System and method for secure control of resources of wireless mobile communication devices

• US 9,998,466 B2
• Filed: 07/11/2016
• Issued: 06/12/2018
• Est. Priority Date: 08/19/2002
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Blackberry Limited
• Inventors: Owen, Russell Norman, Little, Herbert Anthony, Yach, David Paul, Shenfield, Michael
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/207,140
• Publication Number:
  US 20160323285A1
• Time in Patent Office: 701 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/086 using security domains

Abstract

Systems and methods for secure control of a wireless mobile communication device are disclosed. Each of a plurality of domains includes at least one wireless mobile communication device asset. When a request to perform an operation affecting at least one of the assets is received, it is determined whether the request is permitted by the domain that includes the at least one affected asset, by determining whether the entity with which the request originated has a trust relationship with the domain, for example. The operation is completed where it is permitted by the domain. Wireless mobile communication device assets include software applications, persistent data, communication pipes, and configuration data, properties or user or subscriber profiles.

Claims

1. A method comprising:

storing corporate data and other data on a wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device;

receiving, from a software application, a request to access the corporate data; and

controlling access, using a security firewall, to the corporate data based on whether the corporate data is digitally signed using a private key, wherein the corporate data that is digitally signed is verified using a corresponding public key.

2. The method of claim 1, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

3. The method of claim 2, wherein the corporate domain and the personal domain are secure domains.

4. The method of claim 1, further comprising determining whether the software application is in the corporate domain by using a cryptographic key from a key store.

5. The method of claim 1, further comprising:

receiving information; and

determining whether to assign the information to the corporate domain based upon a domain policy.

6. The method of claim 5, wherein the domain policy specifies that the information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, or an input from the user of the wireless communication device.

7. The method of claim 1, wherein the corporate data includes a signed software application.

8. A wireless communication device, comprising:

at least one memory storing corporate data and other data on the wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device; and

a controller configured to;

receive, from a software application, a request to access the corporate data; and

control access to the corporate data, using a security firewall, based on whether the corporate data is digitally signed using a private key, wherein the corporate data that is digitally signed is verified using a corresponding public key.

9. The wireless communication device of claim 8, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

10. The wireless communication device of claim 9, wherein the corporate domain and the personal domain are secure domains.

11. The wireless communication device of claim 8, wherein the controller is further configured to determine whether the software application is in the corporate domain by using a cryptographic key from a key store.

12. The wireless communication device of claim 8, wherein the controller is further configured to:

receive information; and

determine whether to assign the information to the corporate domain based upon a domain policy.

13. The wireless communication device of claim 12, wherein the domain policy specifies that the information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, or an input from the user of the wireless communication device.

14. A non-transitory computer readable medium, comprising program code executable by a processor such that when executed, cause a wireless communication device to:

store corporate data and other data on the wireless communication device, wherein the corporate data is stored in a corporate domain of the wireless communication device and the other data is not stored in the corporate domain, wherein the corporate data is controlled by a corporate entity and the other data is controlled by a user of the wireless communication device;

receive, from a software application, a request to access the corporate data; and

control access, using a security firewall, to the corporate data based on whether the corporate data is digitally signed using a private key, wherein the corporate data that is digitally signed is verified using a corresponding public key.

15. The non-transitory computer readable medium of claim 14, wherein the other data comprises personal data of the user of the wireless communication device, and wherein the personal data is stored in a personal domain of the wireless communication device.

16. The non-transitory computer readable medium of claim 15, wherein the corporate domain and the personal domain are secure domains.

17. The non-transitory computer readable medium of claim 14, wherein the program code is further configured to determine whether the software application is in the corporate domain by using a cryptographic key from a key store.

18. The non-transitory computer readable medium of claim 14, wherein the program code is further configured to:

receive information; and

determine whether to assign the information to the corporate domain based upon a domain policy.

19. The non-transitory computer readable medium of claim 18, wherein the domain policy specifies that the information should be associated with the corporate domain based upon any one or more of the following including any combination thereof:

a source of the information, a digital signature of the information, an access list describing allowed domain information, or an input from the user of the wireless communication device.

20. The non-transitory computer readable medium of claim 14, wherein the corporate data includes a signed software application.