Method and system for managing delayed user authentication

• US 8,489,890 B2
• Filed: 08/21/2012
• Issued: 07/16/2013
• Est. Priority Date: 07/30/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Darbha, Sriram, Barker, Melanie, Emery, Jeffrey Kenneth
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US13/590,984
• Publication Number:
  US 20120317618A1
• Time in Patent Office: 329 Days
• Field of Search: 713182-185, 726/4, 726/8, 726/9, 726/10
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04N 21/41407 embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4184 providing storage capabilities, e.g. memory stick
• CPC Class Codes: H04N 21/422 Input-only peripherals , i.e. input devices connected to specially adapted client devices, e.g. global positioning system [GPS] input devices also receiving signals from specially adapted client devices H04N21/4104
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4753 for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08

Abstract

A system and methods for coordinating the operation of a client security module and a host security module on a mobile electronic device. The modules communicate with each other through a platform abstraction layer using application programming interfaces to coordinate their activities. In particular, on start-up of the device, the host security module obtains user authorization input from a user and passes the input to a client operating system for validation. Once validated, the host security module unlocks the host-side of the device. At the same time, the client operating system sends a notice or request to the client-side virtual machine requesting that the client-side be unlocked. Once the virtual machine is initialized and available it launches the client security module and unlocks the client-side. During the delay while the virtual machine loads, the user is given access only to the host applications.

Claims

1. A method for unlocking a mobile electronic device, the method comprising:

initiating start-up of the device which triggers launch of a virtual machine on a client operating system on the device;

after the initiation of start-up of the device and before completion of the launch of the virtual machine;

passing a user authentication input from a host-side of the device to the client operating system with a validation request;

the client operating system authenticating the user authentication input and notifying the host-side of a successful authentication;

a host security module of the host-side notifying the virtual machine of a validated unlock request; and

the host-side unlocking access to at least one host application running on the host-side to enable access to the at least one host application;

launching the virtual machine and unlocking a client-side of the device in response to the validated unlock request.

2. The method of claim 1 wherein client operating system authenticating comprises authenticating the user authentication input through an application programming interface called by the host security module of the host-side to validate the user input.

3. The method of claim 1 further comprising the client operating system storing the user authentication input.

4. The method of claim 1 further comprising storing the user authentication input and, following the virtual machine recognizing the request, a client security module of the client-side of the device obtaining the stored user authentication input.

5. The method of claim 4 further comprising clearing memory of the stored user authentication input following obtaining the stored user authentication input by the client security module.

6. A mobile electronic device comprising:

memory storing protected client data;

a processor adapted to;

initiate start-up of the mobile electronic device, thereby triggering launch of a virtual machine on a client operating system on the device;

after the initiation of start-up of the device and before completion of the launch of the virtual machine, the processor adapted to;

pass a user authentication input from a host-side of the device to the client operating system with a validation request;

at the client operating system;

authenticate the user authentication input; and

notify the host-side of a successful authentication; and

at a host security module of the host-side, notify the virtual machine of a validated unlock request; and

at the host-side, unlock access to at least one host application running on the host-side to enable access to the at least one host application;

launch the virtual machine and unlock a client-side of the device in response to the validated unlock request.

7. The mobile electronic device of claim 6 wherein the processor is further adapted to execute the client operating system to authenticate the user authentication input through an application programming interface called by the host security module of the host-side.

8. The mobile electronic device of claim 6 wherein the processor is further adapted to execute the client operating system to store the user authentication input.

9. The mobile electronic device of claim 6 wherein the processor is further adapted to store the user authentication input and, following the virtual machine recognizing the request, the processor is further adapted to execute the client security module of a client-side of the device to obtain the stored user authentication input.

10. The mobile electronic device of claim 9 wherein the processor is further adapted to clear the memory of the stored user authentication input following obtaining the stored user authentication input by the client security module.

11. A non-transitory computer readable medium containing computer-executable instructions that, when performed by processor in a mobile electronic device having a memory storing protected client data, cause said processor to:

initiate start-up of the mobile electronic device, thereby triggering launch of a virtual machine on a client operating system on the device;

after the initiation of start-up of the device and before completion of the launch of the virtual machine, the instructions causing said processor to;

pass a user authentication input from a host-side of the device to the client operating system with a validation request;

at the client operating system;

authenticate the user authentication input; and

notify the host-side of a successful authentication; and

at a host security module of the host-side, notify the virtual machine of a validated unlock request; and

at the host-side, unlock access to at least one host application running on the host-side to enable access to the at least one host application;

launch the virtual machine and unlock a client-side of the device in response to the validated unlock request.

12. The non-transitory computer readable medium of claim 11 wherein the instructions further cause said processor to execute the client operating system to authenticate the user authentication input through an application programming interface called by the host security module of the host-side.

13. The non-transitory computer readable medium of claim 11 wherein the instructions further cause said processor to execute the client operating system to store the user authentication input.

14. The non-transitory computer readable medium of claim 11 wherein the instructions cause said processor to store the user authentication input and, following the virtual machine recognizing the request, wherein the instructions further cause said processor to execute the client security module of a client-side of the device to obtain the stored user authentication input.

15. The non-transitory computer readable medium of claim 14 wherein the instructions cause said processor to clear the memory of the stored user authentication input following obtaining the stored user authentication input by the client security module.