Using permissions to allocate device resources to an application

• US 20030051169A1
• Filed: 08/13/2002
• Published: 03/13/2003
• Est. Priority Date: 08/13/2001
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Sprigg, Stephen A., Lundblade, Laurence
• Granted Patent: US 7,743,407 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Resources to a device are granted access to an application based on privileges associated with the application. A permission list may be created by a server. The permission list may be created using information from authorities, entities, or parties and information about the device resources. The permission list indicates what device resources the application may access. During application execution when the application requests a resource, a control program executing on the device may be used to check the permission list associated with the application to determine if the application may access the resource. The control program can then grant or deny access based on the privileges defined in the permission list. Digital signatures may be used to detect modifications to the application and/or permission list. In addition, multiple permission lists may be associated with the same application.

Claims

1. A method for storing an application on a device, comprising the steps of:

receiving an application at the device;

receiving a permission list at the device, wherein the permission list indicates a resource the application may access on the device; and

storing the application and permission list on the device.

2. The method of claim 1, wherein the permission list is created using input from an authority.

3. The method of claim 2, wherein the authority is a separate entity from the device.

4. The method of claim 1 further comprising the steps of:

executing the application on the device; and

granting the application access to the device'"'"'s resource based on the permission list.

5. The method of claim 1 further comprising the step of receiving a modification detection technique, wherein the digital signature is created based on information from the permission list.

6. The method of claim 1, wherein the device is a wireless device.

26. The method of claim 5, wherein the modification detection technique is created based on information from the application.

7. A device for executing an application, comprising:

a control program operable to interface between the handset resources and an application,

wherein the control program is operable to receive a request for a device resource from an application and to grant the application access to the device resource based on data contained in a permission list associated with the application.

8. The device of claim 7, wherein the device is a wireless device.

9. The device of claim 7, wherein the control program is further operable to evaluate a digital signature associated with the permission list.

10. A method of allowing access to a device resource, comprising the steps of:

receiving a request for the device resource from an application;

evaluating a permission list associated with the application, wherein the permission list indicates the resources the application can access; and

granting the application access to the device resource based on the indication in the permission list.

11. The method of claim 10, further comprising the step of:

receiving a digital signature associated with at least the permission list; and

evaluating the digital signature to determine whether the permission list was modified.

12. The method of claim 10, further comprising the steps of:

denying the application access to the device resource based on the indication in the permission list.

13. The method of claim 10, wherein the device resource is located on a second device connected to the device.

14. The method of claim 10, wherein the permission list was received from a server and the server created the permission list based on requirements from an authority.

15. A method of allowing access to a device resource, comprising the steps of:

receiving a request for the device resource from an application;

evaluating a permission list associated with the application, wherein the permission list indicates the resources the application can access; and

denying the application access to the device resource based on the indication in the permission list.

16. A method of associating a permission list with an application, comprising the steps of:

receiving an application;

receiving at least one or more privilege rights associated with one or more device resources, wherein the privilege right indicates access to the associated device resource; and

creating a permission list using the one or more privilege rights and a field associated with each of the one or more device resources,

wherein, the permission list is associated with an application and is used to evaluate whether the application may access the one or more device resources.

17. The method of claim 16 further comprising the step of transmitting the permission list to a device.

18. The method of claim 17 further comprising creating a digital signature using information in the permission list and transmitting the digital signature to the device.

19. The method of claim 16 further comprising the steps of:

receiving at least one or more privilege rights associated with one or more device resources for a second device, wherein the privilege right indicates access to the associated second device resource; and

creating a permission list using the one or more privilege rights and a field associated with each of the one or more second device resources,

wherein, the permission list is associated with the application and is used to evaluate whether the application may access the one or more second device resources.

20. A system for storing an application on a device, comprising:

means for receiving an application at the device;

means for receiving a permission list at the device, wherein the permission list indicates a resource the application may access on the device; and

means for storing the application and permission list on the device.

21. A system for allowing access to a device resource, comprising:

means for receiving a request for the device resource from an application;

means for evaluating a permission list associated with the application, wherein the permission list indicates the resources the application can access; and

means for granting the application access to the device resource based on the indication in the permission list.

22. A system for associating a permission list with an application, comprising:

means for receiving an application;

means for receiving at least one or more privilege rights associated with one or more device resources, wherein the privilege right indicates access to the associated device resource; and

means for creating a permission list using the one or more privilege rights and a field associated with each of the one or more device resources,

wherein, the permission list is associated with an application and is used to evaluate whether the application may access the one or more device resources.

23. A computer-readable medium containing computer-executable instructions for storing an application on a device that when executed perform a method, comprising the steps of:

receiving an application at the device;

receiving a permission list at the device, wherein the permission list indicates a resource the application may access on the device; and

storing the application and permission list on the device.

24. A computer-readable medium containing computer-executable instructions for allowing access to a device resource that when executed perform a method, comprising the steps of:

receiving a request for the device resource from an application;

evaluating a permission list associated with the application, wherein the permission list indicates the resources the application can access; and

granting the application access to the device resource based on the indication in the permission list.

25. A computer-readable medium containing computer-executable instructions for associating a permission list with an application that when executed perform a method, comprising the steps of:

receiving an application;

receiving at least one or more privilege rights associated with one or more device resources, wherein the privilege right indicates access to the associated device resource; and

creating a permission list using the one or more privilege rights and a field associated with each of the one or more device resources,

wherein, the permission list is associated with an application and is used to evaluate whether the application may access the one or more device resources.