Function-based authorization to access electronic devices

Systems and methods to secure authorized access are disclosed. A method includes receiving, an electronic device, a request to generate function-authorization settings including function-access data associated with a particular function of the electronic device to be protected. The method also includes prompting for and receiving function-access data. The received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function and second function-access data that specifies access credentials of a second user to access the particular function. The method also includes associating the received function-access data with the particular function and storing the function-authorization settings including the received function-access data at a memory of the electronic device.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to controlling access to functions on an electronic device.

BACKGROUND

User interfaces generally mediate access to computing resources, which incorporate or can affect sensitive data and devices. Access to such user interfaces may be restricted using initial explicit or implicit credentials that are provided during a login or startup procedure. An example of implicit credentials is physical possession of a cellular phone. An example of explicit credentials is logging in to an internet portal using a user ID and password.

DETAILED DESCRIPTION

Systems and methods of providing function-based authorization to access an electronic device are disclosed. In a first particular embodiment, a method is disclosed that includes receiving, at a mobile communication device, a request to generate function-authorization settings including function-access data associated with a particular function of the mobile communication device to be protected. The method includes prompting for and receiving the function-access data from an authorized user. The received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function to be protected and second function-access data that specifies access credentials of a second user to access the particular function to be protected. The method also includes associating the received function-access data with the particular function to be protected and storing the function-authorization settings including the received function-access data at a memory of the mobile communication device.

In a second particular embodiment, a computer-readable medium is disclosed that includes computer-executable instructions that, when executed, cause an electronic device to perform operations including receiving, at the electronic device, a request to generate function-authorization settings including function-access data associated with a particular function of the electronic device to be protected. The operations also include prompting for and receiving the function-access data from an authorized user. The received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function to be protected and second function-access data that specifies access credentials of a second user to access the particular function to be protected. The operations also include associating the received function-access data with the particular function to be protected and storing the function-authorization settings including the received function-access data at a memory of the electronic device.

In a third particular embodiment, a computer-readable medium is disclosed that has stored thereon a data structure. The data structure includes computer-executable instructions to perform a particular function associated with an electronic device. The data structure includes function-authorization settings including function-access data associated with the particular function. The function-access data includes first function-access data that specifies access credentials of a first user to access the particular function and second function-access data that specifies access credentials of a second user to access the particular function. The data structure includes computer-executable instructions to perform operations including receiving, at the electronic device, a request to perform the particular function. The operations include prompting for user access credentials in response to receiving the request and receiving the user access credentials in response to prompting for the user access credentials. The operations include determining whether the received user access credentials match the function-access data associated with the particular function. The operations include performing the particular function in accordance with usage restrictions of the function-access data associated with a particular user identified by the received user access credentials when the received user access credentials match the function-access data associated with the particular function.

In a fourth particular embodiment, a mobile communication device is disclosed that includes an antenna, a transceiver coupled to the antenna, an input/output (I/O) interface, a processor coupled to the transceiver and to the I/O interface, and a memory device. The memory device includes executable instructions that, when executed by the processor, cause the mobile communication device to perform operations including receiving, via the I/O interface, a request to generate function-authorization settings including function-access data associated with a particular function of the mobile communication device. The operations include prompting, via the I/O interface, for the function-access data and receiving, via the I/O interface, the prompted for function-access data. The received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function and second function-access data that specifies access credentials of a second user to access the particular function. The function-authorization settings are stored at the memory device.

Referring toFIG. 1, an illustrative embodiment of a system100to provide function-based authorization to access an electronic device is disclosed. The system100includes an electronic device102connected to an access network140. The access network140provides the electronic device102with access to resources142accessible to the access network140. The resources may include a web site, an email server, a messaging server, or a video server, for example. The electronic device102includes a network interface104, an I/O interface106, a memory108, and a processor110. The network interface104is connected to the access network140and is configured to provide the electronic device102with access to the resources142via the access network140. The I/O interface106is configured to output information to one or more users and to receive information from the one or more users. In particular embodiments, the electronic device102provides a windowing environment through which users may interact with the electronic device102. For example, inputs may be received from users via a windowing environment and outputs may be provided to users via the windowing environment.

