System and method of data security in synchronizing data with a wireless device

• US 8,001,082 B1
• Filed: 10/28/2005
• Issued: 08/16/2011
• Est. Priority Date: 10/28/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Good Technology Incorporated (Blackberry Limited)
• Inventors: Muratov, Alexander
• Primary Examiner(s): Robinson; Greta L
• Assistant Examiner(s): Chang; Jeffrey
• Application Number:
  US11/261,529
• Time in Patent Office: 2,118 Days
• Field of Search: 380/270, 707/634
• US Class Current: 707/634
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system is disclosed. The system includes a server, a client application, and a first database. The first database is associated with the client application. The system further includes a second database to store data in an encrypted format, and a replicator to synchronize the data stored in the first and second databases. The system also includes a synchronizer to synchronize the data stored in the second database and the server based on a current security level.

Claims

1. A system comprising:

a server configured to store data; and

a wireless device communicatively coupled to the server, the wireless device including;

a client application;

a first database configured to store data for access by the client application;

a second database configured to store data in an encrypted format;

a replicator for synchronizing the data stored in the first database with encrypted data stored in the second database; and

a synchronizer for synchronizing the encrypted data stored in the second database with data stored in the server,

wherein when the wireless device is operating in a first security level, the synchronizer synchronizes the encrypted data stored in the second database with the data stored in the server, and the replicator synchronizes data stored in the first database with the encrypted data stored in the second database; and

when the wireless device is operating in a second security level, different to the first security level, the synchronizer synchronizes the encrypted data stored in the second database with the data stored in the server, and access by the client application to data stored in the first database is restricted.

2. The system of claim 1 wherein the first database is disabled whenever the wireless device is operating in the second security level.

3. The system of claim 2 wherein the first database, second database, synchronizer, and replicator are disabled whenever the wireless device is operating in a third security level.

4. The system of claim 1 wherein the encrypted data stored in the second database is restricted to being read from and written to via an application program interface (API).

5. The system of claim 1 wherein the current security level increases based on one or more of the following:

failed attempts to enter a password for the wireless device exceeds a predetermined amount, occurrence of an attempted remote command via short message service (“

SMS”

), and detection of a network intrusion.

6. The system of claim 3 wherein the first, second, and third security levels correspond to the following device modes:

an unlocked device mode, a locked/sync device mode, and a lock/emergency device mode.

7. The system of claim 1 wherein the synchronizer is coupled to the server via one of:

a wired network, and wireless network.

9. The system of claim 1, wherein the wireless device is configured such that, when the wireless device is operating in the second security level, synchronization of the data stored in the first database with the encrypted data stored in the second database is restricted.

8. A method of controlling access to data held on a wireless device, the wireless device comprising a first database and a second database, different from the first database, the second database being configured to store data in an encrypted format, the wireless device being capable of operating in a first security mode and a second, different, security mode, wherein, when operating in the first security mode, the wireless device is configured to:

synchronize the data stored in the first database with encrypted data stored in the second database; and

synchronize encrypted data stored in the second database with data stored on a server remote from the wireless device,

the method comprising;

determining whether the wireless device is operating in the first security mode or the second security mode; and

responsive to a determination that the wireless device is operating in the second security mode, configuring the wireless device so as to restrict access to data stored in the first database, and to synchronize the encrypted data in the second database with data stored in said server.

10. The method of claim 8 further comprising:

responsive to a determination that the device is operating in the second security mode, configuring the wireless device to restrict synchronization of encrypted data stored in the second database with data stored in the first database.

11. The method of claim 8 further comprising:

determining that the device is operating in a third security mode, different to said first and second security modes, and, responsive thereto,

interrupting the synchronization of the encrypted data stored in the second database with the data stored in the server.

12. The method of claim 8, in which the determination that the device is operating in the second security mode is based on one or more of the following:

failed attempts to enter a password for the device exceeds a predetermined number, occurrence of an attempted remote command via short message service (“

SMS”

), and detection of a network intrusion.

13. The method of claim 12 further comprising erasing cipher keys associated with the encrypted data in the second database in response to determining that the device is operating in the second security mode.

14. The method of claim 8 wherein the device is coupled to the server via one of:

a wired network, and wireless network.

23. The method of claim 8, in which:

the device comprises a client application and, when the device is operating in a first mode, the data stored in the first database is accessible by the client application, and

the method comprises, responsive to a determination that the device is in the second mode, restricting access by the client application to the data stored in the first database.

24. The method of claim 8, comprising, responsive to a determination that the device is in the second mode, deleting the data stored in said first database.

15. A wireless device comprising:

a client application;

a first database configured to store data for access by the client application;

a second database for storing data in an encrypted format;

a replicator for synchronizing data stored in the first database with encrypted data stored in the second database; and

a synchronizer for synchronizing the encrypted data stored in the second database with data stored in a server,

the wireless device being configured such that;

when the wireless device is operating in a first state, the synchronizer synchronizes the encrypted data stored in the second database with the data stored in the server, and the replicator synchronizes data stored in the first database with the encrypted data stored in the second database; and

when the wireless device is operating in a second state, different to the first state, the synchronizer synchronizes the encrypted data stored in the second database with the data stored in the server, and the wireless device prevents access by the client application to the data stored in the first database.

16. The wireless device of claim 15 wherein the first database is disabled whenever the wireless device is operating in the second state.

17. The wireless device of claim 16 wherein the first database, second database, synchronizer, and replicator are disabled whenever the wireless device is operating in a third state, different to said first and second states.

18. The wireless device of claim 17 wherein the first, second, and third states correspond to the following device modes:

an unlocked device mode, a locked/sync device mode, and a lock/emergency device mode.

19. The wireless device of claim 15 wherein the first and second states are characterized by different security levels of the wireless device and the wireless device is configured to change a current security level based on one or more of the following:

failed attempts to enter a password for the device exceeds a predetermined amount, occurrence of an attempted remote command via short message service (“

SMS”

), and detection of a network intrusion.

20. The wireless device of claim 15, wherein the synchronized data comprises personal information manager data.

21. The wireless device of claim 15, wherein, when the device is operating in the second state, the replicator is prevented from synchronizing the data stored in the first database with the encrypted data stored in the second database.

22. The wireless device of claim 15, wherein, when the device is operating in the second state, the data stored in the first database is deleted.

25. A computer readable storage medium storing computer readable instructions thereon for execution on a wireless device to implement a method of controlling access to data stored thereon, the wireless device comprising a first database configured to store data and a second database, different from the first database, the second database being configured to store data in an encrypted form, the wireless device being capable of operating in a first security mode and a second, different, security mode, wherein, when operating in the first security mode, the wireless device is configured to:

synchronize the data stored in the first database with the encrypted data stored in the second database; and

synchronize the encrypted data stored in the second database with data stored on a server remote from the wireless device,

the computer readable instructions, when executed on a processor of the wireless device, causing the processor to perform the method comprising;

receiving an indication of a change of mode from the first to the second mode; and

responsive to receipt of said indication, configuring the device so as to restrict access to data stored in the first database, and to maintain said synchronization of the encrypted data stored in the second database with data stored on the remote server.

26. The computer readable storage medium of claim 25, wherein the computer readable instructions, when executed on a processor of the wireless device, cause the processor, responsive to receipt of said indication, to restrict synchronization of the data stored in the first database with the encrypted data stored in the second database.