(19)
(11)EP 3 229 165 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
02.09.2020 Bulletin 2020/36

(21)Application number: 17163976.8

(22)Date of filing:  30.03.2017
(51)International Patent Classification (IPC): 
G06F 21/62(2013.01)

(54)

CONTROLLING ACCESS TO APPLICATION DATA

STEUERUNG DES ZUGRIFFS AUF ANWENDUNGSDATEN

CONTRÔLE D'ACCÈS À DES DONNÉES D'APPLICATION


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 07.04.2016 US 201615093183

(43)Date of publication of application:
11.10.2017 Bulletin 2017/41

(73)Proprietor: BlackBerry Limited
Waterloo, ON N2K 0A7 (CA)

(72)Inventors:
  • QUINLAN, Sean Michael
    Bellevue, WA Washington 98008 (US)
  • SOMANI, Haniff
    Mercer Island, WA Washington 98040 (US)
  • BARKER, Peter
    Sunnyvale, CA California 94085 (US)
  • HAWKINS, Siavash James Joorabchian
    London, WC2E 7EN (GB)
  • MAURYA, Sanjiv
    Sunnyvale, California 94085 (US)

(74)Representative: Hanna Moore + Curley 
Garryard House 25/26 Earlsfort Terrace
Dublin 2, D02 PX51
Dublin 2, D02 PX51 (IE)


(56)References cited: : 
US-A1- 2006 112 423
US-A1- 2011 178 930
  
      
    Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


    Description

    BACKGROUND OF THE INVENTION


    Field of the Invention



    [0001] Embodiments of the present disclosure relate to controlling access to application data on a computing device.

    Description of the Related Technology



    [0002] Secure platforms provide an architecture for deployment and management of secure applications running on computing devices. A secure application enables an enterprise to deploy sensitive data to the respective computing devices, and to remotely manage the sensitive data in a secure manner. For example, such management may include remote deletion of the sensitive data in the event that the computing device is compromised or in the event that the user of the computing device leaves the employment of the enterprise.

    [0003] At least some of the data managed by the secure application running on the mobile device is stored in encrypted format. The data may be encrypted using methods as known in the art. For example, the encryption may be employed in "containerization" techniques, according to which the data is encrypted and subject to various access policies which are applied to control how and when users can access the data within the container. The access policies can, for example, be determined and varied if desired by a remote user, such as an administrator of the enterprise which has deployed the secure application.

    [0004] An example of a secure platform which employs secure applications in this manner is the Good Dynamics™ mobile platform developed by Good Technology™ of Sunnyvale, California, United States of America.
    Separately, US2011/178930 discloses a method of providing multiple-level access control to objects in a computer system.

    SUMMARY



    [0005] According to a first aspect of the present disclosure, there is provided a method according to claim 1.

    [0006] According to some embodiments the stored data comprises, for each of the plurality of access levels associated with the application, one or more application data keys corresponding to the respective access level, each of which is encrypted by the access level key corresponding to the respective access level, the method comprising: decrypting the one or more application data keys corresponding to the determined access level using the decrypted access level key corresponding to the determined access level; decrypting the one or more application data keys corresponding to the one or more access levels subordinate to the determined access level using the one or more decrypted access level keys corresponding to the one or more access levels subordinate to the determined access level; decrypting the encrypted application data associated with the application and corresponding to the determined access level using the one or more decrypted application data keys; and decrypting the encrypted application data associated with the application and corresponding to the one or more access levels subordinate to the determined access level using the one or more decrypted application data keys corresponding to the one or more access levels subordinate to the determined access level.

    [0007] According to some embodiments the method further comprises: encrypting the decrypted master key using new level key corresponding to the new access level; and storing the encrypted master key in association with the new access level in the stored data.

    [0008] According to some embodiments the instruction to create a new access level is received from a server remote from the computing device.

    [0009] According to some embodiments the first data comprises meta-data indicative of the credential or combination of credentials associated with the respective access level.

    [0010] According to a second aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium according to claim 6.

    [0011] According to a third aspect there is provided a computing device according to claim 7.

    BRIEF DESCRIPTION OF THE DRAWINGS



    [0012] Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings.

    Figure 1 is a schematic diagram showing a computing device comprising an application in accordance with a first embodiment.

    Figures 2A is a schematic diagram showing a first policy data structure defining an access policy in accordance with an embodiment.

    Figures 2B is a schematic diagram showing a second policy data structure defining a credential policy in accordance with an embodiment.

    Figures 3A is a schematic diagram showing a first key data structure storing access level keys, the first key data structure being usable in accordance with an embodiment.

    Figures 3B is a schematic diagram showing a second key data structure storing container level keys, the second key data structure being usable in accordance with an embodiment.

    Figure 4 is a flow diagram showing a method of controlling access to application data in accordance with an embodiment.

    Figure 5 is a schematic diagram showing a computing device comprising an application in accordance with a second embodiment.

    Figure 6 is a schematic diagram showing a computing device comprising an application in accordance with a third embodiment.

    Figure 7 is a schematic diagram showing a computing device in accordance with an embodiment.



    [0013] In the drawings, components, steps and features which appears on two or more Figures have been assigned the same reference numeral for clarity.

    DETAILED DESCRIPTION OF CERTAIN INVENTIVE EMBODIMENTS



    [0014] Figure 1 is a schematic diagram which shows a computing device 100 comprising an application 110 configured to selectively provide access to application data 114 in accordance with an embodiment. The application 110 is configured to interact with an operating system 124 configured on the computing device 100, and includes an application runtime 112 (i.e. a runtime process executed by the operating system 124), and application data 114 and management data 116 stored in a persistent memory (not shown) of the computing device 100. The application data 114 comprises data utilized or generated by the application runtime 112 during execution. The application data 114 includes a plurality of data structures 114-1 to 114-4 (hereinafter termed "containers") into which the application data 114 may be segregated and securely stored in encrypted format to prevent unauthorized access. In this respect, segregation of the application data 114 into the plurality of containers 114-1 to 114-4 may be based on a plurality of data categories defined for the application data 114, as discussed below in more detail. Similarly, the management data 116 may comprise a data structure (hereinafter termed a "management container") in which data for controlling configuration and functionality associated with the application 110 is stored.

    [0015] The application runtime 112 securely stores application data 114 in the containers 114-1 to 114-4 using cryptographic techniques known in the art, such as those specified in the Advanced Encryption Standard (AES) established by the U.S. National Institute of Standards and Technology. In this context, each secure container 114-1 to 114-4 represents an area of secure storage configured in non-volatile memory and associated with the application 110. Each secure container 114-1 to 114-4 may adopt a plurality of states (hereinafter termed "lock states"), including a locked state and an unlocked state. When in the locked state, the application data 114 stored in the containers 114-1 to 114-4 is encrypted and cannot be accessed by the associated application runtime 112, or any other process running on the computing device 100. Conversely, when the containers 114-1 to 114-4 are in an unlocked state, the application data 114 stored in the containers 114-1 to 114-4 is decrypted (e.g., plaintext) and can be accessed by the corresponding application runtime 112. Encryption and decryption of each container 114-1 to 114-4 is performed by the application runtime 112 using a cryptographic key (hereinafter termed a "container key" or an "application data key") corresponding to the respective container 114-1 to 114-4. The container key is derived from a combination of one or more credentials available to the application runtime 112, as discussed below in more detail. In this respect, it will be appreciated that the lock state for each of the plurality of containers 114-1 to 114-4 can be controlled independently by the application runtime 112.