The memory108includes a controller112and function-authorization settings114. The controller112includes instructions, executable by the processor110, to provide function-based authorization to access the electronic device102. In particular embodiments, the controller112is implemented separately from a windowing environment provided by the electronic device102. In this manner, the controller112can be implemented to be portable from a first windowing environment to a second windowing environment with little or no necessary modifications. The function-authorization settings114include function-1access data116associated with a particular illustrative function, Function-1. In a particular embodiment, Function-1is a program that can be invoked via the electronic device102. For example, in a windowing environment provided to a user, the user may invoke the program by double-clicking on a selectable icon presented to the user in a window provided by the windowing environment. In another particular embodiment, Function-1is an internet-access function that enables the electronic device102to access the Internet. For example, in a windowing environment provided to a user, the user may invoke a browser to access the Internet by double-clicking on a selectable icon representing the browser. In another embodiment, Function-1comprises access to a subscription service associated with the electronic device102. In another embodiment, performing Function-1accrues charges to a subscriber of the subscription service. In yet another embodiment, Function-1enables the electronic device102to send and receive email messages. In yet another embodiment, Function-1enables the electronic device102to send and receive instant messages.

The function-1access data116includes first function-1access-data-1118A and second function-1access-data-2118B. The first function-1access-data-1118A includes user ID information120A. The user ID information120A specifies credentials of a first user to access Function-1. The first user may be a primary user124or a secondary user126. In particular embodiments, the credentials include user identification and password information. The first function-1access-data-1118A also includes usage restrictions122A. The usage restrictions122A indicate restrictions, if any, on how, whether and/or when the first user is authorized to access Function-1. In particular embodiments, the usage restrictions122A include temporal restrictions. For example, the temporal restrictions may indicate that the first user is authorized to access Function-1for a limited amount of time. In another example, the temporal restrictions indicate a time frame during which the first user is authorized to access Function-1. In another example, the temporal restrictions indicate that the first user is authorized to access Function-1regardless of the current time. In particular embodiments, the usage restrictions122A include constraints on the first user's access to Function-1. For example, if Function-1is for a browser's access to the Internet, the usage restrictions122A may enable invocation of the browser function only until 7:30 PM on a daily basis. In another example, the usage restrictions122A indicate that the first user is authorized to access Function-1without restrictions. For example, the primary user124may be authorized to access Function-1without restrictions. In one particular embodiment, function-1access-data-1118A is configured to be common across all of the programs on the electronic device102, and corresponds to the primary user124. The usage restrictions122A allow the primary user124to access Function-1without restrictions. In another particular embodiment, the contents of function-1access-data-1118A are implicit and enforced globally across all of the programs that are accessible from the user interface, while the primary user124is logged into the operating system environment and is using the user interface.

The electronic device102may comprise a general computing device, such as the general computing device700illustrated inFIG. 7. For example, the computing device102may include a personal computer, a server, a set top box, or a mobile communication device. In the case of a personal computer, the user ID information120A may be that of the primary user124, who is logged in to the operating system of the personal computer, and the usage restrictions122A may be initialized by the primary user124or by an administrator, and may be changed later by the user or the administrator.

During operation, a primary user124(e.g., a parent) may create or amend the function-authorization settings114to protect Function-1. Accordingly, the primary user124may enter, and the electronic device102may receive, a request to generate function-authorization settings114including function-1access data116associated with Function-1. The electronic device102may prompt for and receive user-authorization credentials identifying a particular user (e.g., the primary user124) authorized to generate the function-authorization settings. For example, a windowing environment provided by the electronic device102may present a window to the particular user, allowing the particular user to enter the user-authorization credentials. The electronic device102may then prompt for the function-access data. For example, the electronic device102may present a window-based interface to the particular user, allowing the particular user to enter the function-access data. The electronic device102may then receive the function-access data130. The function-access data130includes first function-1access-data-1118A that specifies access credentials of a first user (e.g., a first child) to access Function-1and second function-1access-data-2118B that specifies access credentials of a second user (e.g., a second child) to access Function-1. The electronic device102associates the received function-access data130with Function-1and stores the function-authorization settings114including the received function-access data130at the memory108of the electronic device102. The function-authorization settings114are stored in memory108and are used by the user interface mechanism (for example, the windowing environment). The user interface mechanism may be separable from the underlying operating system and may be implemented on various operating systems. Secondary User ID Information (120A and/or120B, depending on the particular embodiment) need not be known to the underlying operating system.

