System and method of connection control for wireless mobile communication devices

• US 20060253529A1
• Filed: 07/10/2006
• Published: 11/09/2006
• Est. Priority Date: 11/08/2002
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Yach, David P., Kirkup, Michael G., Little, Herbert A.
• Granted Patent: US 7,330,712 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Systems and methods of connection control for wireless mobile communication devices enabled for communication via a plurality of communication connections are provided. Connection control information associates software applications with communication connections. When a connection request specifying a requested connection is received from a software application, it is determined whether the requested connection is permitted by the connection control information. Where the requested connection is permitted by the connection control information, the requested connection is opened. If the requested connection is a first connection opened by the software application, then the software application is associated with the requested connection in the connection control information.

Claims

1. A system for controlling a connection on a remote communicating device, comprising:

means for receiving a connection request from a software application executing on the remote communicating device;

means for determining if the received connection request satisfies connection control information associated with the software application;

means, responsive to the connection request satisfying the connection control information associated with the software application, for authorizing the opening of a communication connection for use by the software application; and

means, responsive to the connection request not satisifying the connection control information associated with the software application, for displaying an interface to a user of the remote communicating device for receiving authorization for the opening of the communication connection and for updating the connection control information associated with the software application if the received authorization indicates authorization for both current and future opening of the communication connection.

2. The system of claim 1, further comprising means for authorizing the opening the communication connection for use by the software application.

3. The system of claim 1, wherein the determining means comprises means for retrieving connection control information associated with the software application.

4. The system of claim 3, wherein the determining means further comprises means for comparing one or more control criteria based on the retrieved connection control information with one or more request parameters based upon the received connection request.

5. The system of claim 3, wherein the determining means further comprises:

means for determining a desired communication connection from the received connection request; and

,

means, responsive to the retrieved connection control information comprising a record of the desired communication connection as an allowable communication connection, for determining that the received connection request satisfies connection control information associated with the software application.

6. The system of claim 3, wherein the determining means further comprises:

means for determining a desired communication connection from the received connection request; and

means, responsive to the retrieved connection control information comprising a record of the desired communication connection as a prohibited communication connection, for determining that the received connection request does not satisfy connection control information associated with the software application.

7. The system of claim 1, further comprising means for receiving connection control information associated with the software application and storing the received connection control information.

8. The system of claim 7, further comprising means for authenticating the received connection control information.

9. The system of claim 7, further comprising means for receiving a connection control information update associated with the software application and updating the stored connection control information based upon the received connection control information update.

10. The system of claim 1, wherein the connection control information associated with the software application is based upon the software application at installation on the remote communicating device, a connection type associated with the software application, one or more allowable connection types associated with the software application, a source associated therewith or a connection type associated therewith, one or more prohibited connection types associated with the software application, a source associated therewith or a connection type associated therewith, configuration information provided at installation, or manual association of connection control information associated with the software application, or combinations thereof;

wherein the connection request is a request for use of a physical transport layer.

11. The system of claim 1, wherein the connection control information is stored in a protected memory area of the remote communication device.

12. The system of claim 11, wherein the software application is not able to address the protected memory area of the remote communication device.

13. The system of claim 1, further comprising means for updating the connection control information if the received connection request is the first connection request received from the software application.

14. The system of claim 1, wherein the received connection request satisfies connection control information, and further comprising means for receiving data via the communication connection for use by the software application.

15. The system of claim 14, wherein the communication connection allows access to data from a computer within a secured corporate computer network.

16. The system of claim 15, further comprising means for receiving a second connection request from the software application, wherein the second connection request does not satisfy connection control information, and means for denying authorization for opening a second communication connection in response to the received second connection request.

17. The system of claim 10, wherein the physical transport layer is a wireless interface, a USB interface, an Infrared Data Association interface, a serial interface, a parallel interface, a PCMCIA interface, a PCI interface, or combinations thereof.

18. The system of claim 1, wherein the connection control information includes one or more connection types associated with the software application.

19. The system of claim 18, wherein the connection types are an external connection, an internal connection, or combinations thereof.

20. The system of claim 1, wherein the connection request is a request for use of a physical transport layer.

21. The system of claim 20, wherein the physical transport layer is a wireless interface, a USB interface, an Infared Data Association interface, a serial interface, a parallel interface, a PCMCIA interface, a PCI interface, or combinations thereof.

