Patent Description:
Electronic devices, have gained widespread use and may provide a variety of functions including, for example, telephonic, electronic messaging and other personal information manager (PIM) application functions. Electronic devices include several types of devices including mobile stations such as simple cellular telephones, smart telephones, wireless PDAs, and computers.

Such electronic devices are often able to display various types of information to a user. In some situations, protection of the information displayed to inhibit viewing by others near the electronic device that is displaying the information is desirable. In other situations, protection of information sent from the electronic device such that only an intended recipient electronic device may view the information is desirable. Encryption of sensitive data may be utilized to protect sensitive data from being viewed by someone other than those intended to have access to the information.

Improvements in protection of such information are desirable.

The relevant state of the art is represented by <CIT>, <CIT> and <CIT>.

The present invention provides a method as detailed in claim <NUM>. Also provided is a method according to claim <NUM>, an electronic device according to claim <NUM>, and a computer program according to claim <NUM>. Advantageous features are provided in the dependent claims.

Embodiments of the present disclosure will now be described, by way of example only, with reference to the attached figures, in which:.

The following describes an electronic device including a display and a method of encrypting information displayed on the display of the electronic device. The method includes displaying content elements associated with an application running on the electronic device on a display of the electronic device, receiving a selection of a content element associated with the application running on the electronic device, determining an identity profile having an associated key, encrypting information associated with the selected content element utilizing the key associated with the determined identity profile to generate encrypted information, and displaying the encrypted information in the selected content element.

The following also describes an electronic device including a display and a method of decrypting encrypted information displayed on the display of the electronic device. The method includes displaying a content element associated with an application running on the electronic device, the content element including encrypted information, receiving a selection of the content element, determining an identity profile having an associated key, decrypting the encrypted information utilizing the key associated with the determined identity profile to generate decrypted information, and displaying the decrypted information.

For simplicity and clarity of illustration, reference numerals may be repeated among the figures to indicate corresponding or analogous elements. Numerous details are set forth to provide an understanding of the examples described herein. The examples may be practiced without these details. In other instances, well-known methods, procedures, and components are not described in detail to avoid obscuring the examples described. The description is not to be considered as limited to the scope of the examples described herein.

The disclosure generally relates to an electronic device. Examples of electronic devices include mobile, or handheld, wireless communication devices such as cellular phones, cellular smart-phones, wireless organizers, personal digital assistants, computers, tablet computers, mobile internet devices, electronic navigation devices, and so forth.

A block diagram of one example of an electronic device <NUM>, which in the present example is a portable electronic device, is shown in <FIG>. The electronic device <NUM> includes multiple components, such as a processor <NUM> that controls the overall operation of the electronic device <NUM>. Communication functions, including data and voice communications, are performed through a communication subsystem <NUM>. Data received by the electronic device <NUM> is decompressed and decrypted by a decoder <NUM>. The communication subsystem <NUM> receives messages from and sends messages to a wireless network <NUM>. The wireless network <NUM> may be any type of wireless network, including, but not limited to, data wireless networks, voice wireless networks, and networks that support both voice and data communications. A power source <NUM>, such as one or more rechargeable batteries or a port to an external power supply, powers the electronic device <NUM>.

The processor <NUM> interacts with other components, such as a Random Access Memory (RAM) <NUM>, memory <NUM>, a touch-sensitive display <NUM>, a keyboard <NUM>, an auxiliary input/output (I/O) subsystem <NUM>, a data port <NUM>, a speaker <NUM>, a microphone <NUM>, short-range communications <NUM> and other device subsystems <NUM>. The speaker <NUM>, also referred to as an earpiece speaker, is utilized to output audible signals when a user's ear is very close to the speaker <NUM>. Although not shown, the processor may also interact with a loudspeaker, for example, for hands-free use.

The touch-sensitive display <NUM> includes a display <NUM> and touch sensors <NUM> that are coupled to at least one controller <NUM> that is utilized to interact with the processor <NUM>. Input via a graphical user interface is provided via the touch-sensitive display <NUM>. Information, such as text, characters, symbols, images, icons, and other items that may be displayed or rendered on a portable electronic device, is displayed on the touch-sensitive display <NUM> via the processor <NUM>. The processor <NUM> may also interact with an accelerometer <NUM> that may be utilized to detect direction of gravitational forces or gravity-induced reaction forces.

The keyboard <NUM> includes a plurality of keys, which may be mechanical keys that include mechanical switches or contacts for input to the electronic device <NUM> when a mechanical key of the keyboard is depressed by a sufficient amount to oppose a bias of the mechanical key. In addition, the keys of the keyboard include touch sensors <NUM> coupled to a controller <NUM> to detect touch input thereon. The controller may be a keyboard controller <NUM> as illustrated in <FIG>. Alternatively, the keys of the keyboard <NUM> may be coupled to the controller <NUM> utilized to detect touches using the touch sensors <NUM> of the touch-sensitive display <NUM>.

The processor <NUM> also interacts with a plurality of control keys <NUM> and a navigation device <NUM>. The control keys <NUM> may include, for example, a send key, a menu key, an escape key, an end key, or any other suitable control keys. The navigation device <NUM> may be a touch-sensitive track pad, an optical joystick, or any other suitable navigation device to interface with a user to provide input. The navigation device <NUM> may be utilized, for example, to navigate or scroll through information on a display, control a cursor or other indicator, edit information, and so forth.

