System and method for preventing access to data on a compromised remote device

• US 8,012,219 B2
• Filed: 08/09/2003
• Issued: 09/06/2011
• Est. Priority Date: 08/09/2002
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Good Technology Corporation (Blackberry Limited)
• Inventors: Mendez, Daniel J., Ng, Mason
• Primary Examiner(s): Flynn; Nathan
• Assistant Examiner(s): Avery; Jeremiah
• Application Number:
  US10/637,267
• Publication Number:
  US 20040117310A1
• Time in Patent Office: 2,950 Days
• Field of Search: 713/375, 726/3, 726/34, 380/260, 380/274
• US Class Current: 726/35
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

This invention discloses a system and method for selective erasure, encryption and or copying of data on a remote device if the remote device has been compromised or the level of authorization of a roaming user in charge of the remote device has been modified.

Claims

1. A method of controlling access to data including a plurality of sets of data, the plurality of sets of data comprising a first set of data items to be synchronized between a server system and a remote device, the remote device being remote from the server system, and a second, different, set of data items held on the remote device, the first set of data items including data items whose values are updated at the server system in response to changes thereto on the remote device, the second set of data items including data items whose values are not updated at the server system in response to changes thereto on the remote device, the remote device providing access to at least some of the data held thereon, the method comprising:

maintaining, on the remote device, a list identifying each data item as belonging to one of the first set and the second set;

receiving, at the server system, an indication that the remote device is compromised, the indication originating from a source other than the remote device;

selecting, at the server system, a subset of data stored on the remote device, the selected subset of data being specified as having data items either from the first set or data items from the second set;

transmitting, to the remote device in response to the indication, a command to prevent access to the selected subset of data;

using, at the remote device, the list and specification of data items from the first or second set to identify the selected subset of data on the remote device;

preventing access to the identified subset of data based on the transmitted command; and

maintaining access to a further subset of data on the remote device, the further subset of data having data items from the first set or data items from the second set, the set of data of the plurality of sets to which the data items of the further subset of data belong being different to the set of data of the plurality of sets to which the data items of the selected subset of data belong.

2. The method of claim 1, wherein the step of preventing access to the selected subset of data includes erasing the selected subset of data.

3. The method of claim 1, wherein the step of preventing access to the selected subset of data includes encrypting the selected subset of data.

4. The method of claim 1, comprising:

transmitting, to the remote device, a further command to transmit the selected subset of data to another device.

5. The method of claim 1, wherein the selected subset of data includes personal data.

6. The method of claim 1, wherein the selected subset of data includes applications.

7. The method of claim 1, further comprising:

transmitting a disconnect command, to the remote device from the server, responsive to the indication, to prevent a connection between the remote device and the server to disable further communication with respect to the selected subset of data.

8. The method of claim 1, wherein the indication is transmitted by the remote device.

25. The method of claim 1, wherein the list identifies a location of each of the data items.

26. The method of claim 1, further comprising:

identifying a location of the selected subset of data on the remote device.

30. The method of claim 1, wherein the indication that the remote device is compromised is received from a user.

9. A non-transitory computer-readable storage medium having computer-readable instructions stored thereon, the computer-readable instructions when executed by a computing device cause the computing device to perform a method of controlling access to data including a plurality of sets of data, the plurality of sets of data including a first set of data to be synchronized between a server system and a device remote therefrom and a second, different, set of data held on the remote device, the first set of data items including data items whose values are updated at the server system in response to changes thereto on the remote device, the second set of data items including data items whose values are not updated at the server system in response to changes thereto on the remote device, the remote device providing access to at least some of the data held thereon, the method comprising:

maintaining, at the remote device, a list of data items identifying each data item as belonging to the first set or the second set;

receiving, at the remote device, a command specifying at least one technique employed by the remote device to prevent access to a first subset of data stored thereon, the first subset of data being specified as belonging to the first set or the second set;

using, at the remote device, the list and specification of data items from the first or second sets to identify the first subset of data on the remote device;

preventing access to the identified first subset of data based on the transmitted command; and

maintaining access to a second subset of data on the remove device, the second subset of data having data items from the first set or data items from the second set, the set of data of the plurality of sets of data to which the data items of the second subset of data belong being different to the set of data of the plurality of sets to which the data items of the first subset of data belong,

wherein the command is received in response to an indication that the remote device is compromised originating from a source other than the remote device.

