Secure device sharing

• US 20070180492A1
• Filed: 02/01/2006
• Published: 08/02/2007
• Est. Priority Date: 02/01/2006
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Hassan, Ahmed, Martin, Daryl, Wilson, John
• Granted Patent: US 8,078,990 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

A device and method for placing the device in a locked state having an associated set of permitted tasks so as to permit the device owner to share the device with others but maintain security over aspects of the device. A task change request is evaluated to determine whether the requested task is permitted and, if so, the requested task is allowed; if not, then an authorization process is invoked to prompt the user to input authorization data. Upon verification of the authorization data, the device may be unlocked and the requested change implemented. The permitted tasks may designate specific applications, specific operations or functions within applications or at the operating system level, one or more currently open windows, and other levels of granularity.

Claims

1. A method of securing an electronic device to enable a user to share the device with another person, the device having an operating system, the method comprising the steps of:

receiving a request to lock the device,

setting a lock indicator to establish the locked state of the device;

associating permitted task information with a locked state of the device,

receiving a user request to activate a selected task;

identifying the locked state of the device; and

reading said permitted task information and determining whether said selected task is permitted based upon said permitted task information and, if so, activating said selected task.

2. The method claimed in claim 1, wherein, if said step of determining determines that said selected task is not permitted, then invoking an authorization process to receive a user input, verifying said user input, and, if verified, activating said selected task.

3. The method claimed in claim 1, further including a step of calling a task change application programming interface (API) without an authorization argument, and generating a call failure in response to said task change API if said device is identified as being in a locked state, and wherein said step of verifying includes calling said task change API with said user input as said authorization argument, and validating said user input.

4. The method claimed in claim 3, wherein said task change API includes a task argument, said task argument indicating said selected task.

5. The method claimed in claim 3, wherein said task change API is selected from a group consisting of an active window change API, a window resizing API, a window minimizing API, a window launch API, and an application launch API.

6. The method claimed in claim 1, wherein said step of associating includes designating a user profile, said user profile being associated with said permitted task information.

7. The method claimed in claim 6, wherein said step of designating said user profile includes selecting said user profile from a plurality of user profiles, each of said user profiles having associated permitted task information.

8. The method claimed in claim 1, wherein said step of associating said permitted task information with said locked state includes selecting one or more tasks from a list of available tasks.

9. The method claimed in claim 1, wherein said permitted task information includes information identifying permitted tasks said user may engage in while said device is in said locked state.

10. The method claimed in claim 1, wherein said steps of identifying and determining are performed at an operating system level.

11. The method claimed in claim 1, wherein said permitted tasks includes application-specific operations, and wherein said steps of identifying and determining are performed at an application program level.

12. An electronic device, the device having a locked state and an unlocked state, the device comprising:

a main body housing a user input device, a display, memory, and a processor operatively coupled to said user input device, said display and said memory;

an operating system running on said processor for managing input and output through said user input device and said display and providing a platform for operation of application programs, wherein said operating system is configured to receive a user request to change to a selected task;

a locking component for receiving a request to lock the device, setting a lock indicator to establish the locked state of the device, and associating permitted task information with the locked state of the device; and

a task request component for identifying that the device is in the locked state and for determining whether said selected task is permitted based upon the permitted task information and, if so, activating said selected task.

13. The electronic device claimed in claim 12, wherein said locking component is configured to invoke an authorization process to receive user input if said task request component determines that said selected task is not permitted, verify said user input, and, if verified, activate said selected task.

14. The electronic device claimed in claim 12, wherein said task request component includes a process control layer for receiving said called task change API and, if the device is in the locked state, determining whether said permitted task information includes said selected task and, if not, sending said locking component a failure message in response to the task change API.

15. The electronic device claimed in claim 14, wherein said locking component is configured to launch an authorization process to receive user input and call a further task change API, wherein said further task change API includes said user input as an argument, and wherein said process control layer verifies said argument and passes said further task change API to said operating system for implementation if said argument is verified.

16. The electronic device claimed in claim 14, wherein said task change API is selected from a group consisting of an active window change API, a window resizing API, a window minimizing API, a window launch API, and an application launch API.

17. The electronic device claimed in claim 12, wherein said memory stores a plurality of user profiles, each user profile having an associated set of permitted tasks, and wherein said locking component is configured to associate the locked state with said permitted task information in response to user selection of one of said user profiles.

18. The electronic device claimed in claim 12, wherein said locking component includes a component for receiving user designation of one or more tasks from a list of available tasks as permitted or impermissible tasks, and wherein said permitted task information comprises said user designated tasks.

19. The electronic device claimed in claim 12, wherein said task request component is implemented within said operating system.

20. The electronic device claimed in claim 12, wherein said permitted tasks include application-specific operations and wherein said task request component is implemented within an application program.

21. A computer program product for securing an electronic device to enable a user to share the device with another person, the computer program product comprising a computer-readable medium having recorded thereon computer executable instructions, said electronic device having an operating system and said computer executable instructions comprising:

computer executable instructions for receiving a request to lock the device,

computer executable instructions for setting a lock indicator to establish the locked state of the device;

computer executable instructions for associating permitted task information with a locked state of the device,

computer executable instructions for receiving a user request to activate a selected task;

computer executable instructions for identifying the locked state of the device; and

computer executable instructions for reading said permitted task information and determining whether said selected task is permitted based upon said permitted task information and, if so, activating said selected task.

22. The computer program product claimed in claim 21, wherein, if said computer executable instructions for determining determine that said selected task is not permitted, then further computer executable instructions invoke an authorization process to receive a user input, verify said user input, and, if verified, activate said selected task.

23. The computer program product claimed in claim 21, further including computer executable instructions for calling a task change application programming interface (API) without an authorization argument, and computer executable instructions for generating a call failure in response to said task change API if said device is identified as being in a locked state, and wherein said computer executable instructions for verifying include computer executable instructions for calling said task change API with said user input as said authorization argument, and validating said user input.

24. The computer program product claimed in claim 23, wherein said task change API includes a task argument, said task argument indicating said selected task.

25. The computer program product claimed in claim 23, wherein said task change API is selected from a group consisting of an active window change API, a window resizing API, a window minimizing API, a window launch API, and an application launch API.

26. The computer program product claimed in claim 21, wherein said computer executable instructions for associating include computer executable instructions for designating a user profile, said user profile being associated with said permitted task information.

27. The computer program product claimed in claim 26, wherein said computer executable instructions for designating said user profile include computer executable instructions for selecting said user profile from a plurality of user profiles, each of said user profiles having associated permitted task information.

28. The computer program product claimed in claim 21, wherein said computer executable instructions for associating said permitted task information with said locked state include computer executable instructions for selecting one or more tasks from a list of available tasks.

29. The computer program product claimed in claim 21, wherein said permitted task information includes information identifying permitted tasks said user may engage in while said device is in said locked state.

30. The computer program product claimed in claim 21, wherein said computer executable instructions for identifying and determining are implemented at an operating system level.

31. The computer program product claimed in claim 21, wherein said permitted tasks include application-specific operations, and wherein said computer executable instructions for identifying and determining are implemented at an application program level.