Method and apparatus for differentiated access control

• US 10,318,764 B2
• Filed: 06/27/2016
• Issued: 06/11/2019
• Est. Priority Date: 09/24/2010
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Kenneth, Bender, Christopher Lyle, Little, Herbert Anthony, Brown, Michael Stephen
• Primary Examiner(s): Dailey, Thomas J
• Application Number:
  US15/193,614
• Publication Number:
  US 20160306987A1
• Time in Patent Office: 1,079 Days
• Field of Search: None
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method for differentiated access control on a computing device having a connection with a second device, the method checking whether a timer has expired on the second device or if a connection is lost to the second device; and preventing at least one of the plurality of application subsets from being launched or enabled if the timer has expired on the second device or the connection is lost to the second device.

Claims

1. A method for providing differentiated access control on a computing device having a connection with a second device, the method comprising:

receiving, at the computing device, an input to start an application belonging to a first of a plurality of application subsets, the starting the application comprising executing the application on the computing device;

receiving, at the computing device, a user input to unlock the second device;

verifying the user input with the second device to unlock the first of the plurality of application subsets;

checking whether a timer has expired on the second device or—

whether a connection is lost to the second device, and based on expiration of the timer or loss of the connection to the second device, locking the first of the plurality of applications subsets on the computing device, the locking including;

allowing access to applications within at least a second of the plurality of application subsets, including allowing launching and enabling of at least one application within the at least the second of the plurality of application subsets;

preventing each application of the first of the plurality of application subsets from being launched on the computing device while the first of the plurality of applications subsets is locked; and

disabling a graphical user interface associated with each application of the first of the plurality of application subsets

wherein the timer is associated with a countdown timer managed by the second device for decreasing time.

2. The method of claim 1, wherein each of the plurality of application subsets utilizes a separate file system in memory of the computing device.

3. The method of claim 1, wherein the disabling comprises changing a graphical representation of an application window or icon displayed on the computing device.

4. The method of claim 3, wherein the graphical representation is a grid style and the changing replaces the application window with an obscured or locked graphic.

5. The method of claim 1, wherein the disabling comprises making an application window inaccessible.

6. The method of claim 1, wherein the first of the plurality of application subsets includes applications designated as corporate applications.

7. The method of claim 6, wherein the designating is based on an enterprise information technology policy.

8. The method of claim 6, wherein the designating is done on the computing device.

9. The method of claim 1, further comprising unlocking each application associated with the first of the plurality of applications subsets in response to successful authentication.

10. A computing device comprising:

a processor;

a communications subsystem;

a user interface; and

memory,

wherein the computing device communicates with a second device, and wherein the computing device is configured to;

receive an input to start an application belonging to a first of a plurality of application subsets, the starting the application comprising executing the application on the computing device;

receive a user input to unlock the second device;

verify the user input with the second device to unlock the first of the plurality of application subsets;

determine whether a timer has expired on the second device or whether a connection is lost to the second device, and based on expiration of the timer or loss of the connection to the second device, lock the first of the plurality of applications subsets on the computing device, the locking including;

allowing access to applications within at least a second of the plurality of application subsets, including allowing launching and enabling of at least one application within the at least the second of the plurality of application subsets;

preventing each application of the first of the plurality of application subsets from being launched on the computing device while the first of the plurality of applications subsets is locked; and

disabling a graphical user interface associated with each application of the first of the plurality of application subsets

wherein the timer is associated with a countdown timer managed by the second device, for decreasing time.

11. The computing device of claim 10, wherein each of the plurality of application subsets utilizes a separate file system in memory of the computing device.

12. The computing device of claim 10, wherein the computing device is configured to disable a graphical user interface by changing a graphical representation of an application window or icon displayed on the computing device.

13. The computing device of claim 12, wherein the graphical representation is a grid style and the changing replaces the application window with an obscured or locked graphic.

14. The computing device of claim 10, wherein the computing device is configured to disable a graphical user interface by making an application window inaccessible.

15. The computing device of claim 10, wherein the computing device comprises at least one of a mobile device, smartphone, a tablet computer, a desktop computer, or a laptop computer.

16. A non-transitory computer readable medium for storing instruction code, which, when executed by a processor of a computing device are configured to provide differentiated access control on the computing device having a connection with a second device, the instruction code comprising instructions for:

receiving an input to start an application belonging to a first of a plurality of application subsets, the starting the application comprising executing the application on the computing device;

receiving a user input to unlock the second device;

verifying the user input with the second device to unlock the first of the plurality of application subsets;

checking whether a timer has expired on the second device or whether a connection is lost to the second device, and based on expiration of the timer or loss of the connection to the second device, locking the first of the plurality of applications subsets on the computing device, the locking including;

allowing access to applications within at least a second of the plurality of application subsets, including allowing launching and enabling of at least one application within the at least the second of the plurality of application subsets;

preventing each application of the first of the plurality of application subsets from being launched on the computing device while the first of the plurality of applications subsets is locked; and

disabling a graphical user interface associated with each application of the first of the plurality of application subsets

wherein the timer is associated with a countdown timer managed by the second device, for decreasing time.

17. The non-transitory computer readable medium of claim 16, wherein each of the plurality of application subsets utilizes a separate file system in memory of the computing device.

18. The non-transitory computer readable medium of claim 16, wherein the disabling comprises changing a graphical representation of an application window or icon displayed on the computing device.

19. The non-transitory computer readable medium of claim 18, wherein the graphical representation is a grid style and the changing replaces the application window with an obscured or locked graphic.

20. The non-transitory computer readable medium of claim 16, wherein the disabling comprises making an application window inaccessible.

21. The non-transitory computer readable medium of claim 16, wherein the first of the plurality of application subsets includes applications designated as corporate applications.

22. The non-transitory computer readable medium of claim 21, wherein the designating is based on an enterprise information technology policy.

23. The non-transitory computer readable medium of claim 21, wherein the designating is done on the computing device.

24. The non-transitory computer readable medium of claim 16, wherein the instruction code further comprises instructions unlocking each application associated with the first of the plurality of applications subsets in response to successful authentication.