Methods and system for implementing a secure lock screen

Patent metadata

Field	Value
Publication number	US-10223540-B2
Application number	US-201414500940-A
Country	US
Kind code	B2
Filing date	Sep 29, 2014
Priority date	May 30, 2014
Publication date	Mar 5, 2019
Grant date	Mar 5, 2019

Abstract

Disclosed herein is a technique for implementing a secure lock screen on a computing device. The secure lock screen is configured to permit particular applications to display their content—such as main user interfaces (UIs)—while maintaining a desired overall level of security on the computing device. Graphics contexts, which represent drawing destinations associated with the applications, are tagged with entitlement information that indicates whether or not each graphics context should be displayed on the computing device when the computing device is in a locked-mode. Specifically, an application manager tags each application that is initialized, where the tagging is based on a level of entitlement possessed by the application. In turn, a rendering server that manages the graphics contexts can identify the tagged entitlement information and display or suppress the content of the applications in accordance with their entitlements.

First claim

What is claimed is:

1. A method for implementing a secure lock screen, the method comprising, at a computing device that is in a locked-mode:
receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates:
a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and
a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;
receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates:
a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and
a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and

displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

2. The method of claim 1 , wherein:
the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and
the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

3. The method of claim 1 , wherein the threshold is based on a user preference.

4. The method of claim 1 , wherein the first application causes an issuance of the second request to launch the second application.

5. The method of claim 1 , further comprising:
transitioning into the locked-mode prior to receiving the first request.

6. The method of claim 1 , wherein the first graphics context is a drawing destination associated with the first application, and the first graphics context is rendered by a rendering server included in the computing device.

7. The method of claim 6 , wherein, when the second depth level does not satisfy the threshold, the method further comprises:
assigning a property to the second graphics context that indicates to the rendering server that the second graphics context is not visible.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to implement a secure lock screen while the computing device is in a locked-mode, by carrying out steps that include:
receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates:
a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and
a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;
receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates:
a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and
a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and

displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

9. The non-transitory computer readable storage medium of claim 8 , wherein:
the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and
the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

10. The non-transitory computer readable storage medium of claim 8 , wherein the threshold is based on a user preference.

11. The non-transitory computer readable storage medium of claim 8 , wherein the first application causes an issuance of the second request to launch the second application.

12. The non-transitory computer readable storage medium of claim 8 , wherein the first graphics context is a drawing destination associated with the first application, and the first graphics context is rendered by a rendering server included in the computing device.

13. The non-transitory computer readable storage medium of claim 12 , wherein, when the second depth level does not satisfy the threshold, the steps further include:
assigning a property to the second graphics context that indicates to the rendering server that the second graphics context is not visible.

14. A computing device configured to implement a secure lock screen while the computing device is in a locked-mode, the computing device comprising:
a display device;
a processor; and
a memory configured to store instructions that, when executed by the processor, cause the computing device to carry out steps that include:
receiving a first request to launch a first application, wherein the first application is associated with a first entitlement that indicates:
a first graphics context for the first application that is permitted to be displayed when the computing device is in the locked-mode, and
a first depth level for the first application that indicates a first position of the first application within a hierarchy;

displaying the first graphics context within the secure lock screen in response to determining that the first depth level satisfies a threshold;
receiving a second request to launch a second application, wherein the second application is associated with a second entitlement that indicates:
a second graphics context for the second application that is permitted to be displayed when the computing device is in the locked-mode, and
a second depth level that is inherited from the first depth level, wherein the second depth level reflects a second position of the second application within the hierarchy; and
displaying the second graphics context for the second application within the secure lock screen in response to determining that the second depth level satisfies the threshold.

15. The computing device of claim 14 , wherein:
the first graphics context includes at least a first subset of content that is displayed within a first primary graphics context for the first application that is displayed when the computing device is in an unlocked-mode, and
the second graphics context includes at least a second subset of content that is displayed within a second primary graphics context for the second application that is displayed when the computing device is in the unlocked-mode.

16. The computing device of claim 14 , whe

Assignees

• Apple Inc

Inventors

• Shepherd Matthew E
• Shaffer Joshua H
• Zhang Chendi
• Schimpf Daniel O
• Nielsen Benjamin E
• Zwarich Cameron W

Classifications

• G06F21/6281

  at program execution time, where the protection is within the operating system · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• G06F3/0481

  based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title