Patent Application
20130171967
The subject matter of this application relates generally to methods and apparatuses, including computer program products, for providing secure execution of mobile device workflows.
As personal mobile devices have become increasingly common, manufacturers and developers have included an array of features to enable use of the devices beyond the typical telephone, messaging, web browsing and application functionality. One area of recent growth has been the use of mobile devices for information gathering and workflow management. For example, many devices are now equipped with short-range communications interfaces, such as Bluetooth, infrared and Near Field Communications (NFC), to enable interaction with a host of additional devices—including physical and logical access control devices, and point-of-purchase and/or electronic wallet devices.
Generally, mobile devices have not included technology which would protect the privacy of the user or prevent unauthorized use of the devices in the context of access control, point-of-purchase, or other interaction functions. However, more traditional hardware devices such as physical keypads and proximity card readers have security elements that would be useful in the context of mobile devices. One example of such security elements is a scrambled keypad 100 (or scramble pad), as shown in
What is needed is a mobile device with a scramble keypad and a short-range frequency interface to communicate with another device to enable execution of workflows on the mobile device, including workflows that allow secure physical and logical access control, as well as process secure transactions using the mobile device.
The invention, in one aspect, features a method for providing secure execution of mobile device workflows. The method includes receiving, by a mobile device, a request to launch a function on the mobile device. The method also includes displaying, by the mobile device, a keypad associated with the launched function, the keypad having randomly-arranged alphanumeric characters, and receiving, by the mobile device, entry of a passcode via the keypad. The method also includes activating, by the mobile device, a short-range frequency interface on the mobile device upon validation of the entered passcode, and establishing, by the mobile device, a communication link with a second device using the short-range frequency interface. The method also includes executing, by the mobile device, a workflow based on data transmitted between the mobile device and the second device via the communication link.
The invention, in another aspect, features a system for providing secure execution of mobile device workflows. The system includes a mobile device configured to receive a request to launch a function on the mobile device, and display a keypad associated with the launched function, the keypad having randomly-arranged alphanumeric characters. The mobile device is also configured to receive entry of a passcode via the keypad, and activate a short-range frequency interface on the mobile device upon validation of the entered passcode. The mobile device is also configured to establish a communication link with a second device using the short-range frequency interface, and execute a workflow based on data transmitted between the mobile device and the second device via the communication link.
The invention, in another aspect, features a computer program product, tangibly embodied in a non-transitory computer-readable storage device, for providing secure execution of mobile device workflows. The computer program product includes instructions operable to cause a mobile device to receive a request to launch a function on the mobile device, and display a keypad associated with the launched function, the keypad having randomly-arranged alphanumeric characters. The computer program product also includes instructions operable to cause a mobile device to receive entry of a passcode via the keypad, and activate a short-range frequency interface on the mobile device upon validation of the entered passcode. The computer program product also includes instructions operable to cause a mobile device to establish a communication link with a second device using the short-range frequency interface, and execute a workflow based on data transmitted between the mobile device and the second device via the communication link.
In some embodiments, any of the above aspects can include one or more of the following features. In some embodiments, the second device includes a data-encoded tag, a smart card, a short-range frequency reader device, or another mobile device. In some embodiments, the short-range frequency includes RFID, NFC, or Bluetooth. In some embodiments, the communication link includes card emulation or peer-to-peer communication link capability.
In some embodiments, executing a workflow includes receiving, by the mobile device from the second device, a request for authentication data, transmitting, by the mobile device to the second device, authentication data including the entered passcode, and providing, by the second device, access to a secure area upon validation of the authentication data. In some embodiments, executing a workflow includes transmitting, by the mobile device to the second device, authentication data including the entered passcode, unlocking, by the second device, secure data stored on the second device upon validation of the authentication data, and receiving, by the mobile device from the second device, the secure data.