The processor <NUM> also interacts with a biometric sensor <NUM> for obtaining data to authenticate a user. The biometric sensor <NUM> may be a fingerprint sensor disposed on the navigation device for detecting a touch thereon and obtaining fingerprint data upon receipt of a touch on the navigation device. Other biometric sensors may also be successfully implemented. For example, an iris scanner or other suitable detector may be utilized for the purpose of authenticating a user.

To identify a subscriber for network access, the electronic device <NUM> may utilize a Subscriber Identity Module or a Removable User Identity Module (SIM/RUIM) card <NUM> for communication with a network, such as the wireless network <NUM>. Alternatively, user identification information may be programmed into memory <NUM>.

The electronic device <NUM> includes an operating system <NUM> and software programs, applications, or components <NUM> that are executed by the processor <NUM> and are typically stored in a persistent, updatable store such as the memory <NUM>. Additional applications or programs may be loaded onto the electronic device <NUM> through the wireless network <NUM>, the auxiliary I/O subsystem <NUM>, the data port <NUM>, the short-range communications subsystem <NUM>, or any other suitable subsystem <NUM>.

A received signal such as a text message, an e-mail message, or web page download is processed by the communication subsystem <NUM> and input to the processor <NUM>. The processor <NUM> processes the received signal for output to the display <NUM> and/or to the auxiliary I/O subsystem <NUM>. A subscriber may generate data items, for example e-mail messages, which may be transmitted over the wireless network <NUM> through the communication subsystem <NUM>. For voice communications, the overall operation of the electronic device <NUM> is similar. The speaker <NUM> outputs audible information converted from electrical signals, and the microphone <NUM> converts audible information into electrical signals for processing.

The touch-sensitive display <NUM> may be any suitable touch-sensitive display, such as a capacitive touch-sensitive display that includes a plurality of capacitive touch sensors <NUM>. Capacitive touch sensors <NUM> include drive electrodes, also known as transmission electrodes, and sense electrodes, also known as receive electrodes. The drive electrodes generally extend in one direction and cross over or under the sense electrodes, which generally extend in another direction, generally at right angles to the direction that the drive electrodes extend, to form a grid pattern. The drive electrodes are spaced from the sense electrodes by a dielectric material. The points at which the drive electrodes and the sense electrodes cross each other are referred to as nodes. The drive and sense electrodes may comprise any suitable material, such as indium tin oxide (ITO).

One or more touches, also known as touch contacts or touch events, may be detected by the touch-sensitive display <NUM>. The processor <NUM> may determine attributes of the touch, including a location of the touch. Touch location data may include data for an area of contact or data for a single point of contact, such as a point at or near a center of the area of contact. The location of a detected touch may include x and y components, e.g., horizontal and vertical components, respectively, with respect to one's view of the touch-sensitive display <NUM>. A touch may be detected from any suitable input member, such as a finger, thumb, appendage, or other objects, for example, a stylus, pen, or other pointer, depending on the nature of the touch-sensitive display <NUM>. Multiple simultaneous touches may be detected.

By repeatedly scanning the electrodes of the touch-sensitive display <NUM> to detect touches, movement of a touch relative to the touch-sensitive display <NUM> may be detected. One or more gestures may also be detected by the touch-sensitive display <NUM>. A gesture, such as a swipe, also known as a flick, is a particular type of touch on a touch-sensitive display <NUM> and may begin at an origin point and continue to an end point, for example, a concluding end of the gesture. A gesture may be identified by attributes of the gesture, including the origin point, the end point, the distance travelled, the duration, the velocity, and the direction, for example. A gesture may be long or short in distance and/or duration. Two points of the gesture may be utilized to determine a direction of the gesture. A gesture may also include a hover. A hover may be a touch at a location that is generally unchanged over a period of time or is associated with the same selection item for a period of time.

The touch sensors <NUM> on the keyboard may be any suitable touch sensors, such as capacitive touch-sensors and may comprise any suitable material, such as indium tin oxide (ITO). Optionally, the touch sensors <NUM> disposed on the keyboard <NUM> may be coupled to the same controller <NUM> as the touch sensors of touch-sensitive display <NUM> such that a single controller is utilized rather than two controllers <NUM>, <NUM>.

One or more touches on the keys of the keyboard <NUM> may be detected. The processor <NUM> may determine attributes of the touch, including a location of the touch. Touch location data may include data for an area of contact or data for a single point of contact, such as a point at or near a center of the area of contact. The location of a detected touch may include x and y components, e.g., horizontal and vertical components, respectively, with respect to one's view of the keyboard <NUM>. A touch may be detected from any suitable input member and multiple simultaneous touches may be detected.

One or more gestures may also be detected utilizing the touch sensors <NUM> disposed on the keyboard <NUM>. A gesture on the keys of the keyboard <NUM> may be identified by attributes of the gesture, including the origin point, the end point, the distance travelled, the duration, the velocity, and the direction, for example. A gesture may be long or short in distance and/or duration. Two points of the gesture may be utilized to determine a direction of the gesture. A gesture may also include a hover.

