System and method of data security in synchronizing data with a wireless device

• US 8,429,128 B2
• Filed: 07/14/2011
• Issued: 04/23/2013
• Est. Priority Date: 10/28/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Good Technology Incorporated (Blackberry Limited)
• Inventors: Muratov, Alexander
• Primary Examiner(s): Trujillo, James
• Assistant Examiner(s): Chang, Jeffrey
• Application Number:
  US13/183,138
• Publication Number:
  US 20110270799A1
• Time in Patent Office: 649 Days
• Field of Search: 707/610, 707/634
• US Class Current: 707/634
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A system is disclosed. The system includes a server, a client application, and a first database. The first database is associated with the client application. The system further includes a second database to store data in an encrypted format, and a replicator to synchronize the data stored in the first and second databases. The system also includes a synchronizer to synchronize the data stored in the second database and the server based on a current security level.

Claims

1. A wireless device comprising:

a client application;

a first database configured to store data for access by the client application;

a second database to store data in an encrypted format;

a replicator to synchronize data stored in the first database with encrypted data stored in the second database; and

a synchronizer to synchronize the encrypted data stored in the second database with data stored by a server,

the wireless device being configured such that;

when the wireless device is operating in a first state, the synchronizer synchronizes the encrypted data stored in the second database with the data stored by the server, and the replicator synchronizes data stored in the first database with the encrypted data stored in the second database; and

when the wireless device is operating in a second state, different from the first state, the synchronizer synchronizes the encrypted data stored in the second database with the data stored by the server, and the wireless device is configured to restrict synchronization, by the replicator, of the data stored in the first database with the encrypted data stored in the second database.

2. The wireless device of claim 1, wherein, when the wireless device is operating in the second state, the wireless device is configured to restrict access by the client application to the data stored in the first database.

3. The wireless device of claim 1, wherein the data stored in the first database is deleted whenever the wireless device is operating in the second state.

4. The wireless device of claim 1, wherein the first database is disabled whenever the wireless device is operating in the second state.

5. The wireless device of claim 4, wherein the first database, second database, synchronizer, and replicator are disabled whenever the wireless device is operating in a third state, different to said first and second states.

6. The wireless device of claim 5, wherein the first, second, and third states correspond respectively to the following device modes:

an unlocked device mode, a locked/sync device mode, and a lock/emergency device mode.

7. The wireless device of claim 1, wherein the first and second states are characterized by different security levels of the wireless device and the wireless device is configured to change a current security level based on one or more of the following:

failed attempts to enter a password for the device exceeds a predetermined amount, occurrence of an attempted remote command via short message service (SMS), and detection of a network intrusion.

8. The wireless device of claim 1, wherein the synchronized data comprises data for processing by a personal information manager application.

9. A system comprising:

a server configured to store data; and

a wireless device communicatively coupled to the server, the wireless device including;

a client application;

a first database configured to store data for access by the client application;

a second database configured to store data in an encrypted format;

a replicator to synchronize the data stored in the first database with encrypted data stored in the second database; and

a synchronizer to synchronize the encrypted data stored in the second database with the data stored by the server,

the wireless device being configured such that;

when the wireless device is operating in a first security level, the synchronizer synchronizes the encrypted data stored in the second database with the data stored by the server, and the replicator synchronizes data stored in the first database with the encrypted data stored in the second database; and

when the wireless device is operating in a second security level, different from the first security level, the synchronizer synchronizes the encrypted data stored in the second database with the data stored by the server, and the wireless device is configured to restrict synchronization, by the replicator, of the data stored in the first database with the encrypted data stored in the second database.

10. A method of controlling access to data held on a wireless device, the wireless device comprising a first database and a second database, different from the first database, the second database being configured to store data in an encrypted format, the wireless device being capable of operating in a first security mode and a second, different, security mode, wherein, when operating in the first security mode, the wireless device synchronizes the data stored in the first database with encrypted data stored in the second database and synchronizes encrypted data stored in the second database with data stored by a server remote from the wireless device, the method comprising:

determining whether the wireless device is operating in the first security mode or the second security mode; and

responsive to a determination that the wireless device is operating in the second security mode, configuring the wireless device so as to restrict the synchronization of the data stored in the first database with the encrypted data stored in the second database, and to synchronize the encrypted data in the second database with data stored by said server.

11. The method of claim 10, further comprising:

responsive to a determination that the device is operating in the second security mode, configuring the wireless device to restrict access to data stored in the first database.

12. The method of claim 11, wherein:

the device comprises a client application and, when the device is operating in a first security mode, the data stored in the first database is accessible by the client application, and

the method comprises, responsive to a determination that the device is in the second security mode, restricting access by the client application to the data stored in the first database.

13. The method of claim 10, further comprising:

determining that the device is operating in a third security mode, different to said first and second security modes, and, responsive thereto,

interrupting the synchronization of the encrypted data stored in the second database with the data stored by the server.

14. The method of claim 10, wherein the determination that the device is operating in the second security mode is based on one or more of the following:

failed attempts to enter a password for the device exceeds a predetermined number, occurrence of an attempted remote command via short message service (SMS), and detection of a network intrusion.

15. The method of claim 10, further comprising erasing cipher keys associated with the encrypted data in the second database in response to determining that the device is operating in the second security mode.

16. The method of claim 10, wherein the device is coupled to the server via one of:

a wired network, and wireless network.

17. The method of claim 10, comprising, responsive to a determination that the device is in the second mode, deleting the data stored in said first database.

18. A non-transitory computer readable storage medium storing computer readable instructions thereon for execution on a wireless device to implement a method of controlling access to data stored thereon, the wireless device comprising a first database configured to store data and a second database, different from the first database, the second database being configured to store data in an encrypted form, the device being capable of operating in a first mode and a second, different, mode, wherein, when operating in the first mode, the device synchronizes the data stored in the first database with the encrypted data stored in the second database and synchronizes the encrypted data stored in the second database with data stored by a server remote from the wireless device,

the computer readable instructions, when executed on a processor of the wireless device, causing the processor to perform the method comprising:

receiving an indication of a change of mode from the first to the second mode; and

responsive to receipt of said indication, configuring the device so as to restrict synchronization of the data stored in the first database with the encrypted data stored in the second database, and to maintain said synchronization of the encrypted data stored in the second database with data stored by the remote server.

19. The non-transitory computer readable storage medium of claim 18, wherein the computer readable instructions, when executed on a processor of the wireless device, cause the processor, responsive to receipt of said indication, to restrict access to data stored in the first database.