Privilege management and revocation

• US 10,515,195 B2
• Filed: 07/31/2017
• Issued: 12/24/2019
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Little, Herbert Anthony
• Primary Examiner(s): Perungavoor, Venkat
• Application Number:
  US15/664,497
• Publication Number:
  US 20170329940A1
• Time in Patent Office: 876 Days
• Field of Search: None
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure relates to management of privileges associated with applications accessible by users of electronic devices. In one aspect, an electronic device detects that a privilege has been revoked, shuts down any application running on the electronic device that has previously accessed the privilege, and restarts any application that was shut down, the restarted application no longer having any access to the revoked privilege. In another aspect, an electronic device keeps a log of which applications have previously accessed which privileges, receives a new set of privileges associated with applications, determines that a privilege has been revoked, and if the log indicates that an application previously accessed the privilege, resets the electronic device. In a further aspect, a method sets privileges associated with applications, records which electronic devices have which applications, revokes a privilege, and instructs those electronic devices having applications to which the privilege is associated to reset themselves.

Claims

1. A method for managing privileges in a computer system, the method comprising:

setting privileges associated with applications capable of running on one or more electronic devices in the system;

recording which of the electronic devices in the system have which applications;

detecting a revocation of a privilege associated with at least one of the applications by comparing an old set of privileges associated with the applications to a new set of privileges associated with the applications; and

responsive to detecting the revocation of the privilege, automatically instructing those electronic devices having applications to which the privilege is associated to reset themselves.

2. The method as recited by claim 1, wherein the privilege comprises allowing an application to use inter-process communication.

3. The method as recited by claim 1, wherein the privilege comprises enabling opening of internal and external connections.

4. The method as recited by claim 1, wherein the privilege comprises enabling use of communication tools.

5. The method as recited by claim 1, wherein the privilege comprises enabling use of personal information management functionality.

6. The method as recited by claim 1, wherein the privilege comprises enabling the use of an application program interface.

7. A computer system comprising:

a processor; and

a memory storing instructions which, when executed by the processor, cause the processor to;

set privileges associated with applications capable of running on one or more electronic devices in the system;

record which of the electronic devices in the system have which applications;

detect a revocation of a privilege associated with at least one of the applications by comparing an old set of privileges associated with the applications to a new set of privileges associated with the applications; and

responsive to detecting the revocation of the privilege, automatically instruct those electronic devices having applications to which the privilege is associated to reset themselves.

8. The computer system as recited by claim 7, wherein the privilege comprises allowing an application to use inter-process communication.

9. The computer system as recited by claim 7, wherein the privilege comprises enabling opening of internal and external connections.

10. The computer system as recited by claim 7, wherein the privilege comprises enabling use of communication tools.

11. The computer system as recited by claim 7, wherein the privilege comprises enabling use of personal information management functionality.

12. The computer system as recited by claim 7, wherein the privilege comprises enabling the use of an application program interface.

13. A non-transitory computer-readable medium storing instructions which, when executed by a processor of a computer system, result in:

setting privileges associated with applications capable of running on one or more electronic devices in the system;

recording which of the electronic devices in the system have which applications;

detecting a revocation of a privilege associated with at least one of the applications by comparing an old set of privileges associated with the applications to a new set of privileges associated with the applications; and

responsive to detecting the revocation of the privilege, automatically instructing those electronic devices having applications to which the privilege is associated to reset themselves.

14. The non-transitory computer-readable medium as recited by claim 13, wherein the privilege comprises allowing an application to use inter-process communication.

15. The non-transitory computer-readable medium as recited by claim 13, wherein the privilege comprises enabling opening of internal and external connections.

16. The non-transitory computer-readable medium as recited by claim 13, wherein the privilege comprises enabling use of communication tools.

17. The non-transitory computer-readable medium as recited by claim 13, wherein the privilege comprises enabling use of personal information management functionality.

18. The non-transitory computer-readable medium as recited by claim 13, wherein the privilege comprises enabling the use of an application program interface.