Abstract:
A system is disclosed. The system includes a server, a client application, and a first database. The first database is associated with the client application. The system further includes a second database to store data in an encrypted format, and a replicator to synchronize the data stored in the first and second databases. The system also includes a synchronizer to synchronize the data stored in the second database and the server based on a current security level.

Description:
RELATED APPLICATION 
       [0001]    This is a continuation application of U.S. application Ser. No. 13/183,138 entitled “System and Method of Data Security in Synchronizing Data with a Wireless Device” and filed Jul. 14, 2011, which is a continuation application of U.S. application Ser. No. 11/261,529 entitled “System and Method of Data Security in Synchronizing Data with a Wireless Device” and filed Oct. 28, 2005, the entire contents of each of which are incorporated herein by reference. U.S. application Ser. No. 11/261,529 is a non-provisional application based on a provisional application Ser. No. 60/622,813 filed on Oct. 28, 2004 and claims priority thereof. 
     
    
     FIELD OF THE INVENTION 
       [0002]    This invention relates generally to the filed of data synchronization. More particularly, the invention relates to a system and method for secure synchronization between server and a device. 
       BACKGROUND 
       [0003]    A variety of wireless data processing devices have been introduced over the past several years. These include wireless personal digital assistants (“PDAs”) such as the Palm® VIIx handheld, cellular phones equipped with data processing capabilities (e.g., those which include wireless application protocol (“WAP”) support), and, more recently, wireless messaging devices such as the Blackberry™ wireless pager developed by Research In Motion (“RIM”).™ 
         [0004]    Presently, a synchronization client on a wireless device watches for changes in a personal information manager (“PIM”) database and uses a network connection to keep the records on a synchronization server and the records in the PIM database synchronized with each other. During this synchronization the PIM database is accessible, and the data is not protected. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0005]    A better understanding of the present invention can be obtained from the following detailed description in conjunction with the following drawings, in which: 
           [0006]      FIG. 1  illustrates one embodiment of a block diagram of a device for secure synchronization with a synchronization server; 
           [0007]      FIG. 2  illustrates one embodiment of a flow diagram for secure synchronization of a device with a synchronization server; and 
           [0008]      FIG. 3  illustrates one embodiment of a computer system. 
       
    
    
     DETAILED DESCRIPTION 
       [0009]    According to one embodiment a system for protecting personal information manager (“PIM”) data on a device is disclosed. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and devices are shown in block diagram form to avoid obscuring the underlying principles of the present invention. 
         [0010]    Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment. 
         [0011]      FIG. 1  illustrates one embodiment of a block diagram of a device  100  securely synchronizing with a synchronization server  160 . Device  100  includes a Personal Information Manager (PIM) application  110 , a PIM database  120 , a replicator  130 , a crypto container  140  and a synchronizer  150 . 
         [0012]    PIM application  110  is coupled to PIM database  120 . PIM application  110  is a program implementation of a PIM. PIM database is a database that includes PIM information. In one embodiment, the PIM information is kept in separate records. 
         [0013]    Crypto container  140  includes a copy of the PIM database (“copyDB”)  145 . Crypto container  140  maintains the data inside copyDB  145  in an encrypted format. Crypto container  140  provides an application program interface (“API”) for reading and writing of the data in an unencrypted form. In one embodiment, access to the data in copyDB  145  is only available through the API. 
         [0014]    In one embodiment, crypto container  140  may be in an unlocked or a locked state. When crypto container  140  is in the unlocked state cipher keys are initialized and external applications (e.g. PIM application  110 ) have access to the data in copyDB  145  via the API. In the locked state, the cipher keys are erased and external applications do not have access to the data in copyDB  145 . 
         [0015]    In one embodiment, SureWave™ Mobile Defense developed by JP Mobile, Inc™ provides for the implementation of crypto container  140 . However, other implementations may be used. The data in copyDB  145  may be stored in a database format, or in another embodiment, the data may be stored in a file or file system via a system driver. 
         [0016]    Replicator  130  is coupled to PIM databse  120  and crypto container  140 . Replicator  130  synchronizes PIM database  120  with copyDB  145 . 
         [0017]    Synchronizer  150  is coupled to crypto container  140  and synchronization server  160 . In one embodiment, synchronizer  150  is implemented using SureWave™ Manager developed by JP Mobile, Inc™. However, other implementations may be used. Synchronizer  150  synchronizes copyDB  145  and synchronization server  160  via a network connection. In one embodiment, the network connection is wired. However, the network connection may be wireless. 
         [0018]    In one embodiment, device  100  may operate in one of the three following states: low security, medium security, and high security. The following table illustrates the possible transitions between states for device  100 . 
         [0000]    
       
         
               
               
               
             
           
               
                   
               
               
                 Initial state 
                 Final state 
                 Condition 
               
               
                   
               
             
             
               
                 Low security 
                 Medium security 
                 Manual lock, auto-lock, remote 
               
               
                   
                   
                 lock 
               
               
                 Medium security 
                 High security 
                 Security alert or remote lock 
               
               
                 Low security 
                 High security 
                 Security alert or remote lock 
               
               
                 High security 
                 Low security 
                 Device unlock 
               
               
                 Medium security 
                 Low security 
                 Device unlock 
               
               
                   
               
             
          
         
       
     
