Method for establishing a plurality of modes of operation on a mobile device

• US 9,147,085 B2
• Filed: 04/30/2011
• Issued: 09/29/2015
• Est. Priority Date: 09/24/2010
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Bender, Christopher Lyle, Little, Herbert Anthony, Brown, Michael Kenneth, Brown, Michael Stephen
• Primary Examiner(s): Smithers, Matthew
• Assistant Examiner(s): GIDDINS, NELSON S
• Application Number:
  US13/098,456
• Publication Number:
  US 20120079609A1
• Time in Patent Office: 1,613 Days
• Field of Search: 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method, device and system for establishing plural modes of operation on a mobile device, including: associating each application on the mobile device with one of a plurality of modes; and restricting access to data on the mobile device to only a subset of applications based on the mode associated for the each application. A system includes connection of an untrusted device to a trusted device and restricting data access for restricted data to a subset of trusted applications on the untrusted device.

Claims

1. A method of establishing plural modes of operation on a mobile device, the method comprising:

associating each application on the mobile device with one of a plurality of modes; and

restricting data on the mobile device to be accessible by only a subset of applications based on the mode associated with the application,

wherein the data is associated with one of the plurality of modes and the restricting comprises adding a group permission to the data and providing each application with access to the data based on the group permission, the group permission for data associated with one of the plurality of modes controls access to the data by applications associated with the others of the plurality of modes, and the group permission for the data limits the ability to copy a subset of the data between modes, where some data can be copied directly between modes, and

wherein data associated with the first mode is deleted from the mobile device when such data is not accessed within a time period, while data associated with the second mode does not have a deletion policy.

2. The method of claim 1, wherein the modes comprise a personal mode and a corporate mode.

3. The method of claim 1, wherein the data associated with one of the plurality of modes is encrypted.

4. The method of claim 1, wherein applications in one of the plurality of modes implement access restrictions.

5. The method of claim 4, wherein the access restrictions include a password requirement to start the applications in the one of the plurality of modes.

6. A mobile device configured for plural modes of operation, the mobile device comprising:

a processor; and

memory,

wherein the processor and memory cooperate to;

associate each application on the mobile device with one of a plurality of modes; and

restrict data on the mobile device to be accessible by only a subset of applications based on the mode associated with the application,

wherein the data is associated with one of the plurality of modes and the restricting comprises adding a group permission to the data and providing each application with access to the data based on the group permission, the group permission for data associated with one of the plurality of modes controls access to the data by applications associated with the others of the plurality of modes, and the group permission for the data limits the ability to copy a subset of the data between modes, where some data can be copied directly between modes, and

wherein data associated with the first mode is deleted from the mobile device when such data is not accessed within a time period, while data associated with the second mode does not have a deletion policy.

7. The mobile device of claim 6, wherein the modes comprise a personal mode and a corporate mode.

8. The mobile device of claim 6, wherein the data associated with one of the plurality of modes is encrypted.

9. The mobile device of claim 6, wherein applications in one of the plurality of modes implement access restrictions.

10. The mobile device of claim 9, wherein the access restrictions include a password requirement to start the applications in the one of the plurality of modes.

11. A non-transitory computer readable medium for storing program instructions, which when executed by a processor of a mobile device are configured to:

associate each application on the mobile device with one of a plurality of modes; and

restrict data on the mobile device to be accessible by only a subset of applications based on the mode associated with the application,

wherein the data is associated with one of the plurality of modes and the restricting comprises adding a group permission to the data and providing each application with access to the data based on the group permission, the group permission for data associated with one of the plurality of modes controls access to the data by applications associated with the others of the plurality of modes, and the group permission for the data limits the ability to copy a subset of the data between modes, where some data can be copied directly between modes, and

wherein data associated with the first mode is deleted from the mobile device when such data is not accessed within a time period, while data associated with the second mode does not have a deletion policy.

12. The non-transitory computer readable medium of claim 11, wherein the modes comprise a personal mode and a corporate mode.

13. The non-transitory computer readable medium of claim 11, wherein the data associated with one of the plurality of modes is encrypted.

14. The non-transitory computer readable medium of claim 11, wherein applications in one of the plurality of modes implement access restrictions.

15. The non-transitory computer readable medium of claim 14, wherein the access restrictions include a password requirement to start the applications in the one of the plurality of modes.