    [0016] As discussed above, the application 110 defines a plurality of data categories for data in the application data 114. Each data category is associated with a respective container 114-1 to 114-4, which in turn provides one or more data structures available to the application runtime 112 for storage of application data 114. In the particular example shown in Figure 1, container 114-1 stores "category A" data, container 114-2 stores "category B" data, container 114-3 stores "category C" data, and container 114-4 stores "category D" data.

    [0017] The application runtime 112 is configured to manage the lock state of each of the containers 114-1 to 114-4 in accordance with the associated data categories and one or more policies which are defined in policy data 118 stored by the application 110 in non-volatile storage. In particular, each category of data respectively stored in containers 114-1 to 114-4 is associated with an access level defined in the policy data 118. For example, the access policy may define category A data as access level 0 (termed "L0" in Figure 1), category B data as access level 1 (termed "L1" in Figure 1), category C data as access level 2 (termed "L2" in Figure 1), and category D data as access level 3 (termed "L3" in Figure 1). In this context, the L0 access level represents the lowest sensitivity access level defined in the access policy and the L3 access level represents the highest sensitivity access level defined in the access policy. According to some embodiments, the access policy defined by the policy data 118 may also define a default access level which is applied to data categories for which no access level has been explicitly defined in the policy data 118.

    [0018] The policy data 118 associated with the application 110 further defines a credential policy which specifies a combination of credentials required to access each respective access level. For example, the credential policy may define that application data 114 associated with the L0 access level (i.e. the category A data stored in container 114-1) can be accessed without requiring any credentials, application data 114 associated with L1 access level (i.e. the category B data stored in container 114-2) can be accessed when the computing device 100 is connected to a particular local area network (hereinafter termed a "LAN credential"), application data 114 associated with the L2 access level (i.e. the category C data stored in container 114-3) can be accessed when a particular password is supplied to the application by a user (hereinafter termed a "password credential"), and application data 114 associated with the L3 access level (i.e. the category D data stored in container 114-4) can been accessed when the application runtime 112 has access to a combination of the password credential and the LAN credential (i.e. a combination of credentials).

    [0019] As discussed above, application data 114 stored in each of the containers 114-1 to 114-4 is encrypted and decrypted using a container key corresponding to the respective container 114-1 to 114-4. The container keys are stored securely in non-volatile memory associated with the application 110 as key data 120. Specifically, the container keys are stored in key data 120 according to a structure which reflects the access level policy and credential policy defined by the policy data 118. In other words, the key data 120 is configured such that, given access to a particular combination of credentials corresponding to a particular access level as defined in the policy data 118, the application runtime 112 is able to retrieve, from the key data 120, the container keys for each of the container 114-1 to 114-4 assigned to a data category corresponding to the particular access level or lower, but is not able to retrieve, from the key data 120, the credential keys for any container 114-1 to 114-4 assigned to a data category at an access level higher than the particular access level. For example, the key data 120 may be configured such that, given access to a combination of credentials corresponding to the L2 access level, the application runtime 112 is able to access the container keys for container 114-1 (i.e. category A application data), container 114-2 (i.e. category B application data) and container 114-3 (i.e. category C application data), but is not able to access the credential key for container 114-4 (i.e. category D application data). In this context, the one or more credentials currently available to the application runtime 112 may be referred to as a "authentication state", the access level corresponding to a given combination of credentials may be referred to as a "current access level" and each access level below the current access level may be referred to as a "subordinate access level".

    [0020] As discussed above, the authentication state for the application 110 depends on the one or more credentials available to the application runtime 112 at the time access to the application data 114 is required. In this respect, the application runtime 112 is configured to utilize one or more interfaces 126 provided by the operating system 124 to receive and store (e.g. in non-volatile memory) the one or more credentials. For example, the application runtime 112 may utilize the one or more interfaces 126 to receive input from a user of the computing device 100 (i.e. a "user credential"), information regarding the state or configuration of the computing device 100 or the operating system 124 (i.e. a "configuration credential"), or information regarding the current environment of the computing device 100 (i.e. an "environment credential").

    [0021] According to some embodiments, the application 110 comprises a plurality of application programming interfaces (APIs), including a client-side API 122-1, an unlock API 122-2 and a storage API 122-3. The client-side API 122-1 provides functionality which enables the application runtime 112 to query the current unlock status for each container 114-1 to 114-4, request a change in lock status for one or more of the containers 114-1 to 114-4 and, where required, to prompt the user of the computing device 100 to provide one or more credentials required for a particular access level. Similarly, the unlock API 122-2 is configured to manage access to the one or more containers 114-1 to 114-4 in accordance with the current authentication state for the application 110 and the access level policy defined in the policy data 118 and reflected in the key data 120. The storage API 122-3 is configured to manage storage of application data 114 in the containers 114-1 to 114-4 in accordance with a data category associated with the data to be stored.

    [0022] Figures 2A and 2B are schematic diagrams showing exemplary structures for data stored in the policy data 118, in accordance with an embodiment. Specifically, Figure 2A shows an example of a first policy data structure 210 defining the access policy for the application 110. Figure 2B shows an example of a second policy data structure 220 defining the credential policy, as discussed above with reference to Figure 1. In the example shown in Figure 2A, the first policy data structure 210 takes the form of a table, such as a database table, in which the first column 212-1 of the table corresponds to the data category and the second column 212-2 of the table corresponds to the access level. Similarly, each of the rows 214-1 to 214-4 of the table corresponds to the data categories assigned to the respective containers 114-1 to 114-4 of Figure 1. Thus, according to the example shown in Figure 2A, row 214-1 specifies that category A data is assigned to access level L0, row 214-2 specifies that category B data is assigned to access level L1, row 214-3 specifies that category C data is assigned to access level L2 and row 214-4 specifies that category D data is assigned to access level L3. As discussed above in relation to Figure 1, the access policy may also define a default access level, which is reflected in Figure 2A by row 214-5 which specifies that L2 is the default access level for the application.

    [0023] The second policy data structure 220 shown in Figure 2B also takes the form of a table, in which the first column 222-1 corresponds to the access level and the second column 222-2 corresponds to the required credential or credential combination for the respective access level. Similarly, each of the rows 224-1 to 224-4 of the table corresponds to the access levels defined for the application 110 of Figure 1. Thus, according to the example shown in Figure 2B, row 224-1 specifies that no credentials are required for access to access level L0 application data, row 224-2 specifies that a LAN credential is required for access to access level L1 application data (hereinafter termed the "L1 credential combination"), row 224-3 specifies that a password credential is required for access to access level L2 application data (hereinafter termed the "L2 credential combination"), and row 224-4 specifies that the LAN credential and the password credential are required for access to access level L3 application data (hereinafter termed the "L3 credential combination").

