METHODS AND APPARATUS FOR CONTROLLING PERMISSIONS TO BE GRANTED TO APPLICATIONS ON USER EQUIPMENT RESPONSIVE TO USER PRIVACY PROFILES

• US 20150249673A1
• Filed: 08/30/2012
• Published: 09/03/2015
• Est. Priority Date: 08/30/2012
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Niemoeller, Joerg, Avesand, Stefan, Mokrushin, Leonid, Peco, Farjola
• Granted Patent: US 10,122,726 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Methods, network nodes, and user equipment nodes are disclosed that control the operation of applications on user equipment nodes. A method includes receiving user information that identifies a user of the user equipment node (120) and application information that identifies an application that the user has selected for installation on the user equipment node. A user profile is retrieved from a user profile repository (106) using the user information, and an application profile is retrieved from an application profile repository (104) using the application information. Settings configuration information is generated responsive to the user profile and the application profile, and indicates what permissions are to be granted to the application while operating on the user equipment node. The application and the settings configuration information is communicated to the user equipment node (120) for installation of the application and configuration of the permissions that are to be granted to the application during operation.

Claims

1. A method by at least one network node of an application control system for controlling operation of applications on a user equipment node, the method comprising:

receiving user information that identifies a user of the user equipment node and application information that identifies an application that the user has selected for installation on the user equipment node;

retrieving a user profile from among a plurality of user profiles in a user profile repository using the user information to identify the user profile, the user profile indicating the user'"'"'s preferences for restricting access by applications to resources of the user equipment node;

retrieving an application profile from among a plurality of application profiles in an application profile repository using the application information to identify the application profile, the application profile indicating resources of the user equipment node that the application will access during operation;

generating settings configuration information, responsive to the user profile and the application profile, that indicates what permissions are to be granted to the application while operating on the user equipment node; and

communicating the application and the settings configuration information through a data network to the user equipment node for installation of the application and configuration of the permissions that are to be granted to the application during operation.

2. The method of claim 1, further comprising:

receiving the application and the settings configuration information at the user equipment node;

installing the application to enable user initiated operation of the application through a user interface of the user equipment node; and

configuring permission settings for the application that restrict what resources of the user equipment node the application will be allowed to access during operation, responsive to the settings configuration information.

3. The method of claim 1, wherein:

the application profile indicates a plurality of modes of operation of the application, each of the modes of operation having a different group of resources that the application will access.

4. The method of claim 3, wherein:

the application profile further indicates first, second, and third modes of operation, the first mode of operation of the application provides more functionality than the second and third modes of operation of the application, and the first mode of operation of the application uses a first group of the resources that is a superset that includes second and third groups of the resources used, respectively, by the second and third modes of operation of the application.

5. The method of claim 3, wherein generating the settings configuration information, responsive to the user profile and the application profile comprises:

selecting among the modes of operation of the application indicated by the application profile, responsive to the user'"'"'s preferences indicated by the user profile; and

generating the settings configuration information to indicate that a selected mode of operation which uses a corresponding group of resources is permitted to be granted to the application while operating on the user equipment node.

6. The method of claim 5, wherein generating the settings configuration information, responsive to the user profile and the application profile further comprises:

generating the settings configuration information to indicate that a non-selected one or more modes of operation using a correspond one or more groups of resources are not permitted to be granted to the application while operating on the user equipment node.

7. The method of claim 3, further comprising:

determining that none of the modes of operation of the application indicated by the application profile satisfy the user'"'"'s preferences indicated by the user profile; and

communicating a message through the data network to the user equipment node informing the user that none of the modes of operation of the application indicated by the application profile satisfy the user'"'"'s preferences indicated by the user profile in response to the determination.

8. The method of claim 1, further comprising:

receiving privacy and security preferences information, from the user through the data network, that indicates the user'"'"'s preferences for controlling privacy and security of information that can be accessible to applications during operation on the user equipment node;

generating the user profile responsive to the privacy and security preferences information from the user; and

storing the user profile in the user profile repository associated with an identifier for the user.

9. The method of claim 8, wherein receiving privacy and security preferences information, from the user through the data network, that indicates the user'"'"'s preferences for controlling privacy and security of information that can be accessible to applications during operation on the user equipment node, comprises:

responding to the user logging into a subscriber account and initiating generation of the user profile, by obtaining the privacy and security preferences information from the user by generating question prompts to the user and receiving responsive answers from the user through the data network and the user equipment node operated by the user.

10. The method of claim 8, further comprising:

receiving updated privacy and security preferences information, from the user through the data network, that indicates changes in the user'"'"'s preferences for controlling privacy and security of information that can be accessible to applications during operation on the user equipment node;

generating an updated user profile responsive to the updated privacy and security preferences information;

storing the updated user profile in the user profile repository associated with the identifier for the user;

generating updated settings configuration information, responsive to the updated user profile and the application profile; and

communicating the updated settings configuration information through the data network to the user equipment node for reconfiguration of the permissions that are to be granted to the application during operation.