         [0019]    The security state of device  100  may change for various reasons. Some of the reasons may include: failed attempts to enter a password for device  100  have exceeded a predetermined amount, an attempted remote command via short message service (“SMS”) or electronic mail (“e-mail”) may have occurred, or a network intrusion may have been detected. However, other reasons may cause an increase in the security state of device  100 . 
         [0020]    In one embodiment, the low security state, the medium security state, and the high security state of device  100  correspond to an unlocked device mode, a locked/sync device mode, and a lock/emergency device mode, respectively. 
         [0021]    In the unlocked device mode, copyDB  145  is unlocked. Synchronizer  150  is authorized to synchronize data between synchronization server  160  and copyDB  145 . Replicator  130  is also authorized to synchronize the data in PIM database  120  and copyDB  145 . The PIM data in PIM database  120  is available for use by PIM application  110 , and the graphical user interface (“GUI”) of device  100  is unblocked. 
         [0022]    In the locked/sync mode, PIM database  120  is cleared, and no unencrypted data is available. The PIM data in PIM database  120  is unavailable to PIM application  110 . Replicator  130  is stopped, and copyDB  145  is unlocked. Synchronizer  150  is still authorized to synchronize data between synchronization server  160  and copyDB  145 . 
         [0023]    In the locked/emergency mode, PIM database  120  is cleared and no unencrypted data is available. The PIM data in PIM database  120  is unavailable to PIM application  110 . Replicator  130  is stopped, copyDB  145  is locked, and cipher keys are cleared. Synchronizer  150  is also stopped, and the network connection is closed. 
         [0024]      FIG. 2  illustrates one embodiment of a flow diagram for secure synchronization of a device with a synchronization server. At process block  210 , synchronization between device  100  and synchronization server  160  is initiated. At decision block  215 , it is determined whether device  100  is in the unlocked device mode. 
         [0025]    If device  100  is in the unlocked device mode then the PIM data is unlocked for use by application  110 , process block  220 . At process block  225 , replicator  130  synchronizes the data in PIM database  120  and copyDB  145 . At process block  230 , synchronizer  150  synchronizes data between synchronization server  160  and crypto container  140 . 
         [0026]    If device  100  is not in the unlocked device mode then the PIM data in PIM database  120  is locked and thus unavailable to PIM application  110 , process block  235 . At process block  240 , replicator  130  is stopped. At decision block  245 , it is determined whether device  100  is in the locked/sync mode. 
         [0027]    If device  100  is in the locked/sync mode then synchronizer  150  synchronizes data between synchronization server  160  and crypto container  140 , process block  230 . 
         [0028]    If device  100  is not in the locked/sync mode then device  100  is in the locked/emergency mode synchronizer  150  is stopped, process block  250 . 
         [0029]    The system described above provides for an efficient mechanism to protect PIM data on a device connected to a server. 
         [0030]      FIG. 3  illustrates a computer system  300  on which device  100  and or synchronization server  160  may be implemented. Computer system  300  includes a system bus  320  for communicating information, and a processor  310  coupled to bus  320  for processing information. According to one embodiment, processor  310  is implemented using one of the multitudes of Motorola ARM family of processors of microprocessors. Nevertheless one of ordinary skill in the art will appreciate that other processors may be used. 
         [0031]    Computer system  300  further comprises a random access memory (RAM) or other dynamic storage device  325  (referred to herein as main memory), coupled to bus  320  for storing information and instructions to be executed by processor  310 . Main memory  325  also may be used for storing temporary variables or other intermediate information during execution of instructions by processor  310 . Computer system  300  also may include a read only memory (ROM) and/or other static storage device  326  coupled to bus  320  for storing static information and instructions used by processor  310 . 
         [0032]    A data storage device  325  such as a magnetic disk or optical disc and its corresponding drive may also be coupled to computer system  300  for storing information and instructions. Computer system  300  can also be coupled to a second I/O bus  350  via an I/O interface  330 . A plurality of I/O devices may be coupled to I/O bus  350 , including a display device  324 ; an input device (e.g., an alphanumeric input device  523  and/or a cursor control device  322 ). 
         [0033]    The communication device  321  is for accessing other computers (servers or clients) via a network. The communication device  321  may comprise a modem, a network interface card, or other well-known interface device, such as those used for coupling to Ethernet, token ring, or other types of networks. 
         [0034]    Embodiments of the invention may include various steps as set forth above. The steps may be embodied in machine-executable instructions. The instructions can be used to cause a general-purpose or special-purpose processor to perform certain steps. Alternatively, these steps may be performed by specific hardware components that contain hardwired logic for performing the steps, or by any combination of programmed computer components and custom hardware components. 
         [0035]    Elements of the present invention may also be provided as a machine-readable medium for storing the machine-executable instructions. The machine-readable medium may include, but is not limited to, floppy diskettes, optical disks, CD-ROMs, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, propagation media or other type of media/machine-readable medium suitable for storing electronic instructions. For example, the present invention may be downloaded as a computer program which may be transferred from a remote computer (e.g., a server) to a requesting computer (e.g., a client) by way of data signals embodied in a carrier wave or other propagation medium via a communication link (e.g., a modem or network connection). 
         [0036]    Throughout the foregoing description, for the purposes of explanation, numerous specific details were set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without some of these specific details. Accordingly, the scope and spirit of the invention should be judged in terms of the claims which follow.