Blackberry Corporation

2236008 Ontario Limited

Qnx Software Systems Limited

Blackberry Limited; 2236008 Ontario Inc.

8758271 Canada Inc.

Sivakumar Nagarajan

Daniel Jonas Major

Christopher Lyle Bender

Kevin Goodman

Ravi Singh

Kevin Dennis Goodman

Thomas Leonard Trevor Plestid

Roger Paul Bowman

Peter Steven Pieda

Pierre Pierre Blais

Timothy Lee Segato

Barry Fraser Yerxa

Kevin Paul Fernandes

Srdan Dikic

Mark De Abreu

Jason Paul Foy

Jung Hyun Cho

Martello Michealangelo Jones

Mark A McConnaughay

Ryan John Waters

Darrell Reginald May

Geordon Thomas Ferguson

Danny Thomas Dodge

Alan Pak-Lun Ho

Chi Chiu Tse

Adam Richard Schieman

Carl Lloyd Cherry

Michael Jonathan Mueller

Daniel Cardamore

Calin Marius Bozsitz

Thomas Leonard Plestid

Marius Bozsitz

Mark David De Abreu

Mark A Mcconnaughay

Marius Calin Bozsitz

A method and apparatus for controlling access to encrypted data is provided. The device comprises: a processor and a memory, the processor configured to: control access to encrypted data, stored at the memory, the encrypted data categorized according to a plurality of categories, using a respective encryption key for each category in the plurality of categories; and, control access to a given encryption key according to given criteria associated with a given category, respective criteria different for each respective category, access to the given encryption key including one or more of, when the respective criteria are met, generating the given encryption key and decrypting the given encryption key.

Method and apparatus for controlling access to encrypted data

A method for administering multiple management agents on a mobile device, the method receiving, at a policy manager on the mobile device, a policy from each of the multiple management agents; determining a current state of the mobile device; and consolidating the policies based on rules within the policy manager and the current state of the mobile device.

Method and system for administering multiple domain management authorities on a mobile device

A method at a computing device having a plurality of concurrently operative operating systems, the method comprising: operating a proxy process within a target operating system on the computing device; receiving, from an originating operating system, a request for resources from a target process within the target operating system at the proxy process; requesting, from the proxy process, the resources of the target process; and returning a handle to the target process from the proxy process to the originating operating system.

System and method for coordinating process and memory management across domains

A method at a user equipment to facilitate activation and splitting of data billing between at least two parties, the method including starting, at the user equipment, a virtual subscriber identity module platform ('VSP') service on the user equipment; verifying VSP configuration information with a network server; upon verification, starting a data networking access point name ('APN') based on the configuration information on the user equipment; and setting a status indicator on the user equipment to indicate the VSP service is enabled.

Method and system for dynamic cellular networking activation for virtual SIM service

Methods and devices for searching are described. In one aspect, the method includes: receiving a search query; identifying a search data file associated with a third party application, the search data file being prepared according to predetermined format rules by the third party application, and stored, prior to receiving the search query; searching, at least a portion of the search data file using the search query to identify information that matches the search query; using the predetermined format rules to identify associated information in the search data file, the associated information being related to the information that matches the search query; obtaining search results from at least one other source; and generating a display of search results based on both the information matching the search query and the associated information, the display including the search results from the at least one other source.

Searching data using pre-prepared search data

There is provided a method and apparatus for resetting a password for a device or managing the device, the device having an encryption perimeter. A device shares a public/private key pair with a server, the public key being on the device and the private key being on the server. An intermediate value is encrypted on the mobile device using the public key. If the password is lost or the device needs to be managed, the server can request the encrypted intermediate value, decrypt it, and send the decrypted value to the mobile device which may then resume operations. A new password may be provided by the server or the user may set a new password once the encryption key is recreated from the decrypted intermediate value.

Key management on device for perimeters

A method at a mobile device for creating a managed domain on the mobile device, the method initializing a container on the mobile device to house the managed domain; retrieving, from the mobile device, a management agent for the management domain; establishing policies to govern the creation of the managed domain; and configuring the container for the domain based on the established policies.

