Blackberry Corporation

2236008 Ontario Limited

Nvidia Corporation

Research in Motion Corporation

Malikie Innovations Limited

Daniel Jonas Major

Sivakumar Nagarajan

Kevin Goodman

Neil Patrick Adams

Ravi Singh

Christopher Lyle Bender

Van Quy Tu

Adam Richard Schieman

Michael Anthony Carrara

Kevin Dennis Goodman

Mark Alan Overby

Geordon Thomas Ferguson

Jonathan Raymond Cardy

David Francis Tapuska

Michael George Langlois

Dinah Lea Marie Davis

Glenn Daniel Wurster

Danny Thomas Dodge

Oliver Whitehouse

Robert David Turner

Srdan Dikic

Eli Omen Jackson

Calin Marius Bozsitz

Ian David Peters

Katherine Evelyn Kalles

Michael Alievsky

Dinah Lea Davis

Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Token-based zero-touch enrollment for provisioning edge computing applications

Systems, methods, and software can be used to manage resource access. In some aspect, a user interface is outputted on an electronic device. The user interface includes information for resource access and a user interface object for controlling a resource access permission. A user input associated with the user interface object is received. In response to receiving the user input, the resource access permission is changed.

Managing resource access

A method of applying information on the display of the electronic device includes displaying content elements associated with an application running on the electronic device on a display of the electronic device, receiving a selection of a content element associated with the application running on the electronic device, determining an identity profile having an associated key, encrypting information associated with the selected content element utilizing the key associated with the determined identity profile to generate encrypted information, displaying the encrypted information in the selected content element.

Electronic device including display and method of encrypting and decrypting information

A method for administering multiple management agents on a mobile device, the method receiving, at a policy manager on the mobile device, a policy from each of the multiple management agents; determining a current state of the mobile device; and consolidating the policies based on rules within the policy manager and the current state of the mobile device.

Method and system for administering multiple domain management authorities on a mobile device

A method at a computing device having a plurality of concurrently operative operating systems, the method comprising: operating a proxy process within a target operating system on the computing device; receiving, from an originating operating system, a request for resources from a target process within the target operating system at the proxy process; requesting, from the proxy process, the resources of the target process; and returning a handle to the target process from the proxy process to the originating operating system.

System and method for coordinating process and memory management across domains

Described are a method and system of authorizing software execution on a computing device having a processor, the device storing a production key associated with software authorized for end-user release and storing a pre-release key associated with software not authorized for end-user release. The method includes determining that a signed software image is not signed with the production key; determining that the device has stored in memory thereon a pre-release token, the pre-release token containing data uniquely identifying the device and identifying the pre-release key; validating the pre-release token; and authenticating the signed software image using the pre-release key and, in response, permitting execution of the software image.

Token-based control of software installation and operation

A computing device and a method for a computing device to control access to data stored on a data store of the device. An access component of the device having control over access to the data. The access component being operative to receive a request for data from a requesting component, identify an assigned access domain of the requesting component and an assigned data domain of the requested data and determine whether the requesting component is authorized to access the data by comparing the assigned access domain and the data domain with permissions specified in a security policy. If the assigned access domain is authorized to access the data domain, the access component may provide access to the requested data.

Data source based application sandboxing

An electronic device may maintain separate OS domains associated with security permissions. The OS domain may implement separate corresponding clipboard services. A clipboard agent or clipboard mediator service may receive a clipboard data request from a first application. The clipboard agent may determine which OS domain has most recently processed a store command associated with storing data in a corresponding clipboard service of the OS domain. The clipboard agent associated with the OS domain that most recently stored content may determine whether to send the data from the corresponding clipboard service based at least in part on permissions associated with the OS domain. Security of the clipboard access may be enforced on a per domain basis. Access to clipboard content may be mediated at the time of the request without a need to share data prior to the request.

Cross-domain data sharing with permission control

A method at a mobile device for creating a managed domain on the mobile device, the method initializing a container on the mobile device to house the managed domain; retrieving, from the mobile device, a management agent for the management domain; establishing policies to govern the creation of the managed domain; and configuring the container for the domain based on the established policies.

Method and system for domain creation and bootstrapping

Information is shared between processing entities that each have a corresponding private data area by placing data corresponding to information for a first one of the private data areas for a first one of the processing entities directly into a second one of the private data areas for a second one of the processing entities without placing the data in an intervening shared data area and without directly invoking a system administrator-like entity. In addition, these private data areas can be pre-populated with a plurality of directories that each have a one-to-one correspondence to a particular predetermined information recipient and then providing a link to a given one of the recipients as corresponds to a given one of the directories when information is placed in that directory to provide the corresponding predetermined information recipient with at least read access to the information.

Method and apparatus pertaining to sharing information via a private data area

A method at a computing device having a plurality of concurrently operating domains for providing a unified home screen, the method sending a request for package information from a home screen application on the computing device; receiving the request for package information at a unified package manager on the computing device; requesting, from the plurality of concurrently operating domains, package information; receiving package information from at least one of the plurality of concurrently operating domains at the unified package manager on the computing device; decorating the received package information with domain information for a domain from which the package information was received at the unified package manager on the computing device; and providing the decorated package information to the home screen application.

System and method for unifying the listing and launching of applications and packages spread across multiple domains

A method of preventing observation of password entry on an electronic device is provided. The electronic device has a processor coupled to a camera, a display, and a memory. The method comprises activating the camera to acquire an image when the electronic device is in a password entry mode; detecting one or more faces present in the image; and presenting a warning when more than one face is present in the image.

System and method for preventing observation of password entry using face detection

Systems, methods, and software can be used to share data across profiles. In some aspects, a first request from a first application for application data associated with a second application is received at a first hybrid agent. The first application and the first hybrid agent are associated with a first profile on a mobile device. The second application is associated with a second profile. A second request for the application data is sent to a second hybrid agent. The second hybrid agent is associated with the second profile. The application data from the second hybrid agent is received from the second hybrid agent. The application data is sent to the first application. The application data is used by the first application to generate a graphical interface for presentation on the mobile device. The graphical interface includes a unified view of data associated with the first and second profiles.

Sharing data across profiles

A device and its operations are described herein. In some examples, the operations can include executing a first application within a first operating system domain of a device, the first application associated with at least a first activity view. The operations can further include detecting user input associated with the first application. The user input is associated with activating a second activity view of a second application. The operations can further include determining that the second application corresponds to a second operating system domain of the device. The operations can further include establishing a first proxy link within the first operating system domain that corresponds with a second proxy link within the second operating system domain. The first proxy link is associated with causing the second proxy link to invoke the second activity view of the second application within the second operating system domain.

Growing community of inventors

Ottawa, Canada

Daniel Jonas Major