Patent Publication Number: US-9426145-B2

Title: Designation of classes for certificates and keys

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     The present application claims priority to U.S. Provisional Patent Application Ser. No. 61/600,302, filed Feb. 17, 2012, the contents of which are hereby incorporated herein by reference. 
    
    
     FIELD 
     The present application relates generally to management of digital identity certificates and cryptographic keys and, more specifically, to designation of classes for certificates and keys. 
     BACKGROUND 
     Mobile devices are used for a variety of purposes. Users may wish to use a particular mobile device for personal applications such as games, reading news distributed using really simple syndication (RSS), web browsing and general leisure. Corporations may want the same mobile device to be used for a subset of functionality required for a user to complete their job. 
     However, when a mobile device is used for both corporate and personal matters, a corporation may choose to limit the risk of exposure of data on the mobile device. This may be done, for example, through the implementation of information technology (IT) policies on the mobile device. Such policies sometimes lead to a poor user experience, as the mobile device may be locked such that no new applications may be loaded onto the mobile device. Alternatively, the mobile device may be restricted regarding which non-work-related applications may be loaded onto the device. For example, an IT policy on the mobile device may, in a effort to prevent potential spread of viruses, prohibit the user of the mobile device from downloading software from any location other than a specifically approved location. In this manner, the range of applications that the user can install may be significantly limited. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Reference will now be made, by way of example, to the accompanying drawings which show example implementations; and in which: 
         FIG. 1  illustrates a memory segregated into plural spaces; 
         FIG. 2  illustrates a mobile communication device with memory that may be segregated as illustrated in  FIG. 1 ; 
         FIG. 3  illustrates example steps in a method of creating a segregated space in a memory as illustrated in  FIG. 1 ; 
         FIG. 4  illustrates example steps in a method of creating a certificate store; 
         FIG. 5  illustrates example steps in a method of deleting a segregated space in a memory as illustrated in  FIG. 1 ; and 
         FIG. 6  illustrates example steps in a method of handling a certificate validation request. 
     
    
    
     DETAILED DESCRIPTION 
     Rather than restricting access to an entire mobile device that is used for both personal and corporate functionality, the present disclosure contemplates the creation of dual or plural modes of operations on the mobile device. In particular, each application of a plurality of applications may be segregated into one of a plurality of groups. In an example scenario involving a corporate mode of operation and a personal mode of operation, applications can be designated as either corporate applications or personal applications. In some cases, where an application may be both corporate and personal, a copy of the application code can be saved in both a personal memory space and a corporate memory space on the mobile device. 
     The present disclosure provides for a mobile device, but is not meant to be limited to any particular mobile device. Examples of mobile devices include smart phones, personal digital assistants, data-enabled cellular telephones, tablet computers, among others. 
     The mobile device in the present disclosure implements an IT policy to control corporate data. This may be done by connection to an enterprise server, which provides the IT policy for the device. In other embodiments, the IT policy may be implemented on a per device basis individually. 
     Notably, the segregation of applications discussed hereinbefore may have far-reaching implications for management of security aspects of the mobile device. For example, public and private cryptographic keys may be saved in memory in such a manner that the keys are associated with the mobile device and not with a mode of operation of the mobile device. Similarly, digital identity certificates may be saved in memory in such a manner that the identity certificates are associated with a user of the mobile device and not with a mode of operation of the mobile device. 
     According to an aspect of the present disclosure, there is provided a method of creating a certificate store in a memory of a device. The method includes receiving, at a space management module, a command to create a space, the space associated with a designation of a class identifying a mode of operation of the device, designating, at the space management module, a range of addresses in a memory for the space and initializing, at a certificate manager, a certificate store in the memory of the device, the certificate store associated with the designation of the class. In other aspects of the present application, a mobile communication device with a processor is provided for carrying out this method and a computer readable medium is provided for adapting a processor in a mobile communication device to carry out this method. 
     According to another aspect of the present disclosure, there is provided a method of deleting a certificate store in a memory of a device. The method including receiving, at a space management module, a command to delete a given memory space among a plurality of memory spaces, the given memory space associated with a designation of a class identifying a mode of operation of the device and deleting, at a certificate manager, a certificate store, the certificate store associated with the designation of the class. In other aspects of the present application, a mobile communication device with a processor is provided for carrying out this method and a computer readable medium is provided for adapting a processor in a mobile communication device to carry out this method. 