Method and system for domain creation and bootstrapping

Information is shared between processing entities that each have a corresponding private data area by placing data corresponding to information for a first one of the private data areas for a first one of the processing entities directly into a second one of the private data areas for a second one of the processing entities without placing the data in an intervening shared data area and without directly invoking a system administrator-like entity. In addition, these private data areas can be pre-populated with a plurality of directories that each have a one-to-one correspondence to a particular predetermined information recipient and then providing a link to a given one of the recipients as corresponds to a given one of the directories when information is placed in that directory to provide the corresponding predetermined information recipient with at least read access to the information.

Method and apparatus pertaining to sharing information via a private data area

A method at a computing device having a plurality of concurrently operating domains for providing a unified home screen, the method sending a request for package information from a home screen application on the computing device; receiving the request for package information at a unified package manager on the computing device; requesting, from the plurality of concurrently operating domains, package information; receiving package information from at least one of the plurality of concurrently operating domains at the unified package manager on the computing device; decorating the received package information with domain information for a domain from which the package information was received at the unified package manager on the computing device; and providing the decorated package information to the home screen application.

System and method for unifying the listing and launching of applications and packages spread across multiple domains

Systems and techniques relating to securely managing electronic resources are described. A described technique includes receiving a request to add to a mobile device an account setting for a server resource account. Detecting a trigger event for a new perimeter based on the account setting. In response to a parameter or a pattern associated with the account setting, retrieving a security policy from a resource server for the server resource account, and generating, by the mobile device, a new perimeter including the server resource account based on the security policy. The new perimeter is configured to prevent transferring data associated with the server resource account being transferred to mobile-device resources external to the new perimeter.

Dynamically generating perimeters

Systems, methods, and software can be used to share data across profiles. In some aspects, a first request from a first application for application data associated with a second application is received at a first hybrid agent. The first application and the first hybrid agent are associated with a first profile on a mobile device. The second application is associated with a second profile. A second request for the application data is sent to a second hybrid agent. The second hybrid agent is associated with the second profile. The application data from the second hybrid agent is received from the second hybrid agent. The application data is sent to the first application. The application data is used by the first application to generate a graphical interface for presentation on the mobile device. The graphical interface includes a unified view of data associated with the first and second profiles.

Sharing data across profiles

A device and its operations are described herein. In some examples, the operations can include executing a first application within a first operating system domain of a device, the first application associated with at least a first activity view. The operations can further include detecting user input associated with the first application. The user input is associated with activating a second activity view of a second application. The operations can further include determining that the second application corresponds to a second operating system domain of the device. The operations can further include establishing a first proxy link within the first operating system domain that corresponds with a second proxy link within the second operating system domain. The first proxy link is associated with causing the second proxy link to invoke the second activity view of the second application within the second operating system domain.

Coordinating activity views across operating system domains

Plural modes of operation may be established on a mobile device. Specific modes of operation of the mobile device may be associated with specific spaces in memory. By using a 'class' designation within the existing certificate store structure and key store structure, certificates and keys can be assigned to one space among plural spaces. Accordingly, a personal certificate store and a personal key store may exist in a personal space. Similarly, a corporate certificate store and a corporate key store may exist in a corporate space. APIs designed to work within such a system may be arranged to employ a 'class' attribute when managing certificates and cryptographic keys.

Designation of classes for certificates and keys

A method and apparatus for controlling access to encrypted data is provided. The device comprises: a processor and a memory, the processor configured to: control access to encrypted data, stored at the memory, the encrypted data categorized according to a plurality of categories, using a respective encryption key for each category in the plurality of categories; and, control access to a given encryption key according to given criteria associated with a given category, respective criteria different for each respective category, access to the given encryption key including one or more of, when the respective criteria are met: generating the given encryption key and decrypting the given encryption key.

Growing community of inventors

Ottawa, Canada

Sivakumar Nagarajan