System and method for configuring devices for secure operations

• US 9,148,448 B2
• Filed: 05/10/2013
• Issued: 09/29/2015
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Little, Herbert Anthony, Brown, Michael Stephen, Robertson, Ian, Kirkup, Michael Grant, Brown, Michael Kenneth, MacFarlane, David Victor
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US13/891,350
• Publication Number:
  US 20130247143A1
• Time in Patent Office: 872 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Systems and methods for establishing a security-related mode of operation for computing devices. A policy data store contains security mode configuration data related to the computing devices. Security mode configuration data is used in establishing a security-related mode of operation for the computing devices.

Claims

1. A wireless mobile device configured to communicate with a policy data storage located remotely from the wireless mobile device, the wireless mobile device comprising:

a processor configured to be placed in a first security mode of operation responsive to the wireless mobile device receiving first instructions from the policy data storage located at a remote location, the first instructions containing a first administrative selection;

the processor further configured to be placed in a second security mode of operation responsive to the wireless mobile device receiving second instructions from the policy data storage at the remote location, the second instructions containing a second administrative selection, wherein at least one of the first and second security modes of operation are initiated without intervention from a user of the wireless device and causes the processor to use one or more security algorithms corresponding to one or more security schemes stored in the policy data storage at the remote location, and wherein at least one of the first and second security modes of operation force use of at least one cryptographic algorithm selected from the one or more security algorithms; and

a display configured to visually indicate a current security mode of operation to a user of the wireless mobile device,

wherein the processor is configured to transmit an indication of the wireless mobile device'"'"'s current security mode to a remote administrator that selects the first and second administrative selections.

2. The wireless mobile device of claim 1, wherein the display further comprises a security options screen configured to provide the visual indication of the current security mode of operation.

3. The wireless mobile device of claim 1, wherein at least one of the first and second security modes of operation comprises a Federal Information Processing Standard (FIPS) mode of operation that forces the wireless mobile device to use only the at least one cryptographic algorithm.

4. The wireless mobile device of claim 1, wherein at least one of the first and second security modes of operation includes forcing the wireless mobile device to use Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES).

5. The wireless mobile device of claim 1, wherein the wireless mobile device is forced to use at least one of Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES) when the current security mode is a Federal Information Processing Standard (FIPS) mode of operation.

6. A method for operating a wireless mobile device configured to communicate with a policy data storage located remotely from the wireless mobile device, the method comprising:

placing a processor in a first security mode of operation responsive to the wireless mobile device receiving first instructions from the policy data storage located at a remote location, the first instructions containing a first administrative selection;

placing the processor in a second security mode of operation responsive to the wireless mobile device receiving second instructions from the policy data storage at the remote location, the second instructions containing a second administrative selection, wherein at least one of the first and second security modes of operation are initiated without intervention from a user of the wireless device and causes the processor to use one or more security algorithms corresponding to one or more security schemes stored in the policy data storage at the remote location, and wherein at least one of the first and second security modes of operation force use of at least one cryptographic algorithm selected from the one or more security algorithms;

visually indicating a current security mode of operation to a user of the wireless mobile device using a display of the wireless mobile device; and

transmitting an indication of the wireless mobile device'"'"'s current security mode to a remote administrator that selects the first and second administrative selections.

7. The method of claim 6, further comprising, wherein the display further comprises a security options screen configured to provide the visual indication of the current security mode of operation.

8. The method of claim 6, wherein at least one of the first and second security modes of operation comprises a Federal Information Processing Standard (FIPS) mode of operation that force the wireless mobile device to use only the at least one cryptographic algorithm.

9. The method of claim 6, wherein at least one of the first and second security modes of operation includes forcing the wireless mobile device to use Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES).

10. The method of claim 6, wherein the wireless mobile device is forced to use at least one of the Triple Data Encryption Standard (3DES) or Advanced Encryption Standard (AES) when the current security mode is a Federal Information Processing Standard (FIPS) mode of operation.

11. A non-transitory computer readable storage medium having computer readable instructions stored thereon that, when executed, implement method for operating a wireless mobile device configured to communicate with a policy data storage located remotely from the wireless mobile device, the method comprising:

placing a processor in a first security mode of operation responsive to the wireless mobile device receiving first instructions from the policy data storage at a remote location, the first instructions containing a first administrative selection;

placing the processor in a second security mode of operation responsive to the wireless mobile device receiving second instructions from the policy data storage at the remote location, the second instructions containing a second administrative selection, wherein at least one of the first and second security modes of operation are initiated without intervention from a user of the wireless device and causes the processor to use one or more security algorithms corresponding to one or more security schemes stored in the policy data storage at the remote location, and wherein at least one of the first and second security modes of operation force use of at least one cryptographic algorithm selected from the one or more security algorithms;

visually indicating a current security mode of operation to a user of the wireless mobile device using a display of the wireless mobile device; and

transmitting an indication of the wireless mobile device'"'"'s current security mode to a remote administrator that selects the first and second administrative selections.

12. The computer readable storage medium of claim 11, wherein the display further comprises a security options screen configured to provide the visual indication of the current security mode of operation.

13. The computer readable storage medium of claim 11, wherein at least one of the first and second security modes of operation comprises a Federal Information Processing Standard (FIPS) mode of operation that forces the wireless mobile device to use only the at least one cryptographic algorithm.

14. The computer readable storage medium of claim 11, wherein at least one of the first and second security modes of operation includes forcing the wireless mobile device to use Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES).

15. The computer readable storage medium of claim 11, wherein the wireless mobile device is forced to use at least one of Triple Data Encryption Standard (3DES) or Advanced Encryption Standard (AES) when the current security mode is a Federal Information Processing Standard (FIPS) mode of operation.

16. A system, comprising:

at least one wireless mobile device operable by a user;

a host circuit in communication with the at least one wireless mobile device and located remotely from the at least one wireless mobile device, the host system including a policy data storage and configured to place the at least one wireless mobile device in a first security mode of operation responsive to receiving first instructions containing a first administrative selection, the policy data storage location configured to store at least one security mode setting including at least one security scheme corresponding to a particular wireless mobile device among the at least one wireless mobile device;

the host circuit configured to select the security mode from the policy data storage and place the at least one wireless mobile device in a second security mode of operation that executes the corresponding at least one security scheme responsive to receiving second instructions containing a first administrative selection, wherein at least one of the first and second security modes of operation are initiated without intervention from the user of the at least one wireless mobile device and causes the processor to use one or more security algorithms corresponding to the at least one security scheme stored in the policy data storage, and wherein at least one of the first and second security modes of operation force use of at least one cryptographic algorithm selected from the one or more security algorithms; and

the at least one wireless mobile device having a display configured to visually indicate a current security mode of operation to a user of the wireless mobile device,

wherein the host device is configured to receive an indication of the current security mode from the at least one wireless mobile device.

17. The system of claim 16, wherein the display further comprises a security options display screen configured to provide the visual indication of the current security mode of operation.

18. The system of claim 16, wherein at least one of the first and second security modes of operation comprises a Federal Information Processing Standard (FIPS) mode of operation that forces the at least one wireless mobile device to use only the at least one cryptographic algorithm.

19. The system of claim 16, wherein at least one of the first and second security modes of operation includes forcing the at least one wireless mobile device to use Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES).

20. The system of claim 16, wherein the at least one wireless mobile device is forced to use Triple Data Encryption Standard (3DES) or Advanced Encryption Standard (AES) when the current security mode is a Federal Information Processing Standard (FIPS) mode of operation.