     According to a further aspect of the present disclosure, there is provided a method of handling certificate validation. The method includes receiving a certificate validation command, the certificate validation command specifying a certificate and a certificate store with a designation of a class identifying a mode of operation of a device, building a certificate chain for the certificate, attempting to validate the certificate chain to a root certification authority certificate in the certificate store and replying to a source of the certificate validation command with an indication of validation status. In other aspects of the present application, a mobile communication device with a processor is provided for carrying out this method and a computer readable medium is provided for adapting a processor in a mobile communication device to carry out this method. 
     According to a still further aspect of the present disclosure, there is provided a method of creating a certificate store in a memory of a device. The method includes receiving a command to create a certificate store, the command indicating a designation of a class identifying a mode of operation of the device and initializing a certificate store in the memory of the device, the certificate store associated with the designation of the class. In other aspects of the present application, a mobile communication device with a processor is provided for carrying out this method and a computer readable medium is provided for adapting a processor in a mobile communication device to carry out this method. 
     Other aspects and features of the present disclosure will become apparent to those of ordinary skill in the art upon review of the following description of specific implementations of the disclosure in conjunction with the accompanying figures. 
     Reference is now made to  FIG. 1 , which shows a block diagram of a memory  110  of a mobile device. The memory  110  is configured to maintain executable code for various applications and data related to the operation of the various applications, such combination of code and data being referred to herein as an “application space”. As illustrated in the example of  FIG. 1 , the memory  110  is divided into a personal space  120  and a corporate space  130 . 
     The corporate space  130  generally comprises a portion of memory on the mobile device segregated for data, applications, or both. The data and/or applications may be considered sensitive to a business, corporation, enterprise, government, non-profit organization, user of the device or any other entity responsible for the setting of an IT policy for the mobile device. 
     The personal space  120  generally comprises a portion of memory segregated for “personal” applications and data, where such applications or data may be considered outside of, or separate from, an IT policy. 
     An application  122  executed from code saved within the personal space  120  may access data  124  that is also saved within the personal space  120 . The data  124  that is saved within the personal space  120  may be considered to be personal data. 
     Similarly, an application  132  executed from code saved within the corporate space  130  may access data  134  that is also saved within the corporate space  130 . The data  134  that is saved within the corporate space  130  may be considered to be corporate data. 
     By segregating corporate applications from personal applications and data associated with each, a corporate IT policy may be implemented on the mobile device for the corporate data, thereby protecting the data, while still allowing for personal applications and personal data on the device. This provides more flexibility to a user of the mobile device and an arguably better user experience. 
     An operating system  140  enforces the segregation of the data as described in more detail below. 
     The designation of each application loaded onto the mobile device as either a personal application or a corporate application may be done in several ways. In one embodiment, a corporate IT policy can be set for the loading of applications onto the mobile device, where certain specified applications are designated by the IT policy to be on a list of corporate applications. Other applications, which are not the list of corporate applications, could be considered, by default, to be personal applications. In other embodiments, a user, administrator, carrier or other entity can use a configuration program or a navigation entity (application launcher) to designate the various applications on the device as either a personal application or a corporate application. Further, signatures applied to applications could also be used for making a distinction between personal applications and corporate applications. Other examples of the designation of applications as corporate and personal would be apparent to those skilled in the art having the benefit of the present disclosure. 
     In further embodiments, hybrid applications, which have both personal and corporate uses, could be duplicated between the corporate space  130  and the personal space  120 . In this way, if a user wants to use a particular application for personal reasons, the user could execute the application code  122  that is saved in the personal space  120 . Conversely, if the user wants to use the same application for corporate purposes, the user could execute the application code  132  that is saved in the corporate space  130 . 
     Thus, for example, one copy of the code for a document editor could be saved in the personal space  120  and another copy of the code for the document editor could be saved in the corporate space  130 , thereby allowing the editing of both personal documents and corporate documents, while maintaining security for the corporate data  134 . 
