# US 10,372,921 B2 · Dynamic security policies

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,921 B2
- Document ID: US10372921B2
- Status: Granted
- Kind: B2
- Application number: 15/459,378
- Filed: 2017-03-15
- Published: 2018-09-20
- Granted: 2019-08-06
- Earliest claimed: 2017-03-15
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Sergio Jose Deras Arreola; Alejandra Sarahi Galindo Copado; Victor Adrian Sosa Herrera
- Web page: https://patentgrep.com/patent/US10372921B2

## CPC

- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/31: User authentication
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04W 12/06: Authentication
- H04W 12/08: Access security
- H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications
- G06F 2221/2149: Restricted operating environment
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Approaches presented herein enable dynamic security policies through a plurality of application profiles. More specifically, a mobile device can open a profile of a plurality of profiles, each associated with an unlock credential and a security scope, in response to an unlock credential associated with that profile. All these profiles can be opened in a single user session and can be swapped within the session in response to an unlock credential corresponding to the desired profile. When the mobile device receives a request to open a digital item, the digital item is compared to a security scope of the opened profile to determine whether access to the digital item is permitted, and, in response to the determination, access to the digital item is permitted or denied. A list of digital items permitted to be accessed in each profile can be synchronized to a list received from a mobile device manager.

## Claims

### Claim 1

A computer-implemented method for dynamic security policies, the computer-implemented method comprising:
establishing a plurality of profiles within a user account on a mobile device, wherein each profile corresponds to a different unlock credential of a plurality of unlock credentials associated with the user account and each profile is associated with a security scope of a plurality of security scopes within the user account;
unlocking the user account on the mobile device in response to receipt of a first unlock credential of the plurality of unlock credentials;
opening, in response to the first unlock credential, a first profile of the plurality of profiles corresponding with the first unlock credential on the mobile device, wherein the opened first profile can be swapped dynamically for a different profile of the plurality of profiles within a same user session in response to receipt of a different unlock credential of the plurality of unlock credentials;
receiving a request to open a digital item on the mobile device;
determining, by comparing the requested digital item to a security scope of the plurality of security scopes associated with the opened first profile, whether access to the digital item is permitted;
issuing a request, subsequent to access to the digital item being denied under all security scopes of the plurality of security scopes associated with the opened first profile, for a second unlock credential associated with a second profile having a security scope permitting access to the requested digital item;
replacing the first profile with the second profile in the same user session responsive to receipt of the second unlock credential; and
permitting access to the digital item responsive to the replacement.

### Claim 2 (depends on 1)

The method of claim 1, the method further comprising:
responsive to access to the digital item being allowed, opening the digital item; and
responsive to access to the digital item not being allowed, providing an error message.

### Claim 3 (depends on 1)

The method of claim 1, the method further comprising:
capturing the unlock credential used to unlock the user account;
identifying the opened profile of the plurality of profiles based on correspondence to the captured unlock credential; and
performing the opening of the profile in response to the identifying.

### Claim 4 (depends on 1)

The method of claim 1, the method further comprising, responsive to access to the digital item being denied, displaying an error message to the user, the error message being a message type selected from the group consisting of: a textual message, a displayed error symbol, a sound, and a haptic vibration.

### Claim 5 (depends on 1)

The method of claim 1, wherein at least one security scope of the plurality of security scopes comprises a list of digital items stored on the mobile device to which access is allowed for that security scope.

### Claim 6 (depends on 5)

The method of claim 5, the method further comprising:
receiving a list of digital items designated as requiring an enhanced security mechanism from a mobile device manager at a client of the mobile device; and
synchronizing the list of designated digital items to the at least one security scope, wherein the mobile device is registered to the mobile device manager through the client.

### Claim 7 (depends on 1)

The method of claim 1, wherein the mobile device comprises a plurality of digital items stored thereon, wherein the plurality of digital items comprises at least an application or sensitive information, and wherein each digital item is assigned to at least one profile of the plurality of profiles.

### Claim 8 (depends on 1)

The method of claim 1, wherein at least one of the plurality of unlock credentials is a type of unlock credential selected from the group consisting of: a password, a passcode, a PIN, a pattern, and a biometric.

