METHODS AND SYSTEM FOR IMPLEMENTING A SECURE LOCK SCREEN

• US 20150347776A1
• Filed: 09/29/2014
• Published: 12/03/2015
• Est. Priority Date: 05/30/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: SHEPHERD, Matthew E., SCHIMPF, Daniel O., SHAFFER, Joshua H., ZHANG, Chendi, NIELSEN, Benjamin E., ZWARICH, Cameron W.
• Granted Patent: US 10,223,540 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance

Abstract

Disclosed herein is a technique for implementing a secure lock screen on a computing device. The secure lock screen is configured to permit particular applications to display their content—such as main user interfaces (UIs)—while maintaining a desired overall level of security on the computing device. Graphics contexts, which represent drawing destinations associated with the applications, are tagged with entitlement information that indicates whether or not each graphics context should be displayed on the computing device when the computing device is in a locked-mode. Specifically, an application manager tags each application that is initialized, where the tagging is based on a level of entitlement possessed by the application. In turn, a rendering server that manages the graphics contexts can identify the tagged entitlement information and display or suppress the content of the applications in accordance with their entitlements.

Claims

1. A method for implementing a secure lock screen, the method comprising:

at a computing device;

receiving a request to launch an application;

identifying an entitlement associated with the application, wherein the entitlement indicates whether content of the application is permitted to be displayed when the computing device is in a locked-mode;

assigning the entitlement to a graphics context associated with the application; and

launching the application.

2. The method of claim 1, wherein the entitlement is based on a digital signature that accompanies the application.

3. The method of claim 1, wherein the entitlement is based on a user preference.

4. The method of claim 1, wherein, when the application is permitted to be displayed when the computing device is in the locked-mode, the application is permitted to display only one graphics context that is associated with a different application.

5. The method of claim 4, wherein, when the application attempts to display a second graphics context that is associated with a different application, the second graphics context is suppressed.

6. The method of claim 1, wherein the graphics context is a drawing destination associated with the application, and the graphics context is rendered by a rendering server included in the computing device.

7. The method of claim 6, further comprising:

assigning a property to the graphics context that indicates to the rendering server that the graphics context is not visible;

obtaining, from the rendering server, a snapshot of a user interface (UI) associated with the application; and

removing the property from the graphics context.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to carry out steps that include:

receiving a request to render a graphics context associated with an application, wherein the graphics context is associated with an entitlement that indicates whether the graphics context is permitted to be displayed when the computing device is in a locked-mode;

determining that the computing device is in the locked-mode; and

displaying the graphics context in accordance with the entitlement.

9. The non-transitory computer readable storage medium of claim 8, wherein, when the entitlement indicates that the graphics context is not permitted to be displayed when the computing device is in the locked-mode, but a property of the graphics context indicates that the graphics context is not visible, the graphics context is not displayed.

10. The non-transitory computer readable storage medium of claim 9, wherein the property is temporarily set by an application manager when the application manager seeks to obtain an up-to-date representation of the graphics context without causing the graphics context to be displayed.

11. The non-transitory computer readable storage medium of claim 8, wherein, when the entitlement indicates a level of depth that is equal to or does not exceed a threshold level of depth, the graphics context is displayed.

12. The non-transitory computer readable storage medium of claim 8, wherein, when the entitlement indicates a level of depth that exceeds a threshold level of depth, the graphics context is not displayed.

13. The non-transitory computer readable storage medium of claim 8, wherein the steps further include:

when the entitlement indicates that the graphics context is not permitted to be displayed when the computing device is in the locked-mode;

causing an application manager to kill the application.

14. A computing device, comprising:

a display device;

a processor; and

a memory configured to store instructions that, when executed by the processor, cause the computing device to carry out steps that include;

assigning an entitlement to a graphics context associated with an application executing on the computing device, wherein the entitlement indicates whether the graphics context is permitted to be displayed on the display device when the computing device is in a locked-mode;

receiving a request to render the graphics context;

determining that the computing device is in the locked-mode; and

displaying the graphics context in accordance with the entitlement.

15. The computing device of claim 14, wherein, when the application is permitted to be displayed when the computing device is in the locked-mode, the application is permitted to display only one graphics context that is associated with a different application.

16. The computing device of claim 15, wherein, when the application attempts to display a second graphics context that is associated with a different application, the second graphics context is suppressed.

17. The computing device of claim 14, wherein, when the entitlement indicates that the graphics context is not permitted to be displayed when the computing device is in the locked-mode, but a property of the graphics context indicates that the graphics context is not visible, the graphics context is not displayed.

18. The computing device of claim 17, wherein the property is temporarily set by an application manager when the application manager seeks to obtain an up-to-date representation of the graphics context without causing the graphics context to be displayed.

19. The computing device of claim 14, wherein, when the entitlement indicates a level of depth that is equal to or does not exceed a threshold level of depth, the graphics context is displayed.

20. The computing device of claim 14, wherein the steps further include:

when the entitlement indicates that the graphics context is not permitted to be displayed when the computing device is in the locked-mode;

causing an application manager to kill the application.