     In one embodiment, the corporate applications  132  may be provided with additional security over the personal applications  122 . For example, before allowing one of the corporate applications  132  to be launched, the operating system  140  may prompt the user to provide authentication, e.g., the operating system  140  may prompt the user to enter a password and the operating system  140  may authenticate the password. Further, inactivity timers could be implemented, such that the corporate applications  132  may be locked after a period of inactivity, while leaving the personal applications  122  unlocked. The operating system  140  may require a user to enter a password to unlock a locked corporate application  132  so that the corporate data  134  related to the corporate application  132  may be accessed. 
     The designation (e.g., “personal” or “corporate”) of a given application may further limit the data to which the given application has access. Thus, for example, the corporate applications  132  may execute in their own mode in which mode any data that is written by the corporate applications  132  may not be accessed by the personal applications  122 . The limitation would be that personal applications  122  are not able to read corporate data  134 , nor is a corporate application capable of writing to personal data  124 . 
     Similarly, a given personal application  122  may not be able to write to the corporate data  134 . In some embodiments, the corporate applications  132  may not be able to read the personal data  124 . In other embodiments, the corporate applications  132  may be able to read the personal data  124 . 
     The corporate data  134  may be encrypted for security. 
     The corporate data  134  may also have date of deletion policies in effect on the mobile device. Thus, if a subset of the corporate data  134  is not accessed within a certain time period, a date of deletion policy may dictate that the subset is to be erased. The date of deletion policy may be pursuant to a corporate data reaping timeline. For example, if data is not accessed on the mobile or computing device for seven days, the data may be deleted from the mobile device. The user would then need to download the data again if the data was required for the mobile device. This may be implemented through tags or data tables associated with the data. 
     The operating system  140  may handle the enforcement of the above differentiating rules between the corporate space  130  and the personal space  120 . For example, the operating system  140  may implement data access for the various applications  122  and  132 , where each application is given a group permission, similar to UNIX group permissions. In other embodiments, other user permission or other permission system may also be used. Data is further designated in files that allow access by certain groups. Thus, the operating system  140  may allow the corporate data  134  to be accessed only by the corporate applications  132  that have group permissions to access such data. Similarly, the personal data  124  may be written to or read only by the personal applications  122  based on the group permissions of the personal applications  122  with regard to the personal data  124 . The corporate applications  132 , however, may not have group permissions to write to the personal data  124  in one embodiment, as enforced by the operating system  140 . 
     As shown by a dashed line with an arrow tip in  FIG. 1 , the personal data  124  may have some form of public permissions that would allow the corporate applications  132  to read the personal data  124 . 
     Access to the data may be maintained for other data functionalities, thereby preventing the corporate data  134  from being accessed in the personal mode. For example, copy or cut functionality may be managed between the personal mode and corporate mode. Potentially, no cutting or copying would be allowed in the corporate mode of operation by the corporate applications  132 . 
     In other embodiments, cutting and copying may be allowed between corporate applications but may be restricted when trying to paste outside corporate mode. As will be appreciated, this could again be managed by UNIX group permission type model using the operating system  140 . When cutting or copying various text or images, or other data, a new data file is created which could have group permissions that would restrict where the pasting of that file is allowed to occur. Thus, when using a personal application, if trying to paste corporate data, an error might be returned, or the paste operation may simply not function. 
     In one embodiment, the corporate data  134  may be provided to a mobile device based on a secure connection with the corporate network. For example, this may be done through a virtual private network or other secure connection to an enterprise server. 
     Further, in one embodiment, the memory  110  may be located on a mobile device. In this case, the mobile device may have a pre-established secure connection with an enterprise server. 
       FIG. 2  illustrates a mobile communication device  200  as an example of a device that may include the memory  110  of  FIG. 1 . The mobile communication device  200  includes a housing, an input device (e.g., a keyboard  224  having a plurality of keys) and an output device (e.g., a display  226 ), which may comprise a full graphic, or full color, Liquid Crystal Display (LCD). In some embodiments, the display  226  may comprise a touchscreen display. In such embodiments, the keyboard  224  may comprise a virtual keyboard. Other types of output devices may alternatively be utilized. A processing device (a microprocessor  228 ) is shown schematically in  FIG. 2  as coupled between the keyboard  224  and the display  226 . The microprocessor  228  controls the operation of the display  226 , as well as the overall operation of the mobile communication device  200 , in part, responsive to actuation of the keys on the keyboard  224  by a user. 
