Selectively wiping a remote device

• US 10,162,983 B2
• Filed: 03/31/2017
• Issued: 12/25/2018
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Kenneth, Brown, Michael Stephen, Little, Herbert Anthony, Totzke, Scott William
• Primary Examiner(s): Chen, Shin-Hon (Eric)
• Application Number:
  US15/475,901
• Publication Number:
  US 20170206378A1
• Time in Patent Office: 634 Days
• Field of Search: None
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system and method for selectively securing data from unauthorized access on a client device storing a plurality of data types with reference to an authorization level indicated in a command. A command is received at a client device comprising an authorization level indicator. Based on at least one predefined rule, which may be implemented in an IT policy stored at the client device, each of the plurality of data types to be secured is determined, and then the data corresponding to those types is secured. The data may be secured by encrypting and/or deleting the data at the client device. The predefined rules associated with each authorization level may be configured by a user or administrator having an authorization level that exceeds the associated authorization level.

Claims

1. A method of securing data on a client device, the client device storing data of a plurality of data types, the method comprising:

determining, at a server, an authorization level for a command issuer when the command issuer logs into the server, the command issuer being associated with one of a plurality of authorization levels;

creating, at the server, a securing command for securing at least one data type based on the determined authorization level associated with the command issuer by;

determining that a subset of data types in the plurality of data types is available to be secured based on the determined authorization level associated with the command issuer;

receiving a selection of the at least one data type from the determined subset of data types; and

generating the securing command for securing the at least one data type from the subset of data types; and

sending the securing command from the server to the client device.

2. The method of claim 1, wherein the selection includes selecting the at least one data type based on received command issuer input.

3. The method of claim 1, wherein the securing includes deleting the at least one data type.

4. The method of claim 1, wherein the securing includes encrypting the at least one data type.

5. The method of claim 1, wherein the command issuer is a user, and wherein the at least one data type is personal data associated with the user.

6. The method of claim 5, wherein a second data type is not a data type in a subset of data types available to be secured, and wherein the second data type is not associated with the created securing command.

7. The method of claim 1, wherein the command issuer is an administrator, and wherein the at least one data type is not personal data.

8. The method of claim 7, wherein a second data type is personal data, and wherein the second data type is not associated with the created securing command.

9. The method of claim 1, wherein the at least one data type includes message data.

10. The method of claim 1, wherein the at least one data type includes applications, or data files created at the client device or received at the client device that are personal to a user.

11. The method of claim 1, wherein the at least one data type is not user-created data, and wherein creating the securing command for securing the at least one data type includes:

determining that the determined authorization level associated with the command issuer is an administrator authorization level to secure data that is not user-created data but preventing the command issuer from securing user-created data.

12. A server comprising:

a memory;

a communication subsystem; and

a processor operatively connected to the memory and the communication subsystem, the processor being configured to;

determine an authorization level for a command issuer when the command issuer logs into the server, the command issuer being associated with one of a plurality of authorization levels;

create a securing command for securing at least one data type based on the determined authorization level associated with the command issuer by;

determining that a subset of data types in the plurality of data types is available to be secured based on the determined authorization level associated with the command issuer;

receiving a selection of the at least one data type from the determined subset of data types; and

generating the securing command for securing the at least one data type from the subset of data types; and

send the securing command from the server to a client device.

13. The server of claim 12, wherein the selection includes the processor being configured to select the at least one data type based on a received selection from the command issuer.

14. The server of claim 12, wherein the securing includes deleting the at least one data type.

15. The server of claim 12, wherein the securing includes encrypting the at least one data type.

16. The server of claim 12, wherein the command issuer is a user, and wherein the at least one data type is personal data associated with the user.

17. The server of claim 16, wherein a second data type is not a data type in a subset of data types available to be secured, and wherein the second data type is not associated with the created securing command.

18. The server of claim 12, wherein the command issuer is an administrator, and wherein the at least one data type is not personal data.

19. The server of claim 18, wherein a second data type is personal data, and wherein the second data type is not associated with the created securing command.

20. A non-transitory computer-readable medium storing code which, when executed by one or more processor of a server, cause the server to perform operations comprising:

determining an authorization level for a command issuer when the command issuer logs into the server, the command issuer being associated with one of a plurality of authorization levels;

creating a securing command for securing at least one data type based on the determined authorization level associated with the command issuer by;

determining that a subset of data types in the plurality of data types is available to be secured based on the determined authorization level associated with the command issuer;

receiving a selection of the at least one data type from the determined subset of data types; and

generating the securing command for securing the at least one data type from the subset of data types; and

sending the securing command from the server to a client device.