Electronic devices having adaptive security profiles and methods for selecting the same

• US 10,574,667 B2
• Filed: 11/05/2018
• Issued: 02/25/2020
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Ingrassia, Jr., Michael I., Lee, Jeffery T.
• Primary Examiner(s): Holder, Bradley W
• Application Number:
  US16/181,113
• Publication Number:
  US 20190327244A1
• Time in Patent Office: 477 Days
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

Adaptive security profiles are supported on an electronic device. One or more security profiles may be automatically or selectively applied to the device based on the device'"'"'s location and one or more geographic zone definitions. The security profiles may be used to determine the level of authentication or number of invalid authentication attempts for a particular feature or application or set of features or applications.

Claims

1. A method comprising:

by an electronic device with one or more processors and memory;

detecting a request to initiate a respective security profile on the electronic device;

in response to detecting the request to initiate the respective security profile on the electronic device, enforcing the respective security profile on the electronic device;

while the respective security profile is enforced on the electronic device, detecting a request to access a first function or feature of the electronic device; and

in response to detecting the request to access the first function or feature of the electronic device;

in accordance with a determination that the respective security profile is a first security profile, controlling access to the first function or feature using a first set of restrictions that defines access control for a plurality of functions or features of the electronic device, including the first function or feature; and

in accordance with a determination that the respective security profile is a second security profile, controlling access to the first function or feature using a second set of restrictions, different than the first set of restrictions, that defines access control for the plurality of functions or features of the electronic device, including the first function or feature;

wherein the first set of restrictions requires authentication to access the first function or feature, and the second set of restrictions does not require authentication to access the first function or feature.

2. The method of claim 1, wherein the first function or feature of the electronic device is a function of the electronic device.

3. The method of claim 1, wherein the first function or feature of the electronic device is an application of the electronic device.

4. The method of claim 1, wherein the first function or feature of the electronic device is a file stored on the electronic device.

5. The method of claim 1, wherein the first set of restrictions allows a first number of authentication attempts when accessing the first function or feature, and the second set of restrictions allows a second number of authentication attempts, different than the first number of authentication attempts, when accessing the first function or feature.

6. The method of claim 1, further comprising:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions, detecting a request to initiate the second security profile on the electronic device; and

in response to detecting the request to initiate the second security profile on the electronic device, enforcing the second security profile on the electronic device, wherein access to functions or features of the electronic device is controlled using the second set of restrictions.

7. The method of claim 1, wherein the first security profile and the second security profile are user-defined.

8. The method of claim 1, further comprising:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions;

detecting a request to access a respective function or feature of the electronic device;

in response to detecting the request to access the respective function or feature of the electronic device;

in accordance with a determination that the respective function or feature is a second function or feature, allowing access to the second function or feature without requiring authentication; and

in accordance with a determination that the respective function or feature is the first function or feature, requiring authentication before allowing access to the first function or feature.

9. An electronic device comprising:

one or more processors; and

memory storing instructions, which when executed by the one or more processors, cause the electronic device to;

detect a request to initiate a respective security profile on the electronic device;

in response to detecting the request to initiate the respective security profile on the electronic device, enforce the respective security profile on the electronic device;

while the respective security profile is enforced on the electronic device, detect a request to access a first function or feature of the electronic device; and

in response to detecting the request to access the first function or feature of the electronic device;

in accordance with a determination that the respective security profile is a first security profile, control access to the first function or feature using a first set of restrictions that defines access control for a plurality of functions or features of the electronic device, including the first function or feature; and

in accordance with a determination that the respective security profile is a second security profile, control access to the first function or feature using a second set of restrictions, different than the first set of restrictions, that defines access control for the plurality of functions or features of the electronic device, including the first function or feature,

wherein the first set of restrictions requires authentication to access the first function or feature, and the second set of restrictions does not require authentication to access the first function or feature.

