Management of network devices utilizing an authorization token

Patent metadata

Field	Value
Publication number	US-9264413-B2
Application number	US-201313787522-A
Country	US
Kind code	B2
Filing date	Mar 6, 2013
Priority date	Dec 6, 2012
Publication date	Feb 16, 2016
Grant date	Feb 16, 2016

Abstract

Aspects of the invention may relate to an apparatus, system, and method for the management of network devices utilizing an authorization token. In one embodiment, an authorization token received from a service provider may be verified using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device. Further, operation privileges may be enforced that are contained in the authorization token.

First claim

What is claimed is:

1. A network device comprising:
a network interface;
a memory including an authorization credential, the memory being configured in a universal integrated circuit card (UICC); and
a processor configured in the UICC to execute functions including:
specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within the UICC;
commanding a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;
verifying the authorization token received from the mobile network operator using the authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and
enforcing operation privileges contained in the authorization token.

2. The network device of claim 1 , wherein the integrated circuit card UICC comprises an embedded universal integrated circuit card (eUICC).

3. The network device of claim 1 , wherein the authorization token is generated within the network device based on the authorization credential or outside of the network device based on the authorization credential wherein a device management authority includes a copy of the authorization credential.

4. The network device of claim 3 , wherein the device management authority transmits the authorization token to the mobile network operator, if the authorization token is not transmitted to the mobile network operator by the network device.

5. The network device of claim 1 , wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

6. The network device of claim 1 , wherein the services provided by the mobile network operator include at least mobile network connectivity service.

7. The network device of claim 1 , wherein the mobile network operator associated with the operation privileges is specified in the authorization token.

8. The network device of claim 1 , wherein a validity of the operation privileges is specified in the authorization token.

9. The network device of claim 1 , wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

10. A method implemented by a network device comprising:
specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within a universal integrated circuit card (UICC) of the network device;
commanding, at the UICC of the network device, a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;
verifying, at the UICC of the network device, the authorization token received from the mobile network operator using an authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and
enforcing, at the UICC of the network device, operation privileges contained in the authorization token.

11. The method of claim 10 , wherein the authorization credential is stored in the UICC of the network device or with the device management authority.

12. The method of claim 10 , wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

13. The method of claim 10 , wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

14. The method of claim 13 , wherein the device management authority transmits the authorization token to the mobile network operator.

15. The method of claim 10 , wherein the services provided by the mobile network operator include at least mobile network connectivity service.

16. The method of claim 10 , further comprising specifying the mobile network operator that includes the operation privileges in the authorization token.

17. The method of claim 10 , further comprising specifying a validity of the operation privileges in the authorization token.

18. The method of claim 10 , wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

19. A computer program product executed at a network device comprising:
a non-transitory computer-readable medium comprising code for:
specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within a universal integrated circuit card (UICC) of the network device;
commanding, at the UICC of the network device, a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;
verifying, at the UICC of the network device, the authorization token received from the mobile network operator using an authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and
enforcing, at the UICC of the network device, operation privileges contained in the authorization token.

20. The computer program product of claim 19 , wherein the authorization credential is stored in the UICC of the network device or with the device management authority.

21. The computer program product of claim 19 , wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

22. The computer program product of claim 19 , wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

23. The computer program product of claim 22 , wherein the device management authority transmits the authorization token to the mobile network operator.

24. The computer program product of claim 19 , wherein the services provided by the mobile network operator include at least mobile network connectivity service.

25. The computer program product of claim 19 , further comprising code for specifying the mobile network operator that includes the operation privileges in the authorization token.

26. The computer program product of claim 19 , further comprising code for specifying a validity of the operation privileges in the authorization token.

27. The computer program product of claim 19 , wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

28. A network device comprising:
means for specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile

Assignees

• Qualcomm Inc

Inventors

• Zhang Jiang

Classifications

• H04L41/28 Primary

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L12/1407

  Policy-and-charging control [PCC] architecture · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04W12/06

  Authentication · CPC title