Abstract:
Provided are a system and method for operating a mobile device, comprising: establishing by a locking mechanism at the mobile device that the mobile device is owned or controlled by a retail establishment at which an operator of the mobile device is an agent; searching, by a mobile device, for a signal from a network; authorizing the mobile device to operate in a vicinity of the network when the signal is detected from the network; and inactivating the mobile device or displaying information where the mobile device can operate in response to a failure by the mobile device to detect the signal.

Description:
RELATED APPLIATION 
       [0001]    This application claims priority to U.S. Provisional Application Ser. No. 62/145,823, filed on Apr. 10, 2015 entitled “Systems and Methods for Controlling Mobile Device Use”, the entirety of which is incorporated by reference herein. 
     
    
     FIELD 
       [0002]    The present concepts relate generally to mobile device use, and more specifically, to the controlled use of a mobile device at a retail establishment. 
       BACKGROUND 
       [0003]    Data entry terminals, bar code scanners, and so on, for example, manufactured by Telxon Corporation, are well-known for use in point-of-sale and related retail applications. Company employees often use their smartphones or related mobile electronic devices for both personal and work-related purposes. 
       BRIEF SUMMARY 
       [0004]    In one aspect, provided is a method for operating a mobile device, comprising: establishing by a locking mechanism at the mobile device that the mobile device is owned or controlled by a retail establishment at which an operator of the mobile device is an agent; searching, by a mobile device, for a signal from a network; authorizing the mobile device to operate in a vicinity of the network when the signal is detected from the network; and inactivating the mobile device or displaying information where the mobile device can operate in response to a failure by the mobile device to detect the signal. 
         [0005]    In some embodiments, the signal from the network includes a service set identification (SSID). 
         [0006]    In some embodiments, the method further comprises activating the mobile device for access to applications executable by the mobile device in response to a detection of the signal. 
         [0007]    In some embodiments, inactivating the mobile device comprises at least one of preventing a bootup of the mobile device, preventing applications of the mobile device from deploying, preventing applications from displaying as an option, and allowing certain actions to be performed in an application 
         [0008]    In some embodiments, the signal of the network is searched in response to selecting an application at the mobile device. 
         [0009]    In some embodiments, the vicinity of the network includes a workplace facility, and wherein the mobile device is operated by an agent of the workplace facility. 
         [0010]    In some embodiments, the mobile device is locked if the agent is an hourly wage pay type and the mobile device is not in the vicinity of the network. 
         [0011]    In another aspect, provided is a method for operating a mobile device, comprising: providing a profile on the mobile device; identifying by the profile an owner of the mobile device and rights of a user regarding use of the mobile device; permitting, by the profile, the mobile device to search for a signal from a network for operating in the vicinity of the network; identifying applications on the mobile device for use outside of the network; and checking whether an application of the applications is permitted to operate. 
         [0012]    In some embodiments, the mobile device is a store owned or company owned electronic device having a display for presenting data related to the applications. 
         [0013]    In some embodiments, the method further comprises installing registry entries from the profile on the mobile device, permitting the mobile device to search for the signal from the network. 
         [0014]    In some embodiments, searching for the signal determines when the mobile device is within range of the signal. 
         [0015]    In some embodiments, the registry entries include data for identifying an owner of the mobile device, and wherein the application of the applications is permitted to operate depending on the owner of the mobile device. 
         [0016]    In some embodiments, the signal is searched when the application is selected to determine whether the application is permitted to operate. 
         [0017]    In some embodiments, the mobile device is a bring your own device (BYOD), and the owner of the mobile device and the user of the mobile device are the same. 
         [0018]    In some embodiments, the signal is detected but the mobile device is not authenticated, and is prohibited from connecting to the network. 
         [0019]    In another aspect, provided is a method for operating a mobile device, comprising: providing a locking mechanism in an application configured at a mobile device; launching the application; determining whether a signal is detected from a network; determining whether the application can be used outside of the network; displaying options for a user of the application who receives payment for services rendered in a form of a salary; and disabling the application for a user of the application who receives the payment for in a form of a wage. 