10. The electronic device of claim 9, wherein the first function or feature of the electronic device is a function of the electronic device.

11. The electronic device of claim 9, wherein the first function or feature of the electronic device is an application of the electronic device.

12. The electronic device of claim 9, wherein the first function or feature of the electronic device is a file stored on the electronic device.

13. The electronic device of claim 9, wherein the first set of restrictions allows a first number of authentication attempts when accessing the first function or feature, and the second set of restrictions allows a second number of authentication attempts, different than the first number of authentication attempts, when accessing the first function or feature.

14. The electronic device of claim 9, the instructions further causing the electronic device to:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions, detect a request to initiate the second security profile on the electronic device; and

in response to detecting the request to initiate the second security profile on the electronic device, enforce the second security profile on the electronic device, wherein access to functions or features of the electronic device is controlled using the second set of restrictions.

15. The electronic device of claim 9, wherein the first security profile and the second security profile are user-defined.

16. The electronic device of claim 9, the instructions further causing the electronic device to:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions;

detect a request to access a respective function or feature of the electronic device;

in response to detecting the request to access the respective function or feature of the electronic device;

in accordance with a determination that the respective function or feature is a second function or feature, allow access to the second function or feature without requiring authentication; and

in accordance with a determination that the respective function or feature is the first function or feature, require authentication before allowing access to the first function or feature.

17. A non-transitory computer readable storage medium storing instructions, which when executed by a processor of an electronic device, cause the electronic device to:

detecting a request to initiate a respective security profile on the electronic device;

in response to detecting the request to initiate the respective security profile on the electronic device, enforce the respective security profile on the electronic device;

while the respective security profile is enforced on the electronic device, detect a request to access a first function or feature of the electronic device; and

in response to detecting the request to access the first function or feature of the electronic device;

in accordance with a determination that the respective security profile is a first security profile, controlling access to the first function or feature using a first set of restrictions that defines access control for a plurality of functions or features of the electronic device, including the first function or feature; and

in accordance with a determination that the respective security profile is a second security profile, controlling access to the first function or feature using a second set of restrictions, different than the first set of restrictions, that defines access control for the plurality of functions or features of the electronic device, including the first function or feature,

wherein the first set of restrictions requires authentication to access the first function or feature, and the second set of restrictions does not require authentication to access the first function or feature.

18. The non-transitory computer readable storage medium of claim 17, wherein the first function or feature of the electronic device is a function of the electronic device.

19. The non-transitory computer readable storage medium of claim 17, wherein the first function or feature of the electronic device is an application of the electronic device.

20. The non-transitory computer readable storage medium of claim 17, wherein the first function or feature of the electronic device is a file stored on the electronic device.

21. The non-transitory computer readable storage medium of claim 17, wherein the first set of restrictions allows a first number of authentication attempts when accessing the first function or feature, and the second set of restrictions allows a second number of authentication attempts, different than the first number of authentication attempts, when accessing the first function or feature.

22. The non-transitory computer readable storage medium of claim 17, the instructions further causing the electronic device to:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions, detect a request to initiate the second security profile on the electronic device; and

in response to detecting the request to initiate the second security profile on the electronic device, enforce the second security profile on the electronic device, wherein access to functions or features of the electronic device is controlled using the second set of restrictions.

23. The non-transitory computer readable storage medium of claim 17, wherein the first security profile and the second security profile are user-defined.

24. The non-transitory computer readable storage medium of claim 17, the instructions further causing the electronic device to:

while the first security profile is enforced on the electronic device, wherein access to functions or features of the electronic device is controlled using the first set of restrictions;

detect a request to access a respective function or feature of the electronic device;

in response to detecting the request to access the respective function or feature of the electronic device;

in accordance with a determination that the respective function or feature is a second function or feature, allow access to the second function or feature without requiring authentication; and

in accordance with a determination that the respective function or feature is the first function or feature, require authentication before allowing access to the first function or feature.