The touch-sensitive display <NUM> includes a display area in which information may be displayed, and a non-display area extending around the periphery of the display area. Information is not displayed in the non-display area by the display. The non-display area is utilized to accommodate, for example, electronic traces or electrical connections, adhesives or other sealants, and/or protective coatings around the edges of the display area. The non-display area may be referred to as an inactive area and is not part of the physical housing or frame of the electronic device. Typically, no pixels of the display are in the non-display area, thus no image can be displayed by the display <NUM> in the non-display area. Optionally, a secondary display, not part of the primary display <NUM>, may be disposed in the non-display area. Touch sensors including drive electrodes and sense electrodes may be disposed in the non-display area, which touch sensors may be extended from the touch sensors in the display area or may be distinct or separate touch sensors from the touch sensors in the display area. A touch, including a gesture, may be associated with, i.e., performed on, the display area, the non-display area, or both areas. The touch sensors including the drive electrodes and the sense electrodes may extend across substantially the entire non-display area or may be disposed in only part of the non-display area.

In some instances, a user may wish to encrypt sensitive data that may be stored on the electronic device <NUM> or transmitted in association with an application, including, for example, text messaging applications, email applications, notes applications, calendar applications, and contacts applications. An issue with current electronic devices is that not all applications include security measures, such as encryption, in order to protect sensitive data. Additionally, for applications that include encryption functionality, generally different applications utilize different encryption keys to encrypt the data, meaning that sharing data from various applications requires also sharing the various associated encryption keys.

In order to overcome at least some of the issues of present electronic devices, the present disclosure provides an electronic device and method of encrypting and decrypting information displayed on the electronic device in a manner that is separate from the application that the displayed information is associated with.

A flowchart illustrating a method of encrypting information displayed on an electronic device, such as the portable electronic device <NUM>, is shown in <FIG>. The method may be carried out by software executed, for example, by the processor <NUM>. Coding of software for carrying out such a method is within the scope of a person of ordinary skill in the art given the present description. The method may contain additional or fewer processes than shown and/or described, and may be performed in a different order. Computer-readable code executable by at least one processor, such as the processor <NUM>, of the portable electronic device to perform the method may be stored in a computer-readable storage medium, such as a non-transitory computer-readable medium. The computer-readable code may be incorporated into an operating system, such as operating system <NUM>, or may be incorporated into a stand-alone application, such as one of the programs <NUM>, or may be a functionality built into a secured vault on the electronic device, such as a secured password database.

At <NUM>, content elements associated with an application running on the electronic device are displayed on the display. An application may be considered "running on the electronic device" if, for example, the application has been opened, or launched, on the electronic device and is the application that is in focus, or active, on the electronic device. The application may be any suitable application including, for example, a text messaging application, an email application, a notes application, a calendar application, and a contacts application.

The content elements are the components of the application that are displayed on the display, and may depend upon the particular application that is running on the electronic device. For example, the content elements associated with a text messaging application may include a text entry field for inputting text characters for a message to be sent, as well as previous messages that have been sent in a particular conversation thread. In another example, the content elements associated with a contacts application may include the various information fields associated with a particular contact such as, for example, name, address, telephone number, mailing address, email address, and notes.

Each content element may have information associated with it. For example, the information associated with a previous message of a conversation thread in a text messaging application is the text that was sent in the previous message. In another example, the information associated with an information field in a contacts application may be any text that is included in that field, such as the contact's email address included in an email address field.

At <NUM>, a selection of a content element is received. Any suitable method for selecting a content element may be utilized. Selecting a content element may be performed when the electronic device has entered an encryption mode. Encryption mode may be entered in response to any suitable input such as, for example, selecting an enter encryption mode button from a command menu or performing a predefined gesture on a touch-screen of the electronic device.

Entering into an encryption mode prior to encrypting or decrypting information may include performing authentication of the user of the electronic device by, for example, prompting the user to enter a password, or utilizing fingerprint or some other biometric verification.

In an example, selecting a content element may include dragging an icon, or lens, that is displayed on the display to a location associated with a content element. In another example, a content element may be selected by receiving a clicking or tapping input at a location of the display associated with the content element.

In another example, selecting a content element may be include defining a region of the display, and selecting all of the content elements within, or partially within, that defined region. Defining a region of the display may be performed by, for example, dragging a filter from an edge of the screen towards center of the screen, such that the portion of the display covered by the filter defines the region. Dragging the filter may be performed by sliding gesture that starts near an edge of the display and moves away from the edge, or by any other suitable input. The region may be defined as the portion of the screen beginning at the edge of the display that the sliding gesture starts near and ending at the end of the sliding touch gesture. In another example, the region may be defined without displaying the filter, such that the region is defined as, for example, the portion of the display lying in the distance between the edge of the display and the end point of the sliding gesture. In another example, the region may be defined by any other suitable gesture other than a sliding gesture such as, for example, a spreading gesture performed on a touch-sensitive display.

In another example, a content element may be selecting by a user selecting all or a portion of the information displayed in association with a content element, similar to selecting information for a cut/paste/copy function. Selecting the information may cause the selected information to be highlighted and may cause a cut/paste/copy menu to be displayed. The cut/paste/copy menu may include, for example, a selectable feature associated with an encryption function such that selection of the content element associated with the selected information may be received in response to the user selecting the encryption selectable feature from the cut/paste/copy menu.