    [0024] As discussed above with reference to Figure 1, the key data 120 securely stores the container keys for containers 114-1 to 114-4 in a manner which reflects the access policy and the credential policy defined in the policy data 118. In this respect, Figures 3A and 3B respectively show a first key data structure 300 and a second key data structure 320 for secure storage of the container keys for containers 114-1 to 114-4 in accordance with the access policy and credential policy defined in data structures 210 and 220 of Figures 2A and 2B respectively. In this respect, the first key data structure 300 takes the form of a table that is used to store a plurality of access level keys corresponding to respective access levels L0 to L3, defined in policy data structure 210 of Figures 2A. The first key data structure 300 includes a first row 302 specifying a version identifier for the data structure 300 and a second row 304 specifying a device identifier corresponding to the computing device 100 of Figure 1. The first key data structure 300 further includes a plurality of rows 306-0 to 306-3 corresponding to each of the access levels L0 to L3 defined in policy data structure 210. In this respect, each row 306-0 to 306-3 stores key data comprising the access level key for the respective access level, encrypted by the credential combination for the respective access level, and meta-data suitable for identifying the credential combination for the respective access level where a corresponding credential combination is specified in the credential policy defined in data structure 220. In the example shown in Figure 3A, row 306-0 corresponding to the L0 access level stores an unencrypted copy of the L0 access level key and does not store any credential meta-data (because the credential policy defined in data structure 220 specifies that no credentials are required for access to L0 access level data). In contrast, rows 306-1 to 306-3 corresponding to the L1 to L3 access levels respectively, store the access level key for the respective access level encrypted by the credential combination for the respective access level, and credential meta-data for identifying the credential combination for the respective access level. Specifically, key data 306-1A stored in row 306-1 comprises the L1 access level key (EC1(LevelKey_L1) encrypted using the credential combination (C1) corresponding to the L1 access level; the key data 306-2A stored in row 306-2 comprises the L2 access level key (EC2(LevelKey_L2) encrypted using the credential combination (C2) corresponding to the L2 access level; and the key data 306-3A stored in row 306-3 comprises the L3 access level key (EC3(LevelKey_L3) encrypted using the credential combination (C3) corresponding to the L3 access level.

    [0025] The meta-data stored for each access level in the first key data structure 300, for which a credential combination is specified in the credential policy defined in data structure 220 (i.e. access levels L1, L2 and L3), includes data specifying a credential type, a credential salt and a credential hash for the credential combination corresponding to the respective access level. The credential type provides an indication of the type of credential or credentials in the credential combination and how they are to be combined and correctly processed for decryption of the corresponding access level key. The credential hash specifies the hash value for the particular credential combination (using the respective credential salt) and is used to identify whether current authentication state includes the credential combination corresponding to the respective access level. Thus, in the present example, the credential meta-data 306-1B stored in row 306-1 includes data specifying the credential type (CredentialType_L1), the credential salt (CredentialSalt_L1) and the credential hash (CredentialHash_L1) for the L1 access level; the credential meta-data 306-2B stored in row 306-2 includes data specifying the credential type (CredentialType_L2), the credential salt (CredentialSalt_L2) and the credential hash (CredentialHash_L2) for the L2 access level; and the credential meta-data 306-3B stored in row 306-3 includes data specifying the credential type (CredentialType_L3), the credential salt (CredentialSalt_L3) and the credential hash (CredentialHash_L3) for the L3 access level.

    [0026] Figure 3B is a schematic diagram showing the second key data structure 320 which takes the form of a table that is used to store the plurality of container keys for containers 114-1 to 114-4 respectively. In the present example the second key data structure 320 includes a first row 322 specifying a version identifier for the data structure 320 and a second row 324 specifying recovery data which is discussed in more detail below. The second key data structure 320 further includes a plurality of rows 326-0 to 326-3 corresponding to each of the access levels L0 to L3 defined in the access policy stored in policy data structure 210. In this respect, each row 306-0 to 306-3 stores the container keys corresponding to the respective access level, encrypted by the access level key for the respective access level, and the access level keys for each subordinate access level below the respective access level encrypted by the access level key for the access level of the current row. Specifically, row 326-0 stores the container key for the category A container 114-1 encrypted by the L0 access level key (ELevelKey_L0[ContainerKey_A]) in container key data 326-0A, but does not store any access level keys for subordinate access levels because the L0 is the lowest access level defined for the application 110. Row 326-1 stores the container key for the category B container 114-2 encrypted by the L1 access level key (ELevelKey_L1[ContainerKey_B]) in container key data 326-1A and stores the L0 level access key encrypted by the L1 access level key (ELevelKey_L1[LevelKey_L0]) in access level key data 326-1B. Similarly, row 326-2 stores the container key for the category C container 114-3 encrypted by the L2 access level key (ELevelKey_L2[ContainerKey_C]) in container key data 326-2A, and the L0 access level key encrypted by the L2 access level key (ELevelKey_L2[LevelKey_L0]) and the L1 access level key encrypted by the L2 access level key (ELevelKey_L2[LevelKey_L1]) in access level key data 326-2B. Finally, row 326-3 stores the container key for the category D container 114-4 encrypted by the L3 access level key (ELevelKey_L3[ContainerKey_D]) in container key data 326-3A, and the L0 access level key encrypted by the L3 access level key (ELevelKey_L3[LevelKey_L0]), the L1 access level key encrypted by the L3 access level key (ELevelKey_L3[LevelKey_L1]), and the L2 access level key encrypted by the L3 access level key (ELevelKey_L3[LevelKey_L2]), in access level key data 326-3B.

    [0027] Referring briefly to Figure 1, in some embodiments the management container stored in management data 116 may also be assigned to a particular access level and encrypted using a corresponding management container key. In the embodiment shown in Figure 3B, the management data 116 is assigned to the L2 access level and the management container key is stored in row 326-2 of data structure 320 as management key 326-2C data, encrypted by the L2 access level key (ELevelKey_L2[MgtContainerKey]). Thus, the application runtime 112 is able to access the management container stored in the management data 116 when the current authentication state comprises the L2 credential combination.

    [0028] As discussed above, in some embodiments, the second key data structure 320 may comprise recovery data 324 which enables recovery of encrypted data stored in containers 114-1 to 114-4 in the event that the user forgets the credential combination corresponding to the highest access level defined for the application. In this example, the recovery data includes a copy of the access level key (EMCK(LevelKey_L3)) for the highest access level defined for the application (i.e. the L3 access level for the example shown in Figure 3B) encrypted by a cryptographic key (EMCK) stored remote from the computing device 100 (hereinafter termed the "master container key"). Thus, upon provision of the master container key to the application 110 (e.g. in a reset operation initiated by a remote server), the application runtime 112 is able to decrypt the L3 access level key stored in recovery data 324, regain access to the container keys stored in the rows 326-0 to 326-3 and generate a new set of access level keys as necessary.