22. A remote communication device, comprising:

a software application executing on the remote communicating device, the software application generating a connection request;

a connection controller that determines if the connection request satisfies connection control information associated with the software application;

wherein if the connection request satisfies the connection control information associated with the software application, then the connection controller authorizes the opening of a communication connection for use by the software application; and

wherein if the connection request does not satisify the connection control information associated with the software application, the connection controller causes the display of an interface to a user of the remote communicating device for receiving authorization for the opening of the communication connection and the connection controller then updates the connection control information associated with the software application if the received authorization indicates authorization for both current and future opening of the communication connection.

23. The device of claim 22, whrein the connection controller opens the communication connection for use by the software application.

24. The device of claim 22, wherein the connection controller retrieves connection control information associated with the software application.

25. The device of claim 23, wherein the connection controller compares one or more control criteria based on the retrieved connection control information with one or more request parameters based upon the connection request.

26. The device of claim 23, wherein the connection controller determines a desired communication connection from the connection request, and, if the retrieved connection control information comprises a record of the desired communication connection as an allowable communication connection, then the connection controller determines that the connection request satisfies connection control information associated with the software application.

27. The device of claim 23, wherein the connection controller determines a desired communication connection from the received connection request, and, if the retrieved connection control information comprising a record of the desired communication connection as a prohibited communication connection, then the connection controller determines that the connection request does not satisfy connection control information associated with the software application.

28. The device of claim 22, further comprising:

means for receiving connection control information associated with the software application; and

a memory that stores the received connection control information.

29. The device of claim 28, wherein the connection control information is received from the software application after it is installed on the device.

30. The device of claim 28, wherein the connection control information is received from an external connection to the device.

31. The device of claim 28, wherein the connection control information is received from a wireless network connection.

32. The device of claim 28, wherein the memory is a protected memory area of the device.

33. The device of claim 32, wherein the software application is unable to access the protected memory area of the device.

34. The device of claim 28, wherein the memory comprises a connection policy store for storing the connection control information.

37. The device of claim 28, wherein the connection controller authenticates the received connection control information before storing it into the memory of the device.

38. The device of claim 22, wherein the connection control information associated with the software application is based upon the software application at installation on the remote communicating device, a connection type associated with the software application, one or more allowable connection types associated with the software application, a source associated therewith or a connection type associated therewith, one or more prohibited connection types associated with the software application, a source associated therewith or a connection type associated therewith, configuration information provided at installation, or manual association of connection control information associated with the software application, or combinations thereof;

wherein the connection request is a request for use of a physical transport layer.

39. The device of claim 22, further comprising:

a protected memory area for storing the connection control information.

40. The device of claim 39, wherein the software application is not able to address the protected memory area of the remote communication device.

41. The device of claim 22, wherein the connection controller receives a second connection request from the software application, wherein the second connection request does not satisfy connection control information, and the connection controller therefore denies authorization for opening a second communication connection in response to the received second connection request.

42. The device of claim 38, wherein the physical transport layer is a wireless interface, a USB interface, an Infrared Data Association interface, a serial interface, a parallel interface, a PCMCIA interface, a PCI interface, or combinations thereof.

43. The device of claim 22, wherein the connection control information includes one or more connection types associated with the software application.

44. The device of claim 43, wherein the connection types are an external connection, an internal connection, or combinations thereof.

35. The device of claim 35, wherein the memory further comprises an authorization record store for storing additional connection control information for the software application.

36. The device of claim 35, wherein the connection control information stored in the authorization record store may override the connection control information stored in the connection policy store.

45. A method of managing connections between software applications executing on a mobile device and one or more data networks with which the mobile device may communicate, comprising:

executing a first software application on the mobile device, wherein the first software application requests a connection to a first data network;

determining that the request is a first request from the executed first software application and storing connection control information associated with the first data network in a protected memory area of the mobile device, wherein the first software application is unable to access the protected memory area; and

in response to further requests for a connection from the executed first software application, comparing the further requests to the connection control information stored in the protected memory area and authorizing the connection only if the subsequent connection requests are for opening a connection to the first data network.

46. A method of managing connections between software applications executing on a mobile device and one or more data networks with which the mobile device may communicate, comprising

storing default connection control information in a memory of the moble device, the default connection control information specifiying one or more data networks with which a first software application may communicate;

executing the first software application and requesting a connection to one of the one or more data networks;

updating the connection control information in the memory for the first software application to restrict it to the requested one of the one or more data networks; and

if the first software application subsequently requests a connection to a second of the one or more data networks, then denying the request.