System and method for privilege management and revocation

• US 7,614,082 B2
• Filed: 06/29/2005
• Issued: 11/03/2009
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil P., Little, Herbert A.
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US11/169,302
• Publication Number:
  US 20070006284A1
• Time in Patent Office: 1,588 Days
• Field of Search: 726 4- 6, 726 27- 30, 726/17, 726/18, 726/21, 717168-173, 713/158, 713164-167
• US Class Current: 726/18
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present disclosure relates generally to the management of privileges associated with certain applications that are accessible by users of electronic equipment, such as, for example, networked computers, mobile wireless communications devices, and the like. In particular, the disclosure is directed to systems and methods for managing privileges associated with particular applications and for revoking these privileges in a timely and robust manner. For example, the device keeps track of which applications get access to which privileges. When policies or application control changes, the system detects which privileges have been revoked for which applications. This can be accomplished by simply comparing the old set of privileges with the new set of privileges. For each revoked privilege for a given application, the system determines if the application has ever accessed that privilege in the past. If an application has accessed a privilege that is now revoked at any time in the past, the device is reset. To ensure that privileges that may be passed between applications are not overlooked, the device is arranged to perform a reset if any revoked privilege accessible by the device is one that may be passed between applications.

Claims

1. A method for managing privileges associated with applications in an electronic system, comprising:

monitoring a plurality of devices in the electronic system to detect use of privileges by applications being run by any of the plurality of the devices in the electronic system;

recording which applications have accessed which privileges;

detecting a change in privileges of the system;

comparing recorded privileges previously accessed by applications with a set of privilege changes;

identifying any privileges to be revoked based on a result of said comparing;

when a privilege to be revoked is identified, shutting down an application that has previously accessed the revoked privilege; and

restarting any application that was shut down for having accessed a revoked privilege.

2. A method according to claim 1, wherein said recording, comprises:

storing an application identifier associated with an application that has accessed a privilege; and

associating said identifier with the privilege accessed by the application.

3. A method according to claim 2, wherein said recording is stored in a data table listing the application identifier and privileges associated therewith.

4. A method according to claim 1, wherein said set of privilege changes comprises privileges to be revoked.

5. A method according to claim 1, wherein said set of privilege changes comprises a listing of all privileges available for use, and does not include privileges to be revoked.

6. A method according to claim 1, wherein said plurality of devices comprise at least one wireless mobile electronic communication device.

7. A method according to claim 1, further comprising continuously repeating said method.

8. A method according to claim 1, wherein said change in privileges is a result of a change in system IT policy.

9. A method for managing privileges in a system comprising a plurality of electronic devices, said method comprising:

monitoring, by each device of the system, which applications on each device have access to which privileges;

recording privileges accessible via applications resident on each device of the system;

detecting a change in privileges available to said devices in said system;

comparing an old set of privileges with a new set of privileges, said new set of privileges corresponding to said change in privileges;

determining if any privileges are to be revoked based on said comparison;

resetting each device that has access to a privilege that is to be revoked;

determining whether any privileges to be revoked are able to be passed between applications; and

when a privilege to be revoked is able to be passed between applications, resetting each device that has access to said privilege.

10. A method according to claim 9, wherein said change in privileges is a result of a change in system IT policy.

11. A method according to claim 9, wherein said change in privileges includes an indication that privileges are to be revoked.

12. A method according to claim 9, wherein said resetting brings said system to a known state.

13. A method according to claim 12, further comprising restarting said electronic devices after said devices have been reset.

14. A method according to claim 9, wherein said electronic devices include a mobile wireless communications device.

15. A system for managing privileges in a network comprising a plurality of electronic devices, said system comprising:

a processor resident in each device of the system, for monitoring which applications on each device have access to which privileges;

a memory for recording privileges accessible via applications resident on each device of the system; and

wherein said processor is operable to;

detect a change in privileges available to said devices in said system;

compare an old set of privileges with a new set of privileges, said new set of privileges corresponding to said change in privileges;

determine if any privileges are to be revoked based on said comparison;

reset each device that has access to a privilege that is to be revoked; and

determine whether any privileges to be revoked are able to be passed between applications, and when a privilege to be revoked is able to be passed between applications, resetting each device that has access to said privilege.

16. A system for managing privileges associated with applications in an electronic system, said system comprising:

a processor resident in each of a plurality of devices of the system, for monitoring the plurality of devices in the electronic system to detect use of privileges by applications being run by any of the plurality of the devices in the electronic system;

a memory for recording which applications have accessed which privileges; and

wherein said processor is operable to;

detect a change in privileges of the system;

perform a comparison of recorded privileges previously accessed by applications with a set of privilege changes;

identify any privileges to be revoked based on a result of said comparison;

when a privilege to be revoked is identified, shut down an application that has previously accessed the revoked privilege; and

restart any application that was shut down for having accessed a revoked privilege.