Blackberry Corporation

Research in Motion Corporation

2236008 Ontario Limited

Huawei Technologies Co., Limited

Certicom Corporation

Qnx Software Systems Limited

Christopher Lyle Bender

Michael Kenneth Brown

Herbert Anthony Little

Michael Grant Kirkup

Neil Patrick Adams

Michael S Brown

Brian Alexander Zubert

Oliver Whitehouse

Radu Alexandru Manea

Sivakumar Nagarajan

Roger Paul Bowman

Scott Douglas Rose

Geordon Thomas Ferguson

Christopher William Lewis Hobbs

Alberto Daniel Zubiri

Kenneth Cyril Schneider

Jason Tyler Griffin

Steven Henry Fyke

David Ryan Walker

Van Quy Tu

Daniel Jonas Major

Graham Russell

Santiago Carbonell Duque

Sam Cheng-Fu Shih

Natalie Michelle Silvanovich

Daryl Joseph Martin

Ian M Robertson

Vahid Moosavi

Robert Henderson Wood

Alexander Truskovsky

David Bukurak

Alan Pak-Lun Ho

Chi Chiu Tse

Michael Thomas Winkler

Timothy Lee Segato

Christopher Maybee Ryerson

Benjamin Altman

Jonathan Raymond Cardy

Casey Vandeputte

Mark A McConnaughay

Jung Hyun Cho

Jason Paul Foy

Andrew Robert Turi

Michael Stephen Brown

Michael Peter Montemurro

Jerome Pasquero

Robert John Lambert

Ravi Singh

Lawrence Edward Kuhl

James Andrew Godfrey

Alexander Sherkin

Scott William Totzke

Kevin John Oerton

Jeremy Lawson Kominar

Colin Mark Werner

Nikhil Vats

Connor Patrick O'Rourke

Shivangi Anantrupa Gandhi

Srdan Dikic

Eli Omen Jackson

John Vincent Storozuk

Marius Bozsitz

Alexandru-Radu Manea

Lee Willis Manchur

John Vincent Stotozuk

Christopher William Hobbs

Connor Patrick O'rourke

Ian Michael Robertson

Casey Jonathan Vandeputte

Stephen Henry Fyke

Mark A Mcconnaughay

Marius Calin Bozsitz

Lee Manchur

Andrew R Turi

A communication device and corresponding methods are provided. The device includes a display screen upon which information is displayed. A microprocessor configured to execute at least one notification program is provided that displays a notification descriptive of an access control request on the display screen. The at least one notification program is programmed to receive data indicative of an access control request and to receive data descriptive of the access control request. Additionally, the at least one notification program is further programmed to display a notification indicative of the access control request and comprising an explanation of the access control request based on the received descriptive data.

Notification of access control request and explanation indicative of the access control request on a communication device

A method and apparatus for controlling access to encrypted data is provided. The device comprises: a processor and a memory, the processor configured to: control access to encrypted data, stored at the memory, the encrypted data categorized according to a plurality of categories, using a respective encryption key for each category in the plurality of categories; and, control access to a given encryption key according to given criteria associated with a given category, respective criteria different for each respective category, access to the given encryption key including one or more of, when the respective criteria are met, generating the given encryption key and decrypting the given encryption key.

Method and apparatus for controlling access to encrypted data

A method at a communication device, comprising: receiving an access control request from an executing program on the communication device; displaying a notification on a display screen of the communication device, in response to receiving the access control request, wherein the notification comprises at least three selectable items and one explanation that describe a proposed setting change related to the access control request; and the at least three selectable items comprise: a first selectable item, used to grant the proposed setting change in response to a selection of the first selectable item; a second selectable item, used to deny the proposed setting change in response to a selection of the second selectable item; and a third selectable item, used to display one further explanation in response to a selection of the third selectable item.

Some aspects of what is described here relate to managing the use of network resources on a mobile device. User input received at the device indicates whether to allow an application associated with a first perimeter on the device to access a network resource associated with a second perimeter on the device. For example, in some instances user input may indicate whether to allow data from applications associated with a personal perimeter on the device to be transmitted over an enterprise communication system. When outbound data associated with the first perimeter are received, the device determines, according to the indication from the user input, whether to route the outbound data to the network resource associated with the second perimeter.

Managing use of network resources

In some implementations, a method of managing access to resources in a single device including receiving, from a first resource assigned to a first perimeter, a request to access a second resource assigned to a second perimeter different from the first perimeter. The single device includes the first perimeter and the second perimeter. Whether access to the second resource is prohibited is determined based on a management policy for the first perimeter. The management policy defining one or more rules for accessing resources assigned to the second perimeter including the second resource.

