Managing application execution and data access on a device

• US 8,656,016 B1
• Filed: 10/24/2012
• Issued: 02/18/2014
• Est. Priority Date: 10/24/2012
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited, QNX Software Systems Limited (Canada) (Blackberry Limited)
• Inventors: Bender, Christopher Lyle, Nagarajan, Sivakumar, Cho, Jung Hyun, Foy, Jason Paul
• Primary Examiner(s): Lazaro, David
• Application Number:
  US13/659,527
• Time in Patent Office: 482 Days
• Field of Search: 709/225, 726/1
• US Class Current: 709/225
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Some aspects of what is described here relate to managing application execution and data access on a mobile device. A request to access data is received from an application associated with a first perimeter on a device. The data is associated with a second, different perimeter on the device and has a data type. It is determined, based on the data type, that a management policy associated with the first perimeter permits the application to access the data independent of a second, different management policy assigned to the second perimeter. Based on the determining, the application is provided access to the data.

Claims

1. A method comprising:

configuring a first management policy associated with a first perimeter on a device to permit an application associated with the first perimeter to access a type of data associated with a second, different perimeter on the device, the first management policy being configured to permit access to the type of data independent of a second, different management policy associated with the second perimeter, the second management policy being configured to deny access to the data by applications not associated with the second perimeter.

2. The method of claim 1, comprising configuring the first management policy associated with the first perimeter to override the second management policy associated with the second perimeter.

3. The method of claim 1, further comprising associating the application with the first perimeter upon installing the application on the device.

4. The method of claim 1, further comprising associating the data with the second perimeter upon storing the data on the device.

5. The method of claim 1, further comprising configuring the first management policy associated with the first perimeter to permit applications associated with the first perimeter to access personal data on the device, and wherein the data includes work-related contact information.

6. The method of claim 5, wherein the application is a telephony application, and wherein the method further comprises:

receiving a request to access the work-related contact information from the telephony application; and

providing the requested work-related contact information.

7. The method of claim 1, wherein the first perimeter includes computing resources executable to control access to data within or outside the first perimeter by applications associated with the first perimeter, and wherein the second perimeter includes computing resources executable to control access to data associated with the second perimeter.

8. The method of claim 1, wherein the first management policy is configured to permit the application to access the type of data associated with the second perimeter while the second perimeter is locked.

9. The method of claim 1, wherein the first perimeter comprises a personal perimeter and the second perimeter comprises an enterprise perimeter.

10. A device comprising:

data processing apparatus operable to run an application associated with a first perimeter on the device; and

a computer-readable medium storing a first management policy associated with the first perimeter, the first management policy configured to permit the application to access a type of data associated with a second, different perimeter on the device, the first management policy configured to permit the application to access the type of data independent of a second, different management policy associated with the second perimeter, the second management policy being configured to deny access to the data by applications not associated with the second perimeter.

11. The device of claim 10, wherein the first management policy associated with the first perimeter is configured to override the second management policy and to permit the application to access the data.

12. The device of claim 10, the application being associated with the first perimeter upon installing the application on the device.

13. The device of claim 10, the data being associated with the second perimeter upon storing the data on the device.

14. The device of claim 10, the first management policy being configured to permit applications associated with the first perimeter to access personal data on the device, wherein the data includes work-related contact information.

15. The device of claim 14, wherein the application is a telephony application, and wherein the device is configured to:

receive a request to access the work-related contact information from the telephony application; and

provide the requested work-related contact information.

16. The device of claim 10, wherein the first perimeter includes computing resources executable to control access to data within or outside the first perimeter by applications associated with the first perimeter, and wherein the second perimeter includes computing resources executable to control access to data associated with the second perimeter.

17. The device of claim 10, wherein permitting the application to access the type of data includes providing the application access to the type of data associated with the second perimeter while the second perimeter is locked.

18. A non-transitory computer-readable medium storing instructions executable by data processing apparatus to perform operations comprising:

configuring a first management policy associated with a first perimeter on a device to permit an application associated with the first perimeter to access a type of data associated with a second, different perimeter on the device, the first management policy being configured to permit access to the data independent of a second, different management policy associated with the second perimeter, the second management policy being configured to deny access to the data by applications not associated with the second perimeter.

19. The medium of claim 18, the operations comprising configuring the first management policy associated with the first perimeter to override the second management policy.

20. The medium of claim 18, the operations further comprising associating the application with the first perimeter upon installing the application on the device.

21. The medium of claim 18, the operations further comprising associating the data with the second perimeter upon storing the data on the device.

22. The medium of claim 18, the operations further comprising configuring the first management policy associated with the first perimeter to permit applications associated with the first perimeter to access personal data on the device, and wherein the data includes work-related contact information.

23. The medium of claim 22, wherein the application is a telephony application, and wherein the operations further comprise:

receiving a request to access the work-related contact information from the telephony application; and

providing the requested work-related contact information.

24. The medium of claim 18, the operations comprising providing the application access to the type of data associated with the second perimeter while the second perimeter is locked.