System and method of owner application control of electronic devices

• US 9,033,216 B2
• Filed: 09/14/2012
• Issued: 05/19/2015
• Est. Priority Date: 12/12/2002
• Status: Expired due to Term

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P., Kirkup, Michael G., Little, Herbert A., Owen, Russell N.
• Primary Examiner(s): HESS, DANIEL A
• Application Number:
  US13/618,311
• Publication Number:
  US 20130019318A1
• Time in Patent Office: 977 Days
• Field of Search: 235/375, 726/17
• US Class Current: 235/375
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading

Abstract

Systems and methods of owner application control of an electronic device are provided. Owner application control information is stored on the electronic device and/or one or more remote servers. Owner application control information is consulted to determine if one or more required applications are available for execution on the electronic device. If not, one or more required applications not available are downloaded and installed. This could be in a manner transparent to the user of the electronic device. If one or more required applications are not available on the electronic device, the device can be functionally disabled in whole, or in part, until one or more required applications are available.

Claims

1. A method of application control for use on an electronic device owned by an owner, the method comprising:

storing on the electronic device owner control information used to control operation of the electronic device, wherein the owner control information includes an authorization record and an application identifier for each application allowed to be executed on the electronic device, and wherein insertion of additional owner control information onto the electronic device is restricted;

receiving an operation request from an application;

determining whether the requested operation is allowed to be performed by the application based upon a particular authorization record and a particular application identifier associated with the application; and

allowing the application to perform the requested operation based upon whether the requested operation is determined to be allowed to be performed by the application,

wherein the particular authorization record and the particular application identifier are provided by an external source through a wireless communication channel,

wherein the owner control information is used to periodically determine whether excluded applications are installed on the electronic device, and wherein the electronic device becomes substantially disabled upon determining an excluded application is installed on the electronic device.

2. The method of claim 1, wherein the application is allowed to perform the requested operation only if the requested operation is determined to be allowed to be performed by the application.

3. The method of claim 1, wherein the particular authorization record related to determining whether the requested operation is to be allowed is provided by an external computer that is used to enforce policies for operating electronic devices within an organization.

4. The method of claim 1, wherein an update to the particular authorization record is provided by an external source for storage on the electronic device.

5. The method of claim 1, wherein a plurality of authorization records associated with a plurality of application identifiers are stored on the electronic device, said method further comprising:

receiving operation requests from a plurality of applications operating on the electronic device;

determining whether the requested operations are allowed to be performed by their respective applications based upon the stored authorization records and the application identifiers that are respectively associated with the plurality of applications; and

allowing the plurality of applications to perform their respective requested operations based upon whether the requested operations are determined to be allowed to be performed.

6. The method of claim 5, wherein a group containing two or more of the applications is associated with one of the authorization records.

7. The method of claim 1, wherein the requested operation comprises opening a connection.

8. The method of claim 1, wherein the requested operation comprises opening a connection via SMS.

9. The method of claim 1, wherein the requested operation comprises opening a network connection inside a firewall.

10. The method of claim 1, wherein the requested operation comprises opening a network connection outside a firewall.

11. The method of claim 1, wherein the requested operation comprises opening a local connection.

12. The method of claim 1, wherein the requested operation comprises accessing a telephone API.

13. The method of claim 1, wherein the requested operation comprises accessing local memory.

14. The method of claim 1, wherein the requested operation comprises accessing a runtime store.

15. The method of claim 1, wherein the requested operation comprises accessing a persistent store.

16. The method of claim 1, wherein the requested operation comprises communicating with another executing application.

17. The method of claim 1, wherein the requested operation comprises interacting with other processes.

18. The method of claim 1, wherein the particular authorization record is associated with data indicative of whether the application is required, allowed, or excluded.

19. The method of claim 1, wherein the particular authorization record is stored in a protected data store thereby preventing alteration or deletion to the particular authorization record unless permitted.

20. The method of claim 1, wherein the application operates upon the electronic device.

21. The method of claim 1 further comprising:

restricting modification of the additional owner control information after the owner control information has been inserted.

22. A system of application control for use on an electronic device owned by an owner, the system comprising:

an authorization record store for enabling storage of operation authorization data records and application identifiers that are associated with the operation authorization data records;

a memory for enabling storage of owner control information used to control operation of the electronic device, wherein the owner control information further includes an authorization record and an application identifier for each application allowed to be executed on the electronic device, and wherein insertion of additional owner control information onto the electronic device is restricted;

a processor for enabling processing of the operation authorization data in the authorization record store in order to determine whether an operation requested by an application operating on the electronic device is allowed to be performed by the application;

wherein the application identifiers are used to determine which of the operation authorization data records is to be used by the software instructions in determining whether to permit the requested operation,

wherein the processor is configured to periodically determine whether required applications are installed on the electronic device based on the owner control information, and wherein the electronic device becomes substantially disabled if the processor determines a required application is not installed on the electronic device,

wherein the electronic device comprises a wireless mobile communications device, and wherein the operation data authorization records and the application identifiers are provided by an external source through a wireless communication channel.

23. The system of claim 22, wherein the electronic device comprises a personal data assistant (PDA).

24. One or more computer readable media storing instructions that upon execution by an electronic device perform a method, comprising:

storing on the electronic device owner control information used to control operation of the electronic device, wherein the owner control information includes an authorization record and an application identifier for each application allowed to be executed on the electronic device, and wherein insertion of additional owner control information onto the electronic device is restricted;

receiving an operation request from an application;

determining whether the requested operation is allowed to be performed by the application based upon a particular authorization record and a particular application identifier associated with the application; and

allowing the application to perform the requested operation based upon whether the requested operation is determined to be allowed to be performed by the application,

wherein the owner control information is used to periodically determine whether required applications are installed on the electronic device, and wherein the electronic device becomes substantially disabled upon determining a required application is not installed on the electronic device,

wherein the electronic device comprises a wireless mobile communications device, and wherein the particular authorization record and the particular application identifier are provided by an external source through a wireless communication channel.