    [0029] In a similar manner, row 326-3 may also store a copy of the master container key encrypted by the L3 access level key (ELevelKey_L3(MCK)) such that if the application 110 is reconfigured to specify a new access level higher (L4) than the current highest access level (L3), the application runtime 112 is able to retrieve the master container key from master key data 332-3D (assuming the current authentication state comprises the L3 credential combination) and optionally store a copy of the L4 access level key encrypted by the master container key (ELevelKey_L4(MCK)) in recovery data 324 without needing to request the master container key from the remote server.

    [0030] Figure 4 is a flow diagram showing a method 400 performed by the application 110 of Figure 1 to control access to the application data 114 associated with the application 110 in accordance with the policies defined in the policy data 118 and key data 120. First, the application runtime 112 determines the current credential state for the application 110 [step 402]. In this respect, step 402 may, for example, be performed in response to receipt of one or more credentials, or in response to a request from the application runtime 112 to access the application data 114. Next, the application runtime 112 accesses the credential meta-data stored in the first key data structure 300 and determines the highest access level associated with the current authentication state [step 404]. Next, the application runtime 112 decrypts the access level key stored in the first key data structure 300 and corresponding to the determined access level using the corresponding credential combination [step 406]. Once the access level key corresponding to the determined access level has been decrypted, the application runtime 112 uses the access level key to decrypt the container key corresponding to the identified access level [step 408] and the access level keys for all subordinate access levels relative to the determined access level [step 410]. Next, the application runtime 112 uses the subordinate access level keys obtained at step 410 to decrypt the container keys associated with the subordinate access levels [step 412]. Finally, the application runtime 112 uses the container keys obtained in steps 408 and 412 to decrypt the corresponding containers 114-1 to 114-4 in the application data 114 and provide access to the application data 114 stored therein.

    [0031] According to some embodiments, the method 400 of Figure 4 may be performed in response to a request to store or access data associated with a particular data category. In this case, the application runtime 112 may determine, at step 404, whether the current authentication state includes the credential combination corresponding to the particular data category. If the current authentication state does not include the required credential combination, the application runtime 112 may prompt the user to supply one or more additional credentials, or inform the user that access to the required access level is not available.

    [0032] According to some embodiments, the application 110 may be installed on computing device 100 in an inactive state. In such embodiments, the key data 120 may be generated as part of an activation process for the application 110 and in accordance with the policies defined in the policy data 118. In this respect, the application runtime 112 may be configured to prompt the user of the computing device 100 for one or more credentials as specified in the credential policy stored in policy data 118. Upon receipt of the one or more credentials, the application runtime 112 generates a plurality of access level keys in accordance with the credential policy and a plurality of container keys in accordance with the access policy, and creates the first key data structure 300. Once the access level keys have been generated, the application runtime 112 generates the second key data structure 320 shown in Figure 3B by encrypting the plurality of container keys using the access level keys and in accordance with the access policy defined in policy 118. Once the container keys have been generated, the respective containers 114-1 to 114-4 can be created or initialized for storage of application data 114.

    [0033] As discussed above, according to some embodiments the management container stored in management data 116 may be assigned to a particular access level and encrypted by the corresponding access level key. Thus, when the current authentication state does not permit access to the access level assigned to the management container, the application runtime 112 is unable to access configuration settings stored in the management data 116. To address this, the application 110 may be configured with separate control data 130 which is assigned to the lowest access level (L0), as shown in the embodiment of Figure 5. According to such embodiments, the control data 130 is accessible to the application runtime 112 irrespective of the current authentication state. In this manner, the control data 130 may be used to store low sensitivity configuration data that ensures a prescribed minimum level of configuration data is available to the application at all times. For example, where the application 110 is managed by a remote server, the control data may include one or more credentials required to initiate a communication session with remote server, thereby ensuring that the remote server can perform critical operations (e.g. to initialize a remote wipe of the application data 114) in respect of the application even if the management container 116 remains in a locked state. It will be appreciated that the credentials stored in the control data 130 may permit only a limited subset of management functionality appropriate for the L0 access level, whereas the management data 116 may be used to stored credentials which allow the application to initiate a relatively less restricted communication session with the remote server.

    [0034] According to some embodiments, the application 110 may be generate one or more logs 128-1 to 128-4 corresponding to the respective access levels defined in the policy data 118 and encrypted by the corresponding access level key stored in the key data 120, as shown in Figure 6. The inclusion of access level specific logging ensures that the application 110 is able to stored audit and debug information regardless of the current authentication state of the application 110. When required, the logs 128-1 to 128-4 may be aggregated and uploaded to a remote server as required.

    [0035] In one use case, the computing device 100 takes the form of a portable computing device. An example of a portable computing 700 device according to an embodiment is shown schematically in Figure 7. The portable computing device 700 may, for example, take the form of a cellular phone, a smart phone, a personal digital assistance (PDA), a tablet computer, a wearable computing device, a notebook computer, or the like. The portable computing device 700 includes a screen 702, which may be a touch screen for receipt of input from a user. Alternatively or additionally, the portable computing device 700 may include a physical keyboard (not shown), which may be integral to the portable computing device 700 or connected wirelessly or by wired connection to the portable computing device 700. The portable computing device 700 further includes a processor 704, a non-volatile (i.e. persistent) storage component 706 (such as a hard disk drive or a solid-state drive) and a volatile (i.e. non-persistent) storage component in the form of random access memory (RAM) 708. The processor, in association with an operating system, executes instructions stored in the random access memory 708 that have been loaded from the non-volatile storage device 706. These instructions are in the form of one or more processes that implement an application 710, such as the application 110 described above with reference to Figures 1 to 6. The random access memory 708 is also used by processes running on the processor 704 as a means for storing and accessing data in the form of electronic signals where the data is used during the execution of the processes. The operating system provides a file system for storing, modifying and accessing files held in the non-volatile storage device 706, such as the application data 114 associated with the application 110 described above with reference to Figures 1 to 6. The file system may be accessible to other process running on the processor 704 via the operating system. Processes running on the processor 704 also process user input obtained via the screen 702 or keyboard (not shown), etc. The portable computing device 700 also includes a network interface 714 (or a plurality of network interfaces) which allow processes running on the processor 704 to transmit and receive data to and from other devices and/or servers via a communications, using wired and/or wireless connections. Typically, the network interface 714 is implemented in a combination of software and hardware (e.g. a network interface controller) to provide the necessary network connectivity to the processes running on the processor 704. Examples of network interface 714 include a Wi-Fi™ interface and/or a cellular radio utilizing standards such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Code Division Multiple Access (CDMA), Long Term Evolution (LTE), or the like. The portable computing device 700 may also include a local communications interface 716, such as a Bluetooth™ interface or an NFC™ interface. The local communications interface 716 may also be implemented in a combination of software and hardware and provide connectivity to one or more additional computing devices in the vicinity of the portable computing device 700.