Similarly, the primary user124may protect functions associated with the electronic device102other than Function-1, each of which may have one, two, or three or more authorized users depending on requests received from the primary user124. In a particular embodiment, the function-access data associated with a Function-2includes first function-2access-data-1that specifies access credentials of a first user to access the function, but does not include second function-2access-data-2that specifies access credentials of a second user to access the function. Thus, only one user is authorized to access Function-2. In another particular embodiment, the function-access data associated with a Function-3includes second function-3access-data-2and third function-3access-data-3in addition to the first function-3access-data-1. The first function-3access-data-1may specify access credentials for the primary user124while the second function-3access-data-2and the third function-3access-data-3may each specify access credentials for a different secondary user. Thus, there are three different users that are authorized to access Function-3. In another particular embodiment for another function Function-4, the function-access data for Function-4may be such that no credentials are required (that is, anybody can invoke Function-4).

In particular embodiments, the user-authorization credentials that the electronic device102prompts for and that identify a particular user authorized to generate the function-authorization settings114, are determined at login. For example, during a login procedure, a primary user124may enter a userid and a password. In a particular embodiment, entering the userid and password provides the user access to an operating system account. The electronic device102may save the entered userid and password as the credentials required to be entered in order to be authorized to generate the function-authorization settings114. Thus, a primary user124may login using credentials identifying the primary user124as having authorization to generate function-authorization settings114. The primary user124can then allow secondary users126to have access to the electronic device102while the primary user124is still logged in (to the operating system account, for example), knowing that a secondary user126will not be authorized to generate the function-authorization settings114if the secondary user126does not have the primary user's124userid and password. If the secondary user126generates a request to generate the function-authorization settings114, the electronic device prompts for the primary user's124userid and password. Unless the secondary user126enters the correct userid and password, the electronic device102denies the secondary user's126request to generate the function-authorization settings114.

Each primary user124may provide different function-authorization settings114for different secondary users126. For example, the electronic device102may associate different credentials identifying different primary users124with different function-authorization settings114. When a first primary user124logs in using first credentials, the electronic device102may save the first credentials as the credentials required to be entered in order to be authorized to generate a first set of function-authorization settings114. When a second primary user124logs in using second credentials, the electronic device102may save the second credentials as the credentials required to be entered in order to be authorized to generate a second set of function-authorization settings114. In this manner, each primary user124can customize the access of secondary users126to protected functions on the electronic device102while the primary user124is logged into the electronic device102.

By way of further example, the login of the primary user may be an implicit login. The credentials prompted for by the electronic device102identify a particular user authorized to generate the function-authorization settings114and may be determined during setup or initialization of the electronic device102. Each time the electronic device is powered up, the credentials determined during setup or initialization may be used as the credentials required to be entered in order to be authorized to generate the function-authorization settings114. If the primary user124desires to change the credentials, the primary user124can perform the setup or initialization procedure again.

In a particular embodiment, the function-authorization settings114may include a global configuration access parameter (GCAP) (not shown) that would specify whether the function-access data for all of the protected functions (e.g., Function-1) are to be consulted in response to invocation attempts by the users of the electronic device102. Furthermore, each function-access data element may also include a function-specific configuration parameter (FSCP) (not shown) that is examined, if the GCAP parameter indicates that function access control is to be enforced for all protected functions. Although the GCAP may indicate an enabled status, the FSCP parameter of each protected function could indicate whether such access control mechanism is enabled for any specific protected function. If the GCAP indicates a disabled state, then access controls are not enforced for any protected function regardless of the function-access data for such protected function.

