Processing resource requests on a mobile device

Systems, methods, and software can be used to process a resource request. In some aspects, a method, comprising: transmitting, from a mobile device, an encrypted request to a proxy server, wherein the encrypted request comprises a Hypertext Transfer Protocol (HTTP) request, the HTTP request is addressed to an application server that provides service to an application on the mobile device, and the encrypted request is encrypted using an application-specific credential that is associated with the application; and receiving, at the mobile device, an encrypted response in response to the encrypted request, wherein the encrypted response comprises an HTTP response generated by the application server.

TECHNICAL FIELD

The present disclosure relates to processing resource requests on a mobile device

BACKGROUND

In some cases, applications executing on a mobile device may request resources from an application server to complete an operation. In one example, an email application may request updated email information from an email server to complete a synchronization application. In another example, a file transfer application may request a file from a remote file system to complete a file transfer protocol (FTP) operation. In some cases, the resource request and resource responses can be formated according to the Hypertext Transfer Protocol (HTTP) format.

DETAILED DESCRIPTION

In some cases, the application can generate the resource requests and send the resource requests to the application server that provides the services. In some implementations, a system process on the mobile device may be used to manage the transmission and reception of the external messages. For example, a system process implemented on the mobile device can manage the HTTP requests and responses on behalf of applications that are executing on the mobile device. In some cases, while the application is executing on the foreground, the application can manage the external messages such as HTTP requests and responses. While the application is executing on the background, the application can use the system process to manage the transmission and receptions of these external messages. The application can be suspended while the request and response are being managed by the system process. The system process can schedule the data communication of the HTTP requests and response of the application that the system process manages. The system process can manage the HTTP requests and responses from different applications, some or all of which can be suspended when the HTTP requests or responses are pending. The system process can cause the application to resume when the HTTP response is ready. The system process can cause each application to resume processing at different times. Other examples of external messages handled by the system process include FTP messages. This approach increases the efficiency of background processes of multiple applications. In some implementations, the system process can be implemented as part of the operating system on the mobile device.

Because the system process handles the background messages for multiple applications and may not have a strong security protection, there may be security risks for these resource requests and resource responses that are sent to the system process. The concerns for security risks may be higher for enterprise applications that may include sensitive information in the resource requests and resource responses. Moreover, the target address of the resource requests, e.g., the application server that provides the service, may be exposed in the resource requests and may be used by potential malicious attacks.

In some cases, the application on the mobile device can establish application-specific encryption credentials and a transmission path identifier with a management server. The encryption credentials can be used to encrypt resource requests before sending to the system process to handle. Furthermore, the transmission path identifier can be used for a proxy server to send the encryted resource request to the encrytion server. The encrytion server can decrypt the encrypted resource request and forward the decryted resource request to the application server. Similarly, the resource response can also be encrypted by the encryption server and sent to the system process through the proxy server.FIGS. 1-5and associated descriptions provide additional details of these implementations. These approaches provide a secure implementation for transmitting, receiving, and processing resource requests and responses. The contents of the resource requests and responses are encrypted and the system process or other applications cannot access these contents without the application-specific encryption credentials. Furthermore, the address of the application server is masked by using a proxy server and also cannot be accessed by the system process or other applications on the mobile device.

FIG. 1is a schematic diagram showing an example communication system100that processes resource requests, according to an implementation. At a high level, the example communication system100includes a mobile device102that is communicatively coupled a management server150over a network110. The communication system100also includes a proxy server120, an encryption server130, a proxy host140, and an application server160that are communicatively coupled with the network110.

The application server160represents an application, a set of applications, software, software modules, hardware, or any combination thereof that can be configured to provide resources for an application executed on the mobile device102. In some cases, the application can be an enterprise application, e.g., email, messaging, file sharing, or other enterprise applications. The resources provided by the application server160can include enterprise resources, e.g., file systems, websites, portals. Alternatively, the application server160can provide resource for a personal application executing on the mobile device102. In some cases, access to the resources can be granted to users that are authenticated. In some cases, the application server160can receive resource requests, e.g., HTTP requests, and respond with resource responses, e.g., HTTP responses.FIGS. 2-5and associated descriptions provide additional details of these implementations.