    [0036] According to some embodiments, the interfaces 126 providing the operating system may provide functionality for receiving data via one or more hardware functions provided by the computing device 100. For example, one of the interfaces provided by the operating system 124 may provide functionality for receiving user input via a touchscreen, keyboard, pointer device, fingerprint scanner, camera or microphone of the computing device 100. Moreover, another of the interfaces provided by the operating system 124 may provide functionality for obtaining information regarding the current environment in which the device is operating, such as location of the computing device (e.g. via GPS module of the computing device 100), or a current network to which the computing device is connected. As discussed above, the application runtime 112 may communicate with the one or more interfaces 126 provided by the operating system 124 to receive one or more credentials for use in unlocking the application data 114. In this respect, the one or more credentials may include a password or passcode credential input by the user of the computing device 100, a biometric credential such as a fingerprint scan, voice scan or an iris scan of the user of the computing device 100, a gesture credential such as a gesture input via a touchscreen or camera associated with the computing device 100, or an environment credential such as a network identifier for a LAN to which the computing device 100 is currently connected. It will be understood from the embodiments described above, that the term "combination of credentials" encompasses a single credential or a plurality of credentials.

    [0037] As discussed above, the application data 114 stored by the application 110 may include any data utilized or generated by the application runtime 112 during execution. It will therefore be apparent that the term "application data" encompasses a wide range of data types and data formats. For example, the application data 114 may include text data, email data, image data, audio data and/or video data, or any combination thereof. Similarly, the application data 114 may include corporate data and/or personal data depending on the usage of the application.

    [0038] According to some embodiments, the credential policy defined by the second policy data structure 220 of Figure 2B can optionally specify a plurality of alternative credential combinations for one or more of the access levels. For example, for a given access level, the policy data structure 220 may include a plurality of rows specifying a plurality of respective alternative credential combinations for the given access level. In this example, the first key data structure 300 would similarly include a plurality of rows for the given access level, with each row corresponding to the respective alternative credential combinations specified in the second policy data structure 220. In this manner, the application runtime 112 is able to determine whether the current authentication state comprises one of the alternative credential combinations defined for the particular access level and decrypt the corresponding encrypted access level key.

    [0039] It will be appreciated that at least parts of the methods and techniques discussed above with reference to Figures 1 to 7 may be implemented using software instructions stored on a computer useable storage medium for execution by a computing device. As an example, an embodiment of a computer program product includes a computer useable storage medium to store a computer readable program that, when executed on a computing device, causes the computing device to perform operations, as described hereinbefore. Furthermore, embodiments can be embodied in the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computing device or any instruction execution system. For the purposes of this description, a computer-usable or computer-readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The apparatus may be a transitory or a non-transitory computer-readable medium. For example, the computer-useable or computer-readable medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device), or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include a compact disk with read only memory (CD-ROM), a compact disk with read/write (CD-R/W), and a digital versatile disk (DVD).

    [0040] The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.


    Claims

    1. A method of controlling access to application data (114-1...114-4) associated with an application (110) including an application runtime (112) and configured on a computing device (100) including an operating system (124) and a network interface (714), the method being performable by the application runtime (112) and comprising:

    storing data comprising, for each of a plurality of access levels (L0...L3) associated with the application (110), first data (306-0B...306-3B) indicative of a credential or a combination of credentials associated with the respective access level (L0...L3) and an access level key (306-0A...306-3A) corresponding to the respective access level (LI...L3), the credentials or combinations of credential associated with different respective access levels (L0...L3) being different from each other, and the access level key (306-0A...306-3A) corresponding to the respective access level (L1...L3) being encrypted by the credential or combination of credentials associated with the respective access level (L0...L3), the stored data further including:

    a master key (326-3D) received, via the network interface (714), from a server remote from the computing device (100) and encrypted by the access level key (306-3A) corresponding to a current highest access level (L3) associated with the application (110), and

    a copy (324) of the access level key (306-3A) associated with the current highest access level (L3) encrypted by the master key (326-3D);

    receiving (402), via one or more interfaces (126) provided by the operating system (124), a credential or a combination of credentials available to the application (110);

    determining (404), based on the first data, an access level (L3) in the plurality of access levels (L0...L3) corresponding to the received credential or combination of credentials available to the application (110);

    decrypting (406) the access level key (306-3A) in the stored data corresponding to the determined access level (L3) using the received credential or combination of credentials available to the application (110); and

    providing access (408, 414) to encrypted application data (114-4) associated with the application (110) and corresponding to the determined access level (L3) using, at least in part, the decrypted access level key (306-3A) corresponding to the determined access level (L3);

    wherein the stored data comprises, for the determined access level (L3), one or more access level keys (326-3B) corresponding to one or more access levels (L0...L2) in the plurality of access levels (L1 - L3) which are subordinate to the determined access level (L3), each of which is encrypted using the access level key (306-3A) corresponding to the determined access level (L3), and the method comprising:

    decrypting (412) the one or more access level keys (326-3B) corresponding to the one or more access levels (L0...L2) subordinate to the determined access level (L3) using the decrypted access level key (306-3A) corresponding to the determined access level (L3); and

    providing access (414) to encrypted application data (114-2, 114-3) associated with the application (110) and corresponding to the one or more subordinate access levels (L0...L2) using, at least in part, the one or more decrypted access level keys (326-3B) corresponding to the one or more access levels (L1...L2) subordinate to the determined access level (L3);

    and wherein the method further comprises:

    in response to an instruction to create a new access level associated with the application (110) above the current highest access level (L3), receiving, via the one or more interfaces (126), a new credential or combination of credentials corresponding to the new access level associated with the application (110);

    generating a new access level key corresponding to the new highest access level based, at least in part, on the received new credential or combination of credentials;

    storing in the stored data the new access level key encrypted by the new credential or combination of credentials;

    obtaining the credential or combination of credentials associated with the former highest access level (L3) and decrypting (406) the access level key (306-3A) corresponding to the former highest access level (L3) using the obtained credential or combination of credentials;

    decrypting the stored master key (326-3D) using the decrypted access level key (326-3B) corresponding to the former highest access level (L3); and

    storing in the stored data a copy of the new access level key corresponding to the new highest access level encrypted by the decrypted master key (326-D).