         [0020]    In some embodiments, disabling the mobile device comprises at least one of preventing a bootup of the mobile device, preventing applications of the mobile device from deploying, preventing applications from displaying as an option, and allowing certain actions to be performed in an application. 
         [0021]    In another aspect, provided is a system for controlling access of a mobile device, comprising: a locking mechanism that determines whether the mobile device is store-owned, searches for a signal from a network, and inactivates the mobile device in response to a determination that the mobile device is store-owned and the signal is not detected; and a lockout system that establishes conditions under which the mobile device or at least one application of the mobile device are locked. 
         [0022]    In some embodiments, the lockout system searches for the signal after at least one of power-up of the mobile device and after an application is launched at the mobile device. 
         [0023]    In some embodiments, the locking mechanism receives data from the lockout system to determine an ownership of the mobile device, including determining whether the mobile device is store-owned, company-owned, or user-owned. 
         [0024]    In some embodiments, the locking mechanism determines an access level of the mobile device, and locks the mobile device or the application in response to the access level being less than a predetermined threshold. 
         [0025]    In another aspect, provided is a system for controlling access of a mobile device, comprising: means for establishing conditions under which the mobile device or at least one application of the mobile device are locked; and means for locking the mobile device or an application of the mobile device if the mobile device is outside of the vicinity of a network and the mobile device&#39;s access level is less than a predetermined threshold access level. 
         [0026]    In some embodiments, the system further comprises means for determining an ownership of the mobile device, including determining whether the mobile device is store-owned, company-owned, or user-owned. 
         [0027]    In some embodiments, means for establishing conditions under which the mobile device or at least one application of the mobile device are locked includes determining an access level of the mobile device. 
         [0028]    In some embodiments, the system further comprises means for performing an action or task-based authentication. 
         [0029]    In some embodiments, the access level is a pay type of the agent. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         [0030]    The above and further advantages may be better understood by referring to the following description in conjunction with the accompanying drawings, in which like numerals indicate like structural elements and features in various figures. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the concepts. 
           [0031]      FIG. 1  is a network diagram of an environment in which embodiments can be practiced. 
           [0032]      FIG. 2  illustrates a logical architecture overview of a system for controlling mobile device use, in accordance with some embodiments. 
           [0033]      FIG. 3  is a flowchart of a method for controlling mobile device use, in accordance with some embodiments. 
           [0034]      FIG. 4  is a view of a message displayed on a mobile device prevented from booting, in accordance with some embodiments. 
           [0035]      FIGS. 5A and 5B  are views of a mobile device displaying applications, in accordance with some embodiments. 
       
    
    
     DETAILED DESCRIPTION 
       [0036]    Company information technology (IT) groups often configure mobile devices under a “Bring Your Own Device” (BYOD) corporate strategy, where an employee or agent personal mobile device is provisioned with applications that permit the use of the personal mobile device in a work environment. However, issues arise with regarding to maintaining adequate security, and risks associated with abuse by mobile device users authorized to access a company network remotely. For example, a mobile device user may be an hourly or wage-earning employee, contractor, or agent who is not permitted to, but may nevertheless attempt to, perform work-related tasks from the mobile device when “off-the-clock” or not on premises during work hours. 
         [0037]      FIG. 1  is a network diagram of an environment in which embodiments can be practiced. 
         [0038]    The environment includes a retail establishment  14  having a local store network  16 . The local store network  16  can incorporate a local area wireless technology such as WiFi, which may include an access point  18  and access server  24  and/or other well-known WiFi elements (not shown), for providing Internet access and internetworking services between mobile electronic devices, or more generally, mobile devices such as smartphones or the like, in the WiFi coverage area  16 . 
