Using permissions to allocate device resources to an application

• US 7,743,407 B2
• Filed: 08/13/2002
• Issued: 06/22/2010
• Est. Priority Date: 08/13/2001
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Sprigg, Stephen A., Lundblade, Laurence
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US10/218,321
• Publication Number:
  US 20030051169A1
• Time in Patent Office: 2,870 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Resources to a device are granted access to an application based on privileges associated with the application. A permission list may be created by a server. The permission list may be created using information from authorities, entities, or parties and information about the device resources. The permission list indicates what device resources the application may access. During application execution when the application requests a resource, a control program executing on the device may be used to check the permission list associated with the application to determine if the application may access the resource. The control program can then grant or deny access based on the privileges defined in the permission list. Digital signatures may be used to detect modifications to the application and/or permission list. In addition, multiple permission lists may be associated with the same application.

Claims

1. A method for downloading and storing an application on a device, comprising the steps of:

configuring at least one processor to perform the functions of;

receiving a downloaded application at the device;

receiving a downloaded permission list associated with said downloaded application at the device, wherein the associated downloaded permission list indicates, respectively for each of a plurality of resources, on the device, which ones of said resources the device would limit the downloaded application to access on the device during continued application execution, wherein the plurality of resources is defined at the device prior to receiving the associated downloaded permission list, wherein if access is limited during the continued application execution, transmitting a request to download on update to the permission list to access the resource being limited from access for the downloaded application; and

storing the downloaded application and the associated downloaded permission list on the device.

2. The method of claim 1, wherein the associated downloaded permission list is created using input from an authority.

3. The method of claim 2, wherein the authority is a separate entity from the device.

4. The method of claim 1, further comprising the steps of:

executing the downloaded application on the device; and

limiting the downloaded application access to the device'"'"'s resources.

5. The method of claim 1, further comprising:

receiving a digital signature, said digital signature being computed over at least said associated downloaded permission list.

6. The method of claim 1, wherein the device is a wireless device.

7. A wireless device comprising:

a wireless interface;

a memory for storing a control program and a plurality of applications, each application including an associated permission list;

a receiver for receiving a downloaded application at the wireless device and for receiving a downloaded permission list associated with the downloaded application at the wireless device and storing the downloaded application and the associated downloaded permission list on the wireless device;

a processor, coupled to said memory, for executing said control program and said plurality of applications; and

a plurality of device resources, coupled to said processor;

wherein said processor is configured by said control program to control access to each of said plurality of resources such that whenever the downloaded application attempts to access one of said device resources, said device resources being defined at the device prior to receiving said associated downloaded permission list, said downloaded application is limited access during continued execution if said associated downloaded permission list of said downloaded application indicates that said downloaded application is only authorized restricted access or is not authorized to access that device resource, wherein if access is limited during the continued application execution, said processor is configured to transmit a request to download an update to the permission list to access the resource being limited from access for the downloaded application.

8. The wireless device of claim 7, wherein said plurality of device resources is selected from a list comprising:

a microphone;

a speaker;

a network interface;

a dialer interface;

a file;

a location based services interface; and

an I/O port.

9. The wireless device of claim 7, wherein each application also includes a digital signature, and said processor is further configured by said control program to validate said downloaded application by evaluating said digital signature to determine whether said downloaded application and said associated downloaded permission list had been modified, and to terminate execution of said downloaded application if either said downloaded application or said associated downloaded permission list had been modified.

10. A system for downloading and storing an application on a wireless device, comprising:

means for receiving a downloaded application at the device;

means for receiving a downloaded permission list associated with said downloaded application at the device, wherein the downloaded permission list indicates, respectively for each of a plurality of resources on the device which ones of said resources the device would limit the downloaded application to access during continued execution of the downloaded application, wherein the plurality of resources is defined at the device prior to receiving the associated downloaded permission list, wherein if access is limited during the continued application execution, transmitting a request to download an update to the permission list to access the resource being limited from access for the downloaded application; and

means for storing the downloaded application and the associated downloaded permission list on

11. A computer-readable storage medium tangibly storing a sequence of computer-executable instructions, which when executed by a wireless device, causes said wireless device to control access to a plurality of device resources, for an application executing on the wireless device, comprising the steps of:

(a) receiving a downloaded application at said wireless device;

(b) receiving a downloaded permission list associated with said downloaded application at said wireless device and storing the downloaded application and the associated downloaded permission list on the wireless device;

(c) receiving, from said downloaded application, an access request for a specific device resource selected from said plurality of device resources, wherein the plurality of resources is defined at the device prior to receiving the associated download permission list;

(d) responsive to step (c), evaluating the associated downloaded permission list stored on said wireless device and associated with said downloaded application, wherein the associated downloaded permission list indicates restrictions on which ones of said device resources the downloaded application can access; and

(e) limiting said downloaded application access to the specific device resource while continuing to execute the downloaded application when said associated downloaded permission list indicates that said downloaded application contains restrictions from accessing said specific device resource, wherein if access is limited during the continued application execution, transmitting a request to download an update to the permission list to access the resource being limited from access for the downloaded application.