System and Method of Owner Application Control of Electronic Devices

• US 20110010705A1
• Filed: 09/17/2010
• Published: 01/13/2011
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Owen, Russell N., Adams, Neil P., Kirkup, Michael G., Little, Herbert A.
• Granted Patent: US 8,887,988 B2
• Time in Patent Office: Days
• US Class Current: 717/178
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading

Abstract

Systems and methods of owner application control of an electronic device are provided. Owner application control information is stored on the electronic device and/or one or more remote servers. Owner application control information is consulted to determine if one or more required applications are available for execution on the electronic device. If not, one or more required applications not available are downloaded and installed. This could be in a manner transparent to the user of the electronic device. If one or more required applications are not available on the electronic device, the device can be functionally disabled in whole, or in part, until one or more required applications are available.

Claims

1-20. -20. (canceled)

21. A method of controlling an application for use on an electronic device, the method comprising:

receiving an operation request from an application;

determining whether the requested operation is allowed to be performed by the application based upon a stored authorization record and an application identifier associated with the application; and

allowing the application to perform the requested operation if the requested operation is determined to be allowed to be performed by the application.

22. The method of claim 21, wherein the authorization record and the application identifier are provided by an external source for storage on the electronic device.

23. The method of claim 22, wherein the authorization record and the application identifier are provided by the external source to the electronic device through a wireless communication channel.

24. The method of claim 22, wherein the authorization record related to determining whether the requested operation is to be allowed is provided by an external computer that is used to enforce policies for operating electronic devices within an organization.

25. The method of claim 21, wherein an update to the authorization record is provided by an external source for storage on the electronic device.

26. The method of claim 21, wherein a plurality of authorization records associated with a plurality of application identifiers are stored on the electronic device, said method further comprising:

receiving operation requests from a plurality of applications operating on the electronic device;

determining whether the requested operations are allowed to be performed by their respective applications based upon the stored authorization records and the application identifiers that are respectively associated with the plurality of applications; and

allowing the plurality of applications to perform their respective requested operations based upon whether the requested operations are determined to be allowed to be performed.

27. The method of claim 26, wherein a group containing two or more of the applications is associated with one of the authorization records.

28. The method of claim 21, wherein the requested operation is selected from the group consisting of:

opening a connection;

accessing a telephone API;

accessing local memory;

or communicating with another executing application.

29. The method of claim 21, wherein the requested operation is selected from the group consisting of:

opening network connections inside a firewall;

opening network connections outside the firewall;

opening local connections;

interacting with other processes;

accessing a runtime store or a persistent store;

or accessing a telephone API in order to make a phone call through the electronic device.

30. The method of claim 21, wherein the stored authorization record is associated with data indicative of whether the application is required, allowed, or excluded.

31. The method of claim 21, wherein the authorization record is stored in a protected data store thereby preventing alteration or deletion of the authorization record unless permitted.

32. The method of claim 21, wherein the electronic device is a wireless mobile communications device or a personal digital assistant (PDA).

33. One or more computer readable media storing instructions that upon execution by the electronic device cause the electronic device to perform the steps of claim 21.

34. A data signal that is transmitted using a communication channel, wherein the data signal includes the authorization record of claim 21 for use by the electronic device for determining whether the requested operation is allowed to be performed.

35. The method of claim 21, wherein the application operates upon the electronic device.

36. A system of application control for use on an electronic device, comprising:

an authorization record store configured to store operation authorization data records and application identifiers that are associated with the operation authorization data records; and

software instructions that are configured to consult the operation authorization data records in the authorization record store in order to determine whether an operation requested by an application operating on the electronic device is allowed to be performed by the application;

wherein the application identifiers associated with the operation authorization data records are used to determine which of the operation authorization data records is to be used by the software instructions in determining whether to permit the requested operation.

37. A system of application control for use on a wireless mobile communications device, comprising:

means for receiving an operation request from an application, wherein the requested operation is selected from the group consisting of;

opening a connection, accessing a telephone API, accessing local memory, and communicating with another executing application;

means for determining whether the requested operation is allowed to be performed by the application based upon a stored authorization record and an application identifier associated with the application, wherein the stored authorization record is associated with data indicative of whether the application is required, allowed, or excluded, and wherein the authorization record related to determining whether the requested operation is to be allowed is provided by an external computer that is used to enforce policies for operating electronic devices within an organization; and

means for allowing the application to perform the requested operation based upon whether the requested operation is determined to be allowed to be performed by the application.