Secure access to a subscription module

• US 20060064458A1
• Filed: 08/26/2003
• Published: 03/23/2006
• Est. Priority Date: 09/16/2002
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Gehrmann, Christian
• Application Number:
  US10/527,397
• Publication Number:
  US 20060064458A1
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/76 Group identity
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method of providing to a client communications device access to a subscription module of a server communications device, the method comprising the steps of establishing a communications link between the client communications device and the server communications device; and communicating a number of messages comprising data related to the subscription module between the server communications device and the client communications device via the communications link. The method further comprises the step of providing integrity protection of the messages communicated between the server communications device and the client communications device via the communications link.

Claims

1. A method of providing to a client communications device access to a subscription module of a server communications device, the method comprising the steps of:

establishing a communications link between the client communications device and the server communications device; and

communicating a number of messages (M) comprising data related to the subscription module between the server communications device and the client communications device via the communications link;

wherein the method further comprises the step of providing integrity protection of the messages communicated between the server communications device and the client communications device via the communications link.

2. The method according to claim 1, wherein the step of providing integrity protection further comprises calculating, based on a secret session key, a respective message authentication code for each of the communicated messages;

and including the calculated message authentication code into the corresponding communicated message.

3. The method according to claim 2, wherein the step of establishing a communications link between the client and server communications devices comprises determining a secret session key based on a shared secret between the server and client communications devices.

4. The method according to claim 3, wherein the method further comprises providing the shared secret by performing a secure pairing procedure including receiving a passcode by at least one of the client communications device and the server communications device.

5. The method according to claim 4, wherein the passcode is at the most 48 bits long.

6. The method according to claim 3, wherein the communications link has a secret link key related to it and the method further comprises providing the shared secret by calculating the shared secret using the secret link key as an input.

7. The method according to any one of claims 2 through 6, wherein the method further comprises:

incorporating a value of a first counter in each of the messages communicated from the client communications device to the server communications device, the first counter being indicative of the number of messages communicated from the client communications device to the server communications device; and

incorporating a value of a second counter in each of the messages communicated from the server communications device to the client communications device, the second counter being indicative of the number of messages communicated from the server communications device to the client communications device; and

wherein the step of calculating a respective message authentication code for each of the communicated messages comprises calculating a message authentication code for each of the communicated messages and the corresponding counter value.

8. The method according to claim 1, wherein the method further comprises determining, for the messages communicated from the client communications device to the server communications device, whether the message is authorised to address the subscription module.

9. The method according to claim 8, wherein the method further comprises:

providing a shared secret between the client communications device and the server communications device; and

providing an access control list stored in the server communications device in relation to at least one of the shared secret and the client communications device.

10. A communications system comprising a client communications device and a server communications device including a subscription module, the client and server communications devices each comprising respective communications means for establishing a communications link between the client communications device and the server communications device, and for communicating a number of messages comprising data related to the subscription module between the server communications device and the client communications device via the communications link;

wherein the client communications device and the server communications device each comprise respective processing means adapted to provide integrity protection of the messages communicated between the server communications device and the client communications device via the communications link.

11. A server communications device including a subscription module, the server communications device comprising communications means for establishing a communications link with a client communications device, and for communicating a number of messages comprising data related to the subscription module between the server communications device and the client communications device via the communications link;

wherein the server communications device comprises processing means adapted to provide integrity protection of the messages communicated between the server communications device and the client communications device via the communications link.

12. A client communications device for providing access to a subscription module of a server communications device, the client communications device comprising communications means for establishing a communications link with the server communications device including the subscription module, and for communicating a number of messages comprising data related to the subscription module between the client communications device and the server communications device via the communications link;

wherein the client communications device comprises processing means adapted to provide integrity protection of the messages communicated between the client communications device and the server communications device via the communications link.

13. A method of providing to a client communications device access to a subscription module by a server communications device comprising the subscription module, the method comprising the steps of

establishing a communications link between the client communications device and the server communications device;

receiving a number of messages from the client communications device by the server communications device via the communications link, the messages addressing the subscription module; and

wherein the method further comprises the step of determining, for at least one of the received messages, whether the message is authorised to address the subscription module.

14. The method according to claim 13, wherein the method further comprises providing integrity protection of the messages communicated between the server communications device and the client communications device via the communications link, where the integrity protection is based on a shared secret between the client communications device and the server communications device;

and providing an access control list stored in the server communications device in relation to at least one of the shared secret and the client communications device.

15. The method according to claim 14, wherein the access control list is stored in a protected database.

16. The method according to claim 14 or 15, wherein the method further comprises calculating, based on a secret session key, a respective message authentication code for each of the communicated messages;

and including the calculated message authentication code into the corresponding communicated message.

17. The method according to claim 16, wherein the step of establishing a communications link between the client and server communications devices comprises determining the secret session key based on said shared secret between the server and client communications devices.

18. The method according to claim 17, wherein the method further comprises providing the shared secret by performing a secure pairing procedure including receiving a passcode by at least one of the client communications device and the server communications device.

19. The method according to claim 18, wherein the passcode is at the most 48 bits long.

20. The method according to claim 18, wherein the communications link has a secret link key related to it and the method further comprises providing the shared secret by calculating the shared secret using the secret link key as an input.

21. The method according to claim 14, wherein the method further comprises:

incorporating a value of a first counter in each of the messages communicated from the client communications device to the server communications device, the first counter being indicative of the number of messages communicated from the client communications device to the server communications device;

incorporating a value of a second counter in each of the messages communicated from the server communications device to the client communications device, the second counter being indicative of the number of messages communicated from the server communications device to the client communications device; and

wherein the step of calculating a respective message authentication code for each of the communicated messages comprises calculating a message authentication code for each of the communicated messages and the corresponding counter value.

22. A server communications device including a subscription module, the server communications device comprising communications means for establishing a communications link with a client communications device, and for receiving a number of messages addressing the subscription module from the client communications device via the communications link;

and

wherein the server communications device comprises processing means for determining, for at least one of the received messages, whether the message is authorised to address the subscription module.