etc.). In yet another embodiment, the protected content may be accessed by local server module (e.g., a local web server, etc.).

For example, the protected content may be accessed by a local web server run within a packaged mobile application that delivers content to a runtime module to be run. In still another embodiment, the local server module may be encapsulated. For example, the local web server may be encapsulated within a packaged application that conditionally answers to standard requests from existing web runtimes within web application content.

Also, as shown in operation304, one or more elements associated with the protected content are verified. In one embodiment, verifying the one or more elements associated with the protected content may include decrypting the protected content. For example, the protected content may include encrypted content that is read and decrypted by the local server module. In another embodiment, verifying the one or more elements associated with the protected content may include sending the protected content that has been decrypted to the validation module. For example, once the protected content is decrypted, the decrypted content may be sent to the validation module for additional analysis.

In addition, in one embodiment, verifying the one or more elements associated with the protected content may include verifying one or more portions of the protected content once the protected content has been decrypted. For example, one or more signatures may be identified by the validation module within the decrypted content, and the one or more signatures may be verified by the validation module (e.g., by comparing the one or more signatures against one or more stored signatures, etc.). In another example, one or more permissions may be identified by the validation module within the decrypted content, and the one or more permissions may be verified by the validation module (e.g., by confirming that each of the one or more permissions have been met, etc.).

Further, as shown in operation306, the protected content is conditionally implemented, based on the verifying. In one embodiment, conditionally implementing the protected content may include providing the protected content to the runtime module if the verifying is successful (e.g., if one or more of the protected content have been verified, etc.). For example, if one or more signatures are identified by the validation module within the decrypted content, then the decrypted content may be provided to the runtime module by the local server module if the one or more signatures are verified by the validation module.

In another example, if one or more permissions are identified by the validation module within the decrypted content, then the decrypted content may be provided to the runtime module by the local server module if the one or more permissions are verified by the validation module. In another embodiment, conditionally implementing the protected content may include withholding the protected content from the runtime module if the verifying is not successful (e.g., if one or more of the protected content have not been verified, etc.). For example, if one or more signatures and/or one or more permissions are identified by the validation module within the decrypted content, then the decrypted content may be withheld from the runtime module by the local server module if the one or more signatures and/or permissions are not verified by the validation module.

Further still, in one embodiment, implementing the protected content may include rendering the protected content. For example, the runtime module may render the decrypted content provided to it by the local server module. In another example, the runtime module may render the decrypted content and display one or more elements to one or more users, based on the decrypted content. In yet another example, the decrypted content may include an application that is run by the runtime module, where one or more users may interact with the application through the runtime module.

Also, in one embodiment, the protected content may be controlled while it is implemented. For example, when the runtime module renders the decrypted content provided to it by the local server module, the validation module may monitor such rendering (e.g., by parsing the HTML document object model (DOM), injecting one or more probes, etc.). Additionally, if the validation module detects a violation (e.g., a permission violation, a policy violation, etc.) during such monitoring, the validation module may stop the runtime module, invalidate the access token within the runtime module's HTTP request, etc. In this way, the runtime may be monitored, and content and access may be disabled if an issue is detected during the monitoring.

Additionally, the protected content may be securely stored and implemented. Further, a variety of different security frameworks may be implemented within the protected content. Further still, the content may be protected against threats such as copying, reverse engineering, etc. Also, plain text files of an application may be secured while being used in a standard web runtime of a device.

FIG. 4illustrates a system400for securing mobile application code, in accordance with one embodiment. As an option, the system400may be carried out in the context of the details ofFIGS. 1-3. Of course, however, the system400may be carried out in any desired environment. Further, the aforementioned definitions may equally apply to the description below.

As shown, a validation module402is implemented within a client device408. Additionally, a local server module404and a runtime module406are implemented within a packaged mobile application410of the client device408. In one embodiment, the packaged mobile application410may include a hybrid mobile application. In another embodiment, the local server module404may deliver content to the runtime module406. In yet another embodiment, the validation module402may verify content according to rules (e.g., rules defined by an application developer, etc.).

Also, in one embodiment, the runtime module406may be executed in memory, and may execute web content (e.g., HTML pages, JavaScript (JS) libraries, cascading style sheets (CSS) pages or instructions, etc.). In still another embodiment, the validation module402, the local server module404, and the runtime module406may be included within a client-side execution environment running on the client device408that may load and run protected content (e.g., mobile HTML5 application code, etc.).

Additionally, in one embodiment, the runtime module406may trigger the retrieval of protected content (e.g., HTML5 content, etc.) by sending a protected content request. For example, the WRT may initiate the retrieval of bootstrap HTML content by sending the request (e.g., content including “http://[local server module name]/index.html,” etc.). In another embodiment, the validation module402may implement a native application programming interface (API) with the runtime module406. In yet another embodiment, implementing the native API may include setting a specific access token that corresponds to the request for protected content sent from the runtime module406.

Further, in one embodiment, the local server module404may receive the protected content request from the runtime module406as a HTTP request. In another embodiment, the HTTP request may include the access token. In yet another embodiment, the local server module404may verify with the validation module402that the access token included in the HTTP request is valid. In still another embodiment, the local server module404may read a protected (e.g., encrypted, etc.) version of the protected content from a data store412. In one embodiment, the data store may include a database, a network, etc.

Further still, in one embodiment, the local server module404may decrypt the protected version of the protected content and may send the decrypted version to the validation module402(e.g., via a runtime memory channel, APIs, etc.). In another embodiment, the validation module402may verify the decrypted version of the protected content, utilizing verification data414. For example, the validation module402may access the verification data414, where such data includes one or more permissions, one or more signatures, etc. Additionally, the validation module402may verify the content by comparing the content against the verification data414. In another embodiment, the one or more permissions and/or the one or more signatures may be implemented by a developer of the content.

Also, in one embodiment, if the protected content passes the verification of the validation module402, the validation module402may notify the local server module404, and the local server module404may deliver the protected content to the runtime module406(e.g., utilizing an HTTP response, etc.). In another embodiment, the runtime module406may then render the protected content for one or more end users. In yet another embodiment, the validation module402may control the content during the rendering of the content by the runtime module406. For example, the validation module402may parse the HTML DOM, as well as dynamically introspect the content by injecting JavaScript probes into the content, etc. In still another embodiment, if one or more violations are detected by the validation module402during the rendering of the content, the validation module402may perform one or more actions (e.g., stop the runtime module406, invalidate the access token, etc.).

In this way, developers may be able to secure their content and the execution of such content. For example, after compilation of the content, if an object format is not considered to be sufficiently protected then a developer can obfuscate the code comprising the content, which may make the code unreadable and not re-usable through techniques such as reverse engineering. Additionally, a developer may sign their content code, which may guarantee the origin of the content code and may also guarantee that such content code has not been altered after the signature has been added. The code may then be executed safely by software that recognizes the signature.

Further, a developer may define one or more code permissions to help protect one or more of resources and operations from unauthorized use. For example, the permissions may be defined in code components of the protected content drafted by the developer, but such permissions may also apply to additional software components that may be loaded and/or used by the protected content. Further still, the system400may allow writing and deploying content such as HTML5 applications with the same protection that may be provided to native applications. Also, the content may include plain text files of an application, and such content may be secured while still using a standard runtime module406of the client device408.