         [0039]    One or more company representatives  11 A,  11 B (generally,  11 ), such as employees, contractors, or other agents or users, may perform job-related functions on a mobile device  12 A,  12 B (generally,  12 ). User  11 A and mobile device  12 A may be proximal to or inside the store network  16 . User  11 B and mobile device  12 B are outside the store network  16 . Either company representative  11 A,  11 B may be a store manager or other authorized representative of the retail establishment  14  who wishes to upload sensitive data to the mobile device  12 A,  12 B, respectively, such as employee files stored electronically. As described herein, such tasks may be performed depending on, but not limited to, user agent status, access level, pay type (wage earner or salaried), location of user, and/or application executed for performing the task. Mobile devices  12 A,  12 B in accordance with some embodiments can be configured for multitasking, for example, where the user  11 A,  11 B can perform personal tasks such as emailing and web browsing and/or job-related activities. Accordingly the mobile devices  12 A,  12 B can each include one or more applications that are stored at the mobile devices  12 A,  12 B and, when executed at the mobile devices  12 A,  12 B, can be used for performing personal and/or job functions. 
         [0040]    When performing job functions, the mobile device  12 A may receive authorization from the access server  24  at the store network  16 , for example, inside the store&#39;s sub-network, or demilitarized zone (DMZ), to operate in a vicinity of the network  16 , for example, the store&#39;s WiFi network, and to provide the user  11 A with remote access to data stored at database  32 , for example, behind a firewall (not shown), which may be physically present at the store  14 , or at a remote location and in communication with the other electronic components via the network  16 . The mobile device  12 B on the other hand is not within proximity of the store network  16 , and therefore may not receive relevant signals from the access point  18  for establishing authentication or the like, or otherwise communicating with the network  16 . Mobile device  12 B may therefore be restricted from some or all work-related use in accordance with some embodiments, for example, described herein. However, user  11 B may use mobile device  12 B for personal use, depending on whether the user  11 B owns the mobile device  12 B, and also depending on whether the application executed on the mobile device  12 B is permissible outside of the store network  16 . 
         [0041]    A mobile device management system  22  may communicate with the network  16  to dynamically deploy relevant mobile device applications on the mobile devices  12  required by the company representatives  11  to perform their job functions. The mobile device management system  22  may be located at the store network  16 , or be physically separate from and in communication with other elements at the store network  16 . The mobile device management system  22  may include a commercially available application management system, such as an AirWatch® Mobile Application Management platform. 
         [0042]    In some embodiments, a lockout system  26  may be provided that communicates with the mobile device  12  in a manner depending on the location of the locking mechanism  44  (described below) of the mobile device  12 , and may provide data to the mobile device  12  that is used for determining conditions under which the mobile device  12  may be locked, or applications of the mobile device  12  that may be prevented from use. The lockout system  26  can therefore deter theft of the mobile device  12 . Related functions performed by the lockout system  26  may include but not be limited to preventing device bootup (for example, shown in the screenshot of  FIG. 4 ), hiding or otherwise inactivating mobile device applications, preventing applications from deploying or executing, hiding or preventing options in an application, and so on. For example, applications used for performing job functions such as bin merchandise, etc. shown in  FIG. 5A  are prevented from use by removing them from the display as shown in  FIG. 5B . 
         [0043]      FIG. 2  illustrates a logical architecture overview of a system for controlling mobile device use. Specifically,  FIG. 2  shows further details of the mobile device  12  and the lockout system  26  of  FIG. 1 . 
         [0044]    As shown in  FIG. 2 , the mobile device  12  can include a user interface  42 , a locking mechanism  44 , one or more applications  46 A- 46 N (generally,  46 ) (where N is an integer greater than 0) that are stored in a memory, such as a random access memory (RAM), a read-only memory (ROM), or other storage device, and executed by one or more hardware processors (not shown). The hardware processors can be part of one or more special-purpose computers, such that execute computer program instructions which implement one or more functions and operations of the mobile device  12  and/or the lockout system  26 , for example, specified in the blocks and decision diamonds of the flowchart of  FIG. 3 , described below. 