At <NUM>, an identity profile having an associated encryption key is determined. A plurality of identity profiles may be stored on the electronic device. Each identity profile may include a unique identifier to identify the different identity profiles, and a unique encryption key that may be utilized to encrypt and decrypt data. An identity profile may be a primary identity profile or a shared identity profile.

A primary identity profile is the identity profile associated with the primary user of the electronic device. The encryption key associated with the primary identity profile may be utilized to encrypt and decrypt data that is intended to be accessible only by the primary user of the electronic device. The primary identity profile may include security settings that prevent the primary identity profile from being shared with, or viewed by, other electronic devices or other users.

A shared identity profile may be associated with a user, or group of users, other than the primary user of the electronic device. A shared identity profile is intended to be shared with electronic devices of another user or group of users. The shared identity profile may be shared with the electronic devices of the other user or users by any suitable method including, for example, near field communication (NFC), and by displaying a barcode on the display of one electronic device that may be scanned by the electronic device of the other user or users.

The identity profiles may be stored on the electronic device in, for example, a secured vault, such as a secured password database, in order to inhibit unauthorized access to the stored identity profiles.

Referring to <FIG>, an example of various identity profiles stored on an electronic device <NUM> is shown. <FIG> shows a list <NUM> of the various identity profiles <NUM> through <NUM> that is displayed on a touch-sensitive display <NUM> of the electronic device <NUM>. <FIG> shows a display of the one identity profile, identity profile identity <NUM> from the list <NUM> of <FIG>. The profile identity <NUM> includes a title <NUM> associated with, for example, the user or group of users associated with the identity profile <NUM> and with whom the identity profile is shared. In this case, the title indicates that the identity profile is associated with "Neil". The identity profile <NUM> also includes an identifier <NUM>, and an encryption key <NUM>. The identity profile <NUM> may also include other information (not shown) in addition to the title <NUM>, the identifier <NUM>, and the encryption key <NUM>, such as, for example, contact details associated with the user, or group of users, associated with the identity profile, and the type of the identity profile, i.e. either primary or shared.

The identifier <NUM> in the example shown is a four digit number that uniquely identifies the identity profile <NUM>. When the encryption key <NUM> is utilized to encrypt data, the encrypted data includes this four digit number in order to identify the encryption key that is needed to decrypt the encrypted data. Although the example shows a four digit identifier <NUM>, a greater or fewer number of digits may be utilized to provide a unique identifier for each identity profile, depending on the number of identity profiles that are desired. In the example shown, the identifier <NUM> is "<NUM>" which may indicated that the identity profile <NUM> is the primary identity profile. In this case, Neil is the primary user of the electronic device, and the identity profile <NUM> may include restrictions on sharing the identity profile <NUM>. In other embodiments, the each identity profile may include an additional field (not shown) that identifies the identity profile type as either primary or shared, and the type may be user selectable.

In the examples described in the present disclosure, the encryption performed is Advanced Encryption Standard <NUM>-bit encryption (AES <NUM>). The key <NUM> in the example is an AES <NUM> key, which may be stored in base64 format. However, in practice any suitable encryption method may be utilized, and the key <NUM> may be any suitable key suitable for the encryption method utilized.

Referring back to <FIG>, determining the identity profile at <NUM> may be include, for example receiving a selection of an identity profile made by a user. For example, in response to receiving a selection of a content element, a menu may be displayed on the electronic device that includes a list of the identity profiles, or a portion of the identity profiles, stored on the electronic device. Selecting an identity profile may include performing authentication of the user of the electronic device by, for example, prompting the user to enter a password, or utilizing fingerprint or some other biometric verification.

In another example, determining the identity profile at <NUM> may be performed automatically such that the electronic device selects an identity profile. For example, an identity profile may be associated with the particular application to which the selected content element is associated. For example, if the selected content element is associated with a contacts application, it may be assumed that the information associated with the selected content element is intended to be accessible only by the primary user of the electronic device, and therefore the primary identity profile may automatically be selected. The identity profile associated with an application may be a default identity profile, which may be user configurable.

In another example, the identity profile may be automatically selected based on the identity profile included in encrypted information associated with other displayed content elements other than the selected content element. For example, in a text messaging application, previous messages of a displayed conversation thread may be encrypted. As noted above, the encrypted text includes the identifier associated with the identity profile. Therefore, determining the identity profile may include automatically selecting the identity profile associated with the identifier included in encrypted information displayed in other content elements other than the selected content element.

In another example, in a messaging context such as a text messaging application or an email application, the identity profile may be automatically selected based on recipient information associated with the message. For example, the message may be intended to be sent to a user associated with a particular email address or telephone number. In the case in which the identity profiles include contact information such as email addresses and telephone numbers, determining an identity profile may include selecting an identity profile having contact information that matches the recipient information of the message.

In the case in which an identity profile is automatically selected at <NUM>, a user may override the automatically selected identity profile and select a different identity profile.

At <NUM>, information associated with the selected content element is encrypted utilizing the encryption key associated with the identity profile determined at <NUM> to generate encrypted information.

