Restricted execution modes

Abstract

In embodiments of restricted execution modes, a mobile device can display a device lock screen on an integrated display device, and transition from the device lock screen to display a shared space user interface of a shared space. The transition to display the shared space user interface is without receiving a PIN code entered on the device lock screen. The mobile device implements a restricted execution service that is implemented to activate a restricted execution mode of the mobile device, and restrict access of a device application to device content while the restricted execution mode is activated. The restricted execution service can also allow a shared device application that is included in the shared space access to the device content while the restricted execution mode is activated.

1 . A mobile device, comprising:
 a display device configured to display a device lock screen and transition to a shared space user interface of a shared space without an authentication credential entered on the device lock screen;   a processing system to implement a restricted execution service that is configured to:
 activate a restricted execution mode of the mobile device; and 
 restrict access of a device application to device content while the restricted execution mode is activated. 
   
     
     
         2 . A mobile device as recited in  claim 1 , wherein:
 the shared space includes a shared device application; and the   restricted execution service is configured to allow the shared device application access to the device content while the restricted execution mode is activated.   
     
     
         3 . A mobile device as recited in  claim 2 , wherein:
 the device application is configured to call the shared device application with a request for the device content; and   the restricted execution service is further configured to restrict the device application access to the device content via the shared device application while the restricted execution mode is activated.   
     
     
         4 . A mobile device as recited in  claim 2 , wherein:
 the device application is configured to call the shared device application with a request for the device content, the request including a request token that indicates the device application is permitted to access the device content via the shared device application in the shared space; and   the restricted execution service is further configured allow the device application access to the device content via the shared device application based on the request token while the restricted execution mode is activated.   
     
     
         5 . A mobile device as recited in  claim 1 , wherein the restricted execution service is further configured to:
 deactivate the restricted execution mode responsive to an authentication credential entered on the device lock screen; and   return to a user mode of the mobile device in which the device application has unrestricted access to the device content.   
     
     
         6 . A mobile device as recited in  claim 1 , wherein:
 the device application is configured to initiate a task call to access the device content; and wherein   the restricted execution service is configured to restrict the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.   
     
     
         7 . A mobile device as recited in  claim 1 , wherein:
 the restricted execution service is further configured to restrict the device application from a file system of the mobile device while the restricted execution mode is activated.   
     
     
         8 . A mobile device as recited in  claim 1 , wherein:
 the restricted execution service is configured to determine that the device application is one of:   user-designated to allow the device application access to the device content if the device application is included in the shared space as a shared device application; or   the device application is designed as not to be allowed access to the device content even if the device application is included in the shared space.   
     
     
         9 . A method, comprising:
 displaying a device lock screen on an integrated display device of a mobile device;   transitioning from displaying the device lock screen to display a shared space user interface of a shared space without an authentication credential entered on the device lock screen;   activating a restricted execution mode of the mobile device; and   restricting access of a device application to device content while the restricted execution mode is activated.   
     
     
         10 . A method as recited in  claim 9 , further comprising:
 allowing a shared device application that is included in the shared space access to the device content while the restricted execution mode is activated.   
     
     
         11 . A method as recited in  claim 10 , further comprising:
 restricting the device application access to the device content via the shared device application while the restricted execution mode is activated when the device application calls the shared device application with a request for the device content.   
     
     
         12 . A method as recited in  claim 10 , further comprising:
 allowing the device application access to the device content via the shared device application while the restricted execution mode is activated based on a request token that the device application includes in a task call to the shared device application for the device content, the request token indicating that the device application is permitted to access the device content via the shared device application in the shared space.   
     
     
         13 . A method as recited in  claim 9 , further comprising:
 deactivating the restricted execution mode responsive to an authentication credential entered on the device lock screen; and   returning to a user mode of the mobile device in which the device application has unrestricted access to the device content.   
     
     
         14 . A method as recited in  claim 9 , further comprising:
 restricting the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.   
     
     
         15 . A method as recited in  claim 9 , further comprising:
 restricting the device application from a file system of the mobile device while the restricted execution mode is activated.   
     
     
         16 . A method as recited in  claim 9 , further comprising:
 determining that the device application is one of:
 user-designated to allow the device application access to the device content if the device application is included in the shared space as a shared device application; or 
 the device application is designed as not to be allowed access to the device content even if the device application is included in the shared space. 
   
     
     
         17 . Computer-readable storage media comprising a restricted execution service stored as instructions that are executable and, responsive to execution of the instructions at a mobile device, the computing device performs operations of the restricted execution service comprising to:
 transition from a device lock screen to a shared space user interface of a shared space without an authentication credential entered on the device lock screen;   activate a restricted execution mode of the mobile device;   restrict access of a device application to device content while the restricted execution mode is activated; and   allow access to the device content for a shared device application that is included in the shared space.   
     
     
         18 . Computer-readable storage media as recited in  claim 17 , wherein the mobile device performs the operations of the restricted execution service further comprising to:
 restrict the device application access to the device content via the shared device application while the restricted execution mode is activated when the device application calls the shared device application with a request for the device content.   
     
     
         19 . Computer-readable storage media as recited in  claim 17 , wherein the mobile device performs the operations of the restricted execution service further comprising to:
 allow the device application access to the device content via the shared device application while the restricted execution mode is activated based on a request token that the device application includes in a task call to the shared device application for the device content, the request token indicating that the device application is permitted to access the device content via the shared device application in the shared space.   
     
     
         20 . Computer-readable storage media as recited in  claim 17 , wherein the mobile device performs the operations of the restricted execution service further comprising to:
 restrict the access to the device content based on one or more device application tasks being designated as restricted while the restricted execution mode is activated.