At a later point in time, a secondary user126may wish to access Function-1on the electronic device102. In one example, the secondary user126may be a child of the primary user124. In another example, the secondary user126may be the same individual as the primary user124, accessing the protected function at a later point in time. For example, Function-1may enable access to the access network140(e.g., the Internet) and the secondary user126may wish to access resource-1142A via the access network140. The secondary user126may wish to access Function-1on the electronic device102while the primary user124is logged into the electronic device102but is not currently using the electronic device102. Accordingly, the secondary user126may enter, and the electronic device102may receive, a request132to perform Function-1(for example, the secondary user126may attempt to invoke an Internet browser program). The electronic device102may generate and communicate a prompt134for user access credentials in response to receiving the request132. The secondary user126may enter and the electronic device102may receive the user access credentials136identifying the secondary user126in response to the prompt134for user access credentials.

The electronic device102determines whether the received user access credentials136match the function-access data116associated with Function-1. For example, the electronic device102may determine if the identify of the secondary user126is specified in either the user ID information120A included in function-1access-data-1118A or specified in the user ID information120B included in function-1access-data-2118B and then the electronic device102may determine that the received user access credentials136match the function-access data116associated with Function-1. For example, the user ID information120A may specify access credentials for a first child and the user ID information120B may specify access credentials for a second child as described above. In this example, if the secondary user126is either the first child or the second child, the electronic device102will determine that the received user access credentials136match the function-access data116associated with Function-1. However, if the secondary user136is a third child, then the electronic device102will determine that the received user access credentials136do not match the function-access data116associated with Function-1and the invocation of Function-1is rejected.

When the received user access credentials136match the function-1access-data-1118A associated with Function-1, the electronic device performs Function-1in accordance with the usage restrictions122A in the function-1access-data-1118A associated with the user identified by the received user access credentials136. For example, if the secondary user126is the first child, then the electronic device102will perform Function-1in accordance with the usage restrictions122A included in function-1access-data-1118A. If the secondary user126is the second child, then the electronic device102will perform Function-1in accordance with the usage restrictions122B included in function-1access-data-2118B.

If during the performing of Function-1, the continuance of performing Function-1would not be in accordance with the usage restrictions122A included in function-1access-data-1118A, the user interface component of the electronic device102may automatically terminate the performing of Function-1. In particular embodiment, the first child requests Function-1(e.g., access to the Internet) and the usage restrictions122A included in the function-1access-data-1118A indicate that the first child is authorized to perform the function for a limited amount of time (e.g., one hour). If the first child performs Function-1for more than the limited amount of time, the user interface component of the electronic device102automatically terminates Function-1one hour after invocation of Function-1by that child. In another particular embodiment, the first child requests Function-1(e.g., access to the Internet) and the usage restrictions122A included in the function-1access-data-1118A indicate that the first child is not authorized to perform Function-1between a time frame of 10:00 pm and 8:00 am. The electronic device102will perform Function-1if the current time is 9:00 pm, for example. However, if the user interface component of the electronic device102is still performing Function-1(i.e., the first child is still accessing the Internet) at 10:00 pm, then the user interface component of the electronic device102automatically terminates the performance of Function-1, thereby halting the first child's access to the Internet.

Referring toFIG. 2, an illustrative embodiment of a data structure to provide function-based authorization to access one or more functions on an electronic device is disclosed. In particular embodiments, the memory200replaces the memory108of the electronic device102ofFIG. 1. The memory200of the electronic device includes function-object-1202A. Function-object-1202A comprises a data structure including computer-executable instructions204to perform a particular function associated with an electronic device. The data structure also includes function-authorization settings206. The function-authorization settings206include function-access data-1210A and function-access data-2210B. The function-access data-1210A includes user ID information212A and usage restrictions214A. The function-access data-2210B includes user ID information212B and usage restrictions214B. In particular embodiments, the function-authorization settings206include the same information or similar types of information as the function-authorization settings114illustrated inFIG. 1. User ID information can include both identity and password information, and is also referred to as user credentials herein.

