Method for defining and checking a connection establishment authorisation, associated program data packet, associated device and associated program

• US 20050020253A1
• Filed: 11/04/2002
• Published: 01/27/2005
• Est. Priority Date: 11/19/2001
• Status: Active Grant

• Current Assignee: Nokia Siemens Networks GmbH & Company KG (Nokia Corporation)
• Original Assignee: Nokia Siemens Networks GmbH & Company KG (Nokia Corporation)
• Inventors: Pasteanu, Calinel
• Granted Patent: US 7,448,082 B2
• Time in Patent Office: Days
• US Class Current: 455/418
• CPC Class Codes: H04W 76/18 Management of setup rejection or failure
• CPC Class Codes: H04W 8/245 from a network towards a terminal
• CPC Class Codes: H04W 92/18 between terminal devices

Abstract

The present invention relates to, inter alia, a method according to which an authorization datum is predefined for a program before transmission to an appliance of a user, the value of the datum indicating a right to establish a connection. A security program which is independent of the program cited authorizes the establishment of a connection via a data transmission network during the running of the program, according to the value of the authorization datum, or rejects the establishment of the connection.

Claims

1. Method for defining and checking a connection establishment authorization,

in which for a program (104) before its transfer to a device (10) of a user (SubA), an item of authorization data (112) is specified of which the value specifies connection establishment rights,

in which the program (104) is transferred jointly with the authorization data (112) to the device (10) (50),

in which the program (104) is stored in a memory unit of the device (10) together with the authorization data (112),

in which, on execution of the program (104), a connection establishment is initiated via a data transmission network (16),

and in which a security program (130) independent of the program (104) allows or rejects (162, 164) the connection establishment depending on the value of the authorization data (112).

2. Method in accordance with claim 1, characterized in that the method is executed in a terminal (10) of a data transmission network (16, 28, 38), especially of a mobile radio data transmission network

3. Method in accordance with claim 1 or 2, characterized in that the authorization data (112) is transmitted outside machine commands or commands in a byte code of the program (104).

4. Method in accordance with one of the previous claims, characterized in that at least two kinds of program types and at least two values for the authorization data (112) are defined,

permitted assignments of program types to at least one value are prespecified,

and the value of the authorization data, depending on the program type, has a value permitted in accordance with the assignment.

5. Method in accordance with claim 4, characterized in that the assignment is defined in a standard, preferably in an internationally valid standard.

6. Method in accordance with claim 4 or 5, characterized in that a third-party supplier program type is defined to which at least one program (104) is assigned which is made available by a third-party supplier who is distinct from the manufacturer of the device (10) and from the network operator of the network via which the device 10) establishes the connection,

and/or that a device manufacturer program type is defined to which at least one program (104) is assigned which is made available by a manufacturer of the device (10),

and/or a network operator program type is defined to which at least one program (104) is assigned which is made available by the network operator of the data transmission network (16, 28, 38) via which the device (10) establishes the connection.

7. Method in accordance with one of the claims 4 to 6, characterized in that a value allows a connection establishment with the agreement of a user (SubA),

and/or that a value allows an unrestricted connection establishment,

and/or that a value allows a connection establishment depending on the amount of a credit,

and that the values differ from one another.

8. Method in accordance with one of the previous claims, characterized in that the value of the authorization data (112) cannot be changed in the device (10),

or that the value of the authorization data (112) can only be changed with the aid of the security program (130).

9. Method in accordance with one of the previous claims, characterized in that the security program (130) records the approval and/or rejection of a connection establishment in a log file.

10. Method in accordance with one of the previous claims, characterized in that , together with the authorization data (112) at least one digital certificate (110) and/or a digital key (108) are transmitted.

11. Method in accordance with claim 10, characterized in that the authorization data (112) is transmitted digitally encrypted and/or stored digitally encrypted.

12. Method in accordance with claim 10 and/or 11, characterized in that the log file is stored digitally encrypted.

14. Program data package(100) in accordance with claim 13, characterized in that the data package (100) is transmitted according to a method in accordance with one of the claims 1 to 12.

17. Device (14) in accordance with claim 15 or 16, characterized in that the device (14) contains units (204) which execute procedural steps in accordance with one of the claims 1 to 12.

19. Program (130) in accordance with claim 18, characterized in that, on its execution, a method in accordance with one of the claims 1 to 12 is executed.

13. Program data package (100),

with program data (104) in a machine code or in a byte code,

and with metadata (106) which is not a component of the program data (104),

characterized in that the metadata (106) contains an authorization data item (112) the value of which specifies connection establishment rights.

15. Device, especially data processing system (14),

with a program execution unit (42) which executes a program (104) which initiates a connection establishment via a data transmission network (16),

characterized by a test unit (130, 208), which, depending on the value of an authorization data item (112) assigned to the program (104), for which the value specifies connection establishment rights, allows or rejects the connection establishment (162, 164).

16. Device in accordance with claim 15, characterized by a receive unit (200) which receives the program (104) together with the authorization data (112).

18. Program (130) with a command sequence, characterized in that, on its execution by a processor (42), depending on the value of an authorization data item (112) for which the values specifies a connection establishment right, a connection establishment of another program (104) is allowed or rejected (162, 164).