10. A server system for use in controlling access to data held on a remote device, the remote device being remote from the server system and holding a plurality of sets of data, the plurality of sets of data including a first set of data to be synchronized between the remote device and the server system and a second, different, set of data, the first set of data items including data items whose values are updated at the server system in response to changes thereto on the remote device, and the second set of data items includes data items whose values are not updated at the server system in response to changes thereto, the remote device providing access to at least some of the data held thereon, the remote device including a list identifying each data item as belonging to the first set or the second set, and the server system comprising:

a procedures file to indicate techniques to prevent data from the first set and data from the second set held on the remote device from being accessed; and

a server configured to

receive an indication that the remote device is compromised, the indication originating from a source other than the remote device,

select a subset of data stored on the remote device in response to the indication, the selected subset being specified as having data items from the first set or data items from the second set, and

transmit, to the remote device, a command specifying at least one technique included in the procedures file to prevent access to the selected subset of data stored thereon,

wherein the transmitted command results in the remote device preventing access to the selected subset of data, the selected subset of data being identified using the list and the specification of data items from the first set or second set,

the remote device maintaining access to a further subset of data held thereon, the further subset of data having data items from the first set or data items from the second set, the set of data of the plurality of sets to which the data items of the further subset of data belong being different to the set of data of the plurality of sets to which the data item of the selected subset of data belong.

11. The system of claim 10, wherein the at least one technique includes erasing the selected subset of data.

12. The system of claim 10, wherein the at least one technique includes encrypting the selected subset of data.

13. The system of claim 10, wherein the server is further configured to transmit, to the remote device and responsive to receipt of the indication, a further command to transfer the selected subset of data to another device.

14. The system of claim 10, wherein the second set of data includes personal data.

15. The system of claim 10, wherein the second set of data includes applications.

16. The system of claim 10, wherein the server is further capable of transmitting a disconnect command, to the remote device, responsive to the indication, to prevent a connection between the remote device and the server to disable further communication with respect to the subset of data.

17. The system of claim 10, wherein the indication is transmitted to the server by the remote device.

27. The server system of claim 10, wherein the server system identifies sets of data items, and communicates a change of set of a data item to the remote device, the remote device updating the list in accordance with the change of set.

31. The server system of claim 10, further comprising input means for receiving the indication that the remote device is compromised from a user.

18. A client device for use in controlling data held thereon, the client device holding a plurality of sets of data, the plurality of sets of data including a first set of data items to be synchronized between the client device and a server system and a second, different set of data items held on the client device, the first set of data items including data items whose values are updated at the server system in response to changes thereto on the remote device, the second set of data items including data items whose values are not updated at the server system in response to changes thereto at the client device, the client device comprising:

a data tracker configured to track a location of data items held in the client device, the data tracker tracking a correspondence of the data items to the first set or the second set device,

wherein the client device is configured to receive a command from the server system to prevent access to a first subset of data identified as belonging to the first set or the second set, and is configured to execute, in accordance with information generated by the data tracker and the set to which the first subset of data belongs, at least one technique to prevent access to the first subset of data stored on the client device in response to receipt of the command, the command being received in response to an indication that the client device is compromised, the indication originating from a source other than the client device,

the client device being configured to maintain access to a second subset of data, the second subset of data having data items from the first set or data items from the second set, the set of data of the plurality of sets to which the data items of the second subset of data belong being different to the set of data of the plurality of sets to which the data items of the first subset of data belong.

19. The client device of claim 18, wherein the command specifies erasing the first subset of data.

20. The client device of claim 18, wherein command specifies encrypting the first subset of data.

21. The client device of claim 18, wherein the client device is configured to receive, at the client device, a further command operative to transmit the first subset of data to another device, and to transmit the first subset of data to another location.

22. The client device of claim 18, wherein the first subset of data includes personal data.

23. The client device of claim 18, wherein the first subset of data includes applications.

24. The client device of claim 18, comprising:

a client device severing engine configured to receive a further command, at the client device, to sever a connection between the client device and a network, and to sever the connection between the client device and the network.

28. The client device of claim 18, wherein the information generated by the data tracker includes an indication of whether a data item belongs to the first set or the second set.

29. The client device of claim 18, wherein the data tracker includes a list identifying each data item as belonging to the first set or the second set, and the client device is configured to modify the list in accordance with receipt of an indication of change of set with respect to a data item.