Method and apparatus for differentiated access control

• US 9,378,394 B2
• Filed: 09/23/2011
• Issued: 06/28/2016
• Est. Priority Date: 09/24/2010
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Kenneth, Bender, Christopher Lyle, Little, Herbert Anthony, Brown, Michael Stephen
• Primary Examiner(s): Dailey, Thomas
• Application Number:
  US13/242,589
• Publication Number:
  US 20120079110A1
• Time in Patent Office: 1,740 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method for differentiated access control on a computing device having a connection with a second device, the method checking whether a timer has expired on the second device or if a connection is lost to the second device; and preventing at least one of the plurality of application subsets from being launched or enabled if the timer has expired on the second device or the connection is lost to the second device.

Claims

1. A method of providing differentiated access control on an electronic device, the method comprising:

receiving at the electronic device a correct user input to unlock the electronic device;

storing multiple classes of data on the electronic device, wherein a first class of data comprises work data including a plurality of work applications, and a second class of data comprises personal data including a plurality of personal applications;

unlocking the first class of data through successful authentication to allow user access to the work applications;

locking, subsequent to the unlocking, the first class of data without locking the second class of data upon an expiration of an inactivity time for the first class of data; and

when the first class of data is locked and the electronic device is unlocked;

allowing user access to the second class of data, including allowing launching and enabling of any of the personal applications; and

preventing user access to the first class of data, including preventing launching and enabling of any of the work applications.

2. The method of claim 1, wherein the locking is based on a manual lock.

3. The method of claim 1, wherein the locking is based on a period of inactivity.

4. The method of claim 1, wherein the locking is based on loss of a connection to another device.

5. The method of claim 1, wherein the successful authentication is based on receipt of a password.

6. The method of claim 1, wherein the successful authentication is based on an authentication token.

7. The method of claim 1, further comprising:

unlocking the first class of data upon successful authentication.

8. The method of claim 1, further comprising:

displaying, via a user interface, obscured data related to one or more work applications when the first class of data is locked.

9. The method of claim 1, wherein the correct user input comprises a password.

10. The method of claim 1, wherein the correct user input comprises a non-text input.

11. The method of claim 1, wherein the plurality of work applications include at least one of a contacts application, a calendar application, an email application, a word processing application, customer relationship management software, server and desktop virtualization software, or enterprise resource planning software.

12. The method of claim 1 wherein the work data comprises at least one of a document, a calendar entry, an electronic mail, customer data, enterprise resource data, or sales information.

13. The method of claim 1, wherein the plurality of personal applications include at least one of a browser application, a camera application, a social networking application, a game application, or a really simple syndication (RSS) reader.

14. The method of claim 1, wherein the personal data comprises at least one of browser data, a photograph, social networking data, or a RSS feed.

15. The method of claim 1, further comprising managing data interaction between the first class of data and the second class of data.

16. The method of claim 1, wherein an application that is considered to be both a personal application and a work application is duplicated between the first class of data and the second class of data.

17. An electronic device enabled for differentiated access control, the electronic device comprising:

a processor;

a communications subsystem; and

memory,

wherein the electronic device is enabled to;

receive at the electronic device a correct user input to unlock the electronic device;

store multiple classes of data, wherein a first class of data comprises work data including a plurality of work applications, and a second class of data comprises personal data including a plurality of personal applications;

unlock the first class of data through successful authentication to allow user access to the work applications;

lock, subsequent to unlocking the first class of data, the first class of data without locking the second class of data upon an expiration of an inactivity time for the first class of data; and

when the first class of data is locked and the electronic device is unlocked;

allow user access to the second class of data, including allowing launching and enabling of any of the personal applications; and

prevent user access to the first class of data, including preventing launching and enabling of any of the work applications.

19. The electronic device of claim 17, wherein the electronic device is enabled to lock based on a manual lock.

20. The electronic device of claim 17, wherein the electronic device is enabled to lock based on a period of inactivity.

21. The electronic device of claim 17, wherein the electronic device is enabled to lock based on loss of a connection to another device.