     
    2. The method of claim 1, wherein the stored data comprises, for each of the plurality of access levels (L0...L3) associated with the application (110), one or more application data keys (326-OA...326-3A) corresponding to the respective access level (L0...L3), each of which is encrypted by the access level key (306-0A...306-3A) corresponding to the respective access level (L0...L3), the method comprising:

    decrypting (410) the one or more application data keys (326-03A) corresponding to the determined access level (L3) using the decrypted access level key (306-3A) corresponding to the determined access level (L3);

    decrypting (412) the one or more application data keys (326-OA...326-2A) corresponding to the one or more access levels (L0...L2) subordinate to the determined access level (L3) using the one or more decrypted access level keys (326-OB...326-2B) corresponding to the one or more access levels (L0...L2) subordinate to the determined access level (L3);

    decrypting (414) the encrypted application data (114-4) associated with the application (110) and corresponding to the determined access level (L3) using the one or more decrypted application data keys (326-3A); and

    decrypting (414) the encrypted application data (114-1...114-3) associated with the application (110) and corresponding to the one or more access levels (L0...L2) subordinate to the determined access level (L3) using the one or more decrypted application data keys (326-OA...326-2A) corresponding to the one or more access levels (L0...L2) subordinate to the determined access level (L3).


     
    3. The method of claim 1, wherein the method further comprises:

    encrypting the decrypted master key (326-3D) using the new access level key corresponding to the new highest access level; and

    storing the encrypted master key in association with the new access level in the stored data.


     
    4. The method of claim 1, wherein the instruction to create a new access level is received from said remote server.
     
    5. The method of any preceding claim, wherein the first data comprises meta-data (306-0B...306-3B) indicative of the credential or combination of credentials associated with the respective access level (L1...L3).
     
    6. A non-transitory computer-readable storage medium comprising computer-executable instructions which, when executed by a processor (704), causes a computing device (700) to perform the method of any preceding claim.
     
    7. A computing device (700) comprising a processor (704) and a storage medium (706) for storing data, the computing device being configured to control access to application data (114) associated with an application (110) executable on the computing device by carrying out the method of any one of claims 1 to 5.
     


    Ansprüche

    1. Verfahren zum Steuern des Zugriffs auf Anwendungsdaten (114-1 ... 114-4), die einer Anwendung (110) zugeordnet sind, die eine Anwendungslaufzeit (112) enthält und auf einem Computergerät (100) konfiguriert ist, das ein Betriebssystem (124) und eine Netzwerkschnittstelle (714) umfasst, wobei das Verfahren von der Anwendungslaufzeit (112) ausgeführt werden kann und Folgendes umfasst:
    Speichern von Daten, umfassend für jede von mehreren Zugriffsebenen (L0 ... L3), die der Anwendung (110) zugeordnet sind, erste Daten (306-0B ... 306-3B), die einen Berechtigungsnachweis oder eine Kombination von Berechtigungsnachweisen angeben, die der jeweiligen Zugriffsebene (L0 ... L3) zugeordnet sind, und einen Zugriffsebenenschlüssel (306-0A ... 306-3A), der der jeweiligen Zugriffsebene (L1 ... L3) entspricht, wobei die den verschiedenen jeweiligen Zugriffsebenen (L0 ... L3) zugeordneten Berechtigungsnachweise oder Kombinationen von Berechtigungsnachweisen voneinander verschieden sind und wobei der Zugriffsebenenschlüssel (306-0A ... 306-3A), der der jeweiligen Zugriffsebene (L1 ... L3) entspricht, durch den Berechtigungsnachweis oder die Kombination von Berechtigungsnachweisen verschlüsselt wird, die der jeweiligen Zugriffsebene (L0 ... L3) zugeordnet sind, wobei die gespeicherten Daten ferner Folgendes umfassen:

    einen Hauptschlüssel (326-3D), der über die Netzwerkschnittstelle (714) von einem von dem Computergerät (100) entfernten Server empfangen und durch den Zugriffsebenenschlüssel (306-3A) verschlüsselt ist, der einer aktuell höchsten Zugriffsebene (L3) entspricht, die der Anwendung (110) zugeordnet ist, und eine Kopie (324) des Zugriffsebenenschlüssels (306-3A), der der aktuell höchsten Zugriffsebene (L3) zugeordnet ist, die durch den Hauptschlüssel (326-3D) verschlüsselt ist;

    Empfangen (402), über eine oder mehrere Schnittstellen (126), die vom Betriebssystem (124) bereitgestellt werden, eines Berechtigungsnachweises oder einer Kombination von Berechtigungsnachweisen, die der Anwendung (110) zur Verfügung stehen;

    Ermitteln (404), basierend auf den ersten Daten, einer Zugriffsebene (L3) in den mehreren Zugriffsebenen (L0 ... L3) entsprechend dem empfangenen Berechtigungsnachweis oder der Kombination von Berechtigungsnachweisen, die der Anwendung (110) zur Verfügung stehen;

    Entschlüsseln (406) des Zugriffsebenenschlüssels (306-3A) in den gespeicherten Daten, die der ermittelten Zugriffsebene (L3) entsprechen, unter Verwendung des empfangenen Berechtigungsnachweises oder einer Kombination von Berechtigungsnachweisen, die der Anwendung (110) zur Verfügung stehen; und

    Bereitstellen des Zugriffs (408, 414) auf verschlüsselte Anwendungsdaten (114-4), die der Anwendung (110) zugeordnet sind und der ermittelten Zugriffsebene (L3) entsprechen, zumindest teilweise unter Verwendung des entschlüsselten Zugriffsebenenschlüssels (306-3A), der der ermittelten Zugriffsebene (L3) entspricht;

    wobei die gespeicherten Daten für die ermittelte Zugriffsebene (L3) einen oder mehrere Zugriffsebenenschlüssel (326-3B) umfassen, die einer oder mehreren Zugriffsebenen (L0 ... L2) in den mehreren Zugriffsebenen (L1 - L3) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind, von denen jede mit dem der ermittelten Zugriffsebene (L3) entsprechenden Zugriffsebenenschlüssel (306-3A) verschlüsselt ist, und wobei das Verfahren Folgendes umfasst:

    Entschlüsseln (412) des einen oder mehrerer Zugriffsebenenschlüssel (326-3B), die der einen oder mehreren Zugriffsebenen (L0 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind, unter Verwendung des entschlüsselten Zugriffsebenenschlüssels (306-3A), der der ermittelten Zugriffsebene (L3) entspricht; und

    Bereitstellen (414) des Zugriffs (414) auf verschlüsselte Anwendungsdaten (114-2, 114-3), die der Anwendung (110) zugeordnet sind und der einen oder mehreren untergeordneten Zugriffsebenen (L0 ... L2) entsprechen, zumindest teilweise unter Verwendung des einen oder der mehreren entschlüsselten Zugriffsebenenschlüssel (326-3B), die der einen oder den mehreren Zugriffsebenen (L1 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind; und

    wobei das Verfahren ferner Folgendes umfasst:

    als Reaktion auf einen Befehl zum Erstellen einer neuen Zugriffsebene, die der Anwendung (110) zugeordnet ist, oberhalb der derzeit höchsten Zugriffsebene (L3), Empfangen eines neuen Berechtigungsnachweises oder einer Kombination von Berechtigungsnachweisen, die der neuen, der Anwendung (110) zugeordneten Zugriffsebene entsprechen, über die eine oder mehrere Schnittstellen (126);

