SECURED PRESENTATION LAYER VIRTUALIZATION FOR WIRELESS HANDHELD COMMUNICATION DEVICE

• US 20100281258A1
• Filed: 07/15/2010
• Published: 11/04/2010
• Est. Priority Date: 01/16/2008
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Dixon, Kevin, Dietrich, Trevor, Andress, Mark, Noble, Duncan
• Granted Patent: US 9,716,689 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data

Abstract

The connectivity and security of wireless handheld devices (HDs) can be leveraged to provide a presentation appliance (PA) such as a laptop with an ability to securely communicate with an enterprise'"'"'s private network. A split-proxy server, with part of it executing on the HD and a part executing on the PA, implements a full HTTP 1.1 compliant Internet/Web Proxy to couple the PA for communication through the HD. Specifically, the split proxy provides support for the pragmatic keep-alive header, the CONNECT method, socket connection sharing, and thread pooling, to enable a fully functional browsing environment. Such an environment enables access to commercial web-based applications that are built on standard Internet technologies without the need for re-rendering or re-writing the user interfaces to suit the HD. In addition, Intranet web-based applications arc made securely accessible without the need for additional VPN and remote access technologies.

Claims

1. A data communication system comprising:

a wireless communication device configured to communicate data securely over a public wireless network; and

a presentation appliance for virtualizing a presentation layer of the wireless communication device to a user;

wherein the appliance and wireless communication device are communicatively coupled for data communication via a split proxy such that the appliance is also configured to communicate data securely within the public wireless network through the wireless communication device, said appliance executing a user interface to virtualize the presentation layer and permit the user to selectively operate the data communications.

4. The system of claim 1 wherein the presentation appliance comprises a laptop and the wireless communication device is configured for secure data communications with a private network, such that operation of the user interface to virtualize the presentation layer couples the laptop to the private network for secure data communications.

5. The system of claim 1 wherein the wireless communication device is configured for secure data communications with a private network and wherein the appliance and wireless communication device are further communicatively coupled to facilitate the exchange of a communications network proxy address with which to route requests for resources From the private network.

7. The system of claim 1 wherein the wireless communication device and appliance are configured to encrypt and decrypt respective split proxy data communications exchanged with one another in accordance with a key, each of said wireless communication device and said appliance securely obtaining the key from a key server coupled to the wireless public network via the wireless communication device.

8. The system of claim 7 wherein the wireless communication device is configured to obtain the key and an authentication token from the key server and present the token to the user for said user to use to request the key for the appliance, said user providing the token to the appliance and requesting the key from the key server via communications through the wireless communication device.

18. The method of claim 8 wherein the wireless communication device is configured for secure data communications with an enterprise thereby to communicate data between the presentation appliance and the enterprise, the step of coupling further comprising:

receiving a communications network proxy address from the enterprise and using the split proxy server to communicate the network proxy address to the presentation appliance.

19. The method of claim 8 wherein the wireless communication device is configured for secure data communications with an enterprise thereby to communicate data between the presentation appliance and the enterprise, the step of coupling further comprising:

receiving a network script address from the enterprise and using the split proxy server to communicate the network script address to the presentation appliance, using said network script address to obtain a network script, the network script for locating a communications network proxy address.

20. The method of claim 8 wherein the wireless communication device is configured for secure data communications with an enterprise thereby to communicate data between the presentation appliance and the enterprise, the step of coupling further comprising:

receiving a network script address from the enterprise and using the split proxy server to communicate the network script address to the presentation appliance.

21. The method of claim 20, further comprising the steps of:

locating a network script using the network script address;

and executing the network script on the enterprise .for locating a communications network proxy address.

2. The system of claim I further comprising a removable dongle comprising storage means and short range radio communications means, said dongle storing instructions and data for execution by the appliance to facilitate the split proxy communications with the wireless communication device and said dongle further providing short range communication capabilities for communicatively coupling the appliance and said wireless communication device.

3. The system of claim 2 wherein the instructions and data configure the appliance to cease virtualizing the presentation layer upon at least one

(a) a removal of the flash drive dongle:

and

(b) a stopping of the short range communications.

6. The system of claim I wherein the wireless communication device communicates data comprising electronic messages and includes a wireless communication device user interface having a presentation layer to display and control said electronic messages;

and wherein the appliance comprises an appliance user interface configured to virtualize the wireless communication device'"'"'s presentation layer to display and control said messages via the appliance.

9. A method for communicating data comprising:

coupling a wireless communication device configured to communicate data securely within a public wireless network with a presentation appliance for virtualizing a presentation layer of the wireless communication device to a user, wherein the appliance and wireless communication device define a split proxy server such that the appliance is also configured to communicate data securely within the public wireless network through the wireless communication device; and

executing a user interface on said appliance to virtualize the presentation layer and permit the user to selectively operate the data communications.

