Enhanced security using service provider authentication

Patent metadata

Field	Value
Publication number	US-9313214-B2
Application number	US-91391904-A
Country	US
Kind code	B2
Filing date	Aug 6, 2004
Priority date	Aug 6, 2004
Publication date	Apr 12, 2016
Grant date	Apr 12, 2016

Abstract

A method ( 100 ) and an apparatus (e.g., a network node ( 210 )) for providing enhanced security using service provider authentication. In addition to authenticating an application signature ( 245 ) against a root certificate ( 235 ) stored on the network node ( 210 ), a first carrier identification ( 250 ) associated with the application ( 240 ) is compared to a second carrier identification ( 255 ). If the first and second carrier identifications match, then the application can be assigned to a trusted protection domain and granted permissions which provide privileged access to the network node. For example, the application can be granted permission to be installed and/or executed on the network node. Otherwise the application can be denied privileged access. Accordingly, a carrier's applications will be only installed onto network nodes that are intended recipients of the applications.

First claim

What is claimed is:

1. An apparatus for processing an application, comprising:
a network interface comprising a receiver for receiving an application suite over a communications network, the application suite including an application, security information associated with the application, and a first carrier identification associated with the application, the first carrier identification identifying a first communication service provider whose customers are intended recipients of the application; and
a hardware processor configured to:
responsive to receiving the application suite, authenticate the security information against a root certificate to determine whether the application is bound to a trusted protection domain;
when the application is bound to a trusted protected domain, compare the first carrier identification to a second carrier identification responsive to receipt of the application suite, the second carrier identification identifying a second communication service provider that is providing communication service to the apparatus, and
responsive to identifying a match between the first and second carrier identifications, assign permissions to the application that provide access to privileged functionality on the apparatus.

2. The apparatus of claim 1 , wherein said processor further authenticates a signature associated with the application against a root certificate stored in the apparatus.

3. The apparatus of claim 1 , wherein the application suite is a Mobile Information Device Profile application (MIDlet) suite and wherein the processor parses the MIDlet suite and identifies the first carrier identification from the parsed MIDlet suite.

4. The apparatus of claim 3 , wherein the first carrier identification is identified in at least one file selected from the group consisting of a manifest of an archive file and a descriptor file.

5. The apparatus if claim 3 , wherein the first carrier identification is identified in a manifest of an archive file and from a descriptor file.

6. The apparatus of claim 1 , wherein the communications network is a wireless communications network.

7. The apparatus of claim 1 , wherein the apparatus receives the second carrier identification over the communications network.

8. The apparatus of claim 1 , wherein the second carrier identification is retrieved from a data store within the apparatus.

9. The apparatus of claim 8 , wherein the data store is a subscriber identity module (SIM) card.

10. A method for providing enhanced security at a mobile communication device that is in communication with a communication network, the method comprising:
receiving, by a receiver of the mobile communication device from the communications network, an application suite that includes an application, security information associated with the application, and a first carrier identification associated with the application, the first carrier identification identifying a first wireless service provider whose customers are intended recipients of the application, the application being executable by the mobile communication device;
responsive to receiving the application suite, authenticating the security information against a root certificate to determine whether the application is bound to a trusted protection domain;
when the application is bound to a trusted protected domain, subsequent to receiving the application suite, comparing, by the mobile communication device, the first carrier identification to a second carrier identification, the second carrier identification identifying a second wireless service provider that is providing wireless communication service to the mobile communication device; and
responsive to identifying a match between the first carrier identification and the second carrier identification, assigning, by the mobile communication device, permissions to the application to enable the application to access privileged functionality within the mobile communication device.

11. The method according to claim 10 , further comprising:
prior to comparing the first carrier identification to the second carrier identification, determining, by the mobile communication device, whether the application is bound to a trusted protection domain; and
wherein the step of comparing comprises:
comparing the first carrier identification to the second carrier identification if the application is bound to a trusted protection domain.

12. The method according to claim 11 , wherein the application includes security information, and the method further comprises:
storing, by the mobile communication device, the root certificate; and
wherein the step of authenticating the security information against a root certificate comprises:
comparing, by the mobile communication device, the root certificate to the security information to determine whether the application is bound to a trusted protection domain.

13. The method according to claim 10 , further comprising:
responsive to identifying a mismatch between the first carrier identification and the second carrier identification, denying the application access to privileged functionality within the mobile communication device.

14. A method for providing enhanced security on a network node, the method comprising:
receiving, by a receiver of the network node, an application suite from a communications network, the application suite including at least one application, security information associated with the at least one application, and a first carrier identification associated with the at least one application, the first carrier identification identifying a first communication service provider whose customers are intended recipients of the at least one application;
responsive to receiving the application suite, authenticating the security information against a root certificate stored on the network node to determine whether the at least one application is bound to a trusted protection domain;
when the at least one application is bound to a trusted protected domain, comparing the first carrier identification to a second carrier identification, the second carrier identification identifying a second communication service provider that is providing communication service to the network node; and
when the first carrier identification matches the second carrier identification, assigning, by the network node, permissions to the at least one application that provide access to privileged functionality on the network node.

15. The method of claim 14 , further comprising:
when the at least one application is not bounded to a trusted protection domain, denying the at least one application access to privileged functionality on the network node.

16. The method of claim 14 , further comprising:
when the first carrier identification does not match the second carrier identification, denying the at least one application access to privileged functionality on the network node.

17. The method of claim 14 , wherein the second carrier identification is stored on the network node.

18. The method of claim 14 , further comprising:
responsive to receiving the application suite and prior to comparing the first carrier identification to the second carrier identification,
sending, by the network node, a request to a server to provide the second carrier identification, and
responsive to the request, receiving, by the network node, the second carrier identification from the server via the communications network.

19. The method of claim 14 , wherein the security information includes a

Assignees

• Xiao Ji
• Lin Jyh-Han
• Smith Ronald R
• Zhuang Ruiqiang
• Google Technology Holdings LLC

Inventors

• Xiao Ji
• Lin Jyh-Han
• Smith Ronald R
• Zhuang Ruiqiang

Classifications

• H04L63/126 Primary

  the source of the received data · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L2209/80

  Wireless · CPC title

• H04W12/06

  Authentication · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title