Blackberry Corporation

Good Technology, Inc.

Visto Corporation

Good Technology Holdings Limited

Malikie Innovations Limited

Sean Michael Quinlan

Haniff Somani

Sanjiv Maurya

Daniel J Mendez

Mason Ng

Mark D Riggins

David I Cowan

Prasad Wagle

Christine C Ying

Peter Barker

R Stanley Bailes

Joanna A Aptekar-Strober

Christopher R Zuleeg

Hong Q Bui

Siavash James Joorabchian Hawkins

Kevin Charles Lohman

Yuri Ardulov

Rajiv Joshi

Nicholas B Van Someren

Balasubrahmanyam Gattu

Jing Zhu

Phillip Riscombe-Burton

David M Schmidt

Mendel Elliot Spencer

Bob Standen

Luis Chirinos

Gary Gilchrist

Saul Kessler

Matt Williams

Daniel I Mendez

Nigel Thompson

Hong O Bui

Sreedhar Annamalai

Adrian Satmarel

Alibek Jorajev

Martin Cheng, Jr

Tom Ruan

David J Cowan

Nicholas Van Someren

Peter Maximilian Barker

Nicholas Benedict Van Someren

Daniel Mendez

Joannna A Aptekar-Strober

Matt O Williams

Systems, methods, and software can be used to perform a two-factor authentication. In some aspects, a method includes: receiving, by an electronic device from a device authentication server, a two-factor authentication (2FA) token; transmitting, by the electronic device to an identity provider (IDP), an authentication request for a 2FA operation, wherein the authentication request comprises the 2FA token; receiving, by the electronic device from the IDP, an authentication response; and determining, by the electronic device, whether the 2FA operation succeeds based on the authentication response.

Two-factor authentication for a shared device

A method, system and computer-readable storage medium for controlling access to application data associated with an application configured on a computing device. The method comprises: storing data comprising, for each of a plurality of access levels associated with the application, first data indicative of a combination of one or more credentials associated with the respective access level and an access level key corresponding to the respective access level, the access level key being encrypted by the combination of one or more credentials associated with the respective access level; determining, based on the first data, an access level in the plurality of access levels corresponding to a combination of one or more credentials available to the application; decrypting the access level key in the stored data corresponding to the determined access level using the combination of one or more credentials available to the application; and providing access to encrypted application data associated with the application and corresponding to the determined access level using, at least in part, the decrypted access level key corresponding to the determined access level.

Controlling access to application data

Systems, methods, and software can be used to handle security events of a device based on remediation actions and recovery actions. In some aspects, a method comprises: receiving, by a security gateway, a security event notification associated with a device; determining, by the security gateway and based on the security event notification, a risk level of the device; determining, by the security gateway and based on the risk level, a set of remediation actions and recovery actions; and sending, by the security gateway, an action plan indicating the set of remediation actions and recovery actions.

Handling security events based on remediation actions and recovery actions

Methods for remotely configuring application software on a user device are described. The application software defines at least one operating parameter having a set of pre-defined values which change the way the application interacts with the operating system. The operating parameter can be configured remotely and pushed to the user device where it is enforced by the application. Methods for providing information of the operating parameter to a remote device and for updating the configuration of an application are also described.

Methods for remote configuration of software applications

A method for monitoring user activity in respect of a plurality of applications on a computing device. The method comprises storing, by a first application running on the computing device, a first timestamp indicating the time that user activity was last detected with respect to the first application. The first application receives a message from a second application running on the computing device. The message comprises a second timestamp indicating the time that user activity was last detected with respect to the second application. The first application updates the first timestamp based on the second timestamp when the time indicated by the second timestamp is later than the time indicated by the first timestamp. Thus, user activity across the plurality of application can be monitored, such that an inactivity timer running on a particular application in the group of applications can account for user activity with respect to the other application in the plurality.

Monitoring user activity

A method of managing a plurality of applications on a computing device. The method comprises receiving, by a first application running on the computing device, a lock message comprising a timestamp and a digital signature associated with the timestamp, from a second application miming on the computing device. Upon receipt of the lock message, the first application verifies the digital signature to confirm the authenticity of the timestamp. Once the timestamp has been confirmed by the first application, the first application locks the first application. Accordingly, a lock event with respect to an application in the plurality of applications can be propagated to other applications in the plurality of applications.

Shared lock state

A method, system and computer-readable storage medium for controlling access to application data associated with an application configured on a computing device. The method comprises: storing data comprising, for each of a plurality of access levels associated with the application, first data indicative of a combination of one or more credentials associated with the respective access level and an access level key corresponding to the respective access level, the access level key being encrypted by the combination of one or more credentials associated with the respective access level; determining, based on the first data, an access level in the plurality of access levels corresponding to a combination of one or more credentials available to the application; decrypting the access level key in the stored data corresponding to the determined access level; and providing access to encrypted application data associated with the application and corresponding to the determined access level.

Embodiments of the invention are concerned with facilitating service provision between software applications. In embodiments of the invention, a first user terminal includes an application which causes the first user terminal to delegate execution of a first service to a different application. In response to determining that the first service is to be executed on behalf of the first service, a request message is sent to a data store including an identifier of the first service. The data store comprising entries indicating applications held on one or more user terminals, and indicating one or more services that may be executed, on request, by a corresponding application. The first user terminal receives a response message from the data store identifying one or more applications to which execution of the first service may be delegated.

Systems and methods for facilitating service provision between applications

Devices and methods for managing a network communication channel are provided. The electronic device is configured to determine a list of available intermediate servers for establishing a network communication channel between the electronic device and an enterprise entity. The electronic device generates a list of aggregate round trip times. The list of aggregate round trip times include an aggregate round trip time associated with each intermediate server in the list of available intermediate servers. Each aggregate round trip time includes a front end round trip time and a back end round trip time. The electronic device selects one of the intermediate servers based on the list of aggregate round trip times and establishes the network communication channel using the selected intermediate server.

Devices and methods for managing a network communication channel between an electronic device and an enterprise entity

A method and system for negotiating a secure device-to-device communications channel between a first computing device and a second computing device, wherein the first computing device is associated with a first user and the second computing device is associated with a second user. The method comprises receiving, at a server, a first connection request comprising first address data and a first cryptographic key associated with the first computing device, the first connection request being received over a first secure communications channel, and receiving, at the server, a second connection request comprising second address data and a second cryptographic key associated with the second computing device, the second connection request being received over a second secure communications channel.

Secure communication channels

A system and method for provisioning a push notification session via a communications network between an application on a client terminal and a server corresponding to the application. In one aspect, a push provisioning entity transmits a message to the client terminal, whereby to configure the client terminal into a state in which it is able to request a push notification session with the server. An application on the client terminal can then request establishment of a push notification session by transmitting a push notification session request message to the push provisioning entity. The push provisioning entity generates a token for use in validating the push notification session, associates the generated token with the application and transmits the token to the application, which uses it to establish the push notification session.

Method, apparatus and system for provisioning a push notification session

Methods and systems for managing access to a resource by one of a plurality of applications. The method comprises: storing, in a first storage area associated with a first application, a first credential for use in accessing the resource; receiving, at a second application, a message comprising data for determining that the first application stores a validated credential for accessing the resource; sending a request for the validated credential from the second application to the first application; receiving the first credential at the second application from the first application in response to the request sent; and storing the first credential in a second storage area associated with the second application; wherein the message received at the second application is received from a server system, remote from the plurality of applications, which maintains data indicating a subset of the plurality of applications which store respective validated credentials for accessing the resource.

Managing access to resources

Growing community of inventors

Duvall, WA, United States of America

Sean Michael Quinlan