The data structure also includes function-authorization instructions208. Function-authorization instructions208include computer-executable instructions to perform operations including receiving, at the electronic device, a request to perform the particular function associated with the electronic device. The operations also include prompting for user access credentials in response to receiving the request and receiving the user access credentials in response to prompting for user access credentials. The operations also include determining whether the received user access credentials match the function-access data210A,210B associated with the particular function. The operations also include performing the particular function in accordance with usage restrictions214A,214B in the function-access data210A,210B associated with a particular user identified by the received user access credentials when the received user access credentials match the function-access data-1210A or the function-access data-2210B associated with the particular function. It should be understood that object-oriented programming techniques and data structures other than the data structure shown inFIG. 2may be used to implement embodiments disclosed herein. For example, the function-authorization instructions208may be stored in a central location in the memory200instead of being stored in each function object as shown inFIG. 2.

Implementing embodiments described herein using object-oriented programming techniques and data structures such as the data structure shown inFIG. 2may allow a primary user124to more easily create hierarchical authorizations and access controls. For example, an authorization constraint applied to a high-level function (e.g., an authorization constraint applied to the top-item in a pull-down menu) may be inherited by and be applicable to all objects subservient to the high-level function (e.g., items listed in sub-menus of the pull-down menu), unless the inheritance is specifically over-written. For example, if a primary user124desired to apply a particular authorization constraint to all the items in a menu except for one item, the primary user may apply the authorization constraint to the menu such that all the items in the menu inherit the authorization constraint. The primary user124can then over-write the authorization constraint on the one item to which the authorization constraint does not apply to.

During operation, the electronic device receives a request to perform the particular function associated with the electronic device. The electronic device sends the request to function-object-1202A and executes the function-authorization instructions208. Function-object202A receives the request to perform the particular function. Function-object-1202A prompts for user access credentials in response to receiving the request and receives the user access credentials in response to the prompt for user access credentials. Function-object-1202A determines whether the received user access credentials match the function-access data-1210A or the function-access data-2210B associated with the particular function. When the received user access credentials match the function-access data-1210A or the function-access data-2210B associated with the particular function, the electronic device executes the instructions204to perform the particular function in accordance with usage restrictions214A in the function-access data-1210A or with usage restrictions214B in the function-access data-2210B associated with a particular user identified by the received user access credentials.

Referring toFIG. 3, an illustrative embodiment of a mobile communication device300that provides function-based authorization to access particular functions is shown. The mobile communication device300includes an antenna302to transmit and receive data via a wireless network and a wireless transceiver304coupled to the antenna302. The mobile communication device300also includes an input/output (I/O) interface to receive information from and output information to a user. The I/O interface comprises a display306, a speaker308, a microphone310, and an input device312(e.g., a keypad). The mobile communication device300includes a processor314coupled to the wireless transceiver304and to the I/O interface. The mobile communication device300includes a memory device316. The memory device316includes function-authorization settings320. The function-authorization settings320may include the information of the function-authorization settings114ofFIG. 1, for example. The memory device316is accessible to the processor314and includes executable instructions318(i.e., the controller) that, when executed by the processor314, cause the mobile communication device300to perform operations including receiving, via the I/O interface, a request to generate function-authorization settings including function-access data associated with a particular function of the mobile communication device300to be protected. The operations include prompting, via the I/O interface, for the function-access data. The operations include receiving the function-access data via the I/O interface. The received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function to be protected and second function-access data that specifies access credentials of a second user to access the particular function to be protected. The operations also include associating the received function-access data with the particular function to be protected and storing the function-authorization settings including the received function-access data at the memory device316.

