Certificate management method based on connectivity and policy

• US 8,893,219 B2
• Filed: 12/27/2012
• Issued: 11/18/2014
• Est. Priority Date: 02/17/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Bender, Christopher Lyle, Ho, Alan Pak-Lun, Tse, Chi Chiu, Stotozuk, John Vincent
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US13/727,788
• Publication Number:
  US 20130219455A1
• Time in Patent Office: 691 Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Plural modes of operation may be established on a mobile device. Specific modes of operation of the mobile device may be associated with specific spaces in memory. By associating the existing certificate store structure and key store structure with a mode of operation, certificates and keys can be assigned to one space among plural spaces. Furthermore, management (viewing/importation/deletion) of certificates associated with specific modes of operation may be controlled based on the presence or absence of a mobile device administration server and the status (enabled/disabled) of an IT policy.

Claims

1. A method of regulating population of a certificate store in a memory of a device, the method comprising:

determining that a device administration server is present;

determining that an information technology policy is disabled; and

responsive to the determining that a device administration server is present and that an information technology policy is disabled, disabling user interface interaction on the device for importing trusted Certificate Authority certificates into a certificate store associated with a portion of memory of the device.

2. The method of claim 1 further comprising seeding the certificate store associated with the portion of memory of the device.

3. The method of claim 1 further comprising, before the determining:

receiving a command to create the certificate store associated with the portion of memory of the device; and

initializing the certificate store in the memory of the device.

4. A communication device comprising:

a memory;

a processor adapted to;

determine that a device administration server is present;

determine that an information technology policy is disabled; and

disable user interface interaction on the device for importing trusted Certificate Authority certificates into a certificate store associated with a mode of operation of the device.

5. The communication device of claim 4 wherein the processor is further adapted to seed the certificate store associated with the portion of memory of the device.

6. The communication device of claim 4 wherein the processor is further adapted to:

receive a command to create the certificate store associated with the portion of memory of the device; and

initialize the certificate store in the memory of the device.

7. A non-transitory computer-readable information recording medium containing computer-executable instructions that, when performed by a processor in a communication device, cause said processor to:

determine that a device administration server is present;

determine that an information technology policy is disabled; and

disable user interface interaction on the device for importing trusted Certificate Authority certificates into a certificate store associated with a portion of memory of the device.

8. The non-transitory computer-readable information recording medium of claim 7 wherein the instructions further cause the processor to seed the certificate store associated with the portion of memory of the device.

9. The non-transitory computer-readable information recording medium of claim 7 wherein the instructions further cause the processor to:

receive a command to create the certificate store associated with the portion of memory of the device; and

initialize the certificate store in the memory of the device.