SYSTEM AND METHOD FOR SECURING WIRELESS DATA

• US 20120246461A1
• Filed: 06/07/2012
• Published: 09/27/2012
• Est. Priority Date: 08/25/2003
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Buckley, Adrian, Asthana, Atul
• Granted Patent: US 8,533,452 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Systems and methods for operation upon a data processing device for handling secure data stored on the device. The device is configurable to communicate over a data channel with an external security information source. User identification information is received from the external security information source which identifies a user of the device. The device, based upon the received user identification information, determines whether the secure data stored on the device is to be accessed by a user of the device.

Claims

1. A method in a device for handling encrypted data, comprising:

receiving encrypted data for a specific recipient from a rules database, the encrypted data having been encrypted at the rules database using an encryption key, wherein recipient user identification information associated with the specific recipient is stored on an external security information source and the rules database contains a copy of the recipient user identification information;

obtaining external user identification information from the external security information source, wherein the external security information source has a location proximate to the device;

obtaining a public key from the rules database, wherein the public key is generated based on the copy of the recipient user identification information and the encryption key;

generating a decryption key using the public key and the external user identification information;

decrypting the encrypted data using the decryption key; and

wherein the encrypted data is accessible when the external user identification information matches the recipient user identification information.

2. The method of claim 1, wherein the device comprises a wireless mobile communications device that receives email messages over a wireless communications network;

and wherein the encrypted data includes an email message.

3. The method of claim 1, wherein the obtaining external user identification information from the external security information step comprises receiving the external user identification information from the external security information over a wireless data link.

4. The method of claim 1, wherein a recipient other than the specific recipient of the encrypted data sent to the device is not able to access the encrypted data if the device does not receive proper external user identification information associated with the specific recipient.

5. The method of claim 4, wherein the device does not receive proper external user identification information because the device does not receive any external user identification information from the external security information source.

6. The method of claim 1, wherein the external security information source includes a security credentials tag or card associated with the specific recipient.

7. The method of claim 6, wherein the external security credentials tag or card communicates to the device via a wireless communications channel.

8. The method of claim 6, wherein the external security credentials tag or card communicates to the device via an external data link.

9. The method of claim 1, wherein the encrypted data is secured on a per email or per file basis before the encrypted data is sent to the device.

10. The method of claim 1, wherein the rules database is configured to determine whether an incoming email message received for the specific recipient is to be encrypted before sending said email message to the specific recipient.

11. The method of claim 1, wherein the encrypted data is stored on the device with respect to a specific user of the device in order to prevent other users from accessing the encrypted data.

12. The method of claim 1, wherein the encrypted data is encrypted for a specific device associated with the specific recipient.

13. A wireless device for handling encrypted data, comprising:

a wireless transceiver for communicating over a data channel; and

wherein;

the wireless device is configured to receive encrypted data for a specific recipient from a rules database, the encrypted data having been encrypted at the rules database using an encryption key, wherein recipient user identification information associated with the specific recipient is stored on an external security information source and the rules database contains a copy of the recipient user identification information;

the wireless device is configured to receive external user identification information from the external security information source, wherein the external security information source has a location proximate to the device;

the wireless device is configured to receive a public key from the rules database, wherein the public key is generated based on the copy of the recipient user identification information and the encryption key;

the wireless device is configured to generate a decryption key using the public key and the external user identification information;

the wireless device is configured to decrypt the encrypted data using the decryption key; and

the wireless device is configured to make the encrypted data accessible when the external user identification information matches the recipient user identification information.

14. The wireless device of claim 13, wherein the encrypted data comprises an email message.

15. The wireless device of claim 13, wherein the device is configured to store the encrypted data on the device with respect to a specific user of the device in order to prevent other users from accessing the encrypted data.

16. The wireless device of claim 13, wherein the device is configured to prevent a recipient other than the specific recipient of the encrypted data sent to the device from accessing the encrypted data if the device does not receive proper external user identification information associated with the specific recipient.

17. The wireless device of claim 16, wherein the wireless device is configured to prevent a user of the device other than the specific recipient of the encrypted data sent to the device from accessing the encrypted data if the wireless device does not receive any external user identification information from the external security information source.

18. The wireless device of claim 13, wherein the external security information source includes a security credentials tag or card associated with the specific recipient and wherein the wireless device is configured to communicate with the external security credentials tag or card via a wireless communications channel.

19. The wireless device of claim 13, wherein the external security information source includes a security credentials tag or card associated with the specific recipient and wherein the wireless device is configured to communicate with the external security credentials tag or card via an external data link.

20. A wireless device comprising:

means for receiving encrypted data for a specific recipient from a rules database, the encrypted data having been encrypted at the rules database using an encryption key, wherein recipient user identification information associated with the specific recipient is stored on an external security information source and the rules database contains a copy of the recipient user identification information

means for receiving external user identification information from the external security information source, wherein the external security information source has a location proximate to the device;

means for receiving a public key from the rules database, wherein the public key is generated based on the copy of the recipient user identification information and the encryption key;

means for generating a decryption key using the public key and the external user identification information;

means for decrypting the encrypted data using the decryption key; and

means for making the encrypted data accessible when the external user identification information matches the recipient user identification information.