         [0045]    The user interface  42  interacts with the applications  46  for electronically presenting application-related data on a screen of the mobile device  12 . In doing so, the user interface  42  may include one or more user input devices and output devices, such as a display screen (e.g. a liquid crystal display (LCD) or light emitting diode (LED) screen or touch-sensitive display screen), a keyboard, an electronic thumbwheel, trackball, mousepad, and so on. 
         [0046]    The mobile device  12  can also include a service set identification (SSID) processor  47  or other authorization scheme that permits admittance of the mobile device  12  to the store&#39;s wireless network  16 . The WiFi access point  18  can be configured with an SSID and corresponding authorization key that, in some embodiments, are compared to a unique identifier configured at and corresponding to the mobile device  12 . In some embodiments, an SSID is not broadcast, whereby the mobile device  12  is configured with appropriate authorization information, such as SSID, password such as Wireless Encryption Protocol (WEP) or, Wi-Fi Protected Access (WPA), and so on for establishing communication with the network  16  during a bootup sequence. In other embodiments, the mobile device  12  is configured as a BYOD device, which is not connected directly to the internal network  16 . Instead, connection can be established through an open SSID or the like, for example, using a modem or other input/output device on the mobile device  12 . 
         [0047]    The locking mechanism  44  can be constructed to determine if the SSID is in the relevant network  16 , and for attempting to establish a connection with the network. When the network  16  confirms that the SSID is valid but the password or the like is incorrect, the system recognizes that the mobile device  12  is within range of the internal network  16 . However, the connection is not established due to the unavailable password or the like, since in this embodiment, the device  12  is not store or company owned. 
         [0048]    In some embodiments, the locking mechanism  44  is physically resident on the mobile device  12 , for example, embedded in firmware at the device  12 , and is configured to lock one or more applications  46 , and/or lock hardware elements of the mobile device  12  to prevent or restrict use of the mobile device  12 , and/or applications, when the locking mechanism fails to detect the store WiFi network  16 , or fails to authenticate with the store WiFi network  16 , and/or for other reasons described herein. The locking mechanism  44  can also be configured to establish an ownership of the device  12 , for example, whether the device  12  is owned by the retail establishment  14  which employs the user  11 . The locking mechanism  44  can lock or allow specific work-related applications  46  on the mobile device  12  depending on the ownership of the device  12 , but under the control and use by a store associate, employee, agent, or the like. 
         [0049]    In embodiments where the mobile device  12  is store or company owned, a registry setting or login to the mobile device  12  can provide a manner in which user profile data is provided. Here, a profile may install registry entries, for example, including global variables, on the mobile device  12 . In some embodiments, the profiles can be configured so that the device  12  pings or otherwise searches for an SSID signal, for determining when the device  12  is within range of the signal. Upon receipt of the signal, applications  46  may be displayed that may be used by the user, for example, work-related applications. In other embodiments, the registry entries may be used to identify the owner  11  of the device  12 , or a user group, and establish rights and privileges of the user or group, for example, permitting the user to operate the device  12  outside the network  16 . Here, applications  46  that allowed to operate outside the network  16  may be displayed, while applications  46  prohibited from use outside the network  16  are not displayed, or are otherwise locked to prevent the user from executing these applications. In other embodiments, the device  12  may search for an SSID signal or the like when an application  46  on the mobile device  12  is selected. 
         [0050]    In other embodiments, the locking mechanism  44  is part of an application  46 . When the application  46  is launched, if a signal is seen, then the device  12  operate in a normal manner. If a signal is not seen, then the locking mechanism  44  can determine if the application can be used outside the store network  16 . If so, then a login screen may appear on the user interface  42 . The login can determine the rights of the user  11 , for example, by accessing a user profile. If the user is determined to be salaried, then the mobile device  11  operates according to options, for example, established by a rules engine  54  described below, that are available to the device  12  outside the store network  16 . The locking mechanism  44  can search in a predetermined and periodic manner for a signal, and in response, adjust the options in the application when the signal is seen. On the other hand, if the user is a wage earner, for example, established at the user profile database  56 , then the application  46  may be locked, or otherwise prohibited from use. 