### Claim 9

A computer system for dynamic security policies, the computer system comprising:
a memory medium comprising program instructions, the program instruction comprising a plurality of profiles within a user account on a the computer system, wherein each profile corresponds to a different unlock credential of a plurality of unlock credentials associated with the user account and each profile is associated with a security scope of a plurality of security scopes within the user account;
a bus coupled to the memory medium; and
a processor, for executing the program instructions, coupled to an applications profile manager via the bus that when executing the program instructions causes the system to:
unlock the user account in response to receipt of an unlock credential of the plurality of unlock credentials;
open, in response to the unlock credential, a profile of the plurality of profiles corresponding with the unlock credential, wherein the opened profile can be swapped dynamically for a different profile of the plurality of profiles within a same user session in response to receipt of a different unlock credential of the plurality of unlock credentials;
receive a request to open a digital item on the computer system;
determine, by comparing the requested digital item to a security scope of the plurality of security scopes associated with the opened profile, whether access to the digital item is permitted;
issue a request, subsequent to access to the digital item being denied under all security scopes of the plurality of security scopes associated with the opened first profile, for a second unlock credential associated with a second profile having a security scope permitting access to the requested digital item;
replace the first profile with the second profile in the same user session responsive to receipt of the second unlock credential; and
permit access to the digital item responsive to the replacement.

### Claim 10 (depends on 9)

The computer system of claim 9, the instructions further causing the system to:
responsive to access to the digital item being allowed, open the digital item; and
responsive to access to the digital item not being allowed, provide an error message.

### Claim 11 (depends on 9)

The computer system of claim 9, the instructions further causing the system to:
capture the unlock credential used to unlock the user account;
identify the opened profile of the plurality of profiles based on correspondence to the captured unlock credential; and
perform the opening of the profile in response to the identifying.

### Claim 12 (depends on 9)

The computer system of claim 9, the instructions further causing the system, responsive to access to the digital item being denied, to display an error message to the user, the error message being a message type selected from the group consisting of: a textual message, a displayed error symbol, a sound, and a haptic vibration.

### Claim 13 (depends on 9)

The computer system of claim 9, wherein at least one security scope of the plurality of security scopes comprises a list of digital items stored on the computer system to which access is allowed for that security scope, wherein the instructions further cause the system to:
receive a list of digital items designated as requiring an enhanced security mechanism from a device manager at a client of the computer system; and
synchronize the list of designated digital items to the at least one security scope, wherein the computer system is registered to the device manager through the client.

### Claim 14 (depends on 9)

The computer system of claim 9, wherein the computer system comprises a plurality of digital items stored thereon, wherein the plurality of digital items comprises at least an application or sensitive information, and wherein each digital item is assigned to at least one profile of the plurality of profiles.

### Claim 15 (depends on 9)

The computer system of claim 9, wherein at least one of the plurality of unlock credentials is a type of unlock credential selected from the group consisting of: a password, a passcode, a PIN, a pattern, and a biometric.

### Claim 16

A computer program product for dynamic security policies, the computer program product comprising a computer readable hardware storage device having program instructions embodied therewith, the program instructions executable by a processor to:
establish a plurality of profiles within a user account on a mobile device, wherein each profile corresponds to a different unlock credential of a plurality of unlock credentials associated with the user account and each profile is associated with a security scope of a plurality of security scopes within the user account;
unlock the user account on the mobile device in response to receipt of an unlock credential of the plurality of unlock credentials;
open, in response to the unlock credential, a profile of the plurality of profiles corresponding with the unlock credential on the mobile device, wherein the opened profile can be swapped dynamically for a different profile of the plurality of profiles within a same user session in response to receipt of a different unlock credential of the plurality of unlock credentials;
receive a request to open a digital item on the mobile device;
determine, by comparing the requested digital item to a security scope of the plurality of security scopes associated with the opened profile, whether access to the digital item is permitted;
issue a request, subsequent to access to the digital item being denied under all security scopes of the plurality of security scopes associated with the opened first profile, for a second unlock credential associated with a second profile having a security scope permitting access to the requested digital item;
replace the first profile with the second profile in the same user session responsive to receipt of the second unlock credential; and
permit access to the digital item responsive to the replacement.

### Claim 17 (depends on 16)

The computer program product of claim 16, the computer readable storage device further comprising instructions to:
responsive to access to the digital item being allowed, open the digital item; and
responsive to access to the digital item not being allowed, provide an error message.

### Claim 18 (depends on 16)

The computer program product of claim 16, the computer readable storage device further comprising instructions to:
capture the unlock credential used to unlock the user account;
identify the opened profile of the plurality of profiles based on correspondence to the captured unlock credential; and
perform the opening of the profile in response to the identifying.

### Claim 19 (depends on 16)

The computer program product of claim 16, the computer readable storage device further comprising instructions, responsive to access to the digital item being denied, to display an error message to the user, the error message being a message type selected from the group consisting of: a textual message, a displayed error symbol, a sound, and a haptic vibration.

### Claim 20 (depends on 16)

The computer program product of claim 16, wherein at least one security scope of the plurality of security scopes comprises a list of digital items stored on the mobile device to which access is allowed for that security scope, wherein the computer readable storage device further comprises instructions to:
receive a list of digital items designated as requiring an enhanced security mechanism from a mobile device manager at a client of the mobile device; and synchronize the list of designated digital items to the at least one security scope, wherein the mobile device is registered to the mobile device manager through the client.