     The housing may be elongated vertically, or may take on other sizes and shapes (including clamshell housing structures). In the case in which the keyboard  224  includes keys that are associated with at least one alphabetic character and at least one numeric character, the keyboard  224  may include a mode selection key, or other hardware or software, for switching between alphabetic entry and numeric entry. 
     In addition to the microprocessor  228 , other parts of the mobile communication device  200  are shown schematically in  FIG. 2 . These may include a communications subsystem  202 , a short-range communications subsystem  204 , the keyboard  224  and the display  226 . The mobile communication device  200  may further include other input/output devices, such as a set of auxiliary I/O devices  206 , a serial port  208 , a speaker  211  and a microphone  212 . The mobile communication device  200  may further include memory devices including a flash memory  216  and a Random Access Memory (RAM)  218  and various other device subsystems  220 . The mobile communication device  200  may comprise a two-way radio frequency (RF) communication device having voice and data communication capabilities. In addition, the mobile communication device  200  may have the capability to communicate with other computer systems via the Internet. 
     The memory  110  of  FIG. 1  may be implemented in a combination of the flash memory  216  and the RAM  218 . 
     Operating system software executed by the microprocessor  228  may be saved in a computer readable medium, such as the flash memory  216 , but may be saved in other types of memory devices, such as a read only memory (ROM) or similar storage element. In addition, system software, specific device applications, or parts thereof, may be temporarily loaded into a volatile store, such as the RAM  218 . Communication signals received by the mobile device may also be saved to the RAM  218 . 
     The microprocessor  228 , in addition to its operating system functions, enables execution of software applications on the mobile communication device  200 . A predetermined set of software applications that control basic device operations, such as a voice communications module  230 A and a data communications module  230 B, may be installed on the mobile communication device  200  during manufacture. A space management module  230 C and a certificate manager  230 D may also be installed on the mobile communication device  200  during manufacture, to implement aspects of the present disclosure. As well, additional software modules, illustrated as an other software module  230 N, which may comprise, for instance, a personal information manager (PIM) application, may be installed during manufacture. The PIM application may be capable of organizing and managing data items, such as e-mail messages, calendar events, voice mail messages, appointments and task items. The PIM application may also be capable of sending and receiving data items via a wireless carrier network  270  represented by a radio tower. The data items managed by the PIM application may be seamlessly integrated, synchronized and updated via the wireless carrier network  270  with the device user&#39;s corresponding data items saved or associated with a host computer system. 
     Communication functions, including data and voice communications, are performed through the communication subsystem  202  and, possibly, through the short-range communications subsystem  204 . The communication subsystem  202  includes a receiver  250 , a transmitter  252  and one or more antennas, illustrated as a receive antenna  254  and a transmit antenna  256 . In addition, the communication subsystem  202  also includes a processing module, such as a digital signal processor (DSP)  258 , and local oscillators (LOs)  260 . The specific design and implementation of the communication subsystem  202  is dependent upon the communication network in which the mobile communication device  200  is intended to operate. For example, the communication subsystem  202  of the mobile communication device  200  may be designed to operate with the Mobitex™, DataTAC™ or General Packet Radio Service (GPRS) mobile data communication networks and also designed to operate with any of a variety of voice communication networks, such as Advanced Mobile Phone Service (AMPS), Time Division Multiple Access (TDMA), Code Division Multiple Access (CDMA), Personal Communications Service (PCS), Global System for Mobile Communications (GSM), Enhanced Data rates for GSM Evolution (EDGE), Universal Mobile Telecommunications System (UMTS), Wideband Code Division Multiple Access (W-CDMA), High Speed Packet Access (HSPA), Long Term Evolution (LTE), etc. Other types of data and voice networks, both separate and integrated, may also be utilized with the mobile communication device  200 . 