The management server150represents an application, a set of applications, software, software modules, hardware, or any combination thereof that can be configured to manage applications and devices for the mobile device102. In one example, the management server150can be implemented as part of an enterprise mobility management (EMM) server. The EMM server can install, update, and manage the license of enterprise applications. In some cases, the management server150can be located on the premise of the enterprise, behind a firewall, or a combination thereof. In some cases, the management server150can be configured to provision an enterprise service in a cloud. In some implementations, the management server150can establish encryption credentials and a transmission path with the mobile device102for transmitting resource requests.FIGS. 2-5and associated descriptions provide additional details of these implementations.

The encryption server130represents an application, a set of applications, software, software modules, hardware, or any combination thereof, that decrypts resource requests and forwards the decrypted resource requests to the application server160. The encryption server130can also encrypt resource responses received from the application server160and forwards the encrypted resource responses to the proxy server120. In some cases, the encryption server130can be located on the premise of the enterprise, behind a firewall, or a combination thereof. In some cases, the encryption server130can be implemented on the same platform as the management server150. Alternatively or additionally, the encryption server130can be implemented in a cloud computing platform.FIGS. 2-5and associated descriptions provide additional details of these implementations.

The proxy server120represents an application, a set of applications, software, software modules, hardware, or any combination thereof that can be configured to provide a proxy service. In some cases, the proxy server120can be provisioned to forward the resource requests received from the mobile device102to the encryption server130and forward the resource response received from the encryption server130to the mobile device102. In some cases, the proxy server120also authenticates the mobile device102and the encryption server130before forwarding the resource requests and the resource responses.FIGS. 2-5and associated descriptions provide additional details of these implementations.

The proxy host140represents an application, a set of applications, software, software modules, hardware, or any combination thereof that can be configured to provision the proxy server120. In some cases, the management server150can send a proxy request to the proxy host140and the proxy host140can provision the proxy server120according to the proxy request and return a proxy response to the management server150. In some cases, the proxy host140can be implemented as part of a network operation center (NOC) associated with an enterprise or an enterprise service.

The example communication system100includes the network110. The network110represents an application, set of applications, software, software modules, hardware, or combination thereof that can be configured to transmit data messages between the entities in the system100. The network110includes a wireless network, a wireline network, or a combination thereof. For example, the network110can include one or a plurality of radio access networks (RANs), core networks (CNs), and external networks. The RANs may comprise one or more radio access technologies. In some implementations, the radio access technologies may be Global System for Mobile communication (GSM), Interim Standard 95 (IS-95), Universal Mobile Telecommunications System (UMTS), CDMA2000 (Code Division Multiple Access), Evolved Universal Mobile Telecommunications System (E-UMTS), Long Term Evaluation (LTE), LTE-Advanced, 5G, or any other radio access technologies. In some instances, the core networks may be evolved packet cores (EPCs).

A RAN is part of a wireless telecommunication system which implements a radio access technology, such as UMTS, CDMA2000, 3GPP LTE, and 3GPP LTE-A. In many applications, a RAN includes at least one base station. A base station may be a radio base station that may control all or at least some radio-related functions in a fixed part of the system. The base station may provide radio interface within their coverage area or a cell for a mobile device to communicate. The base station may be distributed throughout the cellular network to provide a wide area of coverage. The base station directly communicates to one or a plurality of mobile devices, other base stations, and one or more core network nodes.

In operation, the mobile device102can establish application-specific encryption credentials and a transmission path identifier with the management server150. The encryption credentials can be used to encrypt resource requests sent from the mobile device102. The proxy server120is provisioned to forward the encrypted resource requests to the encryption server130based on a mapping relationship indicated by the transmission path identifier. The encryption server130decrypts the resource requests and forwards the decrypted resource requests to the application server160. In the reverse direction, the application server160sends the resource responses to the encryption server130. The encryption server130encrypts the resource responses using the encryption credentials and sends the encrypted resource responses to the proxy server120, which forwards the encrypted resource responses to the mobile device102.FIGS. 2-5and associated descriptions provide additional details of these implementations.

While elements ofFIG. 1are shown as including various component parts, portions, or modules that implement the various features and functionality, nevertheless these elements may instead include a number of sub-modules, third-party services, components, libraries, and such, as appropriate. Furthermore, the features and functionality of various components can be combined into fewer components as appropriate.

