KR20050096114A - System and method for distributed authorization for access to communications device - Google Patents

Abstract

According to the present invention, cellular telephones or other communication devices intercept requests by applications, for example, applications received via over-the-air programming (OAP). Access sensitive device-specific data. The device-specific data may include hardware identifiers such as IMEI or other serial or subscriber identification values, phonebooks, accessor lists, personal settings such as messaging, or other information. Requests by applications for access to this type of data may be intercepted, for example, by an application programming interface executing on the communication device. The application programming interface may communicate the request to a remote authorization server with information identifying the requesting application. Such equipment may compare the application identifier or other information against a list or table of applications authorized to access device-specific data. Thus, a grant, deny, delay or other decision can be communicated back to the device for granting or denying access. Routing of such requests for data to a remote host server can prevent, for example, accessing or corrupting sensitive data by viruses, bad applications, or other types of wireless intrusions.

Description

SYSTEM AND METHOD FOR DISTRIBUTED AUTHORIZATION FOR ACCESS TO COMMUNICATION DEVICES {SYSTEM AND METHOD FOR DISTRIBUTED AUTHORIZATION FOR ACCESS TO COMMUNICATIONS DEVICE}

The subject of this application is filed on the same page as this application, and entitled "Over the Air to Prepare for Communication Device" in US Application No. CM03699J, which has the same inventors as the present application, assigned to or under the same entity as the present application. Related to the subject matter of the System and method for Distributed Authorization and Deployment of Over the Air Provisioning For a Communications Device ", the application of which is incorporated herein by reference, Motorola, It was transferred to Inc.

FIELD OF THE INVENTION The present invention relates to the field of telecommunications, in particular access to data on a mobile unit or other data on a cellular telephone or other device by onboard applications such as phone books, hardware identifiers, etc. A distributed authorization system that can be controlled by authorization processing performed on other resources.

Many cellular telephones and other communication devices are currently programmable in a variety of ways. For example, many cellular phones include editable phonebooks to allow convenient storage and dialing of frequently used or important numbers. Other cellular telephones or other devices have web browsing, file sharing and other enhanced functionality, whether or not through graphical user interfaces, voice commands or other interfaces. In addition, cellular telephones, including integrated positioning capability, such as the ability to track, record, and communicate handset location, via GPS or other location services, are becoming available. Other services exist and will be used properly. Over-the-air programming (OAP) standards, such as those using the Java programming language, have increased the delivery of these services based on on-demand or elsewhere.

However, there are risks associated with improved programmability of cellular telephones and other devices. Handsets and other devices may include handset international mobile device identification (IMEI) data, subscriber identification module (SIM) ID or other related data, number assignment module (NAM) data, mobile identification number (MIN) data, and electronic serial number (ESN). It can have storage capacity and intelligence to store various sensitive or personal information such as data, phonebooks, location tracking or other information. Devices that can accommodate Java or other over-the-air code can be secured due to malicious code or other code or data, such as viruses, spoofed games, or ring tones. Risks may occur. Once malicious processing has invaded the device, the user's sensitive hardware, phonebooks, positioning or other data can be exposed and compromised.

Prior to granting access to hardware, phonebook, or other data, user-direct security methods may be included, such as requiring passwords for the handset interface, but over-the-air and other threats may include the application programming interfaces (API). And the integrity of the mobile device and its data, including by low-level code that ininsulates the device at relatively low levels, such as) and other open ports or interfaces. Better core level security for communication devices is desirable. There are other problems.

1 illustrates a distributed authorization architecture in accordance with an embodiment of the present invention.

2 shows a schematic table for storing authorization parameters according to an embodiment of the invention.

3 illustrates a user interface for a communication device displaying an authorization notification in accordance with an embodiment of the present invention.

4 is a flowchart of an authorization process according to an embodiment of the present invention.

The present invention, which overcomes these and other problems in the art, provides a distributed right for access to a communication device where a cellular handset of another communication device can be installed to receive sensitive onboard data requests by Java or other applications. A system and method for provisioning are provided. Instead of locally authenticating the user or processing for access to a given level of data in the device, in accordance with the present invention, authorization processing may be initiated via a remote server or other resource. In embodiments, the communication device may provide an API to an internal execution program that allows all requests for sensitive data to be made. The API may, for example, forward these requests to the remote support server for authentication via an over-the-air interface. In embodiments, authentication may be made against a permission access list, listing valid programs or processes that have access to the requested level of data. When the request is valid, the approval may be returned to the communication device to approve the request code to obtain the desired data.

The invention will be described with reference to the accompanying drawings, in which like elements refer to like numbers.