During a configuration operation, a primary user (e.g., a parent or a super-user of the device300, who generally logs in to the device) may create or amend the function-authorization settings320to protect a particular function associated with the mobile communication device300. Accordingly, the user may enter, and the mobile communication device300may receive, via the I/O interface, a request to generate function-authorization settings320including function-access data associated with one or more particular functions. The mobile communication device300may prompt for and receive user-authorization credentials identifying the primary user as a user authorized to generate the function-authorization settings320. The mobile communication device300may then prompt for and receive the function-access data. The function-access data includes first function-access data that specifies access credentials of a first secondary user (e.g., a first child or a first subordinate) to access the particular function to be protected and second function-access data that specifies access credentials of a second secondary user (e.g., a second child or a second subordinate) to access the particular function to be protected. The mobile communication device300associates the received function-access data with the particular function to be protected and stores the function-authorization settings320including the received function-access data at the memory device316of the mobile communication device300.

FIG. 4depicts a flow chart of a particular embodiment of a method400of providing function-based authorization to access an electronic device. The method400can be performed, for example, by electronic devices including a personal computer, a server, a set top box, or a mobile communication device (e.g., a PDA or a wireless phone), such as the mobile communication device300ofFIG. 3. The electronic device performing the method400receives a request to generate function-authorization settings including function-access data associated with a particular function of the electronic device to be protected, at402. In particular embodiments, the electronic device comprises a set top box configured to communicate with a television system, such as an internet protocol television (IPTV) system or a cable television system, for example. In particular embodiments, the particular function to be protected comprises access to a subscription service associated with the set top box. In a particular embodiment, the subscription service includes access to a particular channel or to particular media content, which may be selected by following one or more specific user interface menu items. For example, the particular channel may be a premium channel that accrues additional charges to a subscriber.

The function-authorization settings may comprise, for example, the function-authorization settings114ofFIG. 1, the function-authorization settings206ofFIG. 2, or the function-authorization settings320ofFIG. 3. Advancing to404, the electronic device prompts for and receives user-authorization credentials identifying a particular user authorized to generate the function-authorization settings. The particular user may be the primary user124ofFIG. 1, for example. The particular user may be a parent wishing to generate access controls for secondary users (e.g., children) of the electronic device.

The electronic device prompts for the function-access data, at406, and the electronic device receives the function-access data, at408. In a particular embodiment, the received function-access data includes first function-access data that specifies access credentials of a first user to access the particular function to be protected and second function-access data that specifies access credentials of a second user to access the particular function to be protected. The received function-access data may comprise the function-access data130ofFIG. 1, for example. The electronic device associates the received function-access data with the particular function to be protected, at410. Advancing to412, the electronic device stores the function-authorization settings including the received function-access data at a memory of the electronic device. In a first particular embodiment, the memory comprises the memory108ofFIG. 1and the function-authorization settings comprise the function-authorization settings114. In a second particular embodiment, the memory comprises the memory200ofFIG. 2and the function-authorization settings comprise the function-authorization settings206. In a third particular embodiment, the memory comprises the memory316ofFIG. 3and the function-authorization settings comprise the function-authorization settings320.

In accordance with embodiments disclosed herein, additional functions can be defined on an electronic device with each function having different usage restrictions for each user authorized to perform the function, at414. In a particular embodiment, a parent can generate different usage restrictions for each child in the family that uses a particular electronic device, such as a mobile communication device or a desktop computer having access to the Internet, for example. The parent may give herself unrestricted access to a browser that enables access to the Internet on a mobile communication device, for example. The parent may give an oldest child authority to access the browser, but only after a time (e.g., 10:00) determined by the parent. The parent may give a younger child authority to access the browser as well, but may only give authority to access the browser at a different time (e.g., 8:00). Alternatively, the parent may choose to not give the younger child authority to access the browser at all. The parent may allow all users unrestricted access to some functions on the mobile communication device. For example, the parent may wish to allow any user of the mobile communication device to place a “911” call by invoking a call function icon or button. As another example, the parent may disable access to an Internet browser function of a mobile device to avoid excessive charges.

In another particular embodiment, a supervisor can generate different usage restrictions for different subordinates or visitors that are users of a desktop computer in a work environment. For example, the supervisor may log into a desktop computer using his primary user credentials and may authorize a first subordinate to access particular functions that enable access to certain highly confidential or highly sensitive information. Additionally, the supervisor may choose to not authorize a second subordinate or visitors to have access to the particular functions. For functions other than the particular functions, the supervisor may choose to authorize all users to perform the other functions.