FIG. 2is a schematic diagram200showing an example mobile device102that generates a resource request, according to an implementation. The mobile device102includes a processing unit262, a communication subsystem266, a user interface268, and memory264. A mobile device may include additional, different, or fewer features, as appropriate.

The example processing unit262can include one or more processing components (alternatively referred to as “processors” or “central processing units” (CPUs)) configured to execute instructions related to one or more of the processes, steps, or actions described above, in connection with one or more of the implementations disclosed herein. In some implementations, the processing unit262can be configured to generate control information, such as a measurement report, or respond to received information, such as control information from a network node. The processing unit262can also include other auxiliary components, such as random access memory (RAM) and read-only memory (ROM).

The example communication subsystem266can be configured to provide wireless or wireline communication for data or control information provided by the processing unit262. The communication subsystem266can include, for example, one or more antennas, a receiver, a transmitter, a local oscillator, a mixer, and a digital signal processing (DSP) unit. In some implementations, the communication subsystem266can support multiple input multiple output (MIMO) transmissions. In some implementations, the receivers in the communication subsystem166can be an advanced receiver or a baseline receiver. Two receivers can be implemented with identical, similar, or different receiver processing algorithms.

The example user interface268can include, for example, any of the following: one or more of a display or touch screen display (for example, a liquid crystal display (LCD), a light emitting diode (LED), an organic light emitting diode (OLED), or a micro-electromechanical system (MEMS) display), a keyboard or keypad, a trackball, a speaker, or a microphone. In some cases, the user interface268can be used to receive user input for authenticaiton credentials.FIG. 4and associated descriptions provide additional details of these implementations. The user interface268can also include I/O interface, for example, a universal serial bus (USB) interface.

The example memory264can be a computer-readable storage medium on the mobile device102. Examples of the memory264include volatile and non-volatile memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, and others. The memory264can store an operating system (OS) of the mobile device102and various other computer-executable software programs for performing one or more of the processes, steps, or actions described above.

The memory264can store applications, data, operation system, and extensions for the mobile device102. As illustrated, the memory264stores an application210and a system process220.

Applications, e.g., the application210, can include programs, modules, scripts, processes, or other objects that can execute, change, delete, generate, or process application data. For example, applications can be implemented as Enterprise Java Beans (EJBs). Design-time components may have the ability to generate run-time implementations into different platforms, such as J2EE (Java 2 Platform, Enterprise Edition), ABAP (Advanced Business Application Programming) objects, ANDROID, iOS, or Microsoft's .NET. Further, while illustrated as internal to the mobile device102, one or more processes associated with an application may be stored, referenced, or executed remotely. For example, a portion of an application may be an interface to a web service that is remotely executed. Moreover, an application may be a child or sub-module of another software module (not illustrated).

The application210includes a resource module212and an encryption module214. The resource module212includes programs, modules, scripts, processes, or other objects that can be configured to generate resource requests and process resource responses. In some cases, the resource requests and resource responses can be HTTP requests and HTTP responses, respectively. The resource requests are addressed to an application server, e.g., the application server160shown inFIG. 1, to request resources. The resource responses can be generated from the application server160in response to the resource requests.

In one example, the application210can be an email application. The email application can execute resource access operations, e.g., synchronization operations, in the background. The email application can generate HTTP requests for synchronization updates. The HTTP requests can be processed by an email server. In response, the email server can send HTTP responses that include the latest received emails to the email application. In other examples, the application210can be a file transfer application that generates FTP messages.

The encryption module214includes programs, modules, scripts, processes, or other objects that can be configured to encrypt the resource requests before forwarding the encrypted resource requests to the system process220, and decrypt the encrypted resource responses received from the system process220before forwarding to the resource module212for further processing. In some cases, the encryption module214can establish one or more encryption credentials with a management server, e.g., the management server150shown inFIG. 1, and use the one or more encryption credentials for encrypting and decrypting operations. In some cases, the encryption module214can also establish a transmission path identifier with the management server. The transmission path identifier can be used by the proxy server to forward the encrypted request to the encryption server.FIGS. 4-5and associated descriptions provide additional details of these implementations.

