Blackberry Corporation

Evolutionq Inc.

2236008 Ontario Limited

Research in Motion Corporation

Thomas Owen Parry

Spencer Leavitt George Quin

Jason Lee Carter

Bradley Alfred Fach

Nicholas Patrick Alfano

James Andrew Godfrey

Nicholas Alfano

Richard Enrique Lopez

David Clark

Hashim Mohammad Qaderi

Melanie Arlene Barker

Yuhui Liu

Axel D Ferrazzini

Douglas Eugene Ross

Timothy Ryan Salter

Robert David Turner

David Brandon Sosby

Nicole Melissa DeBickes

James Arthur Bruck

Paul Munguia

Cora Lynne Collins

Martin John Bowyer

Vinaykumar Acharya

Norbert Lütkenhaus

Christopher David Smith

Salim Hayder Omar

Barry J Gilhuly

Douglas Michael Gisby

Salim Omar

David J Clarke

Christopher Smith

Piotr Madej

Andrew Christopher Smith

Michele Mosca

Srdan Dikic

Andrew James Guy Brown

Snezana Visnjic-Obucina

Christopher Michael Fogel

Levente Janosi

Christopher Donald MacDonald

Sebastian Reynaldo Verschoor

Ngoc Anh Van

Simon Howard

John Francis Holmes

Michael William Loosemore

Marco Piani

David Clarke

Salim Haydr Omar

Nicole Melissa Debickes

Ricard Enrique Lopez

Nicholas P Alfano

Christopher Donald Macdonald

David Richard Clark

Andrew James Brown

Christopher M Fogel

David James Clarke

A system and method are provided for mitigating key-exhaustion attacks in a key exchange protocol. The method includes computationally confirming an exchange of key bits has provided fresh shared key material before information theoretically confirming the exchange of key bits has provided fresh shared key material, while maintaining synchronization between messaging parties. In one implementation, maintaining synchronization includes updating keys in between each post-processing message session and managing a local state of each messaging party in the key exchange protocol prior to sending a next post-processing message. In another implementation, maintaining synchronization includes hiding a message containing the information theoretic authenticator by executing a decoy authentication process, prior to using an information theoretical key.

System and method for mitigating key-exhaustion in a key distribution protocol

A system and method are described for proactively performing key swaps among nodes in a quantum key distribution (QKD) network. The method includes determining a routing solution for nodes in the QKD network; making the routing solution available to the nodes in the QKD network; and initiating key swaps among the nodes in the QKD network according to the routing solution, prior to key requests being made within the QKD network. The method can also include continuously performing key swaps among the nodes in the QKD network according to the routing solution; detecting a change in capacity and/or a change in demand on one or more links within the QKD network; determining a new routing solution based on the detected change; and continuously preforming subsequent key swaps according to the new routing solution.

System and method for optimizing the routing of quantum key distribution (QKD) key material in a network

A system and method are provided for proactively buffering quantum key distribution (QKD) key material. The method includes monitoring key generation rates and surpluses at QKD devices at each node of a QKD link in a QKD network, retrieving surplus key material from the QKD devices at one or both nodes of the QKD link, and buffering the surplus key material in a local storage at one or both nodes in the QKD link. The surplus key material can be used to offset overhead introduced in securely relaying keys between non-adjacent demand pairs in the QKD network. The surplus key material can also be used to offset future transient decreases in key generation rates.

System and method for proactively buffering quantum key distribution (QKD) key material

Data structures are stored in an endpoint data store. Each data structure represents an endpoint having one or more components, each component having one or more arbitrary properties. Multiple groups of endpoints are identified by name and defined by group criteria expressed in terms of the one or more arbitrary properties of the one or more components of the endpoints that are members of the group. For each group, the group criteria of the group is stored in a data store in association with the name of the group. Packages and releases may be targeted to endpoints in various manners.

Groups of endpoints and targeting of releases and packages to endpoints

A method at a network element for monitoring, at the network element, transactions between the network element and at least one client device; applying rules to each transaction; and performing at least one of parsing, storing, or discarding each transaction based on the rules. Further, a method at a client device including storing a session identifier; generating a transaction message; adding the session identifier and a transaction identifier to the transaction message; and sending the transaction message with the session identifier and transaction identifier to a server.

