AUTOMATIC SECURITY ACTION INVOCATION FOR MOBILE COMMUNICATIONS DEVICE

• US 20100317324A1
• Filed: 08/24/2010
• Published: 12/16/2010
• Est. Priority Date: 05/18/2006
• Status: Abandoned Application

• Current Assignee: Blackberry Limited
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Fyke, Steven, Adams, Neil, Brown, Michael S., Little, Herbert
• Application Number:
  US12/862,228
• Publication Number:
  US 20100317324A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 8/02 Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A mobile communications device, method and computer program product for providing security are described. In one embodiment, the device comprises: a processor; a communications subsystem; a storage element having application modules and data; and a security module operable to detect a locked state of the device and initiate a lockout data protection timer for a predetermined duration upon detection of the locked state. The security module is operable to, after the lockout data protection timer has been initiated, detect if a password is entered through a user input device within the predetermined duration and to terminate the lockout data protection timer if entry of the password is detected to perform a security action comprising erasing or encrypting at least some of the data if entry of the password is not detected.

Claims

1. A mobile communications device, comprising:

a processor;

a communications subsystem connected to the processor operable to exchange signals with a wireless network and with the processor;

a storage element connected to the processor and having a plurality of application modules and data stored thereon, the data comprising at least user application data associated with the application modules and service data including data for establishing communications with the wireless network; and

a security module operable to detect a locked state of the mobile communications device and initiate a lockout data protection timer for a predetermined duration upon detection of the locked state; and

wherein the security module is operable to, after the lockout data protection timer has been initiated, detect if a password shared by the user and the mobile communications device is entered through a user input device within the predetermined duration of the lockout data protection timer;

wherein the security module is operable to terminate the lockout data protection timer if entry of the password is detected within the predetermined duration; and

wherein the security module is operable to perform a security action comprising erasing or encrypting at least some of the data on the storage element if entry of the password is not detected within the predetermined duration.

2. The mobile communications device of claim 1, wherein the security module is operable to initiate the locked state of the mobile communications device upon detection of a trigger condition.

3. The mobile communications device of claim 1, wherein the security module is operable to terminate the locked state of the mobile communications device if entry of the password is detected within the predetermined duration.

4. The mobile communications device of claim 1, wherein the trigger condition is one of:

user input instructing the mobile communications device to initiate the locked state;

the occurrence of a periodic interval;

user inactivity for a predetermined duration of inactivity;

loss of communication with the wireless network;

holstering of the mobile communications device if the device is a holsterable device; and

closing of the mobile communications device if the device is a flip-style device.

5. The mobile communications device of claim 1, wherein the predetermined duration of the lockout data protection timer is an absolute time duration relative to a time when the locked state is initiated.

6. The mobile communications device of claim 1, wherein the security module is operable to enable or disable, upon receipt of a policy message comprising a respective enable or disable instruction, the operability to detect the locked state of the mobile communications device and to detect entry of the password shared by the user and the mobile communications device to terminate the lockout data protection timer.

7. The mobile communications device of claim 6, wherein the predetermined duration of the lockout data protection timer is provided in the policy message enabling the detection of the locked state.

8. The mobile communications device of claim 6, wherein the security module is operable to automatically initiate the lockout data protection timer if the locked state has already been initiated, upon receiving the policy message enabling the detection of the locked state, the lockout data protection timer being set to a predetermined duration provided in the policy message enabling the detection of the locked state.

9. The mobile communications device of claim 6, wherein the security module is operable to automatically terminate the lockout data protection timer if the locked state has already been initiated, upon receiving a policy message disabling the detection of the locked state.

10. The mobile communications device of claim 1, wherein, in the locked state substantially all of the functionality of the mobile communications device is restricted, user input accepted during the locked state being substantially limited to entry of the password shared by the user and the mobile communications device through the user input device.

11. The mobile communications device of claim 1, wherein the security module is operable to detect a lack of communication through the communications subsystem;

and wherein the security module is operable to initiate the locked state of the mobile communications device if the duration of the lack of communication through the communications subsystem exceeds a predetermined duration.

12. A method for providing security on a mobile communications device, the mobile communications device being configured to communicate with a wireless communications network and including a storage element having data stored thereon, the method comprising the acts of:

monitoring to detect for the locked state of the mobile communications device and initiating a lockout data protection timer for a predetermined duration upon detection of the locked state; and

monitoring, after the lockout data protection timer has been initiated, to detect if a password shared by the user and the mobile communications device is entered through the user input device within the predetermined duration of the lockout data protection timer;

if entry of the password is detected within the predetermined duration, terminating the lockout data protection timer; and

if entry of the password is not detected within the predetermined duration, performing a security action comprising erasing or encrypting at least some of the data on the storage element.

13. The method of claim 12, further comprising:

monitoring for a trigger condition for initiating the locked state of the mobile communications device and initiating the locked state of the mobile communications device upon detection of the trigger condition.

14. The method of claim 12, further comprising:

if entry of the password is detected within the predetermined duration, terminating the locked state of the mobile communications device.

15. The method of claim 13, wherein the trigger condition is one of:

user input instructing the mobile communications device to initiate the locked state;

the occurrence of a periodic interval;

user inactivity for a predetermined duration of inactivity;

loss of communication with the wireless network;

holstering of the mobile communications device if the device is a holsterable device; and

closing of the mobile communications device if the device is a flip-style device.

16. The method of claim 12, wherein the predetermined duration of the lockout data protection timer is an absolute time duration relative to a time when the locked state is initiated.

17. The method of claim 12, wherein the monitoring to detect for the locked state of the mobile communications device and monitoring to detect for entry of the password shared by the user and the mobile communications device is entered is enabled and disabled by respective policy messages received on the mobile communications device.

18. A computer program product comprising a tangible machine-readable medium embodying instructions executable on a mobile communications device for providing security on the mobile communications device, the machine-readable instructions comprising:

code for monitoring to detect for the locked state of the mobile communications device and initiating a lockout data protection timer for a predetermined duration upon detection of the locked state;

code for monitoring, after the lockout data protection timer has been initiated, to detect if a password shared by the user and the mobile communications device is entered through the user input device within the predetermined duration of the lockout data protection timer;

code for terminating the lockout data protection timer if entry of the password is detected within the predetermined duration; and

code for performing a security action comprising erasing or encrypting at least some of the data on the storage element if entry of the password is not detected within the predetermined duration.