The system process220includes programs, modules, scripts, processes, or other objects that can be configured to transmits external requests, e.g., HTTP requests, and receives external responses, e.g., HTTP responses for applications executing in background on the mobile device102. In some cases, the system process220can be part of an operating system of the mobile device102. In one example, the system process220can be a Uniform Resource Locator (URL) session.

Turning to a general description, a mobile device, e.g., the mobile device102, may include, without limitation, any of the following: computing device, mobile device, mobile electronic device, user device, mobile station, subscriber station, portable electronic device, mobile communications device, wireless modem, wireless terminal, television, printer or other peripheral, vehicle, or any other electronic device capable of sending and receiving data. Examples of a mobile device may include, without limitation, a cellular phone, personal data assistant (PDA), smart phone, laptop, tablet, personal computer (PC), pager, portable computer, portable gaming device, wearable electronic device, health/medical/fitness device, camera, or other mobile communications devices having components for communicating voice or data via a wireless communication network. The wireless communication network may include a wireless link over at least one of a licensed spectrum and an unlicensed spectrum. The term “mobile device” can also refer to any hardware or software component that can terminate a communication session for a user. In addition, the terms “user equipment,” “UE,” “user equipment device,” “user agent,” “UA,” “user device,” and “mobile device” can be used synonymously herein.

While elements ofFIG. 2are shown as including various component parts, portions, or modules that implement the various features and functionality, nevertheless, these elements may instead include a number of sub-modules, third-party services, components, libraries, and such, as appropriate. Furthermore, the features and functionality of various components can be combined into fewer components, as appropriate.

FIG. 3is a high-level architecture block diagram showing a server302coupled with a network350, according to an implementation. The described illustration is only one possible implementation of the described subject matter and is not intended to limit the disclosure to the single described implementation. Those of ordinary skill in the art will appreciate the fact that the described components can be connected, combined, or used in alternative ways, consistent with this disclosure.

The network350facilitates communications between the server302and other devices. The network350can be a wireless or a wireline network, a memory pipe, a hardware connection, or any internal or external communication paths between the components.

The server302includes a computing system configured to perform the algorithm described in this disclosure to process resource request. For example, the server302can be used to implement the proxy server120, the encryption server130, the proxy host140, the management server150, the application server160, or any combinations thereof shown inFIG. 1. In some cases, the algorithm can be implemented in an executable computing code, e.g., C/C++ executable codes. Alternatively, or in combination, the algorithm can be implemented in an application program, e.g., EXCEL. In some cases, the server302can include a standalone Linux system that runs batch applications. In some cases, the server302can include mobile or personal computers that run the application program.

The server302may include an input device, such as a keypad, keyboard, touch screen, microphone, speech recognition device, or another device that can accept user information, and/or an output device that conveys information associated with the operation of the server302, including digital data, visual and/or audio information, or a GUI.

The server302can serve as a client, network component, a server, a database or other persistency, or the like. In some implementations, one or more components of the server302may be configured to operate within a cloud-computing-based environment.

At a high level, the server302is an electronic computing device operable to receive, transmit, process, store, or manage data and information. According to some implementations, the server302may also include or be communicably coupled with an application server, e-mail server, web server, caching server, streaming data server, business intelligence (BI) server, and/or other server.

The server302can receive requests over network350from a client application (e.g., executing on a user device) and respond to the received requests by processing the said requests in an appropriate software application. In addition, requests may also be sent to the server302from internal users (e.g., from a command console or by another appropriate access method), external or third parties, other automated applications, as well as any other appropriate entities, individuals, systems, or computers.

Each of the components of the server302can communicate using a system bus303. In some implementations, any and/or all the components of the server302, both hardware and/or software, may interface with each other and/or the interface304over the system bus303, using an application programming interface (API)312and/or a service layer313. The API312may include specifications for routines, data structures, and object classes. The API312may be either computer language-independent or -dependent and refer to a complete interface, a single function, or even a set of APIs. The service layer313provides software services to the server302. The functionality of the server302may be accessible for all service consumers using this service layer. Software services, such as those provided by the service layer313, provide reusable, defined business functionalities through a defined interface. For example, the interface may be software written in JAVA, C++, or other suitable language providing data in Extensible Markup Language (XML) format or other suitable format. While illustrated as an integrated component of the server302, alternative implementations may illustrate the API312and/or the service layer313as stand-alone components in relation to other components of the server302. Moreover, any or all parts of the API312and/or the service layer313may be implemented as child or sub-modules of another software module, enterprise application, or hardware module, without departing from the scope of this disclosure.

