Controlled access to data in a sandboxed environment
AssigneeAirWatch LLC
InventorsVijaykumar Bhat, Ramani Panchapakesan, Ilanchezhian Kuppusamy, Gangadhar Nittala
Life of this patent
Estimating the term…
Abstract
Disclosed are various examples of systems and methods for transferring data between applications executing in sandboxed environments. In one example, a first application is in a first sandbox. A request for access to data is transmitted from the first application to a second application in a second sandbox. The data is stored in the second sandbox. The request is transmitted using a sandbox communications framework. The data is received using the sandbox communications framework. The data is encrypted. An encryption key is retrieved from an access-restricted data store.
Claims20
A system for data access in a sandboxed environment, the system comprising:
- a computing device;
- and
- a first application in a first sandbox, wherein the first application, when executed by a processor, causes the computing device to at least:
- transmit, to a second application in a second sandbox, a request for access to a data file stored in the second sandbox, the request being transmitted using a sandbox communications framework;
- receive, by the first application in the first sandbox, the data file from the second application in the second sandbox, the data file being received using the sandbox communications framework, wherein the data file is encrypted using an encryption key stored in an access-restricted data store separate from the first sandbox and the second sandbox;
- and
- retrieve the encryption key from the access-restricted data store, wherein access to the access-restricted data store is restricted to a group of applications that comprises the first application and the second application, and wherein an encryption algorithm to decrypt the data file is hardcoded into the first application based on at least one of:
- compilation of the first application or interpretation of the first application.
A method performed by a first application in a first sandbox, the method comprising:
- transmitting, to a second application in a second sandbox, a request for access to a data file stored in the second sandbox, the request being transmitted using a sandbox communications framework;
- receiving, by the first application in the first sandbox, the data file from the second application in the second sandbox, using the sandbox communications framework, wherein the data file is encrypted using an encryption key stored in an access-restricted data store separate from the first sandbox and the second sandbox;
- and
- retrieving the encryption key from the access-restricted data store, wherein access to the access-restricted data store is restricted to a group of applications that comprises the first application and the second application, and wherein an encryption algorithm to decrypt the data file is hardcoded into the first application based on at least one of:
- compilation of the first application or interpretation of the first application.
A non-transitory computer-readable medium comprising a first application in a first sandbox, wherein the first application, when executed by a processor, causes a computing device to at least:
- transmit, to a second application in a second sandbox, a request for access to a data file stored in the second sandbox, the request being transmitted using a sandbox communications framework;
- receive, by the first application in the first sandbox, the data file from the second application in the second sandbox, the data file being received using the sandbox communications framework, wherein the data file is encrypted using an encryption key stored in an access-restricted data store separate from the first sandbox and the second sandbox;
- and
- retrieve the encryption key from the access-restricted data store, wherein access to the access-restricted data store is restricted to a group of applications that comprises the first application and the second application, and wherein an encryption algorithm to decrypt the data file is hardcoded into the first application based on at least one of:
- compilation of the first application or interpretation of the first application.
Dependencies are inferred from the claim text.