System and method of owner application control of electronic devices

• US 9,542,571 B2
• Filed: 05/18/2015
• Issued: 01/10/2017
• Est. Priority Date: 12/12/2002
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P., Kirkup, Michael G., Little, Herbert A., Owen, Russell N.
• Primary Examiner(s): HESS, DANIEL A
• Application Number:
  US14/715,227
• Publication Number:
  US 20150254472A1
• Time in Patent Office: 603 Days
• Field of Search: 235/375, 235/380, 719/328, 717/168, 717/174
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading

Abstract

Systems and methods of owner application control of an electronic device are provided. Owner application control information is stored on the electronic device and/or one or more remote servers. Owner application control information is consulted to determine if one or more required applications are available for execution on the electronic device. If not, one or more required applications not available are downloaded and installed. This could be in a manner transparent to the user of the electronic device. If one or more required applications are not available on the electronic device, the device can be functionally disabled in whole, or in part, until one or more required applications are available.

Claims

1. A method of application control on an electronic device, the method comprising:

receiving, by the electronic device, owner information from an owner of the electronic device;

receiving, by the electronic device, owner control information that comprises;

a list of applications permitted for installation on the electronic device, and

permissions associated with each permitted application in the list of applications;

storing, by the electronic device, the owner control information in a protected data store to prevent alteration or deletion of the owner control information in response to authenticating the owner control information using the owner information;

receiving, by the electronic device, from an application operating on the electronic device, a request to access local memory on the electronic device;

determining whether the application is allowed to access the local memory in response to identifying a permission associated with the application in the owner control information; and

controlling application access to the local memory based upon the determining.

2. The method of claim 1, wherein the request to access the local memory comprises a request to erase data from the local memory.

3. The method of claim 1, wherein the request to access the local memory comprises a request to read data from the local memory.

4. The method of claim 1, further comprising restricting modification of the owner control information after the owner control information has been stored in the protected data store.

5. The method of claim 1, wherein the owner control information includes an authorization record and an application identifier for each of the applications, and the owner control information is provided by an external source through a wireless communication channel.

6. The method of claim 5, wherein the authorization record related to determining whether access to the local memory is allowed is provided by an external computer that is used to enforce policies for operating electronic devices within an organization.

7. The method of claim 1, wherein an update to the owner control information is provided by an external source for storage on the electronic device.

8. The method of claim 1, wherein a plurality of authorization records associated with a plurality of application identifiers are stored on the electronic device, the method further comprising:

receiving requests to access the local memory from a plurality of applications operating on the electronic device;

determining whether access to the local memory is allowed to be performed by their respective applications based upon the stored authorization records and the application identifiers that are respectively associated with the plurality of applications; and

controlling access by the plurality of applications to local memory based upon whether access to the local memory is allowed.

9. The method of claim 8, wherein a group containing two or more of the applications is associated with one of the authorization records.

10. A device, comprising:

a memory; and

a processor coupled with the memory and configured by instructions stored in the memory to;

receive owner information from an owner of the device;

receive owner control information that comprises;

a list of applications permitted for installation on the device, and

permissions associated with each permitted application in the list of applications;

store the owner control information in a protected data store to prevent alteration or deletion of the owner control information in response to authenticating the owner control information using the owner information;

receive, from an application operating on the electronic device, a request to access local memory on the electronic device;

determine whether the application is allowed to access the local memory in response to identifying a permission associated with the application in the owner control information; and

control application access to the local memory based upon the determining.

11. The device of claim 10, wherein the request to access the local memory comprises a request to erase data from the local memory.

12. The device of claim 10, wherein the request to access the local memory comprises a request to read data from the local memory.

13. The device of claim 10, wherein the processor is further configured to restrict modification of the owner control information after the owner control information has been stored on the electronic device.

14. The device of claim 10, wherein the owner control information includes an authorization record and an application identifier for each of the applications, and wherein the owner control information is provided by an external source through a wireless communication channel.

15. The device of claim 14, wherein the authorization record related to determining whether access to the local memory is allowed is provided by an external computer that is used to enforce policies for operating electronic devices within an organization.

16. The device of claim 10, wherein an update to the owner control information is provided by an external source for storage on the electronic device.

17. A non-transitory computer-readable medium with instructions stored thereon, wherein the instructions are executable by a processor to cause the processor to perform the operations of:

receiving owner information from an owner of an electronic device;

receiving owner control information that comprises;

a list of applications permitted for installation on the device, and

permissions associated with each permitted application in the list of applications;

storing the owner control information in a protected data store to prevent alteration or deletion of the owner control information in response to authenticating the owner control information using the owner information;

receiving, from an application operating on the electronic device, a request to access local memory on the electronic device;

determining whether the application is allowed to access the local memory in response to identifying a permission associated with the application in the owner control information; and

controlling application access to the local memory based upon the determining.

18. The non-transitory computer-readable medium of claim 17, wherein the owner control information includes an authentication record and an identifier for each application allowed to be executed on the electronic device.

19. The non-transitory computer-readable medium of claim 17, wherein the request to access the local memory comprises a request to erase data from the local memory.

20. The non-transitory computer-readable medium of claim 17, wherein the request to access the local memory comprises a request to read data from the local memory.