The server302includes an interface304. Although illustrated as a single interface304inFIG. 3, two or more interfaces304may be used according to particular needs, desires, or particular implementations of the server302. The interface304is used by the server302for communicating with other systems in a distributed environment connected to the network350—(whether illustrated or not). Generally, the interface304comprises logic encoded in software and/or hardware in a suitable combination and operable to communicate with the network350. More specifically, the interface304may comprise software supporting one or more communication protocols associated with communications such that the network350or interface's hardware is operable to communicate physical signals.

The server302includes a processor305. Although illustrated as a single processor305inFIG. 3, two or more processors may be used according to particular needs, desires, or particular implementations of the server302. Generally, the processor305executes instructions and manipulates data to perform the operations of the server302. Specifically, the processor305executes the functionality required for provisioning enterprise services. In some cases, the processor305can include a data processing apparatus.

The server302also includes a memory306that holds data for the server302. Although illustrated as a single memory306inFIG. 3, two or more memories may be used according to particular needs, desires, or particular implementations of the server302. While memory306is illustrated as an integral component of the server302, in alternative implementations, memory306can be external to the server302.

The application307is an algorithmic software engine providing functionality according to particular needs, desires, or particular implementations of the server302, particularly with respect to functionality required for provisioning enterprise service. Although illustrated as a single application307, the application307may be implemented as multiple applications307on the server302. In addition, although illustrated as integral to the server302, in alternative implementations, the application307can be external to the server302.

Further, the terms “client,” “user,” and other appropriate terminology may be used interchangeably, as appropriate, without departing from the scope of this disclosure. Moreover, this disclosure contemplates that many users may use one server302, or that one user may use multiple servers302.

FIG. 4is a flow diagram showing an example process400for processing a resource request, according to an implementation. The process400can be implemented by the mobile device102, the management server150, the proxy host140, the proxy server120, the encryption server130, and the application server160as shown inFIG. 1. The process400shown inFIG. 4can also be implemented using additional, fewer, or different entities. Furthermore, the process400shown inFIG. 4can also be implemented using additional, fewer, or different operations, which can be performed in the order shown or in a different order. In some instances, an operation or a group of the operations can be iterated or repeated, for example, for a specified number of iterations or until a terminating condition is reached.

The example process400begins at410, where the application210and the management server150establish a secure communication channel. In some cases, the secure communication channel can be established according to a secure communication protocol, e.g., the Diffie-Hellman method. The application210and the management server150can establish a shared secret and derived keys that are used for communication between the application210and the management server150.

At420, the application210authenticates with the application server160. In some cases, the authentication is performed while the application210is executing on the foreground of the mobile device102. The authentication can be performed by verifying one or more login credentials. In one example, a user can enter a login name, a password, or a combination thereof using a user interface of the mobile device102. The login credentials can be one or more alphanumerical symbols, one or more user interface gestures such as a swipe, a touch, a tap, a double-tap, a flick, a slide, a pinch, or any combinations thereof. The application210can receive the login credentials, verify the login credentials, and send an authentication token to the application server160, an identity server associated with the application server160, or a combination thereof for authentication. If the authentication is successful, the application210can receive services from the application server160, including for example, transmitting resource requests while the application210is executing on the foreground of the mobile device102.

At430, the application210moves to background execution on the mobile device102. The move to background execution can be determined by operating system of the mobile device102, a user of the mobile device102, or a combination thereof. In one example, a user may select to download a batch of files from the application server160and switches to another application to execute on the foreground of the mobile device102while the download is performed in the background. In another example, the operating system may switch the application210in background if the application210has been idle, e.g., without receiving user input, for a configured period. The application210may also be moved to the background by an interruption, e.g., by an inbound phone call. In some cases, step430may be performed before, after, or concurrently with the step432. For example, the application210can move to background after the encryption credentials and the transmission path identifier are established.