10. The method of claim 9 wherein said coupling comprises using a removable dongle comprising storage means and short range radio communications means, said dongle storing instructions and data for execution by the appliance to facilitate the split proxy communications with the wireless communication device and said dongle further providing short range communication capabilities for communicatively coupling the appliance to said wireless communication device.

11. The method of claim 10 wherein the instructions and data configure the appliance to cease virtualizing the presentation layer upon at least one of:

(a) a removal of the flash drive dongle; and

(b) a stopping of the short range communications.

12. The method of claim 9 wherein the presentation appliance comprises a laptop and the wireless communication device is configured for secure data communications with an enterprise thereby to communicate data between the laptop and the enterprise.

13. The method of claim 9 wherein the wireless communication device communicates data comprising electronic messages and includes a wireless communication device user interface having a presentation layer to display and control said electronic messages;

and wherein the appliance comprises an appliance user interface configured to virtualize the wireless communication device'"'"'s presentation layer to display and control said messages via the appliance and wherein the method comprises executing the appliance user interface to communicate electronic messages from the appliance.

14. The method of claim 13 wherein the wireless communication device provides a servlet framework for processing requests and data communicated with the appliance.

15. The method of claim 13 wherein at least some of the electronic messages are associated with respective attachments, each attachment defined in accordance with a respective associated application format;

and wherein the method comprises operating the appliance user interface to request an attachment server to provide a particular attachment in accordance with its respective associated application format to the appliance via the split proxy server.

16. The method of claim 9 wherein the wireless communication device and appliance are configured to encrypt and decrypt respective split proxy data communications exchanged with one another in accordance with a key and wherein the method further comprises securely obtaining the key by each of said wireless communication device and said appliance from a key server coupled to the wireless public network via the wireless communication device.

17. The method of claim 16 wherein the step of securely obtaining comprises:

obtaining the key and an authentication token by the wireless communication device from the key server;

presenting the token via the wireless communication device to the user for use to request the key for the appliance;

receiving the token at the appliance from the user; and

using the token to request and receive the key from the key server via communications through the wireless communication device.

22. A computer-readable storage medium having computer executable instructions stored thereon for adapting a wireless device configured to communicate data securely within a public wireless network and a presentation appliance for data communications, said instructions including first code means for adapting the wireless communication device and second code means for adapting the appliance, such that when the first and second code means are executed by respective processors of the wireless communication device and appliance, the wireless communication device and appliance are communicatively coupled for data communication via a split proxy such that the appliance is also configured to communicate data securely within the public wireless network through the wireless communication device, and wherein said second code means providing the appliance with a user interface to virtualize a presentation layer of the wireless communication device and permit a user to selectively operate the data communications.

23. A network data communications system comprising:

a network server supporting secure data communications by wireless handled communication devices over a public wireless network, said server providing end to end data encryption with respect to the wireless handled communication devices;

a plurality of wireless communication devices configured to communicate data securely over the public wireless network via said network server;

p1 and

for at least one of the wireless communication devices, a presentation appliance for virtualizing a presentation layer of the wireless communication device to a user;

wherein the appliance and wireless communication device are communicatively coupled for data communication via a split proxy such that the appliance is also configured to communicate data .securely within the public wireless network through the wireless communication device and network server, said appliance executing a user interface to virtualize the presentation layer and permit the user to selectively operate the data communications.

24. The network data communications system of claim 23 further comprising a removable dongle comprising storage means and short range radio communications means, said dongle storing instructions and data for execution by the appliance to facilitate the split proxy communications with the wireless communication device and said dongle further providing short range communication capabilities for communicatively coupling the appliance and said wireless communication device.

25. The network data communications system of claim 23 further comprising a key server for securely providing a key to the wireless communication device and appliance for encrypting and decrypting respective split proxy data communications exchanged between the wireless communication device and appliance.

26. The network data communications system of claim 23 wherein the network server is coupled to an enterprise'"'"'s local area network (LAN) and configured to provide to said wireless communication devices authenticated access to the LAN and wherein said appliance is provided authenticated access to said LAN automatically via said wireless communication device.

27. The network data communications system of claim 23 wherein the network server is configured to provide to said wireless communication device access to at least some of email;

calendar, contacts, tasks and notes;

instant messaging;

web-based applications and services and enterprise applications for users of said wireless communication devices and wherein said user interface executed by said appliance facilitates a user to selectively operate data communications through said wireless communication device for at least one of said email;

calendar, contacts, tasks and notes;

instant messaging;

web-based applications and services and enterprise applications.

28. The network data communications system of claim 23 wherein said network server provides said access to email comprising attachments and wherein the system further comprises an attachment server for communicating to said appliance in response to a request a particular attachment in accordance with the particular attachment'"'"'s associated application format.