The information associated with the content element may include, for example, text information, or any other information including files. The information that is encrypted may include information that was associated with the selected content element prior to the content element being selected, or may include information that is not associated with content element until after the content element is selected.

For example, the selected content element may be a text entry field. The information associated with the selected text entry field may include text that was entered into the text entry field prior to selection, or may include text that is entered into the text entry field after selection.

In an example, the information associated with the selected content element may be entered into a separate overlay window that is not accessible or associated with the application running on the application. For example, in response to selecting a content element, such as a text entry field, a separate window having its own input field may be displayed over the content elements of the application running on the electronic device. Text or other data, such as files, may be input into the input field of the window overlay, and this entered data is the information associated with the selected content element that is encrypted at <NUM>.

In this way, the application running on the device does not have access to the information prior to encryption in order to improve security in the event that the application keeps a log or record of all information. In an example, a virtual keyboard that is separate from and inaccessible by the application running on the electronic device may also be displayed in addition to the overlay window in order to inhibit the application from logging the keystrokes when text is input into the input field of the overlay window. This example is described in more detail below with reference to <FIG>.

In the case described above in which selecting a content element includes selecting a portion of the text or other information displayed in the content element, encrypting the information at <NUM> may include encrypting only the selected information, or may include encrypting all of the information displayed in the selected content element. For example, in the context of composing a message, such as a text message or an email message, only a portion of the message may include sensitive information. In this case, the user may have the option to encrypt only the sensitive portion of the message, by selecting the portion including sensitive information, but not encrypting the other portions that do not include sensitive information.

At <NUM>, the encrypted data is displayed in the selected content element. Displaying the encrypted data may include replacing the information in the selected content element with the encrypted data. For example, if information that is encrypted at <NUM> was associated with the content element prior to the content element being selected, then the information may be replaced with the encrypted information.

However, if the information that is encrypted at <NUM> was not associated with the content element when the content element was selected, then the encrypted information may simply be added to the selected content element without replacing any information. For example, in the case in which information is input into an input field of an overlay window, as described above, then there may be no information displayed in the content element that needs to be replaced by the encrypted information.

Optionally at <NUM>, the selected content element may be set as the default content element for the application. For example, if the selected content element is an text entry field for inputting a new message within a conversation thread in a text messaging application, a user may wish for that text entry field to be a default selected content element such that the user does not need to reselect the text entry field each time the user wishes to send a new message. Whether to set the selected content element as the default selected content element, or which content element is the default selected content element, may be user configurable.

Referring now to <FIG>, an example of encrypting information displayed on a touch-sensitive display <NUM> of an electronic device <NUM> is shown. In the example, the display <NUM> displays a conversation thread within a text messaging application that is running on the electronic device <NUM>. The conversation thread includes messages sent between the user of the electronic device <NUM> and a contact, "Ben". In the example shown, the contact "Ben" of this conversation thread may be associated with the identity profile <NUM>, having the title "Ben", shown in the example shown in <FIG>. In this example, the identity profile <NUM> has be shared between the electronic device <NUM> and an electronic device (not shown) associated with the contact Ben such that Ben is able to decrypt the received messages, is able to encrypt messages sent from the electronic device associated with Ben.

The displayed content elements of the text messaging application includes previously sent messages <NUM>, <NUM> and a text entry field <NUM>. The text messaging application also includes a virtual keyboard <NUM> is also displayed on the display <NUM> for inputting text into the text entry field <NUM>.

In the example shown in <FIG>, the text "This is a secret message. " has been input into the text entry field <NUM> via, for example, input received on the virtual keyboard <NUM>. The previous messages <NUM>, <NUM> in the example shown have been encrypted utilizing AES <NUM>, however any encryption is possible.

In the AES <NUM> format utilized in the present examples, encrypted information has the following format:
--pk2563zt3+RIZKMU2GimidKyUawOYw85Fv9kcG09--pk.

The encrypted text is identified by the starting and ending tags "pk". The first four digits of the encrypted text after the starting tag, e.g., "<NUM>" in the example shown, is the identifier of the identity profile that includes the encryption key utilized to encrypt the information. In the example shown, the identifier "<NUM>" may be associated with the identity profile <NUM> shown in <FIG>, which includes the title "Ben". The identifier included in the encrypted text is utilized to determine which encryption key to utilize to decrypt the encrypted information, as described in more detail below.

In <FIG>, an icon <NUM> is displayed. The icon <NUM> may be displayed in response to a user input that, for example, initiates an encryption mode at the electronic device <NUM>. The encryption mode may be initiated by any suitable method including, for example, making a selection to initiate encryption mode in a command menu. The command menu may be accessible by, for example, swiping up from a bottom edge <NUM> of the display <NUM> or swiping down from a top edge <NUM> of the display <NUM>. In the example shown in <FIG>, the icon <NUM> has been dragged onto the text entry field <NUM> to select the text entry field <NUM> as the selected content element.