         [0051]    The lockout system  26  includes a rules engine  54 , a user profile database  56 , and an action detector  58 . 
         [0052]    The rules engine  54  provides the rules that establish the conditions under which the mobile device  12  is locked. The mobile device  12  is locked and unlocked in accordance with the rules. The rules may be defined by an administrator or other authorized party. For example, the rules engine  54  can be configured to apply one or more rules that determine an action to be applied to the mobile device  12  based on a user&#39;s action or task performed at the mobile device  12 , a location of the mobile device  12 , whether the mobile device  12  is store-owned, leased, or the like, and/or a combination thereof. In particular, the rules engine  54  permits the authorized party to establish the criteria under which the mobile device  12  can be locked. This can be achieved by inputting the rules from a device user interface, or by importing rules from a remote source, for example, another application. The mobile device  12  operates according to the rules loaded at the rules engine  54 . For example, in accordance with the rules engine  54 , the mobile device  12  can filter available access or activities within a particular application, depending on whether the mobile device  12  is store-owned. Although the rules engine  54  is shown in  FIG. 2  as being in the lockout system  26 , which is separate from and in communication with the mobile device  12 , in other embodiments, the rules engine  54  can be resident in an application  46  at the mobile device  12 , or in the user profile database  56 , or in the device firmware, for example, executed during bootup. The lockout system  26  can therefore provide features that may not be covered by the locking mechanism  44  in the phone, or to provide data that may be needed by the locking mechanism to operate, and that resides external to the phone. 
         [0053]    For example, during operation, the rules engine  54  may establish that a store-owned mobile device  12  is to enter a lockout state where the mobile device  12  is inactivated if the mobile device  12  does not receive or recognize a signal, for example, including an SSID, from the store network  16  indicating that the mobile device  12  is in the vicinity of the store network  16 . A related rule may establish that if the signal is recognized by the mobile device  12 , then the mobile device  12  has access-based authorization, for example, with respect to executing relevant applications on the mobile device  12 , or filtering available access or activities within a particular application, for example, the agent&#39;s access level, or access level of the configured mobile device, is less than a predetermined threshold access level. In some embodiments, the rules engine  54  coexists with the locking mechanism  44  at the mobile device  12 . 
         [0054]    The user profile database  56  includes user profiles or the like indicating whether the user of the mobile device  12  is a salaried employee, a wage earner, or other employment status indicator. Other external mechanisms can alternatively or in addition provide relevant data to the user profile database  56 , for example, a company human resource server, which includes profile data that can be provided to the user profile database  56 . In this example, a wage earner (distinguished from a salaried employee) may be prevented from performing work-related functions on a mobile device  12  used by, and possibly owned or leased by, the wage earner when the wage earner is “off the clock” and/or outside of the store&#39;s WiFi perimeter  17 . The user profile database  56  may receive such information from a registry setting (described herein), or during a login session with the mobile device  12 . 
         [0055]    The rules engine  54  can be populated with the contents of the user profile database  56 , for generating an output to the mobile device  12  used for determining the conditions under which the mobile device  12 , one or more applications  46 , or tasks or actions regarding a particular application, may be prevented from use. For example, if the user is a wage earner and the mobile device  12  does not receive a wireless signal from the store network  16 , then the locking mechanism  44  on the mobile device  12  can close applications  46  on the mobile device  12  prohibited for use by the mobile device user outside of the WiFi perimeter  17  of the network  16 . The system may establish whether a wage earning user is “on the clock” by checking for the user status during a login of the mobile device  12 , or communicating with an application on the mobile device  12  that communicates with registry entries that establish user permissions, conditions for application, feature, or task-level permissions, for example, whether the user is permitted to operate the device  12 , or use a particular application  46 , or feature of the application  46 , outside the network. The locking mechanism  44 , regardless of location, e.g., on the device  12  or external to the device  12 , can communicate with a time clock system or other system that tracks the user&#39;s work time during predetermined time intervals. 
