RESTRICTED EXECUTION MODES

• US 20130305354A1
• Filed: 12/22/2012
• Published: 11/14/2013
• Est. Priority Date: 12/23/2011
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: King, Joseph Spencer, Braun, David A., Begun, Andrew P., Matthews, Joseph H. III, Karr, Jennifer Anne, Schrader, Joseph A., Chen, Ted Tai-Yu, Sarin, Raman K., Agarwal, Sharad, Guday, Shai, Thomas, Shawn M., Skovron, John D., Yovin, John A., Goulding, Michael Burt, Derksen, Todd Myles, Yan Woo, Aaron Naoyoshi Sheung, Iturriaga Dubost, Bernardo, Auerbach, Alan Bennett, Haon, Andrew Craig
• Application Number:
  US13/726,099
• Publication Number:
  US 20130305354A1
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

In embodiments of restricted execution modes, a mobile device can display a device lock screen on an integrated display device, and transition from the device lock screen to display a shared space user interface of a shared space. The transition to display the shared space user interface is without receiving a PIN code entered on the device lock screen. The mobile device implements a restricted execution service that is implemented to activate a restricted execution mode of the mobile device, and restrict access of a device application to device content while the restricted execution mode is activated. The restricted execution service can also allow a shared device application that is included in the shared space access to the device content while the restricted execution mode is activated.

Claims

1. A mobile device, comprising:

a display device configured to display a device lock screen and transition to a shared space user interface of a shared space without an authentication credential entered on the device lock screen;

a processing system to implement a restricted execution service that is configured to;

activate a restricted execution mode of the mobile device; and

restrict access of a device application to device content while the restricted execution mode is activated.

2. A mobile device as recited in claim 1, wherein:

the shared space includes a shared device application; and

the

restricted execution service is configured to allow the shared device application access to the device content while the restricted execution mode is activated.

3. A mobile device as recited in claim 2, wherein:

the device application is configured to call the shared device application with a request for the device content; and

the restricted execution service is further configured to restrict the device application access to the device content via the shared device application while the restricted execution mode is activated.

4. A mobile device as recited in claim 2, wherein:

the device application is configured to call the shared device application with a request for the device content, the request including a request token that indicates the device application is permitted to access the device content via the shared device application in the shared space; and

the restricted execution service is further configured allow the device application access to the device content via the shared device application based on the request token while the restricted execution mode is activated.

5. A mobile device as recited in claim 1, wherein the restricted execution service is further configured to:

deactivate the restricted execution mode responsive to an authentication credential entered on the device lock screen; and

return to a user mode of the mobile device in which the device application has unrestricted access to the device content.

6. A mobile device as recited in claim 1, wherein:

the device application is configured to initiate a task call to access the device content; and

wherein

the restricted execution service is configured to restrict the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.

7. A mobile device as recited in claim 1, wherein:

the restricted execution service is further configured to restrict the device application from a file system of the mobile device while the restricted execution mode is activated.

8. A mobile device as recited in claim 1, wherein:

the restricted execution service is configured to determine that the device application is one of;

user-designated to allow the device application access to the device content if the device application is included in the shared space as a shared device application;

or

the device application is designed as not to be allowed access to the device content even if the device application is included in the shared space.

9. A method, comprising:

displaying a device lock screen on an integrated display device of a mobile device;

transitioning from displaying the device lock screen to display a shared space user interface of a shared space without an authentication credential entered on the device lock screen;

activating a restricted execution mode of the mobile device; and

restricting access of a device application to device content while the restricted execution mode is activated.

10. A method as recited in claim 9, further comprising:

allowing a shared device application that is included in the shared space access to the device content while the restricted execution mode is activated.

11. A method as recited in claim 10, further comprising:

restricting the device application access to the device content via the shared device application while the restricted execution mode is activated when the device application calls the shared device application with a request for the device content.

12. A method as recited in claim 10, further comprising:

allowing the device application access to the device content via the shared device application while the restricted execution mode is activated based on a request token that the device application includes in a task call to the shared device application for the device content, the request token indicating that the device application is permitted to access the device content via the shared device application in the shared space.

13. A method as recited in claim 9, further comprising:

deactivating the restricted execution mode responsive to an authentication credential entered on the device lock screen; and

returning to a user mode of the mobile device in which the device application has unrestricted access to the device content.

14. A method as recited in claim 9, further comprising:

restricting the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.

15. A method as recited in claim 9, further comprising:

restricting the device application from a file system of the mobile device while the restricted execution mode is activated.

16. A method as recited in claim 9, further comprising:

determining that the device application is one of;

user-designated to allow the device application access to the device content if the device application is included in the shared space as a shared device application;

or

the device application is designed as not to be allowed access to the device content even if the device application is included in the shared space.

17. Computer-readable storage media comprising a restricted execution service stored as instructions that are executable and, responsive to execution of the instructions at a mobile device, the computing device performs operations of the restricted execution service comprising to:

transition from a device lock screen to a shared space user interface of a shared space without an authentication credential entered on the device lock screen;

activate a restricted execution mode of the mobile device;

restrict access of a device application to device content while the restricted execution mode is activated; and

allow access to the device content for a shared device application that is included in the shared space.

18. Computer-readable storage media as recited in claim 17, wherein the mobile device performs the operations of the restricted execution service further comprising to:

restrict the device application access to the device content via the shared device application while the restricted execution mode is activated when the device application calls the shared device application with a request for the device content.

19. Computer-readable storage media as recited in claim 17, wherein the mobile device performs the operations of the restricted execution service further comprising to:

allow the device application access to the device content via the shared device application while the restricted execution mode is activated based on a request token that the device application includes in a task call to the shared device application for the device content, the request token indicating that the device application is permitted to access the device content via the shared device application in the shared space.

20. Computer-readable storage media as recited in claim 17, wherein the mobile device performs the operations of the restricted execution service further comprising to:

restrict the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.