1 illustrates a distributed authorization architecture in which embodiments of the present invention may operate. As shown in the figure, communication device 102 may authorize server 118 to initiate and validate requests for access to device-specific data 110 made by applications operating on communication device 102. Can communicate wirelessly with Communication device 102 may be a network-enabled wireless device such as, for example, a cellular telephone, a personal digital assistant (PDA) or a personal information manager (PIM) with IEEE 802.11b or other wireless interface, 802.11b or It may be or include a laptop or other portable computer, or other communications or client devices, with other wireless interfaces installed. The communication device 102 may communicate with the authorization server 118, for example, via an antenna 112 in 800/900 MHz, 1.9 GHz, 2.4 GHz, or other frequency bands or by optical or other links. Can be.

Device-specific data 110 may include, for example, IMEI data, data from a SIM, chip-level data, phonebooks or contact lists or other personal user settings, location tracking, electronic wallet, calendar, cellular services. Or messaging or other messaging, such as other billing, short message service (SMS) or other text, or other hardware-related, user-based or other information. Device-specific data 110 may be stored in communication device 102, eg, in electronically programmable memory (EPROM), flash cards or other electronic, optical or other media.

Communication device 102 may execute one or more applications 104, for example, a Java micro-editing application, a Java application that may include C or C ++ or other programs or code in embodiments. In embodiments, the application 104 may be or include, for example, a visitor scheduler application, phonebook application, web browsing application, financial application, personal information manager (PIM) application, or other application or service. . In embodiments, the application 104 may be implemented in accordance with or using the Java Mobile Information Device Profile (MIDP) standard, which applications may be called MIDlets or may be other languages or environments. In embodiments, application 104 may be received over the air via antenna 112 or may be received or stored from other sources, such as a cable-connected download.

The application 104 may in turn communicate with an application programming interface 106 that communicates with an authorization server 118 and with a native layer 108 performed on the communication device 102. The application programming interface 106 can provide a programming interface to the application 104 to communicate requests for the set of device-specific data 110 and perform other tasks on the communication device 102. In embodiments, application programming interface 106 may provide application-accessible interfaces to data or target classes such as, for example, network, user interface, data attributes and data content, and other resources. . The raw layer 108 operates at a relatively low level for the communication device 102 in embodiments, and may operate requests passed by the application programming interface 106 for the device-specific data 110. In embodiments, primitive layer 108 may perform, for example, oversight, file and memory management, and other tasks.

When the application 104 supplies an access request 114 for the device-specific data 110 to prevent the preservation of data and unauthorized or malicious access to that information, the application programming interface ( 106 may trap access request 114 at the system level for an offboard process before authorizing any of the device-specific data 110 to be distributed.

Specifically, when application programming interface 106 receives access request 114 from application 104 for device-specific data 110, application programming interface 106 authorizes access request 114. May communicate with an authorization server 118 to do so. The application programming interface 106 can communicate with the authorization server 118 via the server antenna 116, or other wireless or wired interface. The application programming interface 106 may, for example, include the type of data requested from the set of device-specific data 110, a name or other identifying information for the application 104, an access parameter such as the last access time, upon request An access request 114 that includes a password of or other data associated with the access request 114 for some or all of the device-specific data 110 may be sent to the authorization server 118.

Authorization server 118 may maintain a set of authorization parameters 120 to process an access request 114 for access to device-specific data 110. As shown in FIG. 2, for example, authorization parameters 120 may be maintained in an authorization table 124 that may be stored or accessed by authorization server 118. In embodiments, the authorization table 124 is a list application whose identifiers are in embodiments such as "phonebook.MID", "contactlist.c", "positiontrack.exe", or other names or indicia. It may include a set of application identifiers 126 (APP IDENTIFIER ₁ , APP IDENTIFIER ₂ ,..., APP IDENTIFIER _N , N any) that may include names or other identifiers. Similarly, the authorization table 124 may determine whether a given application 104 may be authorized to access device-specific data 110 and at what levels or what privileges (eg, read, Edit, or otherwise), which may include a set of associated access levels 128 correlated by application name or other witness, which may indicate whether access may be granted.

When the ongoing access request 114 by the application 104 is validated against the authorization parameters 120 by the authorization server 118, the authorization server 118 sends an authorization message 122 to the communication device. And transmit to 102. Authorization message 122 may include, for example, a code, flag or other indication that application 104 may access device-specific data 110. In embodiments, authorization message 122 may include additional fields or variables such as a privileged field or device 104 that device 104 has to allow access to device-specific data 110 to be coordinated. And a flag indicating whether it may have the right to read, modify, delete, or perform other operations on 110. Similarly, authorization message 122 may include a timeout field that sets a period after which application 104 may access desired data but authorization may end. In embodiments, for example, authorization may be granted for a single application 104 or one or more applications, or other applications at different times. In embodiments, the authorization to access device-specific data 110 reflected in the authorization message 122 depends on the sensitivity of the data, the nature of the application 104 generating the access request 114, and other factors. It can be done at different levels for different parts of the data.

