METHOD AND SYSTEM FOR CONTROLLING SYSTEM SETTINGS OF A COMPUTING DEVICE

• US 20150019857A1
• Filed: 07/24/2014
• Published: 01/15/2015
• Est. Priority Date: 12/23/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Courtney, Sean Alexander, Truskovsky, Alexander
• Granted Patent: US 9,292,314 B2
• Time in Patent Office: Days
• US Class Current: 713/100
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

Methods and devices for controlling system settings of a computing device are described herein. One example embodiment comprises: determining configuration data associated with a software application, wherein the configuration data identifies one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, and wherein the configuration data is digitally signed; and in response to an initiation of the execution of the software application, reconfiguring system settings on the computing device; wherein the reconfiguring comprises verifying at least one digital signature associated with the digitally signed configuration data; wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

Claims

1. A method of controlling system settings of a computing device, the method comprising:

determining configuration data associated with a digitally signed software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed; and

in response to an initiation of the execution of the software application, reconfiguring system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data;

verifying a digital signature associated with the digitally signed software application; and

verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid;

wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then after successfully verifying the digital signature associated with the digitally signed software application, and verifying that the certificate is valid, the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

2. The method of claim 1, wherein the temporarily enforcing new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring original system settings upon the termination of the software application.

3. The method of claim 1, wherein the reconfiguring further comprises verifying that a certificate used to verify the digital signature associated with the digitally signed configuration data is valid, and wherein the temporarily enforcing new system settings is performed after successfully verifying that the certificate is valid.

4. The method of claim 1, wherein the at least one digital signature associated with the digitally signed configuration data comprises a first digital signature generated at a developer device and a second digital signature generated at an application authority.

5. The method of claim 4, wherein the configuration data is digitally signed at the developer device to produce developer-signed configuration data, and the developer-signed configuration data is digitally signed at the application authority to produce the digitally signed configuration data.

6. The method of claim 1, wherein an identifier that uniquely identifies the software application is provided with the configuration data.

7. The method of claim 6, wherein the identifier that uniquely identifies the software application comprises a hash of the software application.

8. The method of claim 1, wherein the configuration data that is digitally signed is accompanied by developer-identifying data associated with the application.

9. The method of claim 8, wherein the developer-identifying data comprises a signed hash of a developer'"'"'s certificate.

10. The method of claim 1, wherein the method further comprises detecting the initiation of the execution of the software application.

11. The method of claim 1, wherein the method further comprises receiving the configuration data at the computing device.

12. The method of claim 11, wherein the method further comprises receiving the software application with the configuration data at the computing device.

13. The method of claim 2, wherein the applying the new system setting comprises:

determining if the new system setting is more restrictive than the corresponding original system setting, and changing the original system setting to the new system setting if the new system setting is more restrictive.

14. The method of claim 13, wherein the continuing the execution of the software application with the new system settings applied comprises continuing the execution of the software application with combined system settings that include at least one new system setting and at least one original system setting.

15. The method of claim 1, wherein if the at least one digital signature associated with the digitally signed configuration data fails to successfully verify, then the method further comprises generating an error message and then performing at least one of:

transmitting the error message to a developer device, transmitting the error message to an application authority device, and displaying the error message on a user interface of the computing device.

16. A computing device comprising:

a processor and a memory, the memory storing executable instructions that, when executed by the processor, cause the processor to;

determine configuration data associated with a digitally signed software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed; and

in response to an initiation of the execution of the software application, reconfigure the system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data;

verifying a digital signature associated with the digitally signed software application; and

verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid;

wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then after successfully verifying the digital signature associated with the digitally signed software application, and verifying that the certificate is valid, the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

17. The computing device of claim 16, wherein the temporarily enforcing new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring original system settings upon the termination of the software application.

18. A computer-readable storage medium comprising instructions that, when executed by a processor of a computing device, cause the processor to perform a method of controlling system settings of the computing device, the method comprising:

determining configuration data associated with a digitally signed software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed; and

in response to an initiation of the execution of the software application, reconfiguring system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data;

verifying a digital signature associated with the digitally signed software application; and

verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid;

wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then after successfully verifying the digital signature associated with the digitally signed software application, and verifying that the certificate is valid, the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

19. The medium of claim 18, wherein the temporarily enforcing new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring original system settings upon the termination of the software application.

20. A method of controlling system settings of a computing device, the method comprising:

determining configuration data associated with a digitally signed software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application;

in response to an initiation of the execution of the software application, determining if the software application is allowed to enforce the one or more new system settings, the determining if the software application is allowed to enforce the one or more new system settings comprising;

verifying a digital signature associated with the digitally signed software application; and

verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid; and

if the software application is allowed to enforce the one or more new system settings, configuring system settings on the computing device to temporarily enforce the new system settings, the configuring comprising;

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring original system settings upon the termination of the software application.

21. The method of claim 20, wherein the computing device provides a policy indicating whether the software application can enforce the one or more new system settings, and the determining if the software application is allowed to enforce the one or more new system settings is based on the policy.