In the example shown in <FIG>, an identity profile menu <NUM> is displayed in response to selecting a content element. As shown in <FIG>, the identity profile menu <NUM> may be expanded to display a list <NUM> identity profiles stored in the electronic device <NUM>. The identity profile menu <NUM> may be expanded by, for example, performing a tap gesture on the touch-sensitive display <NUM> at the location that the identity profile menu <NUM> is displayed. Selection of one of the identity profiles may be received in response to a tap gesture being performed at a location on the touch-sensitive display <NUM> in which that identity profile is displayed in the list <NUM>.

Alternatively, or in addition to displaying the menu <NUM>, an identity profile may automatically be selected as described above. For example, the identity profile <NUM> may be the default identity profile associated with the conversation thread between the user and the contact Ben. In another example, the identity profile <NUM> may be automatically selected by determining the identifier "<NUM>" included in the encrypted information included in the previous messages <NUM>, <NUM>. In yet another example, the contact information associated with the contact "Ben" may be included in the identity profile <NUM>, and this contact information is matched to recipient information of the conversation thread with Ben, resulting in the identity profile <NUM> being automatically selected. In an example, the automatically selected identity profile may be overridden by, for example, selecting another identity profile from the list <NUM>.

When the identity profile has been selected, the information associated with the selected content element, in this case the text "This is a secret message. " is encrypted utilizing the encryption key associated with the determined identity profile to generate the encrypted information <NUM>. The encrypted information <NUM> is displayed on the display <NUM>. In the example shown, displaying the encrypted information <NUM> includes replacing the original text, "This is a secret message. ", in the text entry field <NUM> with the encrypted information <NUM>.

Referring to <FIG>, an alternative method for selecting a content element displayed on a touch-sensitive display <NUM> of an electronic device <NUM> is shown. The touch-sensitive display <NUM> of the electronic device <NUM> shown in <FIG> displays the conversation thread of the text messaging application shown in <FIG>. However, instead of displaying an icon <NUM>, the example shown in <FIG> includes a filter tab <NUM> displayed at the edge <NUM> of the touch-sensitive display <NUM>. The filter tab <NUM> may be displayed, for example, in response to the electronic device <NUM> entering an encryption mode, similar to the display of the icon <NUM> shown in <FIG>.

The user may perform a swipe or drag gesture beginning at the filter tab <NUM> and moving away from the edge <NUM>, which may cause a filter <NUM> to be displayed on the touch-sensitive display <NUM> such that the filter <NUM> appears to be dragged out by the gesture. The filter <NUM> defines a region <NUM> that extends from the edge <NUM> of the filter to the edge <NUM> of the touch-sensitive display <NUM>. The content elements that are selected may be any content element that is at least partially within the region <NUM>, or may be only those content elements that are fully within the region <NUM>.

In the example shown, previous messages <NUM>, <NUM> and the text entry field <NUM> are all partially within the region <NUM>. In this example, the text entry field <NUM> may be selected, and the text, "This is a secret message. ", included within the text entry field <NUM> may be encrypted, similar to the encryption performed in the example described with reference to <FIG>.

In addition, previous messages <NUM>, <NUM> are partially within the region <NUM> and may also be selected. Because the previous messages <NUM>, <NUM> include information that is already encrypted, the encrypted information may be decrypted in response to being selected, as described in more detail below with reference to <FIG>. The decrypted information may be displayed over top of the respective previous message <NUM>, <NUM>. The decrypted information may be displayed only within the region <NUM> such that, when the previous messages <NUM>,<NUM> are partially located within the region <NUM>, the decrypted information appears to be revealed as the filter <NUM> is moved over each of the previous messages <NUM>, <NUM>. By expanding or contracting the filter <NUM>, a user may control what region of the screen is subject to encryption or decryption in an intuitive manner.

In other examples, the filter tab <NUM> may not be displayed on the touch-sensitive display <NUM>, and the filter <NUM> may be dragged from the edge <NUM> by a swipe or drag gesture beginning near, i.e., within a predetermined distance, of the edge <NUM> and moved away from the edge <NUM>. In another embodiment, the filter <NUM> may not be displayed on the touch-sensitive display <NUM> at all. In this example, the region <NUM> may be not defined with respect to a filter <NUM>, but is defined by the distance that the swipe gestures moves from the edge <NUM> in the same manner as previously described when the filter <NUM> is displayed.

Although <FIG> show the filter <NUM> extending from an edge <NUM> on the right-hand side of the touch-sensitive display <NUM>, as viewed in the orientation shown in <FIG>, in other examples, any other edge of the display <NUM> may alternatively, or additionally, be utilized to define the region <NUM>.

Referring now to <FIG>, another example of selecting a content element displayed on a touch-sensitive display <NUM> of an electronic device <NUM> is shown. The touch-sensitive display <NUM> of the electronic device <NUM> shown in <FIG> displays the conversation thread of the text messaging application shown in <FIG>. In the example shown in <FIG>, a region <NUM> has been defined on the touch-sensitive display <NUM>. Similar to the region <NUM>, described with reference to <FIG>, content elements within the region <NUM>, either fully or partially, may be selected content elements. In the example shown in <FIG>, the text entry field <NUM> is within the region <NUM>, and is selected. The text, "This is a secret message. " included within the selected text entry field <NUM> may be encrypted as described above with reference to <FIG>.

