Controlling access to application data

Patent metadata

Field	Value
Publication number	US-11610014-B2
Application number	US-202016926361-A
Country	US
Kind code	B2
Filing date	Jul 10, 2020
Priority date	Apr 7, 2016
Publication date	Mar 21, 2023
Grant date	Mar 21, 2023

Abstract

A method, system and computer-readable storage medium for controlling access to application data associated with an application configured on a computing device. The method comprises: storing data comprising, for each of a plurality of access levels associated with the application, first data indicative of a combination of one or more credentials associated with the respective access level and an access level key corresponding to the respective access level, the access level key being encrypted by the combination of one or more credentials associated with the respective access level; determining, based on the first data, an access level in the plurality of access levels corresponding to a combination of one or more credentials available to the application; decrypting the access level key in the stored data corresponding to the determined access level using the combination of one or more credentials available to the application; and providing access to encrypted application data associated with the application and corresponding to the determined access level using, at least in part, the decrypted access level key corresponding to the determined access level.

First claim

What is claimed is:

1. A method, comprising:
obtaining, an access level key corresponding to one access level of a plurality of access levels associated with an application, wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the determined access level by using the received one or more credentials available to the application;

decrypting, an encrypted container key corresponding to the one access level by using the access level key;
decrypting application data stored in one container by using the decrypted container key, wherein data associated the application is segregated into a plurality of containers including the one container; and
providing access to the decrypted application data in the one container.

2. The method of claim 1 , wherein the access level key is obtained in response to a request to data associated with the application.

3. The method of claim 2 , wherein the request indicates a particular category of the requested data, wherein the particular category corresponds to the one access level.

4. The method of claim 1 , further comprising:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting, one or more encrypted subordinate container keys corresponding to the one or more subordinate access level; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.

5. The method of claim 1 , wherein each of the plurality access level key is encrypted by one or more credentials, and first data indicating a credential type for each of the one or more credentials that are used to encrypt the respective access level key is stored with the access level key corresponding to the respective access level.

6. The method of claim 5 , wherein the first data comprises meta-data indicative of the credential types.

7. A device, comprising:
at least one hardware processor; and
a non-transitory computer-readable storage medium coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions, when executed, cause the at least one hardware processor to perform operations comprising:
obtaining, an access level key corresponding to one access level of a plurality of access levels associated with an application, wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the determined access level by using the received one or more credentials available to the application;

decrypting, an encrypted container key corresponding to the one access level by using the access level key;
decrypting application data stored in one container by using the decrypted container key, wherein data associated the application is segregated into a plurality of containers including the one container; and
providing access to the decrypted application data in the one container.

8. The device of claim 7 , wherein the access level key is obtained in response to a request to data associated with the application.

9. The device of claim 8 , wherein the request indicates a particular category of the requested data, wherein the particular category corresponds to the one access level.

10. The device of claim 7 , the operations further comprising:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting, one or more encrypted subordinate container keys corresponding to the one or more subordinate access level; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.

11. The device of claim 7 , wherein each of the plurality access level key is encrypted by one or more credentials, and first data indicating a credential type for each of the one or more credentials that are used to encrypt the respective access level key is stored with the access level key corresponding to the respective access level.

12. The device of claim 11 , wherein the first data comprises meta-data indicative of the credential types.

13. A non-transitory computer-readable medium storing instructions which, when executed, cause a computing device to perform operations comprising:
obtaining, an access level key corresponding to one access level of a plurality of access levels associated with an application, wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the determined access level by using the received one or more credentials available to the application;

decrypting, an encrypted container key corresponding to the one access level by using the access level key;
decrypting application data stored in one container by using the decrypted container key, wherein data associated the application is segregated into a plurality of containers including the one container; and
providing access to the decrypted application data in the one container.

14. The non-transitory computer-readable medium of claim 13 , wherein the access level key is obtained in response to a request to data associated with the application.

15. The non-transitory computer-readable medium of claim 14 , wherein the request indicates a particular category of the requested data, wherein the particular category corresponds to the one access level.

16. The non-transitory computer-readable medium of claim 13 , the operations further comprising:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting, one or more encrypted subordinate container keys corresponding to the one or more subordinate access level; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.

17. The non-transitory computer-readable medium of claim 13 , wherein each of the plurality access level key is encrypted by one or more credentials, and first data indicating a credential type for each of the one or more credentials that are used to encrypt the respective access level key is stored with the access level key corresponding to the respective access level.

Assignees

• Blackberry Ltd

Inventors

• Quinlan Sean Michael
• Somani Haniff
• Maurya Sanjiv
• Barker Peter
• Hawkins Siavash James Joorabchian

Classifications

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F3/0637

  Permissions · CPC title

• G06F3/0622

  in relation to access · CPC title

• G06F3/0673

  Single storage device · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title