Selectively wiping a remote device

• US 9,106,670 B2
• Filed: 02/15/2013
• Issued: 08/11/2015
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Kenneth, Brown, Michael Stephen, Little, Herbert Anthony, Totzke, Scott William
• Primary Examiner(s): Su, Sarah
• Application Number:
  US13/768,902
• Publication Number:
  US 20130167247A1
• Time in Patent Office: 907 Days
• Field of Search: 726/29, 726/2, 726/26, 726/27, 726/28, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system and method for selectively securing data from unauthorized access on a client device storing a plurality of data types with reference to an authorization level indicated in a command. A command is received at a client device comprising an authorization level indicator. Based on at least one predefined rule, which may be implemented in an IT policy stored at the client device, each of the plurality of data types to be secured is determined, and then the data corresponding to those types is secured. The data may be secured by encrypting and/or deleting the data at the client device. The predefined rules associated with each authorization level may be configured by a user or administrator having an authorization level that exceeds the associated authorization level.

Claims

1. A method, comprising:

receiving a securing command at a mobile device via a wireless communication subsystem, the mobile device storing data of at least one type; and

in response to receiving the securing command, the mobile device selectively securing the data by;

determining at least one type of data to be secured based on information comprised in the securing command;

setting an indicator for each type of data thus determined;

securing data of each type of data thus indicated; and

removing each indicator corresponding to a type of data to be secured after the data of that type is secured.

2. The method of claim 1, wherein the securing command comprises an indication of a level, and determining the at least one type of data to be secured comprises identifying those types of data associated with the indicated level.

3. The method of claim 1, wherein the securing command comprises an indication of a level, and determining the at least one type of data to be secured comprises identifying those types of data associated with the indicated level or a level below the indicated level.

4. The method of claim 1, wherein the securing comprises either deleting or encrypting the data of each type of data thus indicated.

5. The method of claim 1, wherein the indicator is a data structure comprising data indicating whether a particular type of data is to be secured.

6. The method of claim 1, wherein the at least one type of data to be secured comprises message data.

7. The method of claim 1, wherein the at least one type of data to be secured comprises personal information management data.

8. The method of claim 1, wherein the at least one type of data to be secured comprises key data.

9. The method of claim 1, further comprising:

when the mobile device enters a powered off state during securing of the data, then enters a powered on state,

the mobile device checking for the indicator; and

if the indicator is present at the mobile device, continuing the securing of the data.

10. A mobile device, comprising:

at least one memory component storing data of at least one type;

a wireless communication subsystem; and

at least one processor configured to enable;

receiving a securing command at a mobile device via the wireless communication subsystem; and

in response to receiving the securing command, selectively securing the data by;

determining at least one type of data to be secured based on information comprised in the securing command;

setting an indicator for each type of data thus determined;

securing data of each type of data thus indicated; and

removing each indicator corresponding to a type of data to be secured after the data of that type is secured.

11. The mobile device of claim 10, wherein the securing command comprises an indication of a level, and determining the at least one type of data to be secured comprises identifying those types of data associated with the indicated level.

12. The mobile device of claim 10, wherein the securing command comprises an indication of a level, and determining the at least one type of data to be secured comprises identifying those types of data associated with the indicated level or a level below the indicated level.

13. The mobile device of claim 10, wherein the securing comprises either deleting or encrypting the data of each type of data thus indicated.

14. The mobile device of claim 10, wherein the indicator is a data structure comprising data indicating whether a particular type of data is to be secured.

15. The mobile device of claim 10, wherein the at least one type of data to be secured comprises message data.

16. The mobile device of claim 10, wherein the at least one type of data to be secured comprises personal information management data.

17. The mobile device of claim 10, wherein the at least one type of data to be secured comprises key data.

18. The mobile device of claim 10, wherein the at least one processor is further configured to enable, when the mobile device enters a powered off state during securing of the data, then enters a powered on state:

checking for the indicator; and

if the indicator is present, continuing the securing of the data.

19. A non-transitory computer-readable medium storing code which, when executed by one or more processors of a mobile device, causes the mobile device to perform operations comprising:

receiving a securing command at the mobile device via a wireless communication subsystem, the mobile device storing data of at least one type; and

in response to receiving the securing command, the mobile device selectively securing the data by;

determining at least one type of data to be secured based on information comprised in the securing command;

setting an indicator for each type of data thus determined;

securing data of each type of data thus indicated; and

removing each indicator corresponding to a type of data to be secured after the data of that type is secured.