    Generieren eines neuen Zugriffsebenenschlüssels, der der neuen höchsten Zugriffsebene entspricht, zumindest teilweise basierend auf dem empfangenen neuen Berechtigungsnachweis oder einer Kombination von Berechtigungsnachweisen;

    Speichern, in den gespeicherten Daten, des neuen Zugriffsebenenschlüssels, der durch den neuen Berechtigungsnachweis oder eine Kombination von Berechtigungsnachweisen verschlüsselt ist;

    Erhalten des Berechtigungsnachweises oder der Kombination von Berechtigungsnachweisen, die der zuvor höchsten Zugriffsebene (L3) zugeordnet sind, und Entschlüsseln (406) des Zugriffsebenenschlüssels (306-3A), der der zuvor höchsten Zugriffsebene (L3) entspricht, unter Verwendung des erhaltenen Berechtigungsnachweises oder der Kombination von Berechtigungsnachweisen;

    Entschlüsseln des gespeicherten Hauptschlüssels (326-3D) unter Verwendung des entschlüsselten Zugriffsebenenschlüssels (326-3B), der der zuvor höchsten Zugriffsebene (L3) entspricht; und

    Speichern, in den gespeicherten Daten, einer Kopie des neuen Zugriffsebenenschlüssels, der der neuen höchsten Zugriffsebene entspricht, die durch den entschlüsselten Hauptschlüssel (326-D) verschlüsselt ist.


     
    2. Verfahren nach Anspruch 1, wobei die gespeicherten Daten für jede der mehreren Zugriffsebenen (L0 ... L3), die der Anwendung (110) zugeordnet sind, einen oder mehrere Anwendungsdatenschlüssel (326-0A ... 326-3A), die der jeweiligen Zugriffsebene (L0 ... L3) entsprechen, umfassen, von denen jeder durch den Zugriffsebenenschlüssel (306-0A ... 306-3A), der der jeweiligen Zugriffsebene (L0 ... L3) entspricht, verschlüsselt ist, wobei das Verfahren Folgendes umfasst:

    Entschlüsseln (410) des einen oder mehrerer Anwendungsdatenschlüssel (326-03A), die der ermittelten Zugriffsebene (L3) entsprechen, unter Verwendung des entschlüsselten Zugriffsebenenschlüssels (306-3A), der der ermittelten Zugriffsebene (L3) entspricht;

    Entschlüsseln (412) des einen oder der mehreren Anwendungsdatenschlüssel (326-0A ... 326-2A), die der einen oder den mehreren Zugriffsebenen (L0 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind, unter Verwendung des einen oder der mehreren entschlüsselten Zugriffsebenenschlüssel (326-0B ... 326-2B), die der einen oder den mehreren Zugriffsebenen (L0 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind;

    Entschlüsseln (414) der verschlüsselten Anwendungsdaten (114-4), die der Anwendung (110) zugeordnet sind und der ermittelten Zugriffsebene (L3) entsprechen, unter Verwendung des einen oder mehrerer entschlüsselter Anwendungsdatenschlüssel (326-3A); und

    Entschlüsseln (414) der verschlüsselten Anwendungsdaten (114-1 ... 114-3), die der Anwendung (110) zugeordnet sind und der einen oder mehreren Zugriffsebenen (L0 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind, unter Verwendung des einen oder der mehreren entschlüsselten Anwendungsdatenschlüssel (326-0A ... 326-2A), die der einen oder den mehreren Zugriffsebenen (L0 ... L2) entsprechen, die der ermittelten Zugriffsebene (L3) untergeordnet sind.


     
    3. Verfahren nach Anspruch 1, wobei das Verfahren ferner Folgendes umfasst:

    Verschlüsseln des entschlüsselten Hauptschlüssels (326-3D) mit dem neuen Zugriffsebenenschlüssel, der der neuen höchsten Zugriffsebene entspricht; und

    Speichern des verschlüsselten Hauptschlüssels in Verbindung mit der neuen Zugriffsebene in den gespeicherten Daten.


     
    4. Verfahren nach Anspruch 1, wobei der Befehl zum Erstellen einer neuen Zugriffsebene von dem entfernten Server empfangen wird.
     
    5. Verfahren nach einem der vorhergehenden Ansprüche, wobei die ersten Daten Metadaten (306-0B ... 306-3B) umfassen, die den Berechtigungsnachweis oder die Kombination von Berechtigungsnachweisen angeben, die der jeweiligen Zugriffsebene (L1 ... L3) zugeordnet sind.
     
    6. Nichtflüchtiges, computerlesbares Speichermedium, umfassend computerausführbare Befehle, die bei ihrer Ausführung durch einen Prozessor (704) ein Computergerät (700) veranlassen, das Verfahren nach einem der vorhergehenden Ansprüche auszuführen.
     
    7. Computergerät (700), umfassend einen Prozessor (704) und ein Speichermedium (706) zum Speichern von Daten, wobei das Computergerät derart konfiguriert ist, dass es den Zugriff auf Anwendungsdaten (114), die einer auf dem Computergerät ausführbaren Anwendung (110) zugeordnet sind, durch Ausführen des Verfahrens nach einem der Ansprüche 1 bis 5 steuert.
     


    Revendications

    1. Procédé de contrôle d'accès à des données d'application (114-1...114-4) associées à une application (110) comportant un runtime de l'application (112) et configuré sur un dispositif informatique (100) comportant un système d'exploitation (124) et une interface réseau (714), le procédé pouvant être exécuté par le runtime de l'application (112) et comprenant :
    le stockage des données comprenant, pour chacun d'une pluralité de niveaux d'accès (L0...L3) associés à l'application (110), des premières données (306-0B...306-3B) indiquant une information d'identification ou une combinaison d'informations d'identifications associées au niveau d'accès respectif (L0...L3) et une clé de niveau d'accès (306-0A...306-3A) correspondant au niveau d'accès respectif (L1...L3), les informations d'identification ou les combinaisons d'informations d'identification associées à différents niveaux d'accès respectifs (L0...L3) étant différents les unes des autres, et la clé de niveau d'accès (306-0A...306-3A) correspondant au niveau d'accès respectif (L1...L3) étant chiffrée par les informations d'identification ou une combinaison d'informations d'identification associées au niveau d'accès respectif (L0...L3), les données stockées comprenant en outre :

    une clé principale (326-3D) reçue, par l'intermédiaire de l'interface réseau (714), d'un serveur distant du dispositif informatique (100) et chiffrée par la clé de niveau d'accès (306-3A) correspondant à un niveau d'accès le plus élevé actuel (L3) associé à l'application (110), et une copie (324) de la clé de niveau d'accès (306-3A) associée au niveau d'accès le plus élevé actuel (L3) chiffré par la clé principale (326-3D) ;

    la réception (402), par l'intermédiaire d'une ou de plusieurs interfaces (126) fournies par le système d'exploitation (124), d'une information d'identification ou d'une combinaison d'informations d'identification disponibles pour l'application (110) ;