         [0056]    The action generator  58  monitors tasks or other actions performed with respect to the applications  46  of the mobile device  12 . As described above, an application  46  may run on the mobile device  12 , and may be permitted for some uses, but not other uses. For example, an email application may operate so that the user can send email messages via the email application to friends and family, but may be prohibited from sending or receiving work-related emails during non-business hours. This feature can prevent wage earning employees from using their mobile devices to perform work-related tasks off the clock. In another example, a feature may include binning, where items are systematically placed in a storage area. More specifically, binning relates to a process of placing overstocked items in the bin or other storage container in a backroom or overstock area. An associate would use an electronic device to scan the location for placing the items. They would then scan the merchandise items. If they are not physically there, the associate may not perform this task. However, they might try to complete the task to show others that the associate complete his or her assigned work. 
         [0057]      FIG. 3  is a flowchart of a method  100  for controlling mobile device use, in accordance with some embodiments. In describing the method  100 , reference is made to elements of  FIGS. 1 and 2 . 
         [0058]    At decision diamond  102 , a determination is made whether the mobile device  12  is owned, leased, or otherwise under the control of the retail establishment, e.g., workplace facility such as a store, which employs the user  11  of the mobile device  12 . In some embodiments, the determination is made based on the presence of the locking mechanism  44  at the mobile device  12 , for example, embedded in firmware of the device  12 . In other embodiments, registry entries can be provided by the user profile database  56 , and installed at the mobile device  12 , which are used to identify the owner of the device  12 . As described herein, the registry entries can also or alternatively identify users who may operate outside the network  16 , indicate which applications may be used, and so on. Profiles can be configured to permit the device  12  to ping for or otherwise search for an SSID signal or the like, for example, to determine whether the device  12  is within range of the signal. A list of applications or features permitted to be used may be displayed. In other embodiments, ownership of the device  12  established upon login of an application  46  that includes the locking mechanism  44 . 
         [0059]    When a determination is made that the mobile device  12  is owned, leased, or otherwise under the control of the store, then the method  100  proceeds to block  104 , where the mobile device  12  can be activated, or turned on. Otherwise, if a determination is made at decision diamond  102  that the mobile device is not store owned, then the method proceeds to block  106 , where a particular application  46  on the mobile device  12  can be launched. Prior to this, the mobile device  12  is turned on so that the application  46  can be executed. Here, the user  11  may own, lease, rent, or otherwise have access to and control over the mobile device  12 . However, the specific launched application permits the user  11  to perform work-related tasks from the mobile device  12  using the executed application  46  on the mobile device  12 . In some embodiments, the locking mechanism  44  is part of the executed application  46 . 
         [0060]    Returning to block  104 , the method  100  proceeds to decision diamond  108  where, in response to the activation of the mobile device  12  at block  104 , a determination is made whether a wireless signal is detected from the store network  16 . For example, the mobile device  12  may, during bootup, receive and recognize a service set identification (SSID) for the store&#39;s wireless network. If the wireless signal is detected by the mobile device  12 , then the method  100  proceeds to block  112 , where the user can enjoy normal use of the mobile device  12 . In doing so, the mobile device  12  can operate in a well-known manner, for example, phone calls can be placed from or received at the mobile device  12 , smartphone applications can be launched without intervention, and so on. Otherwise, if the wireless signal is not detected, for example, a relevant SSID is not found, then the method  100  proceeds to block  114 , where the mobile device  12  is inactivated. In some embodiments, the mobile device  12  can be powered off. In other embodiments, an information screen may be displayed at the mobile device  12  indicating conditions under which the mobile device  12  may operate, for example, specific locations where the mobile device  12  can be used, and/or features of the mobile device  12  that may be used. Other forms of inactivation may include the preventing of bootup or load with limited functionality, hiding or inactivating unauthorized mobile device applications, preventing applications from deploying, hiding or preventing options in an application, and/or only allowing certain actions, or predetermined actions, to be performed. An example of limited functionality may include limited call features, for example, limited phone numbers that may be dialed, instructions on device use, and so on. 