In some embodiments, executing a workflow includes transmitting, by the mobile device to the second device, authentication data including the entered passcode, and exchanging, between the mobile device and the second device, shared content upon validation of the authentication data. In some embodiments, executing a workflow includes broadcasting, by the mobile device, a connection request including the entered passcode, detecting, by the mobile device, additional devices in proximity to the mobile device by receiving responses to the connection request, and establishing a communication link between the mobile device and one or more of the additional devices upon validation of the authentication data.
In some embodiments, executing a workflow includes enabling, by the mobile device, access to an application installed on the mobile device upon validation of the entered passcode.
In some embodiments, executing a workflow includes automatically transmitting, by the mobile device, a message upon validation of the entered passcode.
In some embodiments, executing a workflow includes transmitting, by the mobile device, a request for content to a server, and receiving, by the mobile device, the requested content from the server. In some embodiments, the requested content includes audio content, video content, web browser content, or any combination thereof.
In some embodiments, executing a workflow includes reading, by the mobile device, a barcode based on instructions received from the second device. In some embodiments, executing a workflow includes transmitting, by the mobile device to the second device, authentication data including the entered passcode and payment processing data, executing, by the second device, a purchase transaction based on the payment processing data and upon validation of the authentication data, and receiving, by the mobile device from the second device, confirmation of the executed purchase transaction.
In some embodiments, activating a short-range frequency interface includes detecting, by the mobile device, a short-range frequency card in proximity to the mobile device, reading, by the mobile device, data from the short-range frequency card, and maintaining, by the mobile device, activation of the short-range frequency interface upon validation of the data read from the short-range frequency card. In some embodiments, the short-range frequency interface on the mobile device includes a card emulator configured to enable the mobile device to communicate with a card reader device.
Other aspects and advantages of the invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, illustrating the principles of the invention by way of example only.
The advantages of the invention described above, together with further advantages, may be better understood by referring to the following description taken in conjunction with the accompanying drawings. The drawings are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of the invention.
The mobile computing device 202 communicates with the second device 207 via the communications link 206. Example mobile computing devices 202 can include, but are not limited to a smart phone (e.g., Apple iPhone®, BlackBerry®, Android™-based device) or other mobile communications device, a tablet computer, an internet appliance, a personal computer, or the like. In some examples, the mobile device 202 can be installed in a vehicle. The mobile device 202 can be configured to include an embedded digital camera apparatus, and a storage module (e.g., flash memory) to hold photographs, video or other information captured with the camera. The mobile device 202 includes network-interface components to enable the user to connect to a communications network, such as the Internet, wireless network (e.g., GPRS, CDMA), or the like. The mobile device 202 includes a processor and operating system to allow execution of mobile applications (e.g., 203), including a scramble pad 204, and a screen for displaying the applications to a user. The mobile device 202 includes a short-range frequency interface 205 that enables the mobile device 202 to communicate with other devices (e.g., second device 207) that are in proximity to the mobile device 202 via communications link 206.
The passcode entered by the user can be context-specific. For example, entry of a first passcode can enable certain functionality associated with the launched function or application, while entry of a second passcode can enable other functionality. For a shared mobile device, different passcodes can be used to indicate the identity of the user currently accessing the mobile device.
Upon validation of the entered passcode, the mobile device 202 activates (340) a short-range frequency interface 205 located on the mobile device 202. In some embodiments, the short-range frequency interface 205 can include a radio-frequency identification (RFID) interface, an NFC interface, and/or a Bluetooth interface. The short-range frequency interface 205 can comprise a combination of hardware (e.g., an RF receiver, antenna) and software to manage the interface 205. The short-range frequency interface 205 interacts with other devices (e.g., second device 207) in proximity to the mobile device 202 that have the capability to communicate with the mobile device 202 via a communication link 206 using short-range frequency. Examples of second devices 207 include data-encoded tags, smart cards, proximity access cards, short-range frequency reader devices, and mobile devices (e.g., smartphones, PDAs, tablets).
