System and method for controlling configuration settings for mobile communication devices and services

• US 8,259,611 B2
• Filed: 02/03/2012
• Issued: 09/04/2012
• Est. Priority Date: 10/26/2001
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Godfrey, James A., Chiu, Denny K., Gao, Wen
• Primary Examiner(s): Wong, Warner
• Application Number:
  US13/365,482
• Publication Number:
  US 20120136980A1
• Time in Patent Office: 214 Days
• Field of Search: 370/252, 709/221, 709/223
• US Class Current: 370/252
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/10 Multimedia information
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier

Abstract

A wireless mobile communication device includes a processing system, a memory device and software. The software is stored on the memory device and executable by the processing system to receive a policy setting, authenticate a sender of the received policy, and automatically apply the policy setting on the communication device based on a successful authentication of the sender.

Claims

1. A wireless mobile communication device comprising:

a processing system;

a memory device; and

software stored on the memory device and executable by the processing system to;

receive a policy setting;

authenticate a sender of the received policy; and

automatically apply the policy setting on the communication device based on a successful authentication of the sender;

wherein the software is further configured to rank senders of policy settings, so that a policy setting received from a higher ranked sender will replace a policy setting received from a lower ranked sender whereas a policy setting received from a lower ranked sender will not replace a policy setting received from a higher ranked sender.

2. The communication device of claim 1 wherein an enterprise server administrator sending a policy setting is ranked higher than a third party sending a policy setting.

3. The communication device of claim 2 wherein enterprise server administrators are ranked highest, such that a policy setting received over-the-air from an enterprise server administrator will replace any policy setting on the device.

4. The communication device of claim 2 wherein third party senders are ranked higher than desktop computer system senders, such that a policy setting received from a third party will replace only a policy setting received from a desktop computer system.

5. The communication device of claim 1 wherein the policy setting includes a setting selected from the group consisting of:

a setting that specifies whether particular software applications or services can be installed and executed on the mobile data communication device, a setting that specifies whether a security password is required to access the mobile data communication device, a setting that specifies whether a user of the mobile data communication device can change the device configuration, a setting that enables a long term mobile data communication device timeout, a setting that enables mobile data communication device security password pattern checking, a setting that specifies a maximum mobile data communication device security password age, a setting that specifies a maximum security timeout period for the mobile data communication device, a setting that specifies a minimum length of a mobile data communication device security password, and a setting that specifies mobile data communication device owner information.

6. The communication device of claim 1 wherein the policy setting is received in the form of a data block structured in a tag/value format.

7. The communication device of claim 1 wherein policy setting is received attached to an email message.

8. The communication device of claim 7 wherein the email message includes a digital signature.

9. The communication device of claim 1 wherein the policy setting is received over-the-air from a server.

10. The communication device of claim 1 wherein the policy setting is received through a serial port from a desktop computer.

11. The communication device of claim 1 wherein the software is configured such that:

if the communication device has no previous policy settings, then the software creates a new configuration information entry for the received policy setting; and

if the communication device has a previous policy setting, then the software replaces the existing policy setting with the received setting.

12. The communication device of claim 1 further comprising a query interface that allows software applications from third party developers to query the received policy settings.

13. The communication device of claim 1 further comprising a display screen configured to display a text message that was composed by an enterprise server administrator and included with the received policy setting, the text message indicating that the policy setting has been updated and the reason for the received policy setting.

14. The communication device of claim 1 wherein the authentication is by verifying a digital signature accompanying the received policy setting.

15. The communication device of claim 1 further comprising a feature that has both a policy setting and a user-established setting, such that the feature may be enabled and disabled via a policy setting, whereas a setting to control how the feature operates is established by a user of the device, and the user setting may be established only if the feature is enabled with the policy setting.

16. A method performed by a wireless mobile communication device, comprising:

ranking senders of policy settings, so that a policy setting received from a higher ranked sender will replace a policy setting received from a lower ranked sender, whereas a policy setting received from a lower ranked sender will not replace a policy setting received from a higher ranked sender;

receiving a policy setting that is configured to replace a previously received and applied policy setting;

if a sender of the received policy setting is of higher rank than a sender of the previously received and applied policy setting, then;

authenticating the sender of the currently received policy; and

automatically replacing the previously received and applied policy setting with the currently received policy setting upon successful authentication of the sender; and

if the sender of the currently received policy setting is of lower rank than the sender of the previously received and applied policy setting, then refraining from applying the currently received policy setting.

17. The method of claim 16 wherein the mobile communication device is disabled for redirection of data items from a message server via an enterprise server but is enabled for redirection using desktop redirection.

18. The method of claim 16 further comprising:

enabling or disabling a feature of the communication device based on the policy setting;

establishing a setting to control how the feature operates based on input from a user of the communication device, only if the feature is enabled with the policy setting.

19. The method of claim 16 wherein the policy setting includes a setting selected from the group consisting of:

a setting that specifies whether particular software applications or services can be installed and executed on the communication device, a setting that specifies whether a security password is required to access the communication device, a setting that specifies whether a user of the communication device can change the device configuration, a setting that enables a long term communication device timeout, a setting that enables communication device security password pattern checking, a setting that specifies a maximum communication device security password age, a setting that specifies a maximum security timeout period for the communication device, a setting that specifies a minimum length of a communication device security password, and a setting that specifies communication device owner information.