Methods and system for implementing a secure lock screen

• US 10,223,540 B2
• Filed: 09/29/2014
• Issued: 03/05/2019
• Est. Priority Date: 05/30/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Shepherd, Matthew E., Shaffer, Joshua H., Zhang, Chendi, Schimpf, Daniel O., Nielsen, Benjamin E., Zwarich, Cameron W.
• Primary Examiner(s): Weber, Joy M
• Application Number:
  US14/500,940
• Publication Number:
  US 20150347776A1
• Time in Patent Office: 1,618 Days
• Field of Search: 715807, 715708
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance

Abstract

Disclosed herein is a technique for implementing a secure lock screen on a computing device. The secure lock screen is configured to permit particular applications to display their content—such as main user interfaces (UIs)—while maintaining a desired overall level of security on the computing device. Graphics contexts, which represent drawing destinations associated with the applications, are tagged with entitlement information that indicates whether or not each graphics context should be displayed on the computing device when the computing device is in a locked-mode. Specifically, an application manager tags each application that is initialized, where the tagging is based on a level of entitlement possessed by the application. In turn, a rendering server that manages the graphics contexts can identify the tagged entitlement information and display or suppress the content of the applications in accordance with their entitlements.

Claims

1. A method for implementing a secure lock screen, the method comprising, at a computing device that is in a locked-mode:

receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates;

a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and

a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;

receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates;

a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and

a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and

displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

2. The method of claim 1, wherein:

the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and

the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

3. The method of claim 1, wherein the threshold is based on a user preference.

4. The method of claim 1, wherein the first application causes an issuance of the second request to launch the second application.

5. The method of claim 1, further comprising:

transitioning into the locked-mode prior to receiving the first request.

6. The method of claim 1, wherein the first graphics context is a drawing destination associated with the first application, and the first graphics context is rendered by a rendering server included in the computing device.

7. The method of claim 6, wherein, when the second depth level does not satisfy the threshold, the method further comprises:

assigning a property to the second graphics context that indicates to the rendering server that the second graphics context is not visible.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to implement a secure lock screen while the computing device is in a locked-mode, by carrying out steps that include:

receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates;

a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and

a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;

receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates;

a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and

a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and

displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

9. The non-transitory computer readable storage medium of claim 8, wherein:

the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and

the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

10. The non-transitory computer readable storage medium of claim 8, wherein the threshold is based on a user preference.

11. The non-transitory computer readable storage medium of claim 8, wherein the first application causes an issuance of the second request to launch the second application.

12. The non-transitory computer readable storage medium of claim 8, wherein the first graphics context is a drawing destination associated with the first application, and the first graphics context is rendered by a rendering server included in the computing device.

13. The non-transitory computer readable storage medium of claim 12, wherein, when the second depth level does not satisfy the threshold, the steps further include:

assigning a property to the second graphics context that indicates to the rendering server that the second graphics context is not visible.

14. A computing device configured to implement a secure lock screen while the computing device is in a locked-mode, the computing device comprising:

a display device;

a processor; and

a memory configured to store instructions that, when executed by the processor, cause the computing device to carry out steps that include;

receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates;

a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and

a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;

receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates;

a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and

a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and

displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

15. The computing device of claim 14, wherein:

the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and

the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

16. The computing device of claim 14, wherein the threshold is based on a user preference.

17. The computing device of claim 14, wherein the first application causes an issuance of the second request to launch the second application.

18. The computing device of claim 14, wherein the first graphics context is a drawing destination associated with the first application, and the first graphics context is rendered by a rendering server included in the computing device.

19. The computing device of claim 18, wherein, when the second depth level does not satisfy the threshold, the steps further include:

assigning a property to the second graphics context that indicates to the rendering server that the second graphics context is not visible.

20. The computing device of claim 14, wherein the steps further include:

transitioning into the locked-mode prior to receiving the first request.