Certificate management method based on connectivity and policy

• US 9,294,470 B2
• Filed: 11/18/2014
• Issued: 03/22/2016
• Est. Priority Date: 02/17/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Bender, Christopher Lyle, Storozuk, John Vincent, Ho, Alan Pak-Lun, Tse, Chi Chiu
• Primary Examiner(s): Traore, Fatoumata
• Assistant Examiner(s): DOLLY, KENDALL LYNN
• Application Number:
  US14/546,286
• Publication Number:
  US 20150074754A1
• Time in Patent Office: 490 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Plural modes of operation may be established on a mobile device. Specific modes of operation of the mobile device may be associated with specific spaces in memory. By associating the existing certificate store structure and key store structure with a mode of operation, certificates and keys can be assigned to one space among plural spaces. Furthermore, management (viewing/importation/deletion) of certificates associated with specific modes of operation may be controlled based on the presence or absence of a mobile device administration server and the status (enabled/disabled) of an IT policy.

Claims

1. A method of regulating population of a certificate store in a memory of a device, the method comprising:

determining that a device administration server is present;

determining that an information technology policy is enabled; and

responsive to the determining that the device administration server is present and that an information technology policy is enabled, disabling user interface interaction, on the device, for importing certificates into a certificate store associated with a portion of memory of the device.

2. The method of claim 1 further comprising:

receiving a certificate pushed to the device; and

saving the certificate to the certificate store associated with the portion of memory of the device.

3. The method of claim 1 further comprising, responsive to the determining that a device administration server is present and that an information technology policy is enabled, disabling user interface-based selection for deleting certificates from the certificate store associated with the portion of memory of the device.

4. The method of claim 1 further comprising, before the determining:

receiving a command to create the certificate store associated with the portion of memory of the device; and

initializing the certificate store in the memory of the device.

5. The method of claim 1 further comprising allowing addition of a certificate associated with a private key.

6. The method of claim 5 wherein the certificate is associated with the private key in a file.

7. The method of claim 6 wherein the file has a format defined in a Public-Key Cryptography Standard.

8. A communication device comprising:

a memory;

a processor adapted to;

determine that a device administration server is present;

determine that an information technology policy is enabled; and

disable, responsive to the determining that the device administration server is present and that an information technology policy is enabled, user interface interaction, on the device, for importing certificates into a certificate store associated with a portion of memory of the device.

9. The communication device of claim 8 wherein the processor is further adapted to:

receive a certificate pushed to the device; and

save the certificate to the certificate store associated with the portion of memory of the device.

10. The communication device of claim 8 wherein the processor is further adapted to disable user interface-based selection for deleting certificates from the certificate store associated with the portion of memory of the device.

11. The communication device of claim 8 wherein the processor is further adapted to:

receive a command to create the certificate store associated with the portion of memory of the device; and

initialize the certificate store in the memory of the device.

12. The communication device of claim 8 wherein the processor is further adapted to allow addition of a certificate associated with a private key.

13. The communication device of claim 12 wherein the certificate is associated with the private key in a file.

14. The communication device of claim 13 wherein the file has a format defined in a Public-Key Cryptography Standard.

15. A non-transitory computer-readable information recording medium containing computer-executable instructions that, when performed by a processor in a communication device, cause said processor to:

determine that a device administration server is present;

determine that an information technology policy is enabled; and

disable, responsive to the determining that the device administration server is present and that an information technology policy is enabled, user interface interaction, on the device, for importing certificates into a certificate store associated with a portion of memory of the device.

16. The computer-readable information recording medium of claim 15 wherein the instructions further cause the processor to:

receive a certificate pushed to the device; and

save the certificate to the certificate store.

17. The computer-readable information recording medium of claim 15 wherein the instructions further cause the processor to disable user interface-based selection for deleting certificates from the certificate store associated with the portion of memory of the device.

18. The computer-readable information recording medium of claim 15 wherein the instructions further cause the processor to:

receive a command to create the certificate store associated with the portion of memory of the device; and

initialize the certificate store in the memory of the device.

19. The computer-readable information recording medium of claim 15 further comprising allowing addition of a certificate associated with a private key.

20. The computer-readable information recording medium of claim 19 wherein the certificate is associated with the private key in a file.