At432, the application210establishes one or more encryption credentials and a transmission path identifier with the management server150. The one or more encryption credentials can include encryption keys that are used to encrypt resource requests generated by the application210and resource responses received by the application210. In some cases, the same encryption key can be used to encrypt both the resource requests and the resource responses. Alternatively, one or more encryption credentials can include a first encryption key that is used to encrypt resource request generated by the application210, and a second encryption key that is used to encrypt resource response received by the application210. In some cases, asymmetric cryptography can be used, where a public key of the recipient is used to encrypt the resource requests or resource responses and the private key of the recipient is used to decrypt the resource requests or resource responses. Alternatively or in combination, a symmetric key can be used to encrypt and decrypt the resource requests or resource responses. In some cases, asymmetric cryptography can be used to protect the transmission of the symmetric key. For example, the public key of the recipient can be used to encrypt the symmetric key and the private key of the recipient can be used to decrypt the symmetric key. The communications between the application210and the management server150can be exchanged using the secure communication channel established at step410discussed previously.

In the illustrated example, the encryption server130handles the decryption of the resource requests and the encryption of the resource responses. Therefore, at434, the management server150communicates with the encryption server130to provision the encryption credentials. In some cases, the steps434and432can be performed in a combined procedure, where the encryption server130and the application210exchange the encryption credentials through the management server150. For example, a secure communication protocol, e.g., the Diffie-Hellman protocol, can be used to distribute the public and private keys of the encryption server130and the application210. Alternatively or in combination, the management server150can set up the encryption credentials with the application210and send the encryption credentials to the encryption server130. In some cases, the management server150and the encryption server130have established a secure communication channel to be used for the communications between the management server150and the encryption server130, and the exchanges between the management server150and the encryption server130are encrypted. In some cases, the encryption credentials are specific to the application210, where different applications executing on the mobile device102may use different encryption credentials.

The transmission path identifier indicates a transmission path for the forwarding of encrypted requests. In some implementations, the transmission path identifier can be a random number. Alternatively or in combination, the transmission path identifier can be encrypted address of the application server160. The transmission path identifier can be used by the proxy server120to establish a mapping relationship between the encrypted requests received from the application210on the mobile device102and the encryption server130. For example, the application210can include the transmission path identifier in the encrypted request that is sent to the proxy server120. In some cases, the transmission path identifier can be included in the PATH field of the encrypted request. The proxy server120can detect that the received encrypted request including a particular transmission path identifier and forward the received encrypted request to particular encryption server, e.g., the encryption server130, that has a mapping relationship with the particular transmission path identifier. Alternatively or in combination, the transmission path identifier can be used to establish a pairing relationship for a request-response exchange. For example, the proxy server120can receive an encrypted request from the application210. The encrypted request can include a particular transmission path identifier. The proxy server120can receive an encrypted response from the encryption server130. The encryption response has the same transmission path identifier. The proxy server120can pair the request and response based on the transmission path identifier, and forward the encrypted response to the application210as a response to the encrypted request. Additional details of these implementations will be discussed later.

In some cases, the transmission path identifier can be established during a provisioning process. In one example, at440, the management server150sends a proxy request to the proxy host140. The proxy request indicates a request to set up a proxy for the communication between the application210and the encryption server130. At442, the proxy host140provisions the proxy at the proxy server120. At444, the proxy host140sends a proxy response to the management server150. The proxy response includes the address information of the proxy server120. In some implementation, the management server150can generate the transmission path identifier and send to the proxy server120, e.g., at440or at a different step. Alternatively or in combination, the encryption server130can generate the transmission path identifier and send to the management server150. The management server150can send the address information and the transmission path identifier to the application210. Other sequences of message exchanges between the management server150, the proxy host140, and the proxy server120can also be used to provision the proxy at the proxy server120and send the address of the proxy server120to the application210.

