SYSTEM AND METHOD FOR PRIVILEGE MANAGEMENT AND REVOCATION

• US 20100011417A1
• Filed: 09/17/2009
• Published: 01/14/2010
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Adams, Neil P., Little, Herbert A.
• Granted Patent: US 8,522,321 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present disclosure relates generally to the management of privileges associated with certain applications that are accessible by users of electronic equipment, such as, for example, networked computers, mobile wireless communications devices, and the like. In particular, the disclosure is directed to systems and methods for managing privileges associated with particular applications and for revoking these privileges in a timely and robust manner. For example, the device keeps track of which applications get access to which privileges. When policies or application control changes, the system detects which privileges have been revoked for which applications. This can be accomplished by simply comparing the old set of privileges with the new set of privileges. For each revoked privilege for a given application, the system determines if the application has ever accessed that privilege in the past. If an application has accessed a privilege that is now revoked at any time in the past, the device is reset. To ensure that privileges that may be passed between applications are not overlooked, the device is arranged to perform a reset if any revoked privilege accessible by the device is one that may be passed between applications.

Claims

1. A method for managing privileges in a system comprising electronic devices having applications resident on said electronic devices, comprising:

monitoring electronic devices that are present in the system;

detecting a change in privileges available to said electronic devices; and

resetting said electronic devices in response to detection of a change in privileges.

2. The method of claim 1, wherein said change in privileges is a result of a change in system IT policy.

3. The method of claim 1, wherein said change in privileges comprises an indication that privileges are to be revoked.

4. The method of claim 1, wherein a system administrator determines when said resetting is performed.

5. The method of claim 1, wherein said resetting said electronic devices brings said system to a known state.

6. The method of claim 5, further comprising restarting said electronic devices after said devices have been reset.

7. The method of claim 1, wherein each of said electronic devices comprises a mobile wireless communications device.

8. A system for managing privileges for a plurality of electronic devices having applications resident thereon, said system comprising at least one processor configured to:

monitor said plurality of electronic devices;

detect a change in privileges available to said plurality of electronic devices; and

reset each of said electronic devices in response to detection of a change in privileges.

9. The system of claim 8, wherein said change in privileges is a result of a change in system IT policy.

10. The system of claim 8, wherein said change in privileges comprises an indication that privileges are to be revoked.

11. The system of claim 8, wherein a system administrator determines when to reset each of said electronic devices.

12. The system of claim 8, wherein said at least one processor is configured to reset each of said electronic devices by bringing each of said electronic devices to a known state.

13. The system of claim 12, wherein said at least one processor is further configured to, for each of said electronic devices, restart the electronic device after the electronic device has been reset.

14. The system of claim 8, wherein each of said electronic devices comprises a mobile wireless communications device.

15. A computer-readable medium comprising instructions executable by a processor, wherein the instructions cause the process to perform acts of a method for managing privileges in a system comprising electronic devices having applications resident on said electronic devices, said acts comprising:

monitoring electronic devices that are present in the system;

detecting a change in privileges available to said electronic devices; and

resetting said electronic devices in response to detection of a change in privileges.

16. The medium of claim 15, wherein said change in privileges is a result of a change in system IT policy.

17. The medium of claim 15, wherein said change in privileges comprises an indication that privileges are to be revoked.

18. The medium of claim 15, wherein a system administrator determines when said resetting is performed.

19. The medium of claim 15, wherein said resetting said electronic devices brings said system to a known state.

20. The medium of claim 19, said acts further comprising restarting said electronic devices after said devices have been reset.

21. The medium of claim 15, wherein each of said electronic devices comprises a mobile wireless communications device.