Managing access to resources

A communication device includes a display screen upon which information is displayed. A microprocessor configured to execute at least one notification program is provided that displays a notification descriptive of an access control request on the display screen. The at least one notification program is programmed to receive data indicative of an access control request and to receive data descriptive of the access control request. Additionally, the at least one notification program is further programmed to display a notification indicative of the access control request and comprising an explanation of the access control request based on the received descriptive data.

In some implementations, a method includes receiving, from a user of a first device, a request to enable access, through a second device, to a server resource account of an enterprise. The first device includes a first enterprise perimeter including an internal resource and a first enterprise identifier and configured to prevent external resources from accessing the internal resource. A request is wirelessly transmit, to the second device, to the second device for a second enterprise identifier assigned to a second enterprise perimeter included in the second device. Whether to grant access to the internal resource is determined based on a first enterprise identifier assigned to the first device and a second enterprise identifier assigned to the second device.

Associating services to perimeters

A mobile communication device causes a communication session to be established with a host server of a communication network. The mobile device performs communication operations in the communication session for activating a communication service, such as a data synchronization service, with the host server. In the communication session, the mobile device also receives configuration information which includes information for use in constructing a request message for obtaining a digital certificate from a certificate authority (CA). After receipt of the configuration information, the mobile device constructs the request message for the digital certificate and causes it to be sent to the host server. In response, the host server requests and obtains the digital certificate from the CA on behalf of the mobile device, and thereafter 'pushes' the received digital certificate to the mobile device. The mobile device receives the digital certificate and stores it for use in subsequent communications.

Methods and apparatus for use in enabling a mobile communication device with a digital certificate

A method for differentiated access control on a computing device having a connection with a second device, the method checking whether a timer has expired on the second device or if a connection is lost to the second device; and preventing at least one of the plurality of application subsets from being launched or enabled if the timer has expired on the second device or the connection is lost to the second device.

Method and apparatus for differentiated access control

A computing device and a method for a computing device to control access to data stored on a data store of the device. An access component of the device having control over access to the data. The access component being operative to receive a request for data from a requesting component, identify an assigned access domain of the requesting component and an assigned data domain of the requested data and determine whether the requesting component is authorized to access the data by comparing the assigned access domain and the data domain with permissions specified in a security policy. If the assigned access domain is authorized to access the data domain, the access component may provide access to the requested data.

Data source based application sandboxing

In one illustrative scenario, a mobile communication device causes a communication session to be established with a host server of a communication network. The mobile device performs communication operations in the communication session for activating a communication service, such as a data synchronization service, with the host server. In the communication session, the mobile device also receives configuration information which includes information for use in constructing a request message for obtaining a digital certificate from a certificate authority (CA). After receipt of the configuration information, the mobile device constructs the request message for the digital certificate and causes it to be sent to the host server. In response, the host server requests and obtains the digital certificate from the CA on behalf of the mobile device, and thereafter 'pushes' the received digital certificate to the mobile device. The mobile device receives the digital certificate and stores it for use in subsequent communications. The host server may be part of a local area network (LAN) which includes a wireless LAN (WLAN) adapted to authenticate the mobile device based on the digital certificate, so that the mobile device may obtain access to the WLAN.

In some implementations, a method for managing data in a user device includes pushing first metadata for a first resource in a first perimeter to a service external to the first perimeter. The first perimeter is configured to prevent external resources from accessing resources in the first perimeter. Second metadata for a second resource in a second perimeter is pushed to the external service. The external service is external to the second perimeter, the second perimeter being configured to prevent external resources from accessing resources in the second perimeter. Information is presented to the user based on a combination of the first metadata and the second metadata.

Presenting metadata from multiple perimeters

There is provided a method and apparatus for resetting a password for a device or managing the device, the device having an encryption perimeter. A device shares a public/private key pair with a server, the public key being on the device and the private key being on the server. An intermediate value is encrypted on the mobile device using the public key. If the password is lost or the device needs to be managed, the server can request the encrypted intermediate value, decrypt it, and send the decrypted value to the mobile device which may then resume operations. A new password may be provided by the server or the user may set a new password once the encryption key is recreated from the decrypted intermediate value.

Key management on device for perimeters

Growing community of inventors

Kitchener, Canada

Christopher Lyle Bender