The region <NUM> may be defined on the touch-sensitive display <NUM> in any suitable manner. For example, the region may be defined by a pinching gesture performed on the touch-sensitive display <NUM> such that the locations of the two touches of the pinching gesture define opposing corners of a rectangular region <NUM>. The region <NUM> may be defined by performing a predetermined gesture or input after, for example, the electronic device <NUM> has entered an encryption mode.

Referring now to <FIG>, an example in which information associated with a selected content element is entered in a separate overlay window is shown. The touch-sensitive display <NUM> of the electronic device <NUM> shown in <FIG> displays the conversation thread of the text messaging application shown previously in <FIG>. In the example shown in <FIG>, an overlay window <NUM> is displayed on the touch-sensitive display <NUM>. The overlay window <NUM> may be displayed in response to receiving a selection of the text entry field <NUM> as the selected content element.

The overlay window <NUM> may be separate from the application running on the electronic device <NUM>, in this example the text messaging application. The overlay window <NUM> includes an entry field <NUM> for entering information to be associated with a selected content element, in this example the text entry field <NUM> associated with the text messaging application. In the example shown, the text "This is a secret message. " is entered into the entry field <NUM>.

Text or other information, such as files, that is entered in the entry field <NUM> may be inaccessible by the application because the overlay window <NUM> is separate from the application running on the electronic device <NUM>. The information that is entered in the entry field <NUM> is encrypted to generate the encrypted information, as described above, and the encrypted information may be entered into the text entry field <NUM>.

In addition, a virtual keyboard <NUM> may be displayed in place of the virtual keyboard <NUM> that is displayed in the example shown in <FIG>. The virtual keyboard <NUM> is associated with the overlay window <NUM> and is not associated with or accessible by the application running on the electronic device <NUM> such that the application is not able to monitor keystrokes when entering text into the entry field <NUM>.

For example, some applications may log or otherwise store all data entered into the application, whether that information is transmitted or otherwise stored on the electronic device <NUM>. Entering all data into an overlay window <NUM> and by utilizing a separate virtual keyboard <NUM> for text entry, inhibits an application from accessing unencrypted information, thereby further increasing security of sensitive information.

Referring now to <FIG>, a flowchart illustrating a method of encrypting information displayed on an electronic device, such as the portable electronic device <NUM>, is shown. The method may be carried out by software executed, for example, by the processor <NUM>. Coding of software for carrying out such a method is within the scope of a person of ordinary skill in the art given the present description. The method may contain additional or fewer processes than shown and/or described, and may be performed in a different order. Computer-readable code executable by at least one processor, such as the processor <NUM>, of the portable electronic device to perform the method may be stored in a computer-readable storage medium, such as a non-transitory computer-readable medium. The computer-readable code may be incorporated into the operating system, such as operating system <NUM>, or may be incorporated into a stand-alone application, such as one of the programs <NUM>, or may be a functionality built into a secured vault on the electronic device, such as a secured password database.

At <NUM>, a content element that includes encrypted information is displayed on a display of an electronic device. Displaying the content element including may be similar to displaying the encrypted information at <NUM> as described above with reference to <FIG>, or may be similar to displaying the previous messages <NUM>, <NUM> described above with reference to <FIG>.

Optionally at <NUM>, displaying the content element including encrypted data at <NUM> may include displaying an indicator in association with the encrypted data. The indicator may be, for example, an icon or an emoji that is inserted into the encrypted text, or is displayed proximate to the encrypted text, to indicate to a user, such as the recipient of an encrypted text message, that the information contained in the message is encrypted.

At <NUM>, a selection of the content element is received. Receiving the selection of the content element may be performed similar to receiving the selection of a content element at <NUM> as described above with reference to <FIG>, or similar to any of the examples of selecting a content element described above with reference to <FIG>, and therefore is not further described here to avoid repetition. Selecting a content element may include performing authentication of the user of the electronic device by, for example, prompting the user to enter a password, or utilizing fingerprint or some other biometric verification, before the encrypted information associated with the selected content element is decrypted.

At <NUM>, an identity profile having an associated encryption key is determined. The identity profile may be determined by based on an identifier that is included within the encrypted information and that is associated with the identity profile, as described previously.

At <NUM>, the encrypted information is decrypted utilizing the encryption key associated with the determined identity profile to generate decrypted information.

At <NUM>, the decrypted information is displayed on the display of the electronic device. In an example, the decrypted information is displayed in an overlay window that is separate from, and inaccessible by, the application running on the electronic device. Displaying the decrypted information in an overlay window increases security of the decrypted information by not giving the application access to the decrypted information, as described above with reference to <FIG>.

In another example, the decrypted information is displayed by replacing the encrypted information in the selected content element with the decrypted information. For example, when the selected content element is a text entry field and the user wishes to edit the information entered into the text entry field, it may be desirable to enter the decrypted information into the text entry field to facilitate editing the information.

In an example, the decrypted information may be displayed in an overlay window by default, and entered into the selected content element in response to receiving a further input. The further input may be any suitable input such as, for example, a tap gesture or a double-tap gesture performed at the location of the selected content element or the overlay window.

If, for example, the content element is selected utilizing an icon, such as icon <NUM> described above with reference to <FIG>, the decrypted information may be entered into the selected content element in response to a tap or double-tap gesture performed on the icon, whereas merely dragging the icon to the content element, or hovering the icon over the content element, may cause the decrypted information to be displayed in an overlay window.