     Network access requirements vary depending upon the type of communication system. Typically, an identifier is associated with each mobile device that uniquely identifies the mobile device or subscriber to which the mobile device has been assigned. The identifier is unique within a specific network or network technology. For example, in Mobitex™ networks, mobile devices are registered on the network using a Mobitex Access Number (MAN) associated with each device and in DataTAC™ networks, mobile devices are registered on the network using a Logical Link Identifier (LLI) associated with each device. In GPRS networks, however, network access is associated with a subscriber or user of a device. A GPRS device therefore uses a subscriber identity module, commonly referred to as a Subscriber Identity Module (SIM), in order to operate on a GPRS network. Despite identifying a subscriber by SIM, mobile devices within GSM/GPRS networks are uniquely identified using an International Mobile Equipment Identity (IMEI) number. 
     When required network registration or activation procedures have been completed, the mobile communication device  200  may send and receive communication signals over the wireless carrier network  270 . Signals received from the wireless carrier network  270  by the receive antenna  254  are routed to the receiver  250 , which provides for signal amplification, frequency down conversion, filtering, channel selection, etc., and may also provide analog to digital conversion. Analog-to-digital conversion of the received signal allows the DSP  258  to perform more complex communication functions, such as demodulation and decoding. In a similar manner, signals to be transmitted to the wireless carrier network  270  are processed (e.g., modulated and encoded) by the DSP  258  and are then provided to the transmitter  252  for digital to analog conversion, frequency up conversion, filtering, amplification and transmission to the wireless carrier network  270  (or networks) via the transmit antenna  256 . 
     In addition to processing communication signals, the DSP  258  provides for control of the receiver  250  and the transmitter  252 . For example, gains applied to communication signals in the receiver  250  and the transmitter  252  may be adaptively controlled through automatic gain control algorithms implemented in the DSP  258 . 
     In a data communication mode, a received signal, such as a text message or web page download, is processed by the communication subsystem  202  and is input to the microprocessor  228 . The received signal is then further processed by the microprocessor  228  for output to the display  226 , or alternatively to some auxiliary I/O devices  206 . A device user may also compose data items, such as e-mail messages, using the keyboard  224  and/or some other auxiliary I/O device  206 , such as a touchpad, a rocker switch, a thumb-wheel, a trackball, a touchscreen, or some other type of input device. The composed data items may then be transmitted over the wireless carrier network  270  via the communication subsystem  202 . 
     In a voice communication mode, overall operation of the device is substantially similar to the data communication mode, except that received signals are output to the speaker  211 , and signals for transmission are generated by a microphone  212 . Alternative voice or audio I/O subsystems, such as a voice message recording subsystem, may also be implemented on the mobile communication device  200 . In addition, the display  226  may also be utilized in voice communication mode, for example, to display the identity of a calling party, the duration of a voice call, or other voice call related information. 
     The short-range communications subsystem  204  enables communication between the mobile communication device  200  and other proximate systems or devices, which need not necessarily be similar devices. For example, the short-range communications subsystem may include an infrared device and associated circuits and components, or a Bluetooth™ communication module to provide for communication with similarly-enabled systems and devices, or a near field communication module, etc. 
     The mobile communication device  200  may generate cryptographic keys for use in a public key infrastructure (PKI) scheme. In a PKI scheme, a device generates a public cryptographic key (public key) and a corresponding private cryptographic key (private key). However, such cryptographic keys are of little use unless the public key is reliably associated with the identity of the mobile communication device  200 , or the identity of the user of the mobile communication device  200 . 
     A public key certificate (or digital identity certificate) is an electronic document, issued by a trusted party. The public key certificate incorporates a digital signature to bind together a public key with an identity—information such as the name of a person or an organization, an associated address and so forth. The certificate can be used to verify that a public key belongs to an individual. 
     A Certificate Authority (CA) may act as the trusted party, the entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the digital certificate. 
     Upon receiving a communication and an associated signature, the microprocessor  228  of the mobile communication device  200  may act to authenticate the communication. The microprocessor  228  may generate a hash of the communication. The microprocessor  228  may also decrypt the signature using a public key associated with the source of the communication. Upon matching the decrypted signature to the generated hash of the communication, the microprocessor  228  may consider the communication to have reliably originated at the source. 
