Method for protecting electronic device, and electronic device

• US 20030009680A1
• Filed: 06/21/2002
• Published: 01/09/2003
• Est. Priority Date: 06/29/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Kiiveri, Antti
• Granted Patent: US 8,296,575 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications

Abstract

The invention relates to an electronic device, which comprises an operational unit and a user-specific module. Data in the device, necessary for checking the user-specific module, is protected with a key of the encryption method employed by the device manufacturer. A verification key of the encryption method employed by the electronic device manufacturer is stored in the operational unit, by means of which verification key the data necessary for checking the user-specific module is verified.

Claims

1. A method for protecting an electronic device, which comprises an operational unit and a user-specific module and which is intended to communicate with a radio network, the method comprising

protecting data necessary for checking the user-specific module with a key of an encryption method used by the protection performer;

and

storing in the operational unit of the electronic device a verification key of the encryption method used by the protection performer for verifying the data necessary for checking the user-specific module.

2. A method as claimed in claim 1, performing the protection of the data necessary for checking the user-specific module with a secret key of a public key encryption method used by the protection performer;

and

storing the public key of the public key encryption method used by the protection performer in the operational unit of the electronic device to serve as the verification key.

3. A method as claimed in claim 1, performing the protection of the data necessary for checking the user-specific module by signing the data necessary for checking the user-specific module by the public key encryption method using the secret key of the protection performer;

and

storing in the operational unit of the electronic device the public key of the public key encryption method employed by the protection performer for verifying the signature of the data necessary for checking the user-specific module to serve as the verification key.

4. A method as claimed in claim 1, protecting the data necessary for checking the user-specific module by encrypting the data necessary for checking the user-specific module by the public key encryption method using the secret key of the protection performer;

and

storing in the operational unit of the electronic device the public key of the public key encryption system employed by the protection performer for decrypting the data necessary for checking the user-specific module to serve as the verification key.

5. A method as claimed in claim 1, protecting the data necessary for checking the user-specific module by a MAC encryption method, and

storing a key of the MAC encryption method in the operational unit of the electronic device for verifying the data necessary for checking the user-specific module to serve as the verification key.

6. A method as claimed in claim 1, wherein the electronic device is a terminal equipment and the user-specific module is a SIM module, and

storing the data necessary for checking the user-specific module is stored in a security state of the mobile equipment in the encrypted form and

storing the verification key of the encryption method in the security state of the electronic device for verifying the data necessary for checking the user-specific module.

10. A method as claimed in claim 6, wherein the data in the electronic device, necessary for checking the user-specific module, is encrypted by the public key encryption method using the secret key of the protection performer, the method comprising

verifying the data necessary for checking the user-specific module by decrypting the data necessary for checking the user-specific module by means of the public key of the public key method.

21. A method as claimed in claim 1 or 7, wherein the protection performer is the electronic device manufacturer.

7. A method for protecting an electronic device, which comprises an operational unit and a user-specific module and which is intended to communicate with a radio network, wherein

the data in the electronic device, necessary for checking the user-specific module, is encrypted with a key of the encryption method employed by the protection performer, and

for verifying the data necessary for checking the user-specific module a verification key of the encryption method employed by the protection performer is stored in the operational unit of the electronic device, the method comprising

verifying the data necessary for checking the user-specific module by using the verification key of the encryption method, and if the verification fails, at least preventing the electronic device from being connected to a radio network;

checking the user-specific module by means of the data necessary for checking the user-specific module; and

starting the electronic device if the user-specific module check succeeds, or at least preventing the electronic device from being connected to the radio network if the user-specific module check fails.

8. A method as claimed in claim 7, wherein the data necessary for checking the user-specific module is protected by a public key encryption method using a secret key of the protection performer, and for verifying the data necessary for checking the user-specific module the public key of the public key encryption method employed by the protection performer is stored in the operational unit of the electronic device;

the method comprising

verifying the data necessary for checking the user-specific module by using the public key of the public key encryption method.

9. A method as claimed in claim 7, wherein the data in the electronic device, necessary for checking the user-specific module, is protected with a signature that is provided by the public key encryption method using the secret key of the protection performer, the method comprising

verifying the data necessary for checking the user-specific module is verified by checking the signature using the public key of the public key method.

11. A method as claimed in claim 7, wherein the data in the electronic device, necessary for checking the user-specific module, is protected by a MAC encryption method, the method comprising

verifying the data necessary for checking the user-specific module with a key of the MAC encryption method.

12. A method as claimed in claim 7, wherein the electronic device is a terminal equipment, which comprises a mobile equipment and a SIM module as the user-specific module, and data necessary for checking the SIM module is stored in a security state of the mobile equipment for verifying the data necessary for checking the SIM module, the method comprising

performing the verification of the data necessary for checking the user-specific module in the security state.

13. A method as claimed in claim 7, wherein the data necessary for checking the user-specific module comprises at least a program intended for checking the user-specific module.

14. A method as claimed in claim 7, wherein the electronic device is a terminal equipment and the user-specific module is a SIM module, and the data necessary for checking the SIM module comprises the program intended for checking the user-specific module and an operator identifier.

15. A method as claimed in claim 9, checking the user-specific module by comparing the signature check sum with the data check sum;

and

if the check sums tally, the electronic device is started, or if the check sums do not tally, at least the connection of the electronic device to the radio network is blocked.