In some cases, during the provisioning process, a mapping relationship between the application210and the encryption server130can be stored at the proxy server120. In some cases, as discussed previously, the mapping relationship can be based on the transmission path identifier. During operation, the proxy server120can receive encrypted requests from the application210, determine the corresponding encryption server130based on the mapping relationship, and send the encrypted requests to the encryption server130. In some cases, the mapping relationship can be specific to the application210, where different applications that are executed on the same mobile devices can be mapped to the different encryption servers by using different transmission path identifiers. Alternatively or additionally, the mapping relationship can be specific to the mobile device102, where the different applications that are executed on the same mobile device can be mapped to the same encryption server130by using the same transmission path identifier. Alternatively or in combination, the proxy server120can be provisioned to use other information, e.g., an identifier of the application210, the mobile device102, or a combination thereof to establish a mapping relationship with an encryption server. In some cases, the management server150can update the provisioning by instructing the proxy server120to change the mapping relationship using an updated provisioning message.

Similar to the encryption credential establishment discussed previously, the transmission path identifier exchange part of the step432can be performed before, during, or after steps440,442, and444. In one example, the management server150generates the encryption credentials and transmission path identifier, either alone or together with the application210, and provisions the encryption server130and the proxy server120with the information. In this example, the transmission path identifier exchange part of the step432can be performed before steps434and440-444. In another example, the management server150provisions the proxy server120, and performs the steps440-444before sending the transmission path identifier to the application210to complete the step432.

At450, the application210generates a resource request and transmits the resource request to the system process220. In some cases, the resource request can be an HTTP GET, HTTP PUT, HTTP POST, or other HTTP message. The resource request is encrypted by the application210using the one or more encryption credentials, e.g., an encryption key, that were established at step432. The final target address of the resource request, i.e., the address of the application server160, is also encrypted and included in the encrypted resource request. The application210includes the transmission path identifier in the encrypted request, e.g., in the PATH field of an HTTP message. In some cases, the encrypted resource request can be formatted as an HTTP POST message.

In some cases, the application210can generate a resource request, and in response to the generation of the resource request, initiate the establishment of the encryption credentials and the transmission path identifier, e.g., step432as discussed previously. The application210can then use the established encryption credentials to encrypt the resource request and transmit the encrypted resource request to the system process220.

At452, the system process220transmits the encrypted resource request to the proxy server120. At454, the proxy server120, based on the mapping relationship established in step442, determines that the encrypted resource request should be forwarded to the encryption server130. The proxy server120forwards the encrypted resource request to the encryption server130. At456, the encryption server130, using the encryption credentials established at434, decrypts the encrypted resource request. The encryption server130determines the final target address of the resource request based on the decrypted resource request, and transmits the decrypted resource request to the application server160.

At460, the application server160generates a resource response in response to the resource request. In some cases, the resource response can be Hyptertext Mark-up Language (HTML) files, Cascading Stylesheet (CSS) or JavaScript (JS) files that are references by an HTML file, image files that are referenced by an HTML or CSS file or other resource information requested by the application210. The resource response can include files from an enterprise file repository, e.g., word processor files, presentation files, spreadsheets, database records of workflow or other enterprise data. In some cases, the resource response can be an OK reply to a posting of data. The application server160transmits the resource response to the encryption server130. At462, the encryption server130, using the encryption credentials established at434, encrypts the resource response and transmits the encrypted resource response to the proxy server120. At464, the proxy server120transmits the encrypted resource response to the system process220. In some cases, the encrypted server130can include the address of the mobile device102as the target address for the encrypted resource response to inform the proxy server120to send the encrypted resource response to the mobile device102.

At466, the system process220forwards the encrypted response to the application210. At470, the application210uses the encryption credentials to decrypt the encrypted response and access the resource. In some cases, an authentication procedure similar to the one discussed previously with respect to step420is performed before the resources can be accessed. Alternatively or in combination, a different authentication procedure can be performed. In some example, the request encryption credentials are stored on the mobile device102in a protected file. The protection can be obtained by encryption using a key derived from a password set by the end user at the mobile device102, e.g., an unlock password. When the encrypted response is received, the application210is resumed. The application210can prompt the user to enter the password. A key is derived from the entered password, and the request encryption credentials can be retrieved from the protected file using the derived key.