     When the microprocessor  228  requires the public key associated with the source of the communication, the microprocessor  228  may review a local key store. Upon failing to locate the public key in the local key store, the microprocessor  228  may seeks to import a digital certificate associated with the source of the communication. The microprocessor  228  may obtain the digital certificate directly from the source of the communication or from a trusted CA. Upon obtaining the digital certificate, the microprocessor  228  may save the digital certificate at the mobile communication device  200  in a certificate store. Furthermore, the microprocessor  228  may extract the public key from the digital certificate and save the public key in a key store. 
     Historically, certificate stores and key stores have been implemented independent of the concept of the mobile communication device  200  having distinct modes of operation and corresponding memory spaces. 
     In aspects of the present application, a “class” designation may be used within the existing certificate store structure and key store structure. Accordingly, individual certificates and keys can be assigned to one space among plural spaces. In operation, the microprocessor  228  may consider a class of a certificate when importing the certificate, validating the certificate and deleting the certificate. Similarly, the microprocessor  228  may consider a class of a key when importing the key and when deleting the key. 
     The space management module  230 C, executed by the microprocessor  228 , may be configured to handle such tasks as space creation and space removal. 
       FIG. 3  illustrates example steps in a method of creating a space. Initially, the space management module  230 C may receive (step  302 ) a command to create a personal space. Responsively, the space management module  230 C may designate (step  304 ) a range of addresses in the memory  110  for the personal space  120 . The space management module  230 C may send (step  306 ) inter-process messages to the certificate manager  230 D to indicate that the personal certificate stores are to be initialized for the personal space  120 . The certificate manager  230 D may then initialize (step  308 ) one or more personal certificate stores, that is, ranges of memory in which to save certificates. For example, a personal certificate store may be created for certificates related to the browsing, by the mobile communication device  200 , of the world wide web. For another example, a personal certificate store may be created for certificates related to use, by the mobile communication device  200 , of WiFi networks. For a further example, a personal certificate store may be created for certificates related to use, by the mobile communication device  200 , of Virtual Private Networks (VPNs). 
     The same method may be repeated for the corporate space. Similarly, the method illustrated in  FIG. 3  can be used to create a personal key store or a corporate key store. 
     Initially, the space management module  230 C may receive (step  302 ) a command to create a corporate space. Responsively, the space management module  230 C may designate (step  304 ) a range of addresses in the memory  110  for the corporate space  130 . The space management module  230 C may send (step  306 ) inter-process messages to the certificate manager  230 D to indicate that the corporate certificate stores are to be initialized for the corporate space  120 . The certificate manager  230 D may then initialize (step  308 ) one or more corporate certificate stores. For example, a corporate certificate store may be created for certificates related to the browsing, by the mobile communication device  200 , of the world wide web. For another example, a corporate certificate store may be created for certificates related to use, by the mobile communication device  200 , of WiFi networks. For a further example, a corporate certificate store may be created for certificates related to use, by the mobile communication device  200 , of Virtual Private Networks (VPNs). 
     Hereinbefore, creation (step  308 ) of a certificate store associated with the designation of a class has been presented in the context of creation of a space associated with the designation of the same class (e.g., corporate). Notably, however, a certificate store may be created independent of the creation of a space and responsive to a command to create a certificate store. 
       FIG. 4  illustrates example steps in a method of creating a certificate store. Some time subsequent to the creation of a space associated with the designation of a class, the certificate manager  230 D may receive (step  402 ) a command (say, in the form of an inter-process message) to create a certificate store. Based on the command indicating a class for the certificate store, the certificate manager  230 D may proceed to create (step  404 ) a certificate store associated with a designation of the class (corporate or personal). 
       FIG. 5  illustrates example steps in a method of deleting a space. Initially, the space management module  230 C may receive (step  502 ) a command to delete the corporate space  130 . Responsively, the space management module  230 C may send (step  504 ) inter-process messages to the certificate manager  230 D to indicate that the corporate certificate stores are to be deleted. The certificate manager  230 D may delete (step  506 ) the one or more corporate certificate stores. More specifically, there may exist Application Programming Interfaces (APIs) specific to each mobile device activity that is associated with a certificate store. Recalling previous examples, there may be an API specific to web browsing, an API specific to WiFi use and an API specific to VPN use. A call to one of these APIs to delete a corporate certificate store may indicate specific attributes for each of the corporate certificate stores to be deleted. Such attributes may specify that the certificate store has a corporate class designation, is associated with a specific owner and has specific a group ID attribute. 