         [0061]    Returning to block  106 , after the application is launched, the method  100  may proceed to decision diamond  110 , where a determination is made whether a wireless signal is detected from the store network  16 . For example, the mobile device  12  may receive and recognize a service set identification (SSID) for the store&#39;s wireless network. In another example, the SSID is preconfigured at the device instead of being broadcast, for example, where the device  12  does not access the internal store network  16 , but instead connects to other networks via an open SSID or the like. In configurations where the mobile device  12  looks for and detects a wireless signal, the method  100  proceeds to block  112 , where the user  11  can enjoy normal use of the mobile device  12 . Otherwise, if the wireless signal is not detected, then the method  100  proceeds to decision diamond  116 , where is the user status is determined, for example, whether user  11  of the mobile device  12  is a salaried employee or an hourly or wage-earning employee, contractor, or other non-salaried agent. As described herein, registry entries may be used to identify the owner of the device  12 , or a user group. In other embodiments, the user status is determined during a login procedure with an authentication device or the like. If a determination is made that the user  11  of the mobile device  12  is an hourly or wage-earning employee, contractor, or other non-salaried agent (by registry settings, login, or other technique in accordance with some embodiments), then the method  100  proceeds to block  118 , where the application  46  is disabled, or otherwise inactivated so that the wage-earning user  11  cannot use the application  46  on the mobile device  12 . 
         [0062]    Otherwise, the method  100  proceeds to block  120  upon a determination that the user is not an hourly or wage-earning employee, contactor, or other non-salaried agent, where the salaried user performs an action related to the application, for example, executes the application on the mobile device  12  and uses the application to perform a work-related task. For example, the action may be the user executing an application that generates a sales report pertaining to item sales at the store. If the user  11  is a salaried user, then options that are available outside the network  16  may be displayed or otherwise provided to the user  11 . The locking mechanism  44  may continue to search for a signal related to the application  46 , and adjust options in the application  46  when the signal is detected. 
         [0063]    At decision diamond  122 , a determination is made whether the action or task performed on the application of block  106  is allowed to be performed outside the store, in particular, outside the store network  16 . As described above, in some embodiments, registry entries can establish whether the user is permitted to operate the device  12  outside the network  16 . In other embodiments where the locking mechanism  44  is coded in the application  46 , upon application launch, the locking mechanism  44  determines after login whether the application can be used outside the store network  16 . If the action or task is allowed to be performed outside the store network  16 , then the method  100  proceeds to block  124 , where the action can be performed on the application of block  106 . Otherwise, at block  126 , the action is blocked. In some embodiments, the locking mechanism  44  is used to display a task that can be used. In other embodiments, a communication may be initiated by the application  46  to an intended system for performing a task. Here, the locking mechanism  44  may intercept the communication, and inform the user, for example, by a displayed message, that the application is blocked. 
         [0064]    As will be appreciated by one skilled in the art, aspects of the disclosed system and method for determining a sequence for a plurality of tasks may be embodied as a system, method, or computer program product. Accordingly, aspects may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon. 
         [0065]    Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. 
         [0066]    A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. 
         [0067]    Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire-line, optical fiber cable, radio frequency, etc., or any suitable combination of the foregoing. 
         [0068]    Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user&#39;s computer, partly on the user&#39;s computer, as a stand-alone software package, partly on the user&#39;s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user&#39;s computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). 
         [0069]    Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. 
         [0070]    While the invention has been shown and described with reference to specific preferred embodiments, it should be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the following claims.