Method and system for managing delayed user authentication

• US 20060123056A1
• Filed: 12/14/2005
• Published: 06/08/2006
• Est. Priority Date: 07/30/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Barker, Melanie, Emery, Jeffrey Kenneth, Darbha, Sriram
• Granted Patent: US 7,784,088 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4184 providing storage capabilities, e.g. memory stick
• CPC Class Codes: H04N 21/422 Input-only peripherals , i.e. input devices connected to specially adapted client devices, e.g. global positioning system [GPS] input devices also receiving signals from specially adapted client devices H04N21/4104
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08

Abstract

A system and methods for coordinating the operation of a client security module and a host security module on a mobile electronic device. The modules communicate with each other through a platform abstraction layer using application programming interfaces to coordinate their activities. In particular, on start-up of the device, the host security module obtains user authorization input from a user and passes the input to a client operating system for validation. Once validated, the host security module unlocks the host-side of the device. At the same time, the client operating system sends a notice or request to the client-side virtual machine requesting that the client-side be unlocked. Once the virtual machine is initialized and available it launches the client security module and unlocks the client-side. During the delay while the virtual machine loads, the user is given access only to the host applications.

Claims

1. A method for unlocking a mobile electronic device, the device having a host operating system and a client operating system layer, the host operating system running a host security module, the device including a virtual machine running on the client operating system layer, the device including memory storing protected client data, the host operating system supporting at least one host application, the method being initiated on start-up of the device, which triggers the launch of the virtual machine, the method comprising the steps of:

after the initiation of start-up and before completion of the launch of the virtual machine,

the host security module receiving user authentication input;

passing the user authentication input from the host security module to the client operating system layer with a validation request;

the client operating system layer authenticating the user authentication input and notifying the host security module of a successful authentication;

the host security module unlocking access to the at least one host application, thereby enabling user access to the at least one host application;

the client operating system layer sending a message to the virtual machine regarding the authenticated user input; and

on completion of the launch of the virtual machine, the virtual machine unlocking the protected client data in response to the message, thereby enabling user access to the protected client data.

2. The method claimed in claim 1, wherein the device includes one or more client applications and wherein the step of unlocking includes enabling user access to said one or more client applications, and wherein prior to said step of enabling any user requests to access said client applications are denied.

3. The method claimed in claim 1, wherein said virtual machine includes a client security module and wherein said step of unlocking includes said client security module generating an instruction to unlock the protected client data.

4. The method claimed in claim 3, wherein the client operating system layer includes an encryption component for encrypting and decrypting data, and wherein said instruction includes an instruction to said encryption component.

5. The method claimed in claim 4, wherein said encryption component includes a decryption function, and wherein said step of generating an instruction includes calling said decryption component.

6. The method claimed in claim 5, wherein said instruction includes the user authentication input, and wherein said decryption is performed based upon the user authentication input.

7. The method claimed in claim 1, wherein said step of sending a message to the virtual machine includes storing the user authentication input in memory and sending a notice to said virtual machine.

8. The method claimed in claim 1, wherein said step of sending a message to the virtual machine includes sending an unlock request, wherein said unlock request includes the user authentication input.

9. The method claimed in claim 1, wherein said at least one host application includes a cellular telephone application, and wherein said virtual machine includes a plurality of client applications, said client applications including an electronic messaging application.

10. The method claimed in claim 1, wherein said step of unlocking access to the at least one host application occurs prior to completion of the launch of the virtual machine and the consequent unlocking of the protected client data, thereby permitting the user limited access to device functionality pending completion of the launch of the virtual machine.

11. A mobile electronic device, comprising:

memory storing protected client data;

a host operating system supporting at least one host application;

a host security module, wherein the host operating system and the host security module are resident on a host-side of the device, and wherein the host security module includes a component for receiving user authorization input from a user after initiation of start-up of the device;

a client entity, the client entity including a client operating system layer and a virtual machine, wherein the client entity is resident on a client-side of the device, and wherein the client operating system layer includes a password validator for authenticating the user authorization input, and wherein the start-up of the device triggers the launch of the virtual machine; and

an abstraction interface layer between the client-side and the host-side, said abstraction layer including a plurality of application programming interfaces (APIs) for exchanging communications between the client operating system layer and the host security module, and wherein said APIs include a validation request callable by said host security module for passing the user authentication input to the client operating system layer,

wherein, the client operating system layer includes a component for notifying the host security module of a successful authentication, the host security module having a host unlocking component for unlocking access to the at least one host application prior to completion of the launch of the virtual machine in response to the notification of the successful authentication, and wherein the client operating system layer includes a request component for sending a message to the virtual machine regarding the successful authentication, and

wherein, the virtual machine includes a client unlocking component for unlocking the protected client data in response to the message after completion of the launch of the virtual machine, thereby enabling user access to the protected client data.

12. The mobile electronic device claimed in claim 11, wherein the virtual machine includes one or more client applications and wherein said client unlocking component enables user access to said one or more client applications in response to the message.

13. The mobile electronic device claimed in claim 11, wherein the virtual machine includes a client security module having a launch component for launching said client security module in response to said message and following completion of launch of the virtual machine.

14. The mobile electronic device claimed in claim 13, wherein the client operating system layer includes an encryption component for encrypting and decrypting data, and wherein said client security module includes an instruction component for sending an instruction to said encryption module to decrypt the protected client data.

15. The mobile electronic device claimed in claim 14, wherein said instruction includes the user authentication input, and wherein said decryption is performed based upon the user authentication input.

16. The mobile electronic device claimed in claim 11, wherein said client operating system layer stores the user authentication input in said memory for later use by said virtual machine in decrypting the protected client data.

17. The mobile electronic device claimed in claim 11, wherein said message comprises an unlock request, wherein said unlock request includes the user authentication input.

18. The mobile electronic device claimed in claim 11, wherein said at least one host application includes a cellular telephone application, and wherein said virtual machine includes a plurality of client applications, said client applications including an electronic messaging application.

19. The mobile electronic device claimed in claim 11, wherein said host unlocking component unlocks access to the at least one host application prior to completion of the launch of the virtual machine and the consequent unlocking of the protected client data, thereby permitting the user limited access to device functionality pending completion of the launch of the virtual machine.

20. A computer program product comprising a computer readable medium storing computer executable instructions for unlocking a mobile electronic device, the device having a host operating system and a client operating system layer, the host operating system running a host security module, the device including a virtual machine running on the client operating system layer, the device including memory storing protected client data, the host operating system supporting at least one host application, the computer executable instructions implementing an unlocking process initiated on start-up of the device, which triggers the launch of the virtual machine, the computer executable instructions comprising:

computer executable instructions for execution after the initiation of start-up and before completion of the launch of the virtual machine, including

instructions for receiving user authentication input and passing the user authentication input from the host security module to the client operating system layer with a validation request

instructions for authenticating the user authentication input at the client operating system layer and notifying the host security module of a successful authentication

instructions for unlocking access to the at least one host application, thereby enabling user access to the at least one host application,

instructions for sending a message from the client operating system layer to the virtual machine regarding the authenticated user input; and

computer executable instructions for execution on completion of the launch of the virtual machine, including instructions for unlocking the protected client data in response to the message, thereby enabling user access to the protected client data.