System and method for secure control of resources of wireless mobile communication devices

• US 10,298,584 B2
• Filed: 07/02/2018
• Issued: 05/21/2019
• Est. Priority Date: 08/19/2002
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Owen, Russell Norman, Little, Herbert Anthony, Yach, David Paul, Shenfield, Michael
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/025,583
• Publication Number:
  US 20180316678A1
• Time in Patent Office: 323 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Systems and methods for secure control of a wireless mobile communication device are disclosed. Each of a plurality of domains includes at least one wireless mobile communication device asset. When a request to perform an operation affecting at least one of the assets is received, it is determined whether the request is permitted by the domain that includes the at least one affected asset, by determining whether the entity with which the request originated has a trust relationship with the domain, for example. The operation is completed where it is permitted by the domain. Wireless mobile communication device assets include software applications, persistent data, communication pipes, and configuration data, properties or user or subscriber profiles.

Claims

1. A method comprising:

storing first data and second data in a wireless communication device,

wherein the first data is stored in a first domain of the wireless communication device and the second data is stored in a second domain of the wireless communication device,

wherein the first data is controlled by an organization and the second data is controlled by a user of the wireless communication device;

permitting a first software application to access the first data, the first software application executing at the wireless communication device and associated with the first domain; and

controlling whether a second software application is permitted to access the first data, the second software application executing at the wireless communication device and associated with the second domain.

2. The method of claim 1, wherein the organization comprises an employer of the user.

3. The method of claim 1, wherein the second software application is permitted to access the first data.

4. The method of claim 1, wherein the second software application is not permitted to access the first data.

5. The method of claim 1, further comprising permitting the second software application to access the second data.

6. The method of claim 1, wherein the first data comprises data related to one or more contacts of an address book.

7. The method of claim 1, wherein the first data comprises corporate data.

8. The method of claim 1, wherein the second data comprises personal data.

9. A wireless communication device, comprising:

at least one memory storing first data and second data in the wireless communication device, wherein the first data is stored in a first domain of the wireless communication device and the second data is stored in a second domain of the wireless communication device, wherein the first data is controlled by an organization and the second data is controlled by a user of the wireless communication device; and

a controller configured to;

permit a first software application to access the first data, the first software application executing at the wireless communication device and associated with the first domain; and

control whether a second software application is permitted to access the first data, the second software application executing at the wireless communication device and associated with the second domain.

10. The wireless communication device of claim 9, wherein the organization comprises an employer of the user.

11. The wireless communication device of claim 9, wherein the second software application is permitted to access the first data.

12. The wireless communication device of claim 9, wherein the second software application is not permitted to access the first data.

13. The wireless communication device of claim 9, wherein the controller is configured to permit the second software application to access the second data.

14. The wireless communication device of claim 9, wherein the first data comprises data related to one or more contacts of an address book.

15. The wireless communication device of claim 9, wherein the first data comprises corporate data.

16. The wireless communication device of claim 9, wherein the second data comprises personal data.

17. A non-transitory computer readable medium comprising program code executable by a processor such that, when executed, causes a wireless communication device to perform operations comprising:

storing first data and second data in the wireless communication device, wherein the first data is stored in a first domain of the wireless communication device and the second data is stored in a second domain of the wireless communication device, wherein the first data is controlled by an organization and the second data is controlled by a user of the wireless communication device;

permitting a first software application to access the first data, the first software application executing at the wireless communication device and associated with the first domain; and

controlling whether a second software application is permitted to access the first data, the second software application executing at the wireless communication device and associated with the second domain.

18. The non-transitory computer readable medium of claim 17, wherein the organization comprises an employer of the user.

19. The non-transitory computer readable medium of claim 17, wherein the second software application is permitted to access the first data.

20. The non-transitory computer readable medium of claim 17, wherein the second software application is not permitted to access the first data.

21. The non-transitory computer readable medium of claim 17, wherein the second software application is permitted to access the second data.

22. The non-transitory computer readable medium of claim 17, wherein the first data comprises data related to one or more contacts of an address book.

23. The non-transitory computer readable medium of claim 17, wherein the first data comprises corporate data.

24. The non-transitory computer readable medium of claim 17, wherein the second data comprises personal data.