Method and system for controlling system settings of a computing device

• US 9,292,314 B2
• Filed: 07/24/2014
• Issued: 03/22/2016
• Est. Priority Date: 12/23/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Courtney, Sean Alexander, Truskovsky, Alexander
• Primary Examiner(s): TRAN, VINCENT HUY
• Application Number:
  US14/339,723
• Publication Number:
  US 20150019857A1
• Time in Patent Office: 607 Days
• Field of Search: 713/1, 713/2, 713/100, 713/156, 713/161, 713/182
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

Methods and devices for controlling system settings of a computing device are described herein. One example embodiment comprises: determining configuration data associated with a software application, wherein the configuration data identifies one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, and wherein the configuration data is digitally signed; and in response to an initiation of the execution of the software application, reconfiguring system settings on the computing device; wherein the reconfiguring comprises verifying at least one digital signature associated with the digitally signed configuration data; wherein if the at least one digital signature associated with the digitally signed configuration data successfully verifies, then the reconfiguring further comprises temporarily enforcing new system settings for the duration of the execution of the software application.

Claims

1. A method of controlling system settings of a computing device, the method comprising:

determining configuration data associated with a software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed;

in response to an initiation of the execution of the software application, determining whether the one or more new system settings are more restrictive than one or more corresponding original system settings; and

upon determining that the one or more new system settings are more restrictive than the one or more corresponding original system settings;

reconfiguring the system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data; and

if the at least one digital signature associated with the digitally signed configuration data successfully verifies, temporarily enforcing the one or more new system settings for a duration of the execution of the software application.

2. The method of claim 1, wherein the temporarily enforcing the one or more new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the one or more new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring the one or more corresponding original system settings upon the termination of the software application.

3. The method of claim 1, wherein the reconfiguring further comprises verifying that a certificate used to verify the digital signature associated with the digitally signed configuration data is valid, and wherein the temporarily enforcing the one or more new system settings is performed after successfully verifying that the certificate is valid.

4. The method of claim 1, wherein the at least one digital signature associated with the digitally signed configuration data comprises a first digital signature generated at a developer device and a second digital signature generated at an application authority.

5. The method of claim 4, wherein the configuration data is digitally signed at the developer device to produce developer-signed configuration data, and the developer-signed configuration data is digitally signed at the application authority to produce the digitally signed configuration data.

6. The method of claim 1, wherein an identifier that uniquely identifies the software application is provided with the configuration data.

7. The method of claim 6, wherein the identifier that uniquely identifies the software application comprises a hash of the software application.

8. The method of claim 1, wherein the configuration data that is digitally signed is accompanied by developer-identifying data associated with the application.

9. The method of claim 8, wherein the developer-identifying data comprises a signed hash of a developer'"'"'s certificate.

10. The method of claim 1, wherein the method further comprises detecting the initiation of the execution of the software application.

11. The method of claim 1, wherein the method further comprises receiving the configuration data at the computing device.

12. The method of claim 11, wherein the method further comprises receiving the software application with the configuration data at the computing device.

13. The method of claim 1, wherein the reconfiguring further comprises continuing the execution of the software application with combined system settings that include at least one new system setting and at least one original system setting.

14. The method of claim 1, wherein if the at least one digital signature associated with the digitally signed configuration data fails to successfully verify, then the method further comprises generating an error message and then performing at least one of:

transmitting the error message to a developer device, transmitting the error message to an application authority device, and displaying the error message on a user interface of the computing device.

15. The method of claim 1, wherein the software application is digitally signed, wherein the reconfiguring further comprises verifying a digital signature associated with the digitally signed software application, and verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid, and wherein the temporarily enforcing the one or more new system settings is performed after successfully verifying the digital signature associated with the digitally signed software application, and after successfully verifying that the certificate is valid.

16. A computing device comprising:

a processor and a memory, the memory storing executable instructions that, when executed by the processor, cause the processor;

to determine configuration data associated with a software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed;

in response to an initiation of the execution of the software application, to determine whether the one or more new system settings are more restrictive than one or more corresponding original system settings; and

upon a determination that the one or more new system settings are more restrictive than the one or more corresponding original system settings;

to reconfigure system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data; and

if the at least one digital signature associated with the digitally signed configuration data successfully verifies, temporarily enforcing the one or more new system settings for a duration of the execution of the software application.

17. The computing device of claim 16, wherein the temporarily enforcing the one or more new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the one or more new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring the one or more corresponding original system settings upon the termination of the software application.

18. The computing device of claim 16, wherein the software application is digitally signed, wherein the reconfiguring further comprises verifying a digital signature associated with the digitally signed software application, and verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid, and wherein the temporarily enforcing the one or more new system settings is performed after successfully verifying the digital signature associated with the digitally signed software application, and after successfully verifying that the certificate is valid.

19. A computer-readable storage medium comprising instructions that, when executed by a processor of a computing device, cause the processor:

to determine configuration data associated with a software application, the configuration data identifying one or more new system settings to be temporarily enforced on the computing device during an execution of the software application, wherein the configuration data is digitally signed;

in response to an initiation of the execution of the software application, to determine whether the one or more new system settings are more restrictive than one or more corresponding original system settings; and

upon a determination that the one or more new system settings are more restrictive than the one or more corresponding original system settings;

to reconfigure system settings on the computing device, the reconfiguring comprising;

verifying at least one digital signature associated with the digitally signed configuration data; and

if the at least one digital signature associated with the digitally signed configuration data successfully verifies, temporarily enforcing the one or more new system settings for a duration of the execution of the software application.

20. The medium of claim 19, wherein the temporarily enforcing the one or more new system settings comprises:

for each of at least one new system setting identified by the configuration data;

storing data identifying a corresponding original system setting, and

applying the new system setting;

continuing the execution of the software application with the one or more new system settings applied, until the execution of the software application terminates;

detecting termination of the software application; and

restoring the one or more corresponding original system settings upon the termination of the software application.

21. The computer-readable storage medium of claim 19, wherein the software application is digitally signed, wherein the reconfiguring further comprises verifying a digital signature associated with the digitally signed software application, and verifying that a certificate used to verify the digital signature associated with the digitally signed software application is valid, and wherein the temporarily enforcing the one or more new system settings is performed after successfully verifying the digital signature associated with the digitally signed software application, and after successfully verifying that the certificate is valid.