FIG. 5depicts a flow chart of a particular embodiment of a method500of accessing a particular restricted function of an electronic device that has function-based authorization. The method500can be performed, for example, by electronic devices including a personal computer, a server, a set top box, or a mobile communication device, such as the mobile communication device300ofFIG. 3. The electronic device performing the method500receives a request to perform a particular function associated with the electronic device, at502. Advancing to504, the electronic device determines whether the particular function requires authorization before the particular function can be performed. In a particular embodiment, the electronic device includes one or more functions that any user is authorized to perform. For example, a mobile communication device may allow any user of the device to invoke an icon or press a button to place a “911” call without having to enter any user credentials. The mobile communication device may authorize certain, but not all, users to invoke an Internet browser.

When the particular function does not require authorization before the particular function can be performed, the method500advances to514and the electronic device begins performing the particular function. When the particular function requires authorization before the particular function can be performed, the method500advances to506and the electronic device prompts for user access credentials, at506. Advancing to508, the electronic device receives user access credentials. The electronic device determines whether the user is authorized to perform the particular function at the time of the request (e.g., a current time as determined by a clock of the electronic device), at510. When the user is not authorized to perform the particular function at the present time or at any time, the method advances to512and the electronic device denies the user's request to perform the particular function. When the user is authorized to perform the particular function at the present time, the method500advances to514and the electronic device begins performing the particular function.

Advancing to516, the electronic device waits for a predetermined amount of time. The electronic device determines if the user is authorized to perform the particular function at the subsequent time, at518. When the user is not authorized to perform the particular function at the subsequent time, the method advances to520and the electronic device automatically terminates the performance of the particular function. When the user is authorized to continue to perform the particular function at the subsequent time, the method advances to522. The electronic device determines whether performance of the particular function is complete, at522. When the performance of the particular function is not complete the method returns to516to continue monitoring the time-related and other restrictions on the user's performance of the particular function. When the performance of the particular function is complete, the method ends, at524.

FIG. 6depicts a flow chart of a particular embodiment of a method600of providing function-based authorization to access an electronic device. The method600can be performed, for example, by electronic devices including a personal computer, a server, a set top box, or a mobile communication device, such as the mobile communication device300ofFIG. 3. The electronic device performing the method600receives a request to perform a particular function, at602. In particular embodiments, the particular user is the secondary user126ofFIG. 1and the request comprises the function request132. Advancing to604, the electronic device prompts for user access credentials in response to receiving the request. The electronic device receives the user access credentials in response to prompting for the user credentials, at606.

Advancing to608, the electronic device determines whether the received user access credentials match function-access data associated with the particular function. In a particular embodiment, the function-access data includes first function-access data that specifies access credentials of a first user to access the particular function and second function-access data that specifies access credentials of a second user to access the particular function. In particular embodiments, the user access credentials include a user-id and a password and determining whether the received user access credentials match the function-access data associated with the particular function includes determining whether the stored function-access data includes a user-id and a password that match the user-id and the password included in the received user access credentials. In a first particular embodiment, the function-access data associated with the particular function comprises the function-access data116ofFIG. 1. In a second particular embodiment, the function-access data associated with the particular function comprises the function-access data210A and the function-access data210B ofFIG. 2. In a particular embodiment, at least a portion of the stored function-access data, such as credential data, is stored in secure memory. In another particular embodiment, some or all of the stored function-access data is encrypted.

Advancing to610, the electronic device performs the particular function in accordance with usage restrictions defined in the function-access data associated with a particular user identified by the received user access credentials. In a first example, the usage restrictions associated with a particular user identified by the received access credentials may comprise the usage restrictions122A or the usage restrictions122B ofFIG. 1. In a second example, the usage restrictions associated with a particular user identified by the received access credentials may comprise the usage restrictions214A or the usage restrictions214B ofFIG. 2. The electronic device may automatically terminate the performance of the particular function when performing the particular function is not in accordance with the usage restrictions in the function-access data associated with the particular user identified by the received user access credentials, at612. For example, performing the particular function may be in accordance with the usage restrictions associated with the particular user at the time the electronic device starts performing the particular function, but continuing the performance of the particular function may not be in accordance with the usage restrictions associated with the particular user at a later point in time.