    la détermination (404), sur la base des premières données, d'un niveau d'accès (L3) dans la pluralité de niveaux d'accès (L0...L3) correspondant aux informations d'identification reçues ou à la combinaison d'informations d'identification disponibles pour l'application (110) ;

    le déchiffrement (406) de la clé de niveau d'accès (306-3A) dans les données stockées correspondant au niveau d'accès déterminé (L3) au moyen des informations d'identification reçues ou de la combinaison d'informations d'identification disponibles pour l'application (110) ; et

    la fourniture d'un accès (408, 414) aux données d'application chiffrées (114-4) associées à l'application (110) et correspondant au niveau d'accès déterminé (L3) au moyen, au moins en partie, de la clé de niveau d'accès déchiffrée (306-3A) correspondant au niveau d'accès déterminé (L3) ;

    dans lequel les données stockées comprennent, pour le niveau d'accès déterminé (L3), une ou plusieurs clés de niveau d'accès (326-3B) correspondant à un ou plusieurs niveaux d'accès (L0...L2) dans la pluralité de niveaux d'accès (L1 - L3) qui sont subordonnés au niveau d'accès déterminé (L3), dont chacun est chiffré au moyen de la clé de niveau d'accès (306-3A) correspondant au niveau d'accès déterminé (L3), et le procédé comprenant :

    le déchiffrement (412) de la ou des clés de niveau d'accès (326-3B) correspondant au ou aux niveaux d'accès (L0...L2) subordonnés au niveau d'accès déterminé (L3) au moyen de la clé de niveau d'accès déchiffrée (306-3A) correspondant au niveau d'accès déterminé (L3) ; et

    la fourniture d'un accès (414) aux données d'application chiffrées (114-2, 114-3) associées à l'application (110) et correspondant au ou aux niveaux d'accès subordonnés (L0...L2) au moyen, au moins en partie, de la ou des clés de niveau d'accès déchiffrées (326-3B) correspondant au ou aux niveaux d'accès (L1...L2) subordonnés au niveau d'accès déterminé (L3) ; et

    le procédé comprenant en outre :

    en réponse à une instruction de création d'un nouveau niveau d'accès associé à l'application (110) au-dessus du niveau d'accès le plus élevé actuel (L3), la réception, par l'intermédiaire de la ou des interfaces (126), d'une nouvelle information d'identification ou d'une combinaison d'informations d'identification correspondant au nouveau niveau d'accès associé à l'application (110) ;

    la génération d'une nouvelle clé de niveau d'accès correspondant au nouveau niveau d'accès le plus élevé sur la base, au moins en partie, des nouvelles informations d'identification ou de la combinaison d'informations d'identification reçues ;

    le stockage, dans les données stockées, de la nouvelle clé de niveau d'accès chiffrée par les nouvelles informations d'identification ou la combinaison d'informations d'identification ;

    l'obtention des informations d'identification ou de la combinaison d'informations d'identification associées à l'ancien niveau d'accès le plus élevé (L3) et le déchiffrement (406) de la clé de niveau d'accès (306-3A) correspondant à l'ancien niveau d'accès le plus élevé (L3) au moyen des informations d'identification ou de la combinaison d'informations d'identification obtenues ;

    le déchiffrement de la clé principale stockée (326-3D) au moyen de la clé de niveau d'accès déchiffrée (326-3B) correspondant à l'ancien niveau d'accès le plus élevé (L3) ; et

    le stockage, dans les données stockées, d'une copie de la nouvelle clé de niveau d'accès correspondant au nouveau niveau d'accès le plus élevé chiffré par la clé principale déchiffrée (326-D).


     
    2. Procédé selon la revendication 1, dans lequel les données stockées comprennent, pour chacun de la pluralité de niveaux d'accès (L0...L3) associés à l'application (110), une ou plusieurs clés de données d'application (326-0A...326-3A) correspondant au niveau d'accès respectif (L0...L3), dont chacune est chiffrée par la clé de niveau d'accès (306-0A...306-3A) correspondant au niveau d'accès respectif (L0...L3), le procédé comprenant :

    le déchiffrement (410) de la ou des clés de données d'application (326-03A) correspondant au niveau d'accès déterminé (L3) au moyen de la clé de niveau d'accès déchiffrée (306-3A) correspondant au niveau d'accès déterminé (L3) ;

    le déchiffrement (412) de la ou des clés de données d'application (326-0A...326-2A) correspondant au ou aux niveaux d'accès (L0...L2) subordonnés au niveau d'accès déterminé (L3) au moyen de la ou des clés de niveau d'accès déchiffrées (326-0B...326-2B) correspondant au ou aux niveaux d'accès (L0...L2) subordonnés au niveau d'accès déterminé (L3) ;

    le déchiffrement (414) des données d'application chiffrées (114-4) associées à l'application (110) et correspondant au niveau d'accès déterminé (L3) au moyen d'une ou de plusieurs clés de données d'application déchiffrées (326-3A) ; et

    le déchiffrement (414) des données d'application chiffrées (114-1...114-3) associées à l'application (110) et correspondant au ou aux niveaux d'accès (L0...L2) subordonnés au niveau d'accès déterminé (L3) au moyen de la ou des clés de données d'application déchiffrées (326-0A...326-2A) correspondant au ou aux niveaux d'accès (L0...L2) subordonnés au niveau d'accès déterminé (L3).


     
    3. Procédé selon la revendication 1, le procédé comprenant en outre :

    le chiffrement de la clé principale déchiffrée (326-3D) au moyen de la nouvelle clé de niveau d'accès correspondant au nouveau niveau d'accès le plus élevé ; et

    le stockage de la clé principale chiffrée en association avec le nouveau niveau d'accès dans les données stockées.


     
    4. Procédé selon la revendication 1, dans lequel l'instruction de création d'un nouveau niveau d'accès est reçue dudit serveur distant.
     
    5. Procédé selon une quelconque revendication précédente, dans lequel les premières données comprennent des métadonnées (306-0B...306-3B) indiquant les informations d'identification ou la combinaison d'informations d'identification associées au niveau d'accès respectif (L1 ...L3).
     
    6. Support de stockage non transitoire lisible par ordinateur comprenant des instructions exécutables par ordinateur qui, lorsqu'elles sont exécutées par un processeur (704), amènent un dispositif informatique (700) à exécuter le procédé selon une quelconque revendication précédente.
     
    7. Dispositif informatique (700) comprenant un processeur (704) et un support de stockage (706) destiné à stocker des données, le dispositif informatique étant configuré pour contrôler l'accès aux données d'application (114) associées à une application (110) exécutable sur le dispositif informatique par la mise en Ĺ“uvre du procédé selon l'une quelconque des revendications 1 à 5.
     




    Drawing





























    Cited references

    REFERENCES CITED IN THE DESCRIPTION



    This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

    Patent documents cited in the description