System and method for protecting data in a synchronized environment

• US 8,027,665 B2
• Filed: 09/29/2005
• Issued: 09/27/2011
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Edward H.
• Primary Examiner(s): Edouard; Patrick N
• Assistant Examiner(s): LEE, JUSTIN YE
• Application Number:
  US11/239,828
• Publication Number:
  US 20060105744A1
• Time in Patent Office: 2,189 Days
• Field of Search: 455/411, 455/410, 455/412.1
• US Class Current: 455/411
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04M 1/72436 for text messaging, e.g. short messaging services [SMS] or e-mails
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A system includes a mobile device providing a plurality of applications and an agent providing first and second authentication procedures for authenticating a user of the mobile device to first and second applications running on the mobile device. A first application is enabled by authenticating a user through a first authentication procedure, and a second application is enabled by authenticating a user through a second authentication procedure. The agent authenticates the user to the first application following the first authentication procedure, and the agent authenticates the user to the second application following the second authentication procedure.

Claims

1. A system comprising:

a mobile device configured to run first and second applications, each of the first and second applications configured to run on the mobile device and provide a user-interactive interface that allows a user of the mobile device to interactively operate each of the applications; and

an agent configured to provide first and second authentication procedures that are independently or combinably assignable to the first and second applications and are configured to gather first and second authentication data from the mobile device and prevent access to first and second application data associated respectively with the first and second applications prior to authentication;

wherein the agent grants access to the first application data by authenticating the gathered first authentication data through the first authentication procedure to authenticate the mobile device to the first application; and

wherein the agent grants access to the second application data by authenticating the gathered first and second authentication data through both the first authentication procedure and the second authentication procedure, respectively, to authenticate the mobile device to the second application.

2. The system of claim 1 further comprising a server for communicating with the mobile device;

and

wherein the first and second applications receive first and second application data from the server.

3. The system of claim 2, wherein authentication of the mobile device by the agent to at least one of the first and second applications allows application data to be exchanged between the server and the mobile device.

4. The system of claim 1 wherein the first application includes e-mail services.

5. The system of claim 4, wherein the first application comprises retrieving and displaying of e-mail messages, and wherein the second application comprises modifying, forwarding and drafting of e-mail messages.

6. The system of claim 4, wherein the first application comprises downloading and opening attachments to e-mail messages as one application.

7. The system of claim 1, wherein the first authentication procedure comprises an entry of a first pass code, and wherein the second authentication procedure comprises an entry of a second pass code.

8. The system of claim 1, wherein the first authentication procedure comprises a biometric authentication of a user of the mobile device.

9. The system of claim 1, wherein the first authentication procedure comprises an authentication of a geographic location of the mobile device.

10. The system of claim 1, wherein the first authentication procedure comprises a time based authentication procedure.

11. The system of claim 1, wherein each of the first and second applications are selected from one of the following:

photo, voice telephony services, GPS data, stock quotes, accessing incoming e-mail, editing e-mail, forwarding e-mail, downloading e-mail, reading e-mail, downloading attachments to e-mail, opening attachments to e-mail, music downloading, music playing, music replaying, providing entertainment services, and receiving and placing telephone calls.

12. A wireless network comprising:

a server;

a mobile device for communicating with the server, the mobile device configured to run a plurality of applications each configured to receive application data from the server and provide a user-interactive interface that allows a user of the mobile device to interactively operate each application; and

an agent configured to provide a plurality of authentication procedures that are independently or combinably assignable to the plurality of applications and are configured to gather authentication data from the mobile device and prevent access to the application data prior to authentication;

wherein the agent authenticates access to the application data for each of the plurality of applications based on the authentication data using a boolean logic combination criterion of more than one of the plurality of authentication procedures different from a boolean logic combination criterion associated with any of the other of the plurality of applications.

13. The system of claim 12, wherein authentication of each of the plurality of applications allows at least a particular portion of the application data to be exchanged between the server and the mobile device.

14. The system of claim 12 wherein the plurality of applications includes e-mail services comprising retrieving and displaying of e-mail messages as a first one of the plurality of applications;

modifying, forwarding and drafting of e-mail messages as a second one of the plurality of applications; and

downloading and opening attachments to e-mail messages as a third one of the plurality of applications.

15. The system of claim 12, wherein the plurality of authentication procedures comprises an entry of a first pass code as a first one of the plurality of authentication procedures, an entry of a second pass code as a second one of the plurality of authentication procedures, and a biometric authentication of a user of the mobile device as a third one of the plurality of authentication procedures.

16. The system of claim 12, wherein the plurality of authentication procedures comprises an authentication of a geographic location of the mobile device.

17. The system of claim 12, wherein the plurality of authentication procedures comprises time based authentication procedures.

18. The wireless network of claim 12, wherein each of the plurality of applications are selected from one of the following:

photo, voice telephony services, GPS data, stock quotes, accessing incoming e-mail, editing e-mail, forwarding e-mail, downloading e-mail, reading e-mail, downloading attachments to e-mail, opening attachments to e-mail, music downloading, music playing, music replaying, providing entertainment services, and receiving and placing telephone calls.

19. A method for authenticating a mobile device to a mobile communications network, the method comprising:

providing a mobile device configured to communicate with one or more servers;

providing a plurality of authentication procedures independently or combinably assignable to a plurality of applications, the plurality of applications provided by at least one of the mobile device and the one or more servers and each configured to run on the mobile device and provide a user-interactive interface that allows a user of the mobile device to interactively operate the application, wherein the plurality of authentication procedures are configured to gather authentication data from the mobile device and prevent access to application data associated with the plurality of applications prior to authentication; and

associating each of the plurality of applications with one or more of the plurality of authentication procedures;

wherein each of the plurality of authentication procedures is configured to obtain authentication of the authentication data from the one or more servers to allow access to the application data.

20. The method of claim 19, further comprising authenticating the mobile device to a particular one of the associated applications to allow application data to be sent between the server and the mobile device.

21. The method of claim 19, wherein each of the plurality of applications is associated with a corresponding one of the authentication procedures in response to a selection made at the mobile device.