System and Method for Secure Control of Resources of Wireless Mobile Communication Devices

• US 20160337363A1
• Filed: 07/11/2016
• Published: 11/17/2016
• Est. Priority Date: 08/19/2002
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Owen, Russell Norman, Little, Herbert Anthony, Yach, David Paul, Shenfield, Michael
• Granted Patent: US 10,015,168 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Systems and methods for secure control of a wireless mobile communication device are disclosed. Each of a plurality of domains includes at least one wireless mobile communication device asset. When a request to perform an operation affecting at least one of the assets is received, it is determined whether the request is permitted by the domain that includes the at least one affected asset, by determining whether the entity with which the request originated has a trust relationship with the domain, for example. The operation is completed where it is permitted by the domain. Wireless mobile communication device assets include software applications, persistent data, communication pipes, and configuration data, properties or user or subscriber profiles.

Claims

1. A method comprising:

storing corporate data and other data on a wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device;

receiving, via a communication pipe, a request to access the corporate data; and

controlling access to the corporate data based on whether the communication pipe is in the corporate domain.

2. The method of claim 1, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

3. The method of claim 2, wherein the corporate domain and the personal domain are secure domains.

4. The method of claim 1, further comprising determining whether the communication pipe is in the corporate domain by using a cryptographic key from a key store.

5. The method of claim 1, further comprising:

receiving information; and

determining whether to assign the information to the corporate domain based upon a domain policy.

6. The method of claim 5, wherein the domain policy specifies that information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, and an input from the user of the wireless communication device.

7. A wireless communication device, comprising:

at least one memory storing corporate data and other data on the wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device; and

a controller configured to receive, via a communication pipe, a request to access the corporate data, and to control access to the corporate data based on whether the communication pipe is in the corporate domain.

8. The wireless communication device of claim 7, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

9. The wireless communication device of claim 8, wherein the corporate domain and the personal domain are secure domains.

10. The wireless communication device of claim 7, wherein the controller is further configured to determine whether the communication pipe is in the corporate domain by using a cryptographic key from a key store.

11. The wireless communication device of claim 7, wherein the controller is further configured to:

receive information; and

determine whether to assign the information to the corporate domain based upon a domain policy.

12. The wireless communication device of claim 11, wherein the domain policy specifies that information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, and an input from the user of the wireless communication device.

13. The wireless communication device of claim 7, wherein the communication pipe is in the corporate domain if a cryptographic key controlled by the corporate entity is used for communication over the communication pipe.

14. The wireless communication device of claim 7, wherein the communication pipe is in the corporate domain if the communication pipe includes a gateway through a corporate security firewall.

15. A non-transitory computer readable medium, comprising program code executable by a processor such that when executed, cause a wireless communication device to:

store corporate data and other data on the wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device;

receive, via a communication pipe, a request to access the corporate data; and

control access to the corporate data based on whether the communication pipe is in the corporate domain.

16. The non-transitory computer readable medium of claim 15, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

17. The non-transitory computer readable medium of claim 16, wherein the corporate domain and the personal domain are secure domains.

18. The non-transitory computer readable medium of claim 15, wherein the program code is further configured to determine whether the communication pipe is in the corporate domain by using a cryptographic key from a key store.

19. The non-transitory computer readable medium of claim 15, wherein the program code is further configured to:

receive information; and

determine whether to assign the information to the corporate domain based upon a domain policy.

20. The non-transitory computer readable medium of claim 19, wherein the domain policy specifies that information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, and an input from the user of the wireless communication device.