SYSTEM AND METHOD FOR CONTROLLING MESSAGE ATTACHMENT HANDLING FUNCTIONS ON A MOBILE DEVICE

• US 20090080661A1
• Filed: 09/24/2007
• Published: 03/26/2009
• Est. Priority Date: 09/24/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael S., Brown, Michael K., Kirkup, Michael G.
• Granted Patent: US 8,254,582 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement

Abstract

A system and method for controlling message attachment handling functions on a mobile device is described herein. An attachment handling control can be set to identify one of a number of selected attachment handling control modes. Depending on the attachment handling control mode identified, a request for the attachment structure that includes a decrypted session key for an encrypted message received at the mobile device may or may not be automatically sent to a remote server. This may provide the user with increased control over the content of an encrypted message that the remote server may access when determining the attachment structure for a message.

Claims

1. A method for controlling message attachment handling functions on a mobile device, the method comprising:

receiving at least a part of a message at the mobile device from one or more remote servers, the message comprising encrypted message data, the part of the message comprising an encrypted session key associated with the message;

determining which one of a plurality of attachment handling control modes is identified by an attachment handling control, the plurality of attachment handling control modes comprising a first attachment handling control mode that permits a decrypted session key to be transmitted from the mobile device to the one or more remote servers without user intervention after the part of the message is received at the mobile device; and

decrypting the encrypted session key to determine the decrypted session key and transmitting the decrypted session key to the one or more remote servers if the attachment handling control identifies the first attachment handling control mode.

2. The method of claim 1, further comprising receiving data identifying an attachment structure for the message from the one or more remote servers and providing the attachment structure as output.

3. The method of claim 1, wherein the plurality of attachment handling control modes further comprises a second attachment handling control mode that permits the decrypted session key to be transmitted from the mobile device to the one or more remote servers upon receiving user input at the mobile device to transmit the decrypted session key after the part of the message is received at the mobile device;

and wherein the method further comprises decrypting the encrypted session key to determine the decrypted session key and transmitting the decrypted session key to the one or more remote servers upon receiving the user input at the mobile device to transmit the decrypted session key if the attachment handling control identifies the second attachment handling control mode.

4. The method of claim 3, wherein the plurality of attachment handling control modes further comprises a third attachment handling control mode that prevents the decrypted session key from being transmitted from the mobile device to the one or more remote servers;

and wherein the method further comprises preventing transmission of a decrypted session key to the one or more remote servers if the attachment handling control identifies the third attachment handling control mode.

5. The method of claim 1, wherein the attachment handling control is set according to user input received at the mobile device.

6. The method of claim 1, wherein the attachment handling control is set in accordance with a security policy governing the use of the mobile device.

7. The method of claim 1, wherein the attachment handling control is set to identify one of a configured subset of the plurality of attachment handling control modes.

8. The method of claim 7, wherein the configured subset is configured in accordance with a security policy governing the use of the mobile device.

9. The method of claim 1, further comprising determining if an exception condition is satisfied by applying one or more filtering criteria to the message, wherein the mobile device is configured such that the attachment handling control is set to identify an attachment handling control mode based on whether the exception condition is satisfied.

10. The method of claim 9, wherein said determining if an exception condition is satisfied by applying one or more filtering criteria to the message comprises at least one of the following:

determining if a pre-identified word is contained in one or more parts of the message;

determining if the message originated from a pre-identified sender; and

determining if the message is associated with a pre-identified classification.

11. The method of claim 2, further comprising:

receiving an attachment request, the attachment request identifying an attachment to the message;

transmitting the attachment request from the mobile device to the one or more remote servers; and

receiving data associated with the attachment in decrypted form at the mobile device.

12. The method of claim 1, wherein the message is an S/MIME message.

13. The method of claim 1, wherein the message is a PGP/MIME message.

14. A computer-readable medium comprising instructions executable on a processor of a computing device for performing the following:

receiving at least a part of a message at the mobile device from one or more remote servers, the message comprising encrypted message data, the part of the message comprising an encrypted session key associated with the message;

determining which one of a plurality of attachment handling control modes is identified by an attachment handling control, the plurality of attachment handling control modes comprising a first attachment handling control mode that permits a decrypted session key to be transmitted from the mobile device to the one or more remote servers without user intervention after the part of the message is received at the mobile device; and

decrypting the encrypted session key to determine the decrypted session key and transmitting the decrypted session key to the one or more remote servers if the attachment handling control identifies the first attachment handling control mode.

15. A mobile device comprising at least a processor and a memory, wherein the mobile device is configured to execute an application module programmed to:

receive at least a part of a message at the mobile device from one or more remote servers, the message comprising encrypted message data, the part of the message comprising an encrypted session key associated with the message;

determine which one of a plurality of attachment handling control modes is identified by an attachment handling control, the plurality of attachment handling control modes comprising a first attachment handling control mode that permits a decrypted session key to be transmitted from the mobile device to the one or more remote servers without user intervention after the part of the message is received at the mobile device; and

decrypt the encrypted session key to determine the decrypted session key and transmit the decrypted session key to the one or more remote servers if the attachment handling control identifies the first attachment handling control mode.

16. A system for controlling message attachment handling functions on a mobile device, the system comprising a mobile device and one or more remote servers, wherein the mobile device comprises at least a processor and a memory, and wherein the mobile device is configured to execute an application module programmed to:

receive at least a part of a message at the mobile device from one or more remote servers, the message comprising encrypted message data, the part of the message comprising an encrypted session key associated with the message;

determine which one of a plurality of attachment handling control modes is identified by an attachment handling control, the plurality of attachment handling control modes comprising a first attachment handling control mode that permits a decrypted session key to be transmitted from the mobile device to the one or more remote servers without user intervention after the part of the message is received at the mobile device; and

decrypt the encrypted session key to determine the decrypted session key and transmit the decrypted session key to the one or more remote servers if the attachment handling control identifies the first attachment handling control mode.

17. The system of claim 16, wherein at least one of the one or more remote servers is configured to decrypt the encrypted message data using the decrypted session key received from the mobile device, determine an attachment structure for the message, and transmit data identifying the attachment structure for the message to the mobile device.

18. The system of claim 16, wherein the at least one of the one or more remote servers comprises a message management server.

19. The system of claim 17, wherein at least one of the one or more remote servers is configured to retrieve a user-identified attachment from message data decrypted using the decrypted session key, and to transmit data associated with the attachment in decrypted form to the mobile device.

20. The system of claim 16, wherein the at least one of the one or more remote servers comprises an attachment server.