When communication device 102 receives an authorization message 122 and the desired access is granted, application programming interface 106 may retrieve raw data 108 from device-specific data 110. May forward the access request 114. The raw layer 108 may then communicate the retrieved device-specific data 110 and pass that data to the application programming interface 106 for delivery to the application 104. The application 104 may then receive and read some or all of the device-specific data 110 requested to operate on or modify the data. In embodiments, the application 104 may also store the modified data as device-specific data 110, depending on the type or level of authorization received, network security, and other parameters, and over-deploy the antenna 112. An authorization may be received to transmit device-specific data 110 or take other action via the air interface.

When authorization server 118 cannot be used to authorize access request 114 for authorization parameters 120, authorization message 122 causes application 104 to request device-specific data 110. It may include other indicators or negative flags that are inaccessible to some or anything. In this case, as shown in FIG. 3, in embodiments, the communication device 102 notifies the user that the application or service is denied access to device-specific or sensitive information. As shown, the notification may be by a popup message 132 present on a text or graphical user interface 130 shown by a verbal message or otherwise. The notification may assist the user in determining to run, or take other action, for example, the anti-virus or communication device 102. In embodiments, denial of access to the device-specific data 110 may trigger automatic login of the application 104, automatic transmission of anti-virus or other utility to the communication device 102, or other operation.

The overall processing of distributed authorization for a communication device according to an embodiment of the present invention is shown in FIG. In step 402, the application 104 may request one or more portions of the device-specific data 110 from the communication device 102 via the application programming interface 106 and the raw layer 108 at an API or other level. In step 404, the access request 114 can be communicated using a security or other protocol such as, for example, secure socket layer (SSL), hypertext transfer protocol security (HTTPS), or another protocol or interface. May be sent to the authorization server 118 via the de-air protocol. In embodiments, the request may encapsulate data such as the name or other identifier of the application 104, the data type of the device-specific data 110 requested, and other information.

In step 406, the authorization server 118 examines the access request 114 by the application 104 for authorization parameters 120 or other security fields or templates, and determines authorization. The authorization message 122 can communicate to the communication device 102. Authorization message 122 may include an indication that the access request 114 is approved, denied, deferred, other information is required, or other actions may be taken. At step 408, upon receipt of an authorization decision from authorization server 118, raw layer 108 may read one or more portions of device-specific data 110 that application 104 is authorized to access. In step 410, the raw layer 108 may communicate one or more portions of the device-specific data 110 that the application 104 is authorized to access the application programming interface 106. In step 412, the application programming interface 106 may communicate the requested device-specific data 110 to the application 104. The process can then repeat, return to the previous point in time, and continue or end other processing.

The above description of a system and method for distributed authorization for access to a communication device in accordance with the present invention is described, and changes in configuration and implementation will occur to those skilled in the art. For example, although the invention has been described as being generally implemented in the light of a single authorization server 118, in embodiments, one or more servers or other resources may be deployed. Similarly, although the present invention has generally been described as testing for authorization for one set of authorization parameters 120, in embodiments, there may be a large number of local or secure data for which requests may be authorized. It can be configured as a remote data store.

Similarly, although the present invention has been generally described in the light of a communication device 102 having an intermediate raw layer 108, in embodiments, the communication device 102 may, for example, have some functionality provided by the authorization server 118. It may be distributed to or otherwise operate without the type of local layer. Communication device 102 may conversely include or operate on other or multiple supervisory layers. Other hardware, software or other resources described in the singular may be implemented in multiple or distributed resources, while other hardware, software or other resources described as distributed may likewise be implemented as integrated resources. Accordingly, the scope of the invention is intended to be limited only by the following claims.

Claims (10)

A system for processing requests for access to data on a communication device, the system comprising: Device-specific data, At least one application, generating a request for access to the device-specific data, An interface to a remote authorization device, and An application programming interface executing on the communication device, the remote authority to interface with the at least one application and the device-specific data and to request access to the device-specific data through the interface to request an authorization decision; And the application programming interface to communicate to the granting equipment. The apparatus of claim 1, wherein the device-specific data includes international mobile equipment identification information, subscriber identification module information, number assignment module information, mobile identification number information, electronic serial number information, chip-level information, phonebook information, accessor list information, And at least one of location tracking information, electronic wallet information, calendar information, billing information, and messaging information. 10. The system of claim 1, wherein the interface to the remote authorization equipment comprises a wireless interface. 10. The system of claim 1, wherein the communication device comprises at least one cellular telephone and a network-enabled digital information device. 10. The system of claim 1, wherein the remote authorization equipment comprises a server. The access request processing system of claim 1, wherein the remote authorization equipment includes a repository of authorization parameters. 7. The access request processing system of claim 6, wherein the repository of authorization parameters comprises at least one set of authorized application identifiers. 8. The system of claim 7 wherein the authorization parameters further comprise authorization levels associated with the authorized application identifiers. 2. The access request processing system of claim 1, wherein the at least one application comprises an application received over an air interface. The method of claim 1, wherein the authorization decision is to grant access to the device-specific data, denial of access to the device-specific data, delay of access to the device-specific data, and other authorization decision. And at least one of a request for other information for the device.