SYSTEM AND METHOD FOR SECURELY MANAGING DATA STORED ON MOBILE DEVICES, SUCH AS ENTERPRISE MOBILITY DATA

• US 20120149338A1
• Filed: 02/24/2012
• Published: 06/14/2012
• Est. Priority Date: 02/14/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Brian Roundtree
• Inventors: Roundtree, Brian
• Granted Patent: US 8,494,486 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system and method for managing data stored on mobile devices is described. In some cases, the system stores data, such as data under enterprise mobility management, within a secured memory location of a SIM card. In some cases, the system may request validation credentials before providing access to data stored in secure locations. In some cases, the system may review an access policy and request validation based on instructions from the access policy.

Claims

1. A removable memory device for use with a cell phone, the removable memory device comprising:

a memory component, wherein the memory component contains two or more locations, including;

a first location that stores data assigned a first level of security associated with enterprise mobility security preferences assigned by a business to the stored data,

wherein the enterprise mobility security preferences are defined by the business to protect the stored data from being accessed by users not affiliated with the business; and

a second location that stores data not associated with the enterprise mobility management security preferences assigned by the business,

wherein at least the first location of the removable memory device is protected from unauthorized access regardless of whether the removable memory device is installed in the cell phone or removed from the cell phone;

a processing component, wherein the processing component executes applications within the removable memory device; and

a management application configured to be executed by the processing component,

wherein the management application accesses data stored in the first location.

2. The removable memory device of claim 1, wherein the removable memory device comprises a subscriber identity module.

3. The removable memory device of claim 1, wherein the management application initiates a validation process in response to a user request for access to data stored in the first location.

4. The removable memory device of claim 1, wherein the management application grants access to the data stored in the first location when a validation process determines that the cell phone is secure.

5. A method of providing security for email messages stored within a mobile device, the method comprising:

receiving an indication that a removable storage device has been inserted into the mobile device,

wherein the removable storage device includes a secure memory component and an unsecured memory component;

loading from within the removable storage device a management application into the local memory of the mobile device; and

executing the management application from the local memory of the mobile device,

wherein the executed application causes email messages stored within the local memory to be mapped to the secure memory component of the removable storage device.

6. The method of claim 5, wherein the executed application causes email messages received by the mobile device to be mapped to the secure memory component of the removable storage device.

7. The method of claim 5, wherein the executed application causes a subset of the email messages stored within the local memory associated with enterprise mobility management to be mapped to the secure memory component of the removable storage device.

8. The method of claim 5, further comprising:

receiving a request from a user to access an email message mapped to the secure memory component of the removable storage device;

determining whether the request was received from an authorized user; and

when the user is authorized, providing access to the requested email message, or

when the user is not authorized, blocking access to the requested email message.

9. A computer-readable storage medium storing instructions that when executed by a mobile device implement security for email messages stored within a mobile device, the method comprising:

receiving an indication that a removable storage device has been inserted into the mobile device,

wherein the removable storage device includes a secure memory component and an unsecured memory component;

loading from within the removable storage device a management application into the local memory of the mobile device; and

executing the management application from the local memory of the mobile device,

wherein the executed application causes email messages stored within the local memory to be mapped to the secure memory component of the removable storage device.

10. The computer-readable storage medium of claim 9, wherein the executed application causes email messages received by the mobile device to be mapped to the secure memory component of the removable storage device.

11. The computer-readable storage medium of claim 9, wherein the executed application causes a subset of the email messages stored within the local memory associated with enterprise mobility management to be mapped to the secure memory component of the removable storage device.

12. The computer-readable storage medium of claim 9, further comprising:

receiving a request from a user to access an email message mapped to the secure memory component of the removable storage device;

determining whether the request was received from an authorized user; and

when the user is authorized, providing access to the requested email message, or

when the user is not authorized, blocking access to the requested email message.

13. A system of providing security for email messages stored within a mobile device, the method comprising:

means for receiving an indication that a removable storage device has been inserted into the mobile device,

wherein the removable storage device includes a secure memory component and an unsecured memory component;

means for loading from within the removable storage device a management application into the local memory of the mobile device; and

means for executing the management application from the local memory of the mobile device,

wherein the executed application causes email messages stored within the local memory to be mapped to the secure memory component of the removable storage device.

14. The system of claim 13, wherein the executed application causes email messages received by the mobile device to be mapped to the secure memory component of the removable storage device.

15. The system of claim 13, wherein the executed application causes a subset of the email messages stored within the local memory associated with enterprise mobility management to be mapped to the secure memory component of the removable storage device.

16. The system of claim 13, further comprising:

means for receiving a request from a user to access an email message mapped to the secure memory component of the removable storage device;

means for determining whether the request was received from an authorized user;

means for providing access to the requested email message when the user is authorized; and

means for blocking access to the requested email message when the user is not authorized.