Enhanced security using service provider authentication

• US 20060031941A1
• Filed: 08/06/2004
• Published: 02/09/2006
• Est. Priority Date: 08/06/2004
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Lin, Jyh-Han, Zhuang, Ruiqiang, Xiao, Ji, Smith, Ronald R.
• Granted Patent: US 9,313,214 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A method (100) and an apparatus (210) for providing enhanced security using service provider authentication. In addition to authenticating an application signature (245) against a root certificate (235) stored on the network node (210), a first carrier identification (250) associated with the application (240) is compared to a second carrier identification (255). If the first and second carrier identifications match, then the application can be assigned to a trusted protection domain and granted permissions which provide privileged access to the network node. For example, the application can be granted permission to be installed and/or executed on the network node. Otherwise the application can be denied privileged access. Accordingly, a carrier'"'"'s applications will be only installed onto network nodes that are intended recipients of the applications.

Claims

1. A method for providing enhanced security on a network node, comprising:

responsive to receiving an application over a communications network, comparing a first carrier identification associated with the application to a second carrier identification; and

responsive to identifying a match between the first and second carrier identifications, assigning permissions to the application that provide access to privileged functionality on the network node.

2. The method according to claim 1, further comprising the step of determining whether the application is bound to a trusted protection domain.

3. The method according to claim 2, wherein said determining step further comprises authenticating a signature associated with the application against a root certificate stored on the network node.

4. The method according to claim 1, wherein said comparing step comprises:

parsing a MIDlet suite; and

identifying the first carrier identification in the parsed MIDlet suite.

5. The method according to claim 4, wherein said identifying step comprises identifying the first carrier identification in at least one file selected from the group consisting of a manifest of a Java Archive (JAR) file and a Java Descriptor (JAD) file.

6. The method according to claim 4, wherein said identifying step further comprises identifying the first carrier identification from a manifest of a Java Archive (JAR) file and from a Java Descriptor (JAD) file.

7. The method according to claim 1, further comprising the step of selecting the communications network to be a wireless communications network.

8. The method according to claim 7, further comprising the step of selecting the network node to be a mobile communication device.

9. The method according to claim 1, wherein said comparing step comprises receiving the second carrier identification over the communications network.

10. The method according to claim 1, wherein said comparing step comprises retrieving the second carrier identification from a data store within the network node.

11. The method according to claim 10, further comprising the step of defining the data store to be a subscriber identity module (SIM) card.

12. An apparatus for processing an application, comprising:

a network interface for receiving the application over a communications network;

a processor for comparing a first carrier identification associated with the application to a second carrier identification and, responsive to identifying a match between the first and second carrier identifications, assigning permissions to the application that provide access to privileged functionality on the apparatus.

13. The apparatus of claim 12, wherein said processor further determines whether the application is bound to a trusted protection domain.

14. The apparatus of claim 13, wherein said processor further authenticates a signature associated with the application against a root certificate stored on the network node.

15. The apparatus of claim 12, wherein the processor parses the MIDlet suite and identifies the first carrier identification in the parsed MIDlet suite.

16. The apparatus of claim 15, wherein the first carrier identification is identified in at least one file selected from the group consisting of a manifest of a Java Archive (JAR) file and a Java Descriptor (JAD) file.

17. The apparatus of claim 15, wherein the first carrier identification is identified in a manifest of a Java Archive (JAR) file and from a Java Descriptor (JAD) file.

18. The apparatus of claim 12, wherein the communications network is a wireless communications network.

19. The apparatus of claim 18, wherein the apparatus is a mobile communication device.

20. The apparatus of claim 12, wherein the apparatus receives the second carrier identification over the communications network.

21. The apparatus of claim 12, wherein the second carrier identification is retrieved from a data store within the apparatus.

22. The apparatus of claim 21, wherein the data store is a subscriber identity module (SIM) card.