System and method for secure control of resources of wireless mobile communication devices

• US 20050213763A1
• Filed: 08/19/2003
• Published: 09/29/2005
• Est. Priority Date: 08/19/2002
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Shenfield, Michael, Owen, Russell N, Yach, David P., Little, Herbert A.
• Granted Patent: US 8,544,084 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Systems and methods for secure control of a wireless mobile communication device are disclosed. Each of a plurality of domains includes at least one wireless mobile communication device asset. When a request to perform an operation affecting at least one of the assets is received, it is determined whether the request is permitted by the domain that includes the at least one affected asset, by determining whether the entity with which the request originated has a trust relationship with the domain, for example. The operation is completed where it is permitted by the domain. Wireless mobile communication device assets include software applications, persistent data, communication pipes, and configuration data, properties or user or subscriber profiles.

Claims

1. A system of securely controlling a wireless mobile communication device, comprising:

a plurality of domains residing on a wireless mobile communication device, each domain including an asset of the wireless mobile communication device; and

a domain controller configured to receive a request to perform an operation affecting at least one of the assets, to determine whether the request originated with an entity that has a trust relationship with the domain that includes the at least one affected asset, and to permit completion of the operation where the request originated with an entity that has a trust relationship with the domain that includes the at least one affected asset.

2. The system of claim 1, further comprising a key store for storing cryptographic keys associated with the domain that includes the at least one affected asset, wherein the domain controller is configured to determine whether the request originated with an entity that has a trust relationship with the domain using the cryptographic keys.

3. The system of claim 1, wherein the domain controller is configured to determine whether the request originated with the entity that has a trust relationship with the domain that includes the at least one affected asset by determining whether the domain that includes the at least one affected asset also includes the entity.

4. The system of claim 1, wherein the at least one domain further includes a software application.

5. The system of claim 4, wherein at least one of the domains comprises a plurality of domains, and wherein the wireless mobile communication device further comprises a super user software application that has a trust relationship with more than one of the plurality of domains.

6. The system of claim 5, wherein each of the more than one of the plurality of domains includes the super user software application.

7. The system of claim 1, wherein the domain controller is further configured to receive information, and to place the information into a domain.

8. The system of claim 1, wherein the at least one asset is selected from the group consisting of:

communication pipes, persistent data, properties, and software applications.

9. The system of claim 1, further comprising a data store for storing properties, wherein the domain controller is further configured to determine whether the operation is permitted by properties in the data store, and to permit completion of the operation where the operation is permitted by the properties in the data store.

10. The system of claim 9, wherein each property is global, domain-specific, or specific to a particular software application on the wireless mobile communication device.

11. A method for secure control of a wireless mobile communication device, comprising:

segregating assets of the wireless mobile communication device into a plurality of domains, each domain including at least one asset of the wireless mobile communication device;

receiving a request to perform an operation affecting at least one of the assets;

determining whether the operation is permitted by the domain that includes the affected asset; and

allowing the operation to be completed where the operation is permitted by the domain that includes the affected asset.

12. The method of claim 11, wherein the step of determining comprises the step of determining whether the request originated with an entity that has a trust relationship with the domain that includes the at least one affected asset.

13. The method of claim 12, wherein the step of determining whether the request originated with an entity that has a trust relationship with the domain that includes the at least one affected asset comprises the step of determining whether the domain that includes the at least one affected asset also includes the entity.

14. The method of claim 12, wherein the request originates from a software application, and wherein the step of determining whether the request originated with an entity that has a trust relationship with the domain that includes the at least one affected asset comprises the step of verifying a digital signature of the software application using a cryptographic key associated with the domain.

15. The method of claim 11, further comprising the steps of:

receiving information; and

associating the information with at-least one of the plurality of domains.

16. The method of claim 15, wherein the step of associating comprises the step of determining with which domains the information is to be associated in accordance with domain policies.

17. The method of claim 16, wherein the domain policies specify that information is to be associated with domains based on one or more of:

a source of the information, an indicator of a domain in the information, a communication pipe over which the information is received, a digital signature of the information, an access list describing allowed domain information, and an input from a user of the wireless mobile communication device.

18. The method of claim 11, further comprising the step of:

determining whether the operation is permitted by properties stored at the wireless mobile communication device,

wherein the step of allowing comprises the step of allowing the operation to be completed where the operation is permitted by both the domain and the properties.

19. The method of claim 18, wherein the step of determining whether the operation is permitted by properties stored at the wireless mobile communication device comprises the step of checking global properties for the wireless mobile communication device and domain properties for the domain that includes the at least one affected asset.

20. The method of claim 19, wherein the request originates from a software application, and wherein the step of determining whether the operation is permitted by properties stored at the wireless mobile communication device further comprises the step of checking application properties for the software application.