DEVICES WITH PROFILE-BASED OPERATING MODE CONTROLS

• US 20100319053A1
• Filed: 06/12/2009
• Published: 12/16/2010
• Est. Priority Date: 06/12/2009
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Gharabally, Sam
• Granted Patent: US 9,183,534 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A device (e.g., a phone) can be provided by an entity (e.g., a business) to a user (e.g., an employee). The device includes a profile manager that allows the user to configure a personal profile comprising any of applications, settings, and stored data. The device is also configurable with an entity profile determined by the entity that also may include applications, settings, and stored data. The user can select from operating modes comprising at least a personal mode, and a unity mode; an entity mode also may be available for selection. The profile manager, based on the selected mode, determines whether entity profile data and applications are available to the user, and which applications from either profile may conduct user-perceptible activities. The profile manager may periodically verify entity profile rights with a server, and if verification fails, then the profile manager can restrict entity profile data and applications access, regardless of operating mode.

Claims

1. A device, comprising:

a computer readable medium storing data and applications associated with a personal profile, and data and applications associated with an entity profile; and

a processor with instructions for execution of a profile manager process, the profile manager process to receive user inputs indicative of an operating mode selected from a personal mode, an entity mode, and a unity mode, to restrict access to entity profile data in the personal mode, and to permit access to personal profile data and entity profile data in the unity mode, the profile manager process further to restrict user-perceptible activities of personal profile applications in the entity mode, to restrict user-perceptible activities of entity profile applications in the personal mode, and to permit user-perceptible activities of both personal profile applications and entity profile applications in the unity mode.

2. The device of claim 1, wherein the profile manager process further is to restrict application activities by controlling network access by each application.

3. The device of claim 1, further comprising a network interface, wherein the processor is coupled with the network interface for providing network access to the profile manager process, the profile manager to verify privileges of the device to operate in any mode in which entity profile data and applications are available by periodically presenting a user credential for authentication to a remote profile server, and receiving an authentication response therefrom.

4. The device of claim 1, further comprising an operating system accessing the computer readable medium, and determining, based on a directory structure defined on the computer readable medium, whether stored items of data and applications are associated either with the personal profile or the entity profile.

5. The device of claim 1, wherein the entity profile is maintained over a network interface by a profile server.

6. The device of claim 1, wherein the data associated with each of the personal profile and the entity profile comprises a respective set of contacts, and said user-perceptible activities permitted by the profile manager process comprising providing notification of communication initiation requests only from contacts associated with the personal profile when in the personal mode, only from contacts associated with the entity profile when in the entity mode, and from contacts associated with either the entity or the personal profiles when in the unity mode.

7. The device of claim 1, wherein a given application is associated with both the personal profile and the entity profile, and user-perceptible activities which that application is permitted are determined based on data associated with the profile or profiles for a current mode of the device.

8. A computer readable medium storing computer executable instructions for implementing a method on a device, comprising:

receiving an operating mode selection from operating modes comprising a personal mode, an entity mode, and a unity mode;

restricting access to an entity profile dataset and permitting access to a personal profile dataset when operating in the personal mode and permitting access to both the entity dataset and the personal dataset when operating in the unity mode; and

restricting an application associated with both the personal profile and the entity profile to activities within a scope of authorization determined based either on the personal profile or the entity profile, for operating respectively in either mode, and permitting application activities within a union of the scopes of authorization determined based both on the personal profile and the entity profile, for operating in the unity mode.

9. The medium of claim 8, further storing application code for an application associated with both the personal profile and the entity profile, and instructions for determining authorization for that application based on profile-specific data used by the application.

10. The medium of claim 8, wherein the authorization scopes comprise enforcing security policies for data associated with the entity profile, regardless of operating mode.

11. The medium of claim 8, wherein the medium stores instructions for restricting access to the entity dataset upon a failure of a device reading from the computer readable medium to authenticate with a server.

12. A method, comprising:

providing for the user to have administrative rights on a device that allow the user to create a personal profile comprising applications, device settings, and stored data;

storing an entity profile on the device, the entity profile comprising applications, data, and device settings;

accepting a user indication of a current operating mode selected from a personal mode, an entity mode, and a unity mode; and

enforcing scopes of application authorization for applications running on the device based on the current operating mode, the authorization scopes including that applications of the personal profile and applications of the entity profile can conduct user interface activities in the unity mode.

13. The method of claim 12, wherein the device comprises a network interface, and further comprising enforcing network security policies defined in the entity profile if operating in either the unity mode or the entity mode.

14. The method of claim 13, wherein the network security policies include requiring encryption usage to access an entity server.

15. The method of claim 12, wherein the device comprises a network interface, and the scope of authorization for operating in the personal mode comprising restricting access to entity servers.

16. The method of claim 12, further comprising periodically verifying access authorization for entity profile applications and data by presenting a user credential from the device over a network interface to an entity server, and upon failing to verify authorization, restricting such access authorization.

17. The method of claim 12, wherein the authorization scopes comprise enforcing data security policies for entity data on the device regardless of mode.

18. A method, comprising:

providing for a user to have administrative rights on a device that allow the user to create a personal profile comprising applications, settings, and stored data;

storing an entity profile on the device, the entity profile comprising applications, data, and settings;

accepting a user indication of a current operating mode selected from a personal mode, an entity mode, and a unity mode; and

enforcing scopes of application authorization based on the current operating mode, the authorization scopes including that applications of the personal profile and applications of the entity profile can conduct user interface activities in the unity mode, that applications of the entity profile are restricted in the personal mode, and that applications of the personal profile are restricted in the entity mode.

19. The method of claim 18, wherein respective sets of contacts are associated with each of the personal profile and the entity profile and the scopes of authorization comprise restricting user-perceptible indications of incoming communications from contacts not in the contact set for the current operating mode.

20. The method of claim 18, further comprising verifying permission to operate in the entity mode or the unity mode by verifying a credential for the user with a server over a network.

21. The method of claim 18, further comprising applying the network access control settings of the entity profile to the device, regardless of the current operating mode.

22. A system, comprising:

a device comprising

a computer readable medium storing data and applications associated with a personal profile, and data and applications associated with an entity profile,

a processor with computer executable instructions for execution of a profile manager process, the profile manager process to receive user inputs indicative of an operating mode selected from a personal mode, an entity mode, and a unity mode, the profile manager to permit access only to personal profile data when in the personal mode, to permit access only to entity profile data when in the entity mode, and to permit access to personal profile data and entity profile data when in the unity mode, the profile manager process further to permit user-perceptible activities only of personal profile applications when in the personal mode, to permit user-perceptible activities only of entity profile applications when in the entity mode, and to permit user-perceptible activities of both personal profile applications and entity profile applications when in the unity mode; and

a profile server operable to communicate with the profile manager process over a network interface, the profile server to inventory data and applications stored on the computer readable medium of the device associated with the entity mode, to compare results of the inventory with an expected inventory for the entity profile on that device, and to update the device inventory if the expected inventory differs from the inventory results.

23. The system of claim 22, wherein the entity profile is customized to a user by the profile server based on a credential presented during an authorization process by the device to the profile server.

24. The system of claim 22, wherein the profile server provides for assembly of data and applications to be downloaded to the device, based on correlating a user credential with user identification information available to the profile server.