In some implementations, the management server150can act as a certification authority (CA) and signs electronic certificates that can be used for establishing a secure communication channel according to a Secure Sockets Layer (SSL) or a Transport Layer Security (TLS) protocol. During the step432, the management server150can transmit a client certificate to the application210. The management server150can also transmit a server certificate to encryption server130during the step434. The proxy server120can verify the authenticate application210, the encryption server130, or both, before forwarding the encrypted request and response between them. In these cases, the encryption server130or the proxy server120can be implemented using virtual machine instances.

In some implementations, instead of using the proxy server120to push the encrypted request to the encryption server130, e.g., as discussed in step452previously, a registration procedure can be used for the encryption server130to retrieve the encrypted request. In one example, the encryption server130can initiate a registration procedure by sending a registration request to the proxy server120. The registration request can include the transmission path identifier. In some cases, the registration request can be an HTTP message. The proxy server120can receive the encrypted request, e.g., at step450, determine the transmission path identifier included in the encrypted request, and send the encrypted request to the encryption server130as a response to the registration request, e.g., in a HTTP message. In some cases, more than one responses, e.g., multiple encrypted requests originated from the application210, can be sent as responses to one registration request. In some cases, the encryption server130can be implemented behind a firewall of an enterprise and the proxy server120can be implemented outside of the firewall. This registration approach provides a mechanism for the encryption server130to initiate the through-firewall communication with the proxy server120by initiating outbound communication from behind the firewall to a network node outside of the firewall, and therefore provides better security of the firewall protection of the enterprise network.

FIG. 5is a flow diagram showing an example method500for processing a resource request, according to an implementation. The method500can be implemented by the entities shown inFIG. 1, including e.g., the mobile device102, the proxy server120, the encryption server130, and the application server160. The method500shown inFIG. 5can also be implemented using additional, fewer, or different entities. Furthermore, the method500shown inFIG. 5can be implemented using additional, fewer, or different operations, which can be performed in the order shown or in a different order. In some instances, an operation or a group of operations can be iterated or repeated, for example, for a specified number of iterations or until a terminating condition is reached.

At502, a mobile device transmits an encrypted request to a proxy server. The encrypted request comprises a Hypertext Transfer Protocol (HTTP) request. The HTTP request is addressed to an application server that provides service to an application on the mobile device. The encrypted request is encrypted using an application-specific credential that is associated with the application. In some cases, the encrypted request is transmitted by a system process operating on the mobile device, and the system process is configured to transmit HTTP requests for a plurality of applications on the mobile device. The system process is configured to transmit HTTP requests for the plurality of applications that are executed in background. In some cases, the application-specific credential is shared between the application and an encryption server.

At504, the proxy server transmits the encrypted request to an encryption server. At506, the encryption server decrypts the encrypted request to obtain the HTTP request. At508, the encryption server transmits the HTTP request to the application server.

At510, in response to receiving the resource request, the application server transmits a resource response to the encryption server. At512, the encryption server encrypts the resource response and transmits the resource response to the proxy server. At514, the mobile device receives the encrypted response from the proxy server. The encrypted response comprises an HTTP response generated by the application server

Some of the subject matter and operations described in this disclosure can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures described in this disclosure and their structural equivalents, or in combinations of one or more of them. Some of the subject matter described in this disclosure can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions, encoded on a computer storage medium for execution by, or to control the operation of, data-processing apparatus. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagated signal, for example, a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer-storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or any combinations of computer-storage mediums.

The terms “data-processing apparatus,” “computer,” or “electronic computer device” encompass all kinds of apparatus, devices, and machines for processing data, including, by way of example, a programmable processor, a computer, a system on a chip, or multiple ones, or combinations of the foregoing. The apparatus can include special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). In some implementations, the data processing apparatus or special purpose logic circuitry (or a combination of the data processing apparatus or special purpose logic circuitry) may be hardware- or software-based (or a combination of both hardware- and software-based). The apparatus can optionally include code that creates an execution environment for computer programs, for example, code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of execution environments. The present disclosure contemplates the use of data processing apparatuses with or without conventional operating systems, for example LINUX, UNIX, WINDOWS, MAC OS, ANDROID, IOS, or any other suitable, conventional operating system.

Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read-only memory or a random-access memory, or both. A processor can include by way of example a programmable processor, a computer, a system on a chip, or multiple ones, or combinations of the foregoing. A processor can include special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit).