# US 9,519,765 B2 · Method and apparatus for differentiated access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,765 B2 - Document ID: US9519765B2 - Status: Granted - Kind: B2 - Application number: 14/727,357 - Filed: 2015-06-01 - Published: 2015-11-26 - Granted: 2016-12-13 - Earliest claimed: 2010-09-24 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: Michael Kenneth Brown; Christopher Lyle Bender; Herbert Anthony Little - Web page: https://patentgrep.com/patent/US9519765B2 ## CPC - G06F 21/31: User authentication - G06F 3/04817: using icons (graphical or visual programming using iconic symbols G06F8/34) - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 21/88: Detecting or preventing theft or loss - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 2221/2105: Dual mode as a secondary aspect - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F 2221/2137: Time limited access, e.g. to a computer or data - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for differentiated access control on a computing device, and the computing device, the method including starting a timer on the computing device; resetting the timer if activity occurs on the computing device prior to the expiration of the timer; and preventing a subset of applications from being launched or enabled on expiry of the timer. ## Claims ### Claim 1 A method for providing differentiated access control to individual applications on a computing device, the method comprising: forming a plurality of application subsets; setting an expiry time on the computing device for each of the plurality of application subsets, the expiry time for each of the plurality of application subsets being independently configurable; resetting the expiry time for at least one of the application subsets if activity occurs on the computing device prior to the expiry time for the at least one application subset; and locking each application associated with an application subset to prevent each application associated with that application subset from being launched or enabled if the expiry time for that application subset is reached. ### Claim 2 (depends on 1) The method of claim 1, further comprising providing first and second separate memory areas within application memory of the device and storing each of the plurality of application subsets in different portions of the application memory of the computing device. ### Claim 3 (depends on 1) The method of claim 1, wherein the locking comprises changing a graphical representation of an application thumbnail or icon present on the computing device. ### Claim 4 (depends on 3) The method of claim 3, wherein the graphical representation is a grid style and the changing replaces the application thumbnail with an obscured or locked graphic; wherein the locked graphic has a lock icon displayed over the application thumbnail. ### Claim 5 (depends on 4) The method of claim 4, wherein selection of the obscured graphic initiates a password prompt. ### Claim 6 (depends on 1) The method of claim 1, wherein one of the plurality of application subsets is designated as corporate applications. ### Claim 7 (depends on 6) The method of claim 6, wherein the designating is based on an enterprise information technology policy. ### Claim 8 (depends on 1) The method of claim 1, wherein activity occurring on the computing device includes only interaction with any one of the subset of applications. ### Claim 9 (depends on 1) The method of claim 1, further comprising unlocking each application associated with the at least one of the plurality of application subsets in response to successful authentication. ### Claim 10 (depends on 1) The method of claim 1, further comprising preventing each application associated with the at least one of the plurality of application subsets after the expiry time for the at least one of the plurality of application subsets from being launched or enabled, while allowing the launching or enablement of one or more applications associated with another of the plurality of application subsets. ### Claim 11 A computing device comprising: a processor; a user interface; and memory, wherein the computing device is configured to: form a plurality of application subsets; set an expiry time on the computing device for each of the plurality of application subsets, the expiry time for each of the plurality of application subsets being independently configurable; reset the expiry time for at least one of the application subsets if activity occurs on the computing device prior to the expiry time for the at least one application subset; and lock each application associated with an application subset to prevent each application associated with that application subset from being launched or enabled if the expiry time for that application subset is reached. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the computing device is further configured to provide first and second separate memory areas within application memory of the device and storing each of the plurality of application subsets in different portions of the application memory of the computing device. ### Claim 13 (depends on 11) The computing device of claim 11, wherein the computing device is configured to lock by changing a graphical representation of an application thumbnail or icon present on the computing device. ### Claim 14 (depends on 13) The computing device of claim 13, wherein the graphical representation is a grid style and the changing replaces the application thumbnail with an obscured or locked graphic; wherein the locked graphic has a lock icon displayed over the application thumbnail. ### Claim 15 (depends on 14) The computing device of claim 14, wherein selection of the obscured graphic initiates a password prompt. ### Claim 16 (depends on 11) The computing device of claim 11, wherein one of the plurality of application subsets is designated as corporate applications. ### Claim 17 (depends on 16) The computing device of claim 16, wherein the designating is based on an enterprise information technology policy. ### Claim 18 (depends on 11) The computing device of claim 11, wherein activity occurring on the computing device includes only interaction with any one of the subset of applications. ### Claim 19 (depends on 11) The computing device of claim 11, wherein the computing device is further configured to unlock each application associated with the at least one of the plurality of application subsets in response to successful authentication. ### Claim 20 (depends on 11) The computing device of claim 11, wherein the computing device is further configured to prevent each application associated with the at least one of the plurality of application subsets after the expiry time for the at least one of the plurality of application subsets from being launched or enabled, while allowing the launching or enablement of one or more applications associated with another of the plurality of application subsets. ### Claim 21 A non-transitory computer readable medium having stored thereon executable code for execution by processor of a computing device, the executable code comprising instructions for: forming a plurality of application subsets; setting an expiry time on the computing device for each of the plurality of application subsets, the expiry time for each of the plurality of application subsets being independently configurable; resetting the expiry time for at least one of the application subsets if activity occurs on the computing device prior to the expiry time for the at least one application subset; and locking each application associated with an application subset to prevent each application associated with that application subset from being launched or enabled if the expiry time for that application subset is reached.