# US 2014/0208100 A1 · Provisioning an app on a device and implementing a keystore

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0208100 A1
- Document ID: US20140208100A1
- Status: Published application
- Kind: A1
- Application number: 14/167,418
- Filed: 2014-01-29
- Published: 2014-07-24
- Earliest claimed: 2011-03-21
- Assignees: Mocana Corporation
- Applicants: Mocana Corporation
- Inventors: H. Richard KENDALL
- Web page: https://patentgrep.com/patent/US20140208100A1

## CPC

- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04W 12/06: Authentication
- H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications
- G06F 2221/2149: Restricted operating environment
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04W 12/08: Access security
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A keystore is installed on a mobile app where the keystore is created and provisioned on a server, such as an app wrapping server, under the control of an enterprise. A generic (non-provisioned) wrapped app is installed on a device. The app prompts the user to enter a passphrase. When the user does this, an app keystore is created. It has a user section and a table of contents. The keystore files are hashed, creating “first” keystore hash values. The first keystore hash values are stored in the TOC. The TOC is then hashed, creating a TOC hash value. The passphrase entered by the user is then combined with the TOC hash value. This creates a “first” master passphrase for the keystore. The keystore is then transmitted to the device where it is installed in the generic (non-provisioned) wrapped app.

## Claims

### Claim 1

A method of installing a keystore in an app, the method comprising:
prompting a user to select a passphrase for the app;
creating an app keystore with a user section and a table of contents (“TOC”);
hashing keystore files, thereby creating a first keystore files hash value;
storing first keystore files hash values in the TOC;
hashing the TOC, thereby creating a TOC hash value;
combining the passphrase with the TOC hash value, thereby creating a first master passphrase for the keystore; and
transmitting the keystore to the app on a device, wherein the keystore is installed in the app.

### Claim 2 (depends on 1)

A method as recited in claim 1 further comprising:
embedding user and device specific policy files into the user section of the app keystore on an app server.

### Claim 3 (depends on 1)

A method as recited in claim 1 further comprising:
upon execution of the app on the device, hashing a user section of the TOC in the keystore creating a user section TOC hash value, wherein said hashing is done by the app.

### Claim 4 (depends on 1)

A method as recited in claim 1 further comprising:
combining the passphrase with user section TOC hash value to create a second master passphrase.

### Claim 5 (depends on 1)

A method as recited in claim 1 further comprising:
hashing the keystore, thereby creating a second keystore hash value.

### Claim 6 (depends on 5)

A method as recited in claim 5 further comprising:
comparing the second keystore hash value with the first keystore hash value.

### Claim 7 (depends on 1)

A method as recited in claim 1 wherein a cleartext version of the TOC is maintained.

### Claim 8 (depends on 1)

A method as recited in claim 1 further comprising:
initiating a challenge and response protocol.

### Claim 9

A method of executing an app on a mobile device, the method comprising:
receiving as input a user-selected passphrase, entered by a user to execute the app;
hashing a table-of-content (“TOC”) file in a keystore in the app, thereby creating a TOC file hash value;
combining the passphrase with the TOC file hash value to create a first master passphrase;
unlocking the keystore in the app using the first master passphrase;
hashing keystore files, thereby creating second keystore file hash values;
comparing the second keystore file hash values with previously created first keystore file hash values; and
determining whether any of said first keystore file hash values have been altered.

### Claim 10 (depends on 9)

A method as recited in claim 9 further comprising:
enabling the user to execute the app if it is determined that none of the first keystore file hash values have been altered.