Privilege management and revocation

• US 9,734,308 B2
• Filed: 03/07/2016
• Issued: 08/15/2017
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Little, Herbert Anthony
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US15/063,019
• Publication Number:
  US 20160188847A1
• Time in Patent Office: 526 Days
• Field of Search: None
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure relates to management of privileges associated with applications accessible by users of electronic devices. In one aspect, an electronic device detects that a privilege has been revoked, shuts down any application running on the electronic device that has previously accessed the privilege, and restarts any application that was shut down, the restarted application no longer having any access to the revoked privilege. In another aspect, an electronic device keeps a log of which applications have previously accessed which privileges, receives a new set of privileges associated with applications, determines that a privilege has been revoked, and if the log indicates that an application previously accessed the privilege, resets the electronic device. In a further aspect, a method sets privileges associated with applications, records which electronic devices have which applications, revokes a privilege, and instructs those electronic devices having applications to which the privilege is associated to reset themselves.

Claims

1. A method performed by an electronic device, the method comprising:

tracking which applications on the electronic device have previously accessed which privileges;

detecting at the electronic device that a privilege has been revoked;

automatically shutting down any application running on the electronic device that has previously accessed the privilege, responsive to detecting that the privilege has been revoked; and

automatically restarting any application that was shut down, the restarted application no longer having any access to the revoked privilege.

2. The method as recited in claim 1, wherein detecting that the privilege has been revoked comprises receiving via a communication interface of the electronic device an information technology (IT) policy specifying that the privilege has been revoked.

3. The method as recited by claim 1, wherein the privilege comprises allowing an application to use inter-process communication.

4. The method as recited by claim 1, wherein the privilege comprises enabling opening of internal and external connections.

5. The method as recited by claim 1, wherein the privilege comprises enabling use of communication tools.

6. The method as recited by claim 1, wherein the privilege comprises enabling use of personal information management functionality.

7. The method as recited by claim 1, wherein the privilege comprises enabling use of an application program interface.

8. An electronic device comprising a processor configured to:

track which applications on the electronic device have previously accessed which privileges;

detect at the electronic device that a privilege has been revoked;

automatically shut down any application running on the electronic device that has previously accessed the privilege, responsive to detecting that the privilege has been revoked; and

automatically restart any application that was shut down, the restarted application no longer having any access to the revoked privilege.

10. The electronic device as recited in claim 8, wherein the privilege comprises allowing an application to use inter-process communication.

11. The electronic device as recited in claim 8, wherein the privilege comprises enabling opening of internal and external connections.

12. The electronic device as recited in claim 8, wherein the privilege comprises enabling use of communication tools.

13. The electronic device as recited in claim 8, wherein the privilege comprises enabling use of personal information management functionality.

14. The electronic device as recited in claim 8, wherein the privilege comprises enabling use of an application program interface.

9. A non-transitory computer-readable medium storing instructions which, when executed by a processor of an electronic device, result in:

tracking which applications on the electronic device have accessed which privileges;

detecting at the electronic device that a privilege has been revoked;

automatically shutting down any application running on the electronic device that has previously accessed the privilege, responsive to detecting that the privilege has been revoked; and

automatically restarting any application that was shut down, the restarted application no longer having any access to the revoked privilege.

15. The non-transitory computer-readable medium as recited in claim 9, wherein the privilege comprises allowing an application to use inter-process communication.

16. The non-transitory computer-readable medium as recited in claim 9, wherein the privilege comprises enabling opening of internal and external connections.

17. The non-transitory computer-readable medium as recited in claim 9, wherein the privilege comprises enabling use of communication tools.

18. The non-transitory computer-readable medium as recited in claim 9, wherein the privilege comprises enabling use of personal information management functionality.

19. The non-transitory computer-readable medium as recited in claim 9, wherein the privilege comprises enabling use of an application program interface.