     Similarly, responsive to receiving (step  502 ) a command to delete a space of a particular class, the space management module  230 C may send (step  504 ) inter-process messages to the certificate manager  230 D to indicate that corporate key stores are to be deleted. The certificate manager  230 D may then delete one or more key stores of the same class. 
     The space management module  230 C may also delete (step  508 ) the corporate applications  132 . 
     Notably, the deletion (step  506 ) of the one or more corporate certificate stores, by the certificate manager  230 D may occur without messaging between the space management module  230 C and the certificate manager  230 D. In such a case, the space management module  230 C merely receives (step  502 ) a command to delete a space of a particular class and, responsively, deletes (step  508 ) the applications of the particular class. 
     The certificate manager  230 D, as part of the operating system  140 , may occasionally be called upon by a given application, among the applications  122 ,  132 , to verify the validity of a certificate. For example, the certificate manager  230 D may receive (step  602 , see  FIG. 6 ) a certificate validation command when the given application, executed on the mobile communication device  200 , has received a certificate from a source of a communication. 
     In typical operation, it is expected that the certificate manager  230 D will build (step  604 ) a certificate chain for the received certificate. The received certificate is expected to indicate an issuing CA. The issuing CA may be trusted based on a certificate issued by a further CA, and so on, ending at a so-called “root” CA certificate. Having built the chain, the certificate manager  230 D attempts to validate (step  606 ) the chain by determining that the root CA is saved in one of the trusted certificate stores for the given application and is explicitly trusted. Upon determining that the root CA certificate for the received certificate is saved in one of the trusted certificate stores, the certificate manager  230 D may reply (step  608 ) to the given application from which the certificate validation command was received with an indication of a validation status. As will be familiar to those skilled in the art, the indication may include a message indicating successful validation or a message indicating unsuccessful validation. 
     The certificate manager  230 D will typically attempt to validate (step  606 ) the chain by locating the root CA certificate in any one of the trusted certificate stores, without regard for whether a particular certificate store is a corporate certificate store or a personal certificate store. This could lead to a situation where the given application, running in the corporate space  130 , may cause the certificate manager  230 D to successfully validate (step  606 ) a chain based on a root CA certificate that is explicitly trusted in a personal certificate store but not specifically trusted in one of the corporate certificate stores. 
     The certificate validation command created by the given application may specify one or more certificate stores. As one solution, the certificate manager API may be altered such that, for example, certificate manager  230 D may only validate (step  606 ) a chain based on a root CA certificate in a specific personal certificate store, thereby leading to validation of the certificate with a root CA certificate trusted in the personal space  120 . The certificate manager  230 D may, for another example, only validate (step  606 ) a chain based on a root CA certificate in a specific corporate certificate store, thereby leading to validation of the certificate with a root CA certificate trusted in the corporate space  130 . If the certificate store is not specified, then the certificate manager  230 D may validate (step  606 ) a chain based on a root CA certificate in a personal certificate store or a corporate certificate store, thereby leading to validation of the certificate with either a root CA certificate trusted in the personal space  120  or a root CA certificate trusted in the corporate space  130 . 
     As mentioned hereinbefore, the certificate validation command created by the given application may specify multiple certificate stores. However, it is noted that all of the certificate stores will be in the same space. In such a case, the certificate manager  230 D may attempt to validate (step  606 ) a chain against root CA certificates in all of the multiple certificate stores. 
     Conveniently, designation of a class for certificates and keys allows for specific spaces to be associated with distinct certificate stores and keys stores, thereby allowing for space-aware import, validation and deletion of certificates and keys. As described hereinbefore, validation does not cross space boundaries. Furthermore, on deletion of a space, associated certificates are also deleted. 
     The above-described implementations of the present application are intended to be examples only. Alterations, modifications and variations may be effected to the particular implementations by those skilled in the art without departing from the scope of the application, which is defined by the claims appended hereto.