ACCESS MANAGEMENT SYSTEM

• US 20130067564A1
• Filed: 04/18/2011
• Published: 03/14/2013
• Est. Priority Date: 04/29/2010
• Status: Active Grant

• Current Assignee: Lenovo Innovations Ltd Hong Kong (Lenovo Group Ltd.)
• Original Assignee: NEC Corporation
• Inventors: Fok Ah Chuen, Frederic, Lecroart, Benoit, Perron, Olivier
• Granted Patent: US 9,043,898 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

An access rights management system is presented in which a mobile device may be allowed to access corporately held data in a flexible manner but in which the security and integrity of the data is maintained. The mobile device is provided with a rights adjustment module which modifies the access rights for locally stored corporate data in dependence on the connectivity of the mobile device with a corporate server.

Claims

1. A method of managing access rights for data held locally relative to a mobile communications device connected to a network, the data having a first set of access rights, the method comprising:

detecting disconnection of the mobile communications device from the network; and

adjusting the access rights from the first set of access rights to a second set of access rights for the data on detection of the disconnection;

wherein the first set of access rights is different to said second set of access rights.

2. A method according to claim 1 wherein the second set of access rights comprises at least one access right which is more restrictive than a corresponding access right of the first set of access rights.

3. A method according to claim 1 wherein the first and second set of access rights each comprises at least one of read permissions, write permissions, and execute permissions.

4. A method according to claim 1 wherein said adjusting said access rights to said second set of access rights comprises granting access rights which vary in dependence on at least one of:

an identity of a file comprising the data;

a file type of the file comprising the data;

a rights access level assigned to the file comprising the data;

membership of the file comprising the data in a predefined group; and

an identity of a directory in which the file comprising the data is located.

5. A method according to claim 1 wherein said adjusting said access rights to said second set of access rights comprises granting access rights which vary in dependence on an identity of a user of the mobile device and/or membership of the user of the mobile device in a predefined user group.

6. A method according to claim 1 wherein detecting disconnection of the mobile communications device from the network comprises detecting disconnection of said mobile device from predefined server apparatus.

7. A method according to claim 6 wherein said method further comprises:

determining that the mobile communications device is connected to server apparatus;

obtaining information representing the identity of the server apparatus to which the mobile device is connected;

obtaining information representing the identity of the predefined server apparatus; and

comparing the identity of the server apparatus to which the mobile device is connected with the identity of the predefined server apparatus, whereby to determine connectivity of said mobile device to said predefined server apparatus.

8. A method according to claim 7 wherein said method is performed by a rights management module operating on said mobile device and wherein said information representing the identity of the predefined server apparatus is obtained from configuration parameters provided for configuring said rights management module.

9. A method according to claim 7 wherein said information representing the identity of the predefined server apparatus is obtained by retrieving it from the data held locally relative to the mobile communications device.

10. A method according to claim 7 wherein said information representing the identity of the predefined server apparatus is obtained by receiving it from an application running locally on the mobile communications device.

11. A method according to claim 1 wherein the data is encrypted and wherein the method comprises decrypting the data for which the access rights are granted on the mobile communications device when the mobile communications device is not connected to the network.

12. A method according to claim 1 wherein the data is encrypted and wherein the method comprises receiving a decrypted version of the data for which the access rights are granted, from server apparatus, when the mobile communications device is connected to the network.

13. A method according to claim 1 wherein the method comprises detecting an attempt to mount a portable storage device on which said data is stored on the mobile communications device, requesting entry of secure input information from a user of the mobile communications device, receiving the secure input information from the user, verifying the received secure input information, allowing successful mounting of the portable storage device if the secure input information is successfully verified, and inhibiting mounting of the portable storage device if the secure input information is not successfully verified.

14. A method according to claim 1 wherein the method further comprises detecting a change in the connectivity of the mobile communications device to a network from disconnected to connected and adjusting the access rights from the second set of access rights to the first set of access rights on detection of the change.