In some embodiments, the mobile device 202 can be used in conjunction with a smart card or other short-range frequency card to enhance the security provided to the mobile device 202. For example, the short-range frequency interface 205 of the mobile device 202 detects a short-range frequency card in proximity to the device 202 The short-range frequency interface 205 reads data from the short-range frequency card and, upon validation of the data from the card, the mobile device 202 maintains the activation of the short-range frequency interface 205. In cases where the data from the short-range frequency card cannot be validated, the mobile device 202 is configured to deactivate the short-range frequency interface 205, thus preventing further use of the interface 205 without the required card. In some embodiments, the mobile device 202 can also lock itself or become deactivated if data from the short-range frequency card is unavailable or cannot be verified.
The short-range frequency interface 205 can include a card emulator configured to enable the mobile device 202 to communicate with a card reader device (e.g., second device 207). In this manner, the mobile device 202 can act as a replacement for a smartcard carried by the user, such that the mobile device 202 is used to access the same types of devices and information as the smartcard.
The short-range frequency interface 205 on the mobile device 202 is used to further enhance the security features of the mobile device. As will be described in greater detail below, the mobile device uses the short-range frequency interface 205 to communicate with another device (e.g., second device 207) by establishing (350) a communication link 206. In some embodiments, the communication link 206 between the mobile device 202 and the second device 207 is a peer-to-peer link. Once the communication link has been established, the mobile device 202 executes (360) a workflow based on data transmitted between the mobile device and the second device 207 via the communication link. The workflow can comprise a number of different tasks and/or process steps that are related to security, such as physical access control, logical access control, data access, content sharing, discovering other devices, execution of applications, or transmission of alerts or other messages.
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device. In the example shown in
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device. In the example shown in
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device 207. In the example shown in
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device 207. In the example shown in
In the example shown in
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device 207. In the example shown in
Upon successful validation, the mobile device 202 activates the short-range frequency interface 205 and establishes a link with a second device 207 (e.g., a cash register or payment processing terminal). In the example shown in
Another example of a workflow executable by the mobile device 202 is the reading of a barcode based on instructions received from the second device 207. For example, once the communication link 206 is established between the mobile device 202 and the second device 207, the mobile device can receive an instruction from the second device 207 to read a barcode or other type of data-encoded tag. This technique is useful in the context of remote workflow management, where mobile users are required to perform certain tasks (e.g., inventory, surveys) involving the reading and recordation of data from encoded tags or barcodes.
The above-described techniques can be implemented in digital and/or analog electronic circuitry, or in computer hardware, firmware, software, or in combinations of them. The implementation can be as a computer program product, i.e., a computer program tangibly embodied in a machine-readable storage device, for execution by, or to control the operation of, a data processing apparatus, e.g., a programmable processor, a computer, and/or multiple computers. A computer program can be written in any form of computer or programming language, including source code, compiled code, interpreted code and/or machine code, and the computer program can be deployed in any form, including as a stand-alone program or as a subroutine, element, or other unit suitable for use in a computing environment. A computer program can be deployed to be executed on one computer or on multiple computers at one or more sites.
Method steps can be performed by one or more processors executing a computer program to perform functions of the invention by operating on input data and/or generating output data. Method steps can also be performed by, and an apparatus can be implemented as, special purpose logic circuitry, e.g., a FPGA (field programmable gate array), a FPAA (field-programmable analog array), a CPLD (complex programmable logic device), a PSoC (Programmable System-on-Chip), ASIP (application-specific instruction-set processor), or an ASIC (application-specific integrated circuit), or the like. Subroutines can refer to portions of the stored computer program and/or the processor, and/or the special circuitry that implement one or more functions.
Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital or analog computer. Generally, a processor receives instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and/or data. Memory devices, such as a cache, can be used to temporarily store data. Memory devices can also be used for long-term data storage. Generally, a computer also includes, or is operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. A computer can also be operatively coupled to a communications network in order to receive instructions and/or data from the network and/or to transfer instructions and/or data to the network. Computer-readable storage mediums suitable for embodying computer program instructions and data include all forms of volatile and non-volatile memory, including by way of example semiconductor memory devices, e.g., DRAM, SRAM, EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and optical disks, e.g., CD, DVD, HD-DVD, and Blu-ray disks. The processor and the memory can be supplemented by and/or incorporated in special purpose logic circuitry.
To provide for interaction with a user, the above described techniques can be implemented on a computer in communication with a display device, e.g., a CRT (cathode ray tube), plasma, or LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse, a trackball, a touchpad, or a motion sensor, by which the user can provide input to the computer (e.g., interact with a user interface element). Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, and/or tactile input.
The above described techniques can be implemented in a distributed computing system that includes a back-end component. The back-end component can, for example, be a data server, a middleware component, and/or an application server. The above described techniques can be implemented in a distributed computing system that includes a front-end component. The front-end component can, for example, be a client computer having a graphical user interface, a Web browser through which a user can interact with an example implementation, and/or other graphical user interfaces for a transmitting device. The above described techniques can be implemented in a distributed computing system that includes any combination of such back-end, middleware, or front-end components.
The components of the computing system can be interconnected by transmission medium, which can include any form or medium of digital or analog data communication (e.g., a communication network). Transmission medium can include one or more packet-based networks and/or one or more circuit-based networks in any configuration. Packet-based networks can include, for example, the Internet, a carrier internet protocol (IP) network (e.g., local area network (LAN), wide area network (WAN), campus area network (CAN), metropolitan area network (MAN), home area network (HAN)), a private IP network, an IP private branch exchange (IPBX), a wireless network (e.g., radio access network (RAN), Bluetooth, Wi-Fi, WiMAX, general packet radio service (GPRS) network, HiperLAN), and/or other packet-based networks. Circuit-based networks can include, for example, the public switched telephone network (PSTN), a legacy private branch exchange (PBX), a wireless network (e.g., RAN, code-division multiple access (CDMA) network, time division multiple access (TDMA) network, global system for mobile communications (GSM) network), and/or other circuit-based networks.
Information transfer over transmission medium can be based on one or more communication protocols. Communication protocols can include, for example, Ethernet protocol, Internet Protocol (IP), Voice over IP (VOIP), a Peer-to-Peer (P2P) protocol, Hypertext Transfer Protocol (HTTP), Session Initiation Protocol (SIP), H.323, Media Gateway Control Protocol (MGCP), Signaling System #7 (SS7), a Global System for Mobile Communications (GSM) protocol, a Push-to-Talk (PTT) protocol, a PTT over Cellular (POC) protocol, Universal Mobile Telecommunications System (UMTS), 3GPP Long Term Evolution (LTE) and/or other communication protocols.
Devices of the computing system can include, for example, a computer, a computer with a browser device, a telephone, an IP phone, a mobile device (e.g., cellular phone, personal digital assistant (PDA) device, smart phone, tablet, laptop computer, electronic mail device), and/or other communication devices. The browser device includes, for example, a computer (e.g., desktop computer, laptop computer) with a World Wide Web browser (e.g., Microsoft® Internet Explorer® available from Microsoft Corporation, Mozilla® Firefox available from Mozilla Corporation). Mobile computing device include, for example, a Blackberry®. IP phones include, for example, a Cisco® Unified IP Phone 7985G available from Cisco Systems, Inc, and/or a Cisco® Unified Wireless Phone 7920 available from Cisco Systems, Inc.
Comprise, include, and/or plural forms of each are open ended and include the listed parts and can include additional parts that are not listed. And/or is open ended and includes one or more of the listed parts and combinations of the listed parts.
One skilled in the art will realize the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing embodiments are therefore to be considered in all respects illustrative rather than limiting of the invention described herein.
