AppTree Revolution Release 5 Architecture & Deployment Options

To better understand the changes in the Release 5 architecture, we’ll first revisit how the previous Release 4 is deployed.

Release 4 Deployment Options

In Release 4 and earlier, AppTree Software’s app platform was available as an on-premise enterprise software package. It consisted of an application server, web services and custom APIs to communicate with existing enterprise software, and a database schema that was placed in the customer’s existing enterprise database.

There were three common configurations depending on customer security requirements:

a. Customer could install the AppTree Revolution app server in their DMZ and allow connections from the public internet. R4 Public Internet

b. Customer could install the AppTree Revolution app server in a secure segment of their network and install a VPN client on each mobile device. R4 VPN

c. Customer could install the AppTree Revolution app server in a secure segment of their network and require that mobile clients only connect from a secure wifi access point that was within the secure network. R4 WiFi

In most cases, AppTree Revolution customers had to compromise between access and security. In some cases, use of the platform was heavily restricted in order to comply with existing security mandates at a given customer site.

Security and the Release 5 Architecture

Release 5 was redesigned to offer additional deployment options. While it can still be installed on-premise and run completely on customer owned & supported hardware and networks in configurations similar to R4, the new R5 platform can now be run in the ‘cloud’.

This is a significant improvement form a security perspective. The customer no longer has to expose their network to the public internet in order for mobile devices to access R5 apps from cellular data networks and non-secure Wi-Fi networks. In Release 5, AppTree Revolution Cloud can be used to allow access to your users from public networks, but restrict access to your network to just a single secure point of entry form a single source. R5 Architecture

Another significant improvement in the R5 architecture is separating the AppTree Revolution configuration data from your enterprise software database. AppTree Revolution uses Oracle Corporation’s Secure Cloud Database Services for our metadata repository. This means that the R5 application server never has to connect directly to your database. All connections to your data can be made through your web services and APIs, giving you an additional layer of control and security. In addition to the deployment architecture, R5 has been re-engineered to be more secure at the platform level:

  • We encrypt traffic end-to-end between the mobile clients and the app server.
  • We prevent our mobile clients for launching on rooted or jail broken devices. This is to stop a hacker from installing software on the mobile client to read packets being sent to and from the application before they are encrypted by the transport layer.
  • We use a ‘morphing’ API key system so that in the event that the device security is compromised and network traffic is decoded, the internal API key used to communicate with the server is only valid for a single call. As soon as it’s viewed, it’s already expired and a new API key is use.
  • We do not store user credentials on the mobile device. In previous releases, we stored user credentials in the ‘keychain’ on the device. Even though this was encrypted, it was still a potential security threat in the event the keychain was hacked. In Release 5, we generate an encrypted token and that the only thing related to the session credentials that stored on the device.
  • We use code obfuscation practices so that if the compiled application is cracked open using application development tools, the global variables are disguised to avoid leaving hints about how the app communicates.

AppTree Revolution complies with the best practices and recommendations described in detail by the The Open Web Application Security Project (OWASP). More information about these practices can be found at www.owasp.org.

To ensure our security measures are working as intended, we have the app platform penetration tested by a respected and internationally recognized security lab. We then continually update and improve our security mechanisms based on their feedback and changes in exploits and hacking techniques.

Comment