Providing function-based authorization on electronic devices in accordance with embodiments disclosed herein allows an electronic device to be shared among a plurality of users (e.g., family members or employees in a work place) within the user interface logged-in environment of the primary user with each of the secondary users having different usage restrictions for different functions on the shared electronic device. The electronic device can be shared among the plurality of users while reducing unauthorized activity by the users. For example, a parent may with to lend their cellular phone to a second person, such as a family member or a friend. The parent may wish to limit or restrict the activity for which the second person can use the cellular phone. For example, when lending the cellular phone to a child (or other minor), the parent may wish the child to be authorized to place telephone calls from the cellular phone but not to be authorized to access the Internet from the cellular phone. However, when lending the cellular phone to a friend (or other adult), the parent may wish to authorize the friend to place telephone calls from the cellular phone as well as authorize the friend to access the Internet from the cellular phone. However, the parent may wish to restrict the friend from using the cellular phone to access adult websites on the Internet. Thus, in accordance with embodiments disclosed herein, each user of the cellular phone may have different usage restrictions for each protected function of the cellular phone.

In another example, an employer may keep a particular workstation running for extended periods of time, during which a plurality of different employees may have access to the workstation and the windowing user interface environment of the logged-in primary user is not disabled (e.g., is not locked). In accordance with embodiments disclosed herein, the employer can configure the workstation for an operating system account of a primary user such that each of the plurality of employees is authorized to access the functions that they need to access to accomplish their assigned tasks. The employer can also configure the workstation such that each of the employees not authorized to access functions that they do not need to access to accomplish their assigned tasks. The employer can also configure the workstation to enforce different usage restrictions on functions for different users that are authorized to access the functions. Thus, in accordance with embodiments disclosed herein, each user of the workstation may have different usage restrictions for each protected function of the workstation.

Referring toFIG. 7, an illustrative embodiment of a general computer system is shown and is designated700. The computer system700can include a set of instructions that can be executed to cause the computer system700to perform any one or more of the methods or computer-based functions disclosed herein. For example, the computer system700may include instructions that are executable to perform the methods400,500, or600shown inFIGS. 4-6. In a particular embodiment, the computer system700includes instructions of the controller112and the function-authorization settings114shown inFIG. 1. In another embodiment, the computer system700includes the function objects shown inFIG. 2. In another embodiment, the computer system700includes the controller318and the function-authorization settings320shown inFIG. 3. The computer system700may be connected to other computer systems or peripheral devices via a network, such as the network140shown inFIG. 1. The computer system700may include or be included within, for example, computing devices and set top boxes.

As illustrated inFIG. 7, the computer system700may include a processor702, e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both. Moreover, the computer system700can include a main memory704and a static memory706that can communicate with each other via a bus708. As shown, the computer system700may further include a video display unit710, such as a liquid crystal display (LCD), a projection television display, a flat panel display, a plasma display, or a solid state display. Additionally, the computer system700may include an input device712, such as a remote control device having a wireless keypad, a keyboard, a microphone coupled to a speech recognition engine, a camera such as a video camera or still camera, or a cursor control device714, such as a mouse device. The computer system700can also include a disk drive unit716, a signal generation device718, such as a speaker, and a network interface device720.

In a particular embodiment, as depicted inFIG. 7, the disk drive unit716may include a computer-readable medium722in which one or more sets of instructions724, e.g. software, can be embedded. One or more function objects726also can be embedded in the computer-readable medium722. Further, the instructions724may embody one or more of the methods, such as method400, method500and method600, or logic as described herein. The function objects726may embody the function objects202ofFIG. 2, for example. In a particular embodiment, the instructions724and the function objects726may reside completely, or at least partially, within the main memory704, the static memory706, and/or within the processor702during execution by the computer system700. The main memory704and the processor702also may include computer-readable media.