16. A method as claimed in claim 7, wherein the electronic device is a terminal equipment, which comprises a mobile equipment and a SIM module as the user-specific module, and the mobile equipment comprises a verification key of the encryption method of the operator, which verification key is protected with a key used by the protection performer, the method comprising

starting the terminal equipment irrespective of the SIM module check comprises the steps of

receiving a signal which comprises a SIM-module-check-OK parameter, which is protected with a key of the encryption method employed by the operator and which controls the terminal equipment to start irrespective of the SIM module check result;

verifying the parameter by using a verification key; and

storing the SIM-module-check-OK parameter in the mobile equipment.

17. A method as claimed in claim 16, wherein the parameter is protected by signing it with a secret key of the public key encryption method employed by the operator, the method comprising verifying the correctness of the parameter by checking the signature with the public key of the public key encryption method.

18. A method as claimed in claim 16, wherein the parameter is protected by encrypting it with a secret key of the public key encryption method employed by the operator, the method comprising verifying the correctness of the parameter by decrypting it with the public key of the public key encryption method.

19. A method as claimed in claim 16, performing the protection by a MAC encryption method, and

verifying the parameter with a key of the MAC encryption method.

20. A method as claimed in claim 16, checking the SIM-module-check-OK parameter for the terminal equipment start-up.

22. An electronic device, which comprises an operational unit and a user-specific module and which is arranged to communicate with a radio network, wherein

data in the electronic device, necessary for checking the user-specific module, is protected with a key of the encryption method employed by the protection performer, and a verification key of the encryption method employed by the protection performer is stored in the operational unit of the electronic device for verifying the data necessary for checking the user-specific module, and the electronic device is arranged

to verify the data necessary for checking the user-specific module by using the verification key of the encryption method, and if the verification fails, to restrict its operation at least by not connecting to the radio network;

to check the user-specific module by means of the data necessary for checking the user-specific module; and

to start if the user-specific module check succeeds, or

to restrict its operation at least by not connecting to the radio network if the user-specific module check fails.

23. A device as claimed in claim 22, wherein the data necessary for checking the user-specific module is protected by a public key encryption method using a secret key of the protection performer, and a public key of the public key encryption method employed by the protection performer is stored in the operational unit of the electronic device for verifying the data necessary for checking the user-specific module;

and

the electronic device is arranged to verify the data necessary for checking the user-specific module by using the public key of the public key encryption method.

24. A device as claimed in claim 22, wherein the data in the electronic device, necessary for checking the user-specific module, is protected by a signature, which is provided by the public key encryption method using the secret key of the protection performer;

and

the electronic device is arranged to verify the data necessary for checking the user-specific module by checking the signature with the public key of the public key method.

25. A device as claimed in claim 22, wherein the data in the electronic device, necessary for checking the user-specific module, is encrypted by the public key encryption method, using the secret key of the protection performer, and

the electronic device is arranged to verify the data necessary for checking the user-specific module by decrypting the data necessary for checking the user-specific module by means of the public key of the public key encryption method.

26. A device as claimed in claim 22, wherein the data in the electronic device, necessary for checking the user-specific module is protected by a MAC encryption method, and

the electronic device is arranged to verify the data necessary for checking the user-specific module with a key of the MAC encryption method.

27. A device as claimed in claim 22, wherein the electronic device is a terminal equipment, the operational unit is a mobile equipment comprising a security state, and the user-specific module is a SIM module, and the data necessary for checking the SIM module and a key of the encryption method are stored in the security state of the mobile equipment;

and

the mobile equipment is arranged to verify the data necessary for checking the user-specific module in the security state.

28. A device as claimed in claim 22, wherein the data necessary for checking the user-specific module comprises at least a program intended for checking the user-specific module.

29. A device as claimed in claim 22, wherein the electronic device is a terminal equipment, the operational unit is a mobile equipment and the user-specific module is a SIM module, and the data necessary for checking the SIM module comprises the program necessary for checking the user-specific module and an operator identifier.

30. A device as claimed in claim 22, wherein the operational unit is arranged to check the user-specific module by comparing the check sum of the signature with the check sum of the data;

and

if the check sums tally, the electronic device is arranged to continue the check, or if the check sum do not tally, the electronic device is arranged to restrict its operation at least by not connecting to the radio network.

31. A device as claimed in claim 22, wherein the electronic device is a terminal equipment, the operational unit is a mobile equipment and the user-specific module is a SIM module, and the mobile equipment comprises a verification key of the encryption method employed by the operator, which verification key is protected with a key of the encryption method employed by the protection performer, and

for cancelling the SIM module check

the terminal equipment is arranged to receive a signal which comprises a SIM-module-check-OK parameter, which is protected with the key of the encryption method of the operator and which controls the terminal equipment to start irrespective of the SIM module check result;

the mobile equipment is arranged to verify the parameter by using the verification key; and

the mobile equipment is arranged to store the parameter in the mobile equipment.

32. A device as claimed in claim 31, wherein the parameter is protected by signing it with a secret key of the public key encryption method employed by the operator, and the mobile equipment is arranged to verify the parameter by checking the signature using a public key of the public key encryption method.

33. A device as claimed in claim 31, wherein the parameter is protected by encrypting it with a secret key of the public key encryption method employed by the operator, and the mobile equipment is arranged to verify the parameter by decryption with the public key of the public key encryption method.

34. A method as claimed in claim 31, wherein the protection is performed by a MAC encryption method, and

the mobile equipment is arranged to verify the parameter with a key of the MAC encryption method.

35. A method as claimed in claim 31, wherein the mobile equipment is arranged to check the SIM-module-check-OK parameter for the mobile equipment start-up.

36. A method as claimed in claim 22, wherein the protection performer is an electronic device manufacturer.