22. The electronic device of claim 17, wherein the successful authentication is based on receipt of a password.

23. The electronic device of claim 17, wherein the successful authentication is based on an authentication token.

24. The electronic device of claim 17, wherein the electronic device is further enabled to unlock the first class of data upon successful authentication.

25. The electronic device of claim 17, wherein the electronic device is further enabled to display, via a user interface, obscured data related to one or more work applications when the first class of data is locked..

26. The electronic device of claim 17, wherein the correct user input comprises a password.

27. The electronic device of claim 17, wherein the correct user input comprises a non-text input.

28. The electronic device of claim 17, wherein the plurality of work applications include at least one of a contacts application, a calendar application, an email application, a word processing application, customer relationship management software, server and desktop virtualization software, or enterprise resource planning software.

29. The electronic device of claim 17 wherein the work data comprises at least one of a document, a calendar entry, an electronic mail, customer data, enterprise resource data, or sales information.

30. The electronic device of claim 17, wherein the plurality of personal applications include at least one of a browser application, a camera application, a social networking application, a game application, or a really simple syndication (RSS) reader.

31. The electronic device of claim 17, wherein the personal data comprises at least one of browser data, a photograph, social networking data, or a RSS feed.

32. The electronic device of claim 17, wherein the electronic device is further enabled to manage data interaction between the first class of data and the second class of data.

33. The electronic device of claim 17, wherein an application that is considered to be both a personal application and a work application is duplicated between the first class of data and the second class of data.

18. A non-transitory computer readable medium storing instructions executable by a processor of an electronic device, the instructions comprising instructions to:

receive at the electronic device a correct user input to unlock the electronic device;

store multiple classes of data on the electronic device, wherein a first class of data comprises work data including a plurality of work applications, and a second class of data comprises personal data including a plurality of personal applications;

unlock the first class of data through successful authentication to allow user access to the work applications;

lock, subsequent to unlocking the first class of data, the first class of data without locking the second class of data upon an expiration of an inactivity time for the first class of data; and

when the first class of data is locked and the electronic device is unlocked;

allow user access to the second class of data, including allowing launching and enabling of any of the personal applications; and

prevent user access to the first class of data, including preventing launching and enabling of any of the work applications.

34. The non-transitory computer readable medium of claim 18, wherein the locking is based on a manual lock.

35. The non-transitory computer readable medium of claim 18, wherein the locking is based on a period of inactivity.

36. The non-transitory computer readable medium of claim 18, wherein the locking is based on loss of a connection to another device.

37. The non-transitory computer readable medium of claim 18, wherein the successful authentication is based on receipt of a password.

38. The non-transitory computer readable medium of claim 18, wherein the successful authentication is based on an authentication token.

39. The non-transitory computer readable medium of claim 18, the instructions further comprising instructions to:

unlock the first class of data upon successful authentication.

40. The non-transitory computer readable medium of claim 18, the instructions further comprising instructions to:

display, via a user interface, obscured data related to one or more work applications when the first class of data is locked.

41. The non-transitory computer readable medium of claim 18, wherein the correct user input comprises a password.

42. The non-transitory computer readable medium of claim 18, wherein the correct user input comprises a non-text input.

43. The non-transitory computer readable medium of claim 18, wherein the plurality of work applications include at least one of a contacts application, a calendar application, an email application, a word processing application, customer relationship management software, server and desktop virtualization software, or enterprise resource planning software.

44. The non-transitory computer readable medium of claim 18, wherein the work data comprises at least one of a document, a calendar entry, an electronic mail, customer data, enterprise resource data, or sales information.

45. The non-transitory computer readable medium of claim 18, wherein the plurality of personal applications include at least one of a browser application, a camera application, a social networking application, a game application, or a really simple syndication (RSS) reader.

46. The non-transitory computer readable medium of claim 18, wherein the personal data comprises at least one of browser data, a photograph, social networking data, or a RSS feed.

47. The non-transitory computer readable medium of claim 18, the instructions further comprising instructions to manage data interaction between the first class of data and the second class of data.

48. The non-transitory computer readable medium of claim 18, wherein an application that is considered to be both a personal application and a work application is duplicated between the first class of data and the second class of data.