Methods and systems for token-based application management

• US 9,332,010 B2
• Filed: 03/07/2014
• Issued: 05/03/2016
• Est. Priority Date: 03/07/2014
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Abbate, Alain D, Ley, David J, Thomadsen, Tommy
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/200,606
• Publication Number:
  US 20150256535A1
• Time in Patent Office: 788 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

Disclosed herein are methods and systems for token-based application management. In an embodiment, requests are received from applications for tokens that can be active or inactive. A token-interaction-directive pool is maintained in data storage, each directive having a triggering token, a target token, and one or both of triggering-token actions and target-token actions. Responsive to receiving a token request from an application, any directives having their triggering token equal the requested token and having their target token active are identified. A response plan that includes the actions in the identified directives is generated. Any triggering-token actions in the response plan are communicated to the requesting application, and any target-token actions in the response plan are communicated to each application that is authorized to access the corresponding target token.

Claims

1. A method comprising:

receiving, from respective applications among a plurality of applications, token requests that each identify a respective requested token from a pool of tokens that are each togglable between;

(i) an active state in which one or more of the applications are authorized to access the token, and

(ii) an inactive state in which none of the applications are authorized to access the token;

maintaining in data storage a token-interaction-directive pool comprising a plurality of token-interaction directives, each token-interaction directive specifying;

(i) a triggering token for that token-interaction directive,

(ii) a target token for that token-interaction directive, and

(iii) one or both of;

(a) one or more actions that are to be taken with respect to the triggering token for that token-interaction directive, and

(b) one or more actions that are to be taken with respect to the target token for that token-interaction directive;

responsive to receiving a given token request from a given application, identifying the one or more token-interaction directives for which;

(i) the triggering token is the requested token that is identified by the given token request, and

(ii) the target token is active;

generating a response plan comprising the actions included in the identified one or more token-interaction directives;

communicating each action in the response plan that is to be taken with respect to the triggering token for the corresponding token-interaction directive to the given application; and

communicating each action in the response plan that is to be taken with respect to the target token for the corresponding token-interaction directive to each application that is authorized to access that target token; and

wherein the response plan includes a pend action that is to be taken with respect to the triggering token for the corresponding token-interaction directive, said pend action placing the given application in a pending state of waiting for authorization to access the requested token.

2. The method of claim 1, wherein at least one token in the pool of tokens represents an application.

3. The method of claim 1, wherein at least one token in the pool of tokens represents an application state.

4. The method of claim 1, wherein at least one token in the pool of tokens represents a group of applications.

5. The method of claim 1, wherein at least one token in the pool of tokens represents a device state.

6. The method of claim 1, wherein one or more of the token-interaction directives in the token-interaction-directive pool are configurable.

7. The method of claim 1, wherein the response plan includes an allow action that is to be taken with respect to the triggering token for the corresponding token-interaction directive, said allow action allowing the given application to access the requested token.

8. The method of claim 7, further comprising changing the triggering token in the corresponding token-interaction directive from the inactive state to the active state.

9. The method of claim 1, wherein the response plan includes a block action that is to be taken with respect to the triggering token for the corresponding token-interaction directive, said block action blocking the given application from accessing the requested token.

10. The method of claim 1 further comprising communicating to the given application notice of authorization to access the requested token.

11. The method of claim 10, further comprising changing the triggering token in the corresponding token-interaction directive from the inactive state to the active state.

12. The method of claim 1, wherein the response plan includes a revocation action that is to be taken with respect to the target token for the corresponding token-interaction directive, said revocation action transitioning one or more applications that at that time were authorized to access the target token into a state of not being authorized to access the target token.

13. The method of claim 1, wherein the response plan includes a suspend action that is to be taken with respect to the target token for the corresponding token-interaction directive, said suspend action placing one or more applications that at that time were authorized to access the target token in a suspended state of (i) not being authorized to access the target token and (ii) waiting for reauthorization to access the target token.

14. The method of claim 13, further comprising changing the target token in each of the one or more corresponding token-interaction directives from the active state to the inactive state.

15. The method of claim 13, further comprising communicating to each of the one or more applications notice of reauthorization to access the target token.

16. The method of claim 15, further comprising changing the target token in each of the one or more corresponding token-interaction directives from the inactive state to the active state.

17. The method of claim 1, wherein the response plan includes at least one action selected based at least in part on a priority level associated with one or more token requests.

18. The method of claim 1,

wherein one or more of the applications are token-unaware applications;

wherein receiving token requests from at least one token-unaware application comprises receiving token requests from the at least one token-unaware application via a proxy;

wherein communicating actions to the at least one token-unaware application comprises communicating actions to the at least one token-unaware application via the proxy; and

wherein the proxy translates between a token-aware application programming interface (API) and an API supported by the at least one token-unaware application.

19. A method comprising:

receiving, from respective applications among a plurality of applications, token requests that each identify a respective requested token from a pool of tokens that are each togglable between;

(i) an active state in which one or more of the applications are authorized to access the token, and

(ii) an inactive state in which none of the applications are authorized to access the token;

maintaining in data storage a token-interaction-directive pool comprising a plurality of token-interaction directives, each token-interaction directive specifying;

a triggering token for that token-interaction directive,

(ii) a target token for that token-interaction directive, and

(iii) one or both of;

(a) one or more actions that are to be taken with respect to the triggering token for that token-interaction directive, and

(b) one or more actions that are to be taken with respect to the target token for that token-interaction directive;

responsive to receiving a given token request from a given application, identifying the one or more token-interaction directives for which;

(i)the triggering token is the requested token that is identified by the given token request, and

(ii) the target token is active;

generating a response plan comprising the actions included in the identified one or more token-interaction directives;

communicating each action in the response plan that is to be taken with respect to the triggering token for the corresponding token-interaction directive to the given application; and

communicating each action in the response plan that is to be taken with respect to the target token for the corresponding token-interaction directive to each application that is authorized to access that target token; and

wherein the response plan includes a revocation action that is to be taken with respect to the target token for the corresponding token-interaction directive, said revocation action transitioning one or more applications that at that time were authorized to access the target token into a state of not being authorized to access the target token.

20. A method comprising:

receiving, from respective applications among a plurality of applications, token requests that each identify a respective requested token from a pool of tokens that are each togglable between;

(i) an active state in which one or more of the applications are authorized to access the token, and

(ii) an inactive state in which none of the applications are authorized to access the token;

maintaining in data storage a token-interaction-directive pool comprising a plurality of token-interaction directives, each token-interaction directive specifying;

(i) a triggering token for that token-interaction directive,

(ii) a target token for that token-interaction directive, and

(iii) one or both of;

(a) one or more actions that are to be taken with respect to the triggering token for that token-interaction directive, and

(b) one or more actions that are to be taken with respect to the target token for that token-interaction directive;

responsive to receiving a given token request from a given application, identifying the one or more token-interaction directives for which;

(i) the triggering token is the requested token that is identified by the given token request, and

(ii) the target token is active;

generating a response plan comprising the actions included in the identified one or more token-interaction directives;

communicating each action in the response plan that is to be taken with respect to the triggering token for the corresponding token-interaction directive to the given application; and

communicating each action in the response plan that is to be taken with respect to the target token for the corresponding token-interaction directive to each application that is authorized to access that target token;

wherein the response plan includes a suspend action that is to be taken with respect to the target token for the corresponding token-interaction directive, said suspend action placing one or more applications that at that time were authorized to access the target token in a suspended state of (i) not being authorized to access the target token and (ii) waiting for reauthorization to access the target token.