Method and system for transaction diagnostics

A method for managing software on a device is provided. The method comprises: receiving, from a third party associated with the device, by a software administrator of an organization different from the third party, release information regarding software versions for the device; creating, by the software administrator, a profile that specifies whether or not at least one of the software versions is allowed on the device; and transmitting the profile, by the software administrator to a server computer associated with the third or other parties, to promote enforcement of the profile for the device.

System and method for restricting system and application software available for installation on a managed mobile device

Transport information is to be used by an endpoint to obtain one or more packages comprised in a deployed release. The transport information is sent in a single message that identifies the deployed release and the one or more packages. The transport information may include allowed bearer settings and transport settings. Release parameters to be used by the endpoint in connection with the deployed release are determined and included in the single message. The message may include one of the packages as streamed inline content. The message may identify one of the packages via a network address of a file of that package. The message may identify one of the packages via an indication of where in local removable storage to find a file of that package, the local removable storage being local to the endpoint.

Delivery mechanisms for deployment of releases of packages to endpoints

Data structures are stored in an endpoint data store. Each data structure represents an endpoint having one or more components, each component having one or more arbitrary properties. Any packages installed on the components are represented in the data structures. Representations of the arbitrary properties within the data structure are aggregated from multiple sources, and conflict resolution methods are described.

Management of upgradeable endpoints

Personalization of a mobile device, including receiving at the mobile device a unique code; selecting, from a plurality of personalization policies stored on the mobile device a personalization policy that corresponds to the unique code; and storing the selected personalization policy in a persistent protected storage element of the mobile device. Customizing a mobile device, including determining at the mobile device a unique code; selecting, from a plurality of customized data sets stored on the mobile device a data set that corresponds to the unique code; and activating the selected data set on the mobile device.

Mobile equipment customization using a single manufacturing configuration

An example network device includes a processor configured to execute an Open Mobile Alliance (OMA) Device Management (DM) server, the OMA DM server to perform operations of: participating in mutual authentication with a second OMA DM server; sending a notification to the second OMA DM server for notifying the second OMA DM server to proceed with a delegation process; and sending, to a DM client, information for modifying an access control list (ACL).

Methods and apparatus to transfer management control of a client between servers

Methods and apparatuses relating to Open Mobile Alliance (OMA) device management (DM) are provided. An embodiment provides a method in which a mobile device is configured for: accumulating delta records on the mobile device; and pushing delta records to a DM server when a threshold for the delta records is met or exceeded. The delta records relate to changes made to an Open Mobile Alliance (OMA) device management (DM) tree. The delta records may be purged after the pushing operation. Other embodiments provide a mobile device and computer-readable medium for performing or facilitating the method.

Method for communicating device management data changes

Updating firmware on mobile devices can be performed during device management (DM) sessions between mobile devices and one or more servers. A server can provide data to at least one node of a firmware update management object (FUMO) stored at a mobile device. The data can indicate a plurality of different update file locations accessible via a network. The mobile device can download a plurality of update files from the plurality of different update file locations via the network in response to receiving the command. From a set of update files, each mobile device can thus obtain its particular firmware update as a subset of the update files as indicated by its FUMO. Metadata may be provided to the FUMO to express one or more conditions that the mobile device must meet in order to download respective update files.

Updating firmware on mobile devices

An authentication server and methods of generating a token for use by a mobile device to establish authorization for the mobile device to access a service provided by a service server, the method comprising receiving a request for the token from the mobile device, generating the token comprising location data identifying a location for the mobile device and authentication data indicating a level of access that the mobile device is permitted to have to the service provided by the service server, and transmitting the token to the mobile device.

Authentication server and methods for granting tokens comprising location data

A user equipment (UE) is disclosed comprising an agent configured to monitor and report UE configuration and capability information, wherein the UE is further configured to provide the UE configuration and capability information, and subsequently receive an application based on the configuration and capability information. Also disclosed is a network comprising a provisioning server configured to receive UE configuration and capability information, and subsequently provide an application based on the UE configuration and capability information. Also disclosed is a method comprising providing UE configuration and capability information from a UE, and receiving an application at the UE based on the configuration and capability information. Also disclosed is a method comprising receiving UE configuration and capability information at a provisioning server, and providing an application from the provisioning server based on the UE configuration and capability information.

Provisioning based on application and device capability

Growing community of inventors

Cambridge, Canada

Thomas Owen Parry