Optionally at <NUM>, the selected content element may be set as a default selected content element for the application running on the electronic device. Setting the selected content item as a default selected content item for the application may be similar to <NUM> described above with reference to <FIG>. For example, in the context of a text messaging application, a user may define a region of the display, similar to regions <NUM> and <NUM> described above with reference to <FIG> and <FIG>, respectively, that covers the upper of the display in which previously sent messages are displayed. In this example, at <NUM> may cause any content elements displayed this upper portion of the display, i.e., the previously displayed messages, to be selected by default and decrypted without the user having to reselect the previously sent messages.

Referring now to <FIG>, an example of displaying decrypted information in an overlay window is shown. The touch-sensitive display <NUM> of the electronic device <NUM> shown in <FIG> displays the conversation thread of the text messaging application shown previously in <FIG> after the encrypted information included in the text entry field <NUM> has been sent. The encrypted information now appears in a previously sent message <NUM>.

In the example shown, an icon <NUM> is displayed on the touch-sensitive display <NUM>. As described above, the icon <NUM> may be dragged onto a displayed content element in order to select the content element. <FIG> shows that the icon <NUM> has been dragged onto the previous message <NUM>, selecting the previous message <NUM>. In response to selecting the previous message <NUM>, the encrypted information associated with the previous message <NUM> is decrypted to generated decrypted information, which is displayed in an overlay window <NUM>. As described above, the encrypted information is decrypted utilizing the encryption key associated with the identifier "<NUM>" that is included in the encrypted information included in the previous message <NUM>, which corresponds to the identity profile <NUM> associated with the contact "Ben".

Referring now to <FIG>, another example of displaying decrypted information is shown. In the example shown in <FIG>, the application that is running on the electronic device <NUM> is a contacts application. A particular contact profile associated with a contact "Joey" is displayed on the touch-sensitive display <NUM> of the electronic device <NUM>. The contact profile includes a content element <NUM> titled "Note". The content element <NUM> includes encrypted information <NUM>. The first four digits, "<NUM>" after the "--pk" beginning tag indicates the identifier of the identity profile associated with the encryption key utilized to generate the encrypted information.

In <FIG>, an icon <NUM> has been dragged over the content element <NUM> to select the content element <NUM>. In response to selecting the content element <NUM>, the encrypted information <NUM> is decrypted utilizing the encryption key associated with the determined identity profile, i.e., the identity profile having the identifier "<NUM>", to generate the decrypted information <NUM>, "Nice guy but is a close talker!". In example shown in <FIG>, the icon <NUM> has merely been dragged over the content element <NUM>, and therefore the decrypted information is displayed in an overlay window <NUM>.

In <FIG>, a further input has been received such as, for example a tap or a double-tap gesture on the icon <NUM>. In response to receiving the further input, the encrypted information <NUM> in the content element <NUM> is replaced with the decrypted information <NUM>. Entering the decrypted information <NUM> directly into the content element <NUM> facilitates editing the decrypted information. Once edited, the information may be encrypted again, as described previously.

Although the above examples described with reference to <FIG> and <FIG> are of an electronic device <NUM> having a touch-sensitive display <NUM>, it is understood that the examples also apply to electronic devices that include displays that are not touch-sensitive. For example, rather than receiving gesture inputs from a touch-sensitive display, the various inputs may be received any suitable input device such as, for example, the navigation device <NUM> of the electronic device <NUM>.

Disclosed herein are electronic devices and methods for encrypting and decrypting information displayed on a display of an electronic device. Advantageously, encryption and decryption may be performed on data that is associated with an application that does not itself include encryption functionality. Further, the method facilitates encrypting and decrypting across multiple applications utilizing a single identity profile, facilitating utilizing a single set of shared credentials to be used to share encrypted information across multiple applications and platforms. Further, by entering information for encryption and displaying decrypted information in an overlay window that is separate and inaccessible by an application, security of sensitive information may be increased by inhibiting access by applications to unencrypted data.

Claim 1:
A method of encrypting information on an electronic device (<NUM>), the method comprising:
displaying (<NUM>) content elements (<NUM>) associated with an application running on the electronic device on a display (<NUM>) of the electronic device;
receiving (<NUM>) a selection of a content element associated with the application running on the electronic device;
determining (<NUM>) an identity profile (<NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>) having an associated key (<NUM>);
encrypting (<NUM>) information associated with the selected content element utilizing the key associated with the determined identity profile to generate encrypted information (<NUM>);
displaying (<NUM>) the encrypted information in the selected content element;
wherein:
the selected content element comprises a text entry field (<NUM>) associated with the application running on the electronic device;
encrypting information associated with the selected content element comprises:
displaying a second text entry field (<NUM>) in an overlay window (<NUM>) that is separate from the application running on the electronic device, wherein the second text entry field is configured such that text entered into the second text entry field is not accessible by the application;
receiving text input in the second text entry field;
encrypting the text input received in the second text entry field to generate the encrypted information (<NUM>); and
displaying the encrypted information (<NUM>) comprises entering the encrypted information into the text entry field associated with the application running on the electronic device.