24. A non-transitory computer readable medium storing a program for causing a computer to carry out a method according to claim 1.

15. A method of provisioning a mobile communications device for managing access rights for data held locally relative to the mobile communications device, the method comprising:

receiving, at the mobile communications device, configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network;

receiving, at the mobile communications device, configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network; and

storing said configuration parameters for use in managing said access rights for the data held locally relative to the mobile communications device;

wherein the first set of access rights is different to said second set of access rights.

16. A method of provisioning a mobile communications device for managing access rights for data held locally relative to the mobile communications device, the method comprising:

providing the mobile communications device with configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network; and

providing the mobile communications device with configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network;

wherein the first set of access rights is different to said second set of access rights.

17. A method as claimed in claim 16 wherein the method comprises determining that updated configuration parameters are available, and providing said updated configuration parameters to said mobile communications device in response to said determination.

18. A method according to claim 16 wherein said providing said configuration parameters comprises providing configuration parameters which define access rights which are dependent on at least one of:

an identity of a file comprising the data;

a file type of the file comprising the data;

a rights access level assigned to the file comprising the data;

membership of the file comprising the data in a predefined group; and

/or an identity of a directory in which the file comprising the data is located.

19. A mobile communications device having an access rights managing unit that manages access rights for data held locally relative to the mobile communications device, the access rights managing unit comprising:

connecting unit that connects to a network, wherein when the mobile device is connected to the network the data has a first set of access rights;

a detecting unit that detects disconnection of the mobile communications device from the network; and

an access rights adjusting unit that adjusts the access rights from the first set of access rights to a second set of access rights for the data on detection of the disconnection;

wherein the first set of access rights is different to said second set of access rights.

21. A mobile communications device as claimed in claim 19 wherein said access rights managing unit comprises a rights management module operable to run on said mobile communications device.

22. A mobile communications device as claimed in claim 21 wherein said rights management module is operable to initiate on boot-up of the mobile device.

20. A mobile communications device having an access rights managing unit that manages access rights for data held locally relative to the mobile communications device, the access rights managing unit comprising:

a first receiving unit that receives, at the mobile communications device, configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network;

a second receiving unit that receives, at the mobile communications device, configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network; and

a storing unit that stores said configuration parameters for use in managing said access rights for the data held locally relative to the mobile communications device;

wherein the first set of access rights is different to said second set of access rights.

23. Server apparatus having a provisioning unit that provisions a mobile device to manage access rights for data held locally relative to the mobile communications device, the provisioning unit comprising:

a first providing unit that provides the mobile communications device with configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network; and

a second providing unit that provides the mobile communications device with configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network;

wherein the first set of access rights is different to said second set of access rights.

25. A mobile communications device having a module for managing access rights for data held locally relative to the mobile communications device, the access rights managing module being operable to:

(i) determine the connectivity of the mobile communications device to a network;

(ii) grant a first set of access rights for the data when the mobile communications device is connected to the network, and (iii) grant a second set of access rights for the data when the mobile communications device is not connected to the network;

wherein the first set of access rights is different to said second set of access rights.

26. A mobile communications device having a module for managing access rights for data held locally relative to the mobile communications device, the access rights managing module being operable to:

(i) receive configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network;

(ii) receive configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network; and

(iii) store said configuration parameters for use in managing said access rights for the data held locally relative to the mobile communications device;

wherein the first set of access rights is different to said second set of access rights.

27. Server apparatus having a provisioning module for provisioning a mobile device to manage access rights for data held locally relative to the mobile communications device, the provisioning module being operable to provide the mobile communications device with:

(i) configuration parameters defining a first set of access rights for the data for use when the mobile communications device is connected to a network, and (ii) configuration parameters defining a second set of access rights for the data for use when the mobile communications device is not connected to the network;

wherein the first set of access rights is different to said second set of access rights.