Blackberry Corporation

Research in Motion Corporation

Certicom Corporation

Van Quy Tu

Neil Patrick Adams

Shivangi Anantrupa Gandhi

Herbert Anthony Little

Ravi Singh

Christopher Lyle Bender

Daniel Jonas Major

Cheryl Mok

Alexander Truskovsky

Kristof Takacs

Eli Omen Jackson

Jonathan Raymond Cardy

Matthew John Campagna

Adrian Michael Logan

Andrew John Ewanchuk

Oliver Whitehouse

Anthony Rosati

Nicole Pigeon

Imtiaz Nadaf

Cheryl Wing-Yee Mok

Yaniv Haramati

Ahmed Mohamed Farrakha

Jonathan R Cardy

Daniel J Major

Christopher L Bender

A computing device and a method for a computing device to control access to data stored on a data store of the device. An access component of the device having control over access to the data. The access component being operative to receive a request for data from a requesting component, identify an assigned access domain of the requesting component and an assigned data domain of the requested data and determine whether the requesting component is authorized to access the data by comparing the assigned access domain and the data domain with permissions specified in a security policy. If the assigned access domain is authorized to access the data domain, the access component may provide access to the requested data.

Data source based application sandboxing

A first email message associated with a mobile communication device of a user is conveyed to a destination. The first email message comprises a forwarded portion of a second email message that has been previously archived by an email server associated with the user. The step of conveying comprises the step of obtaining the forwarded portion of the second email message without intervention of the user.

System and method for obtaining a portion of an archived email message

In a certification request, a user device includes an object identifier. When a certification authority generates an identity certificate responsive to receiving the certification request, the certification authority includes the object identifier, thereby allowing improved management of the identity certificate at the user device and elsewhere.

Method of handling a certification request

An apparatus, and an associated method, facilitates security at a wireless device, such as a wireless device comprising a mobile computing platform. A security decision engine is provided that monitors for an event necessitating a security decision. When a security decision is required, request is made of a knowledge fetcher, provided by a trusted third-party, installed at the wireless device for the security decision. The knowledge fetcher obtains the security decision, such as by obtaining the security decision from a remote, trusted third-party server, and provides the security decision to the decision engine. Use is made of the security decision pursuant to a setting for which the security decision is needed.

Apparatus, and an associated method, for facilitating secure operations of a wireless device

A method and system for securing data of a mobile communications device. The method includes: determining that first application data is data associated with a first server; encrypting the first application data with an encryption key stored in the mobile communications device; storing the encrypted first application data on a memory; receiving a request to access the first application data from an application or a service implemented from the mobile communications device; determining that the application or service is authorized to access the first application data; and in response to said determining, decrypting the first application data with the encryption key.

Method and system for securing data of a mobile communications device

Rather than storing all data in the same manner, e.g., an encrypted manner, a security level with which to associate received data of a given type may be determined. Subsequently, distinct types of data may be stored in a distinct manner, with the manner of storage having a security level appropriate to the type of data. For example, a first type of data may be stored in an encrypted manner (i.e., with a high level of security), while a second level of data may be stored in a plain text manner (i.e., with a low level of security).

Multi-level data storage

Data received at, or created on, a device may be tagged as corporate dependent upon a service over which the data is received or an application in which the data is created. When a user attempts to insert tagged data into a data item that is to be transmitted by the device, the insertion may be prevented. Similarly, the transmission of tagged data may be restricted to only occur on a secure service.

Restrictions to data transmission

An electronic communication device may, perhaps with the assistance of a mobile device server, determining that a new electronic message received by the device is part of a message thread that includes the new message and at least one prior electronic message previously received at the device. A comparison may be made of address information of the new message with address information of the at least one prior electronic message in the message thread to determine that there has been a change in addressed recipients between the new message and the at least one prior electronic message. The device may then notify a user of the device of the change.

Recipient change notification

To validate a received certificate issuance notification message, a device may verify that the certificate issuance notification message conforms to expected norms or authenticate a signature associate with the certificate issuance notification message. Upon validating, the device may then transmit a uniform resource locator, extracted from the certificate issuance notification message, to a network entity configured for processing certificate issuance.

System and method for validating certificate issuance notification messages

Through the use of a one-time-use nonce, the transfer of cryptographic data over a potentially insecure link in a two-factor content protection system is avoided. The nonce may be stored encrypted with a public key from a smart card. A random key may be used to produce a storage key, which is used to encrypt a content protection key. The random key may be stored, encrypted with a key derived from the nonce. Instead of receiving a raw content protection key over the potentially insecure link, the raw nonce is received and, once used, replaced with a new nonce.

Protocol for protecting content protection data

A method for handling an encrypted message received on an electronic device that has not been encrypted using a current public key. The portable electronic device automatically generates a reply message to the sender in response to determining that the message has not been encrypted with the current public key. The reply message may contain the current public key of the recipient device, and may request the sender to resend the message encrypted with the current public key.

Method and device for automatically distributing updated key material

Rather than managing a certificate chain related to a newly issued identity certificate at a terminal to which a wireless device occasionally connects, a certificate server can act to determine the identity certificates in a certificate chain related to the newly issued identity certificate. The certificate server can also act to obtain the identity certificates and transmit the identity certificates towards the device that requested the newly issued identity certificate. A mail server may receive the newly issued identity certificate and the identity certificates in the certificate chain and manage the timing of the transmittal of the identity certificates. By transmitting the identity certificates in the certificate chain before transmitting the newly issued identity certificate, the mail server allows the user device to verify the authenticity of the newly issued identity certificate.

Pushing certificate chains to remote devices

A method and apparatus for securing a computing device are provided. A state of the computing device is determined, the state associated with a protection state. The computing device is automatically switching between a plurality of security levels at based on the state.

Growing community of inventors

Kitchener, Canada

Van Quy Tu