11. The method of claim 1, further comprising:

receiving an application query that identifies at least one keyword that is to be searched to identify candidate applications for the user to download to the user equipment node;

responsive to the user profile, selecting between searching for the candidate applications within a secure application store, which contains applications that have corresponding application profiles stored in the application profile repository, and an independent application store, which contains applications that do not have corresponding application profiles stored in the application profile repository;

identifying the candidate applications responsive to the at least one keyword and residing in the selected one of the secure application store and the independent application store; and

communicating the candidate applications to the user equipment node.

12. A method by a user equipment node for controlling operation of applications on the user equipment node, the method comprising:

receiving an application from at least one network node through a data network;

receiving settings configuration information from the at least one network node, the settings configuration information indicating what permissions are to be granted to the application while operating on the user equipment node;

installing the application to enable user initiated operation of the application through a user interface of the user equipment node; and

configuring permission settings for the application that restrict what resources of the user equipment node the application will be allowed to access during operation, responsive to the settings configuration information.

13. The method of claim 12, further comprising:

retrieving a user profile stored at the user equipment node, the user profile indicating the user'"'"'s preferences for restricting access by applications to resources of the user equipment node; and

communicating the user profile with application information that identifies the application that the user has selected for installation on the user equipment node, to the at least one network node.

14. At least one network node that controls operation of applications on a user equipment node, the at least one network node comprising:

a user profile repository that stores a plurality of user profiles, each of the user profiles indicating a user'"'"'s preferences for restricting access by applications to resources of a user equipment node;

an application profile repository that stores a plurality of application profiles, each of the application profiles indicating resources of a user equipment node that an application will access during operation; and

an application installation and settings controller arranged to;

receive user information that identifies a user of a user equipment node and application information that identifies an application that the user has selected for installation on the user equipment node;

retrieve one of the user profiles from among the plurality of user profiles stored at the user profile repository using the user information to identify the user profile;

retrieve one of the application profiles from among the plurality of application profiles stored at the application profile repository using the application information to identify the application profile;

generate settings configuration information, responsive to the user profile and the application profile, that indicates what permissions are to be granted to the application while operating on the user equipment node; and

communicate the application and the settings configuration information through a data network to the user equipment node for installation of the application and configuration of the permissions that are to be granted to the application during operation.

15. The at least one network node of claim 14, wherein:

the application profile indicates a plurality of modes of operation of the application, each of the modes of operation having a different group of resources that the application will access;

the application installation and settings controller selects among the modes of operation of the application indicated by the application profile, responsive to the user'"'"'s preferences indicated by the user profile; and

the application installation and settings controller generates the settings configuration information to indicate that a selected mode of operation having a corresponding group of resources is permitted to be granted to the application while operating on the user equipment node.

16. The at least one network node of claim 14, wherein:

the application installation and settings controller determines that none of the modes of operation of the application indicated by the application profile satisfy the user'"'"'s preferences indicated by the user profile, and communicates a message through the data network to the user equipment node informing the user that none of the modes of operation of the application indicated by the application profile satisfy the user'"'"'s preferences indicated by the user profile in response to the determination.

17. The at least one network node of claim 14, wherein the application installation and settings controller is further configured to:

receive privacy and security preferences information, from the user through the data network, that indicates the user'"'"'s preferences for controlling privacy and security of information that can be accessible to applications during operation on the user equipment node;

generate the user profile responsive to the privacy and security preferences information from the user; and

store the user profile in the user profile repository associated with an identifier for the user.

18. The at least one network node of claim 17, wherein:

the application installation and settings controller responds to the user logging into a subscriber account and initiating generation of the user profile, by obtaining the privacy and security preferences information from the user by generating question prompts to the user and receiving responsive answers from the user through the data network and a user equipment node operated by the user.

19. The at least one network node of claim 17, wherein the application installation and settings controller is further configured to:

receive updated privacy and security preferences information, from the user through the data network, that indicates changes in the user'"'"'s preferences for controlling privacy and security of information that can be accessible to applications during operation on the user equipment node;

generate an updated user profile responsive to the updated privacy and security preferences information from the user;

store the updated user profile in the user profile repository associated with the identifier for the user;

generate updated settings configuration information, responsive to the updated user profile and the application profile; and

communicate the updated settings configuration information through the data network to the user equipment node for reconfiguration of the permissions that are to be granted to the application during operation.

20. The at least one network node of claim 14, wherein the application installation and settings controller is further configured to:

receive an application query that identifies at least one keyword that is to be searched to identify candidate applications for the user to download to the user equipment node;

respond to the user profile by selecting between searching for applications within a secure application store, which contains applications that have corresponding application profiles stored in the application profile repository, and an independent application store, which contains applications that do not have corresponding application profiles stored in the application profile repository;

identify candidate applications responsive to the at least one keyword in the selected one of the secure application store and the independent application store; and

communicate the candidate applications to the user equipment node.