Key revocation in a mobile device

• US 20060089126A1
• Filed: 10/04/2005
• Published: 04/27/2006
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Buer, Mark, Frank, Edward H.
• Granted Patent: US 7,860,486 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72454 according to context-related or environment-related conditions
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A system for revoking access to a mobile device comprises a mobile device providing a plurality of applications and an agent providing a plurality of revocation procedures for revoking access by the mobile device to the plurality of applications running on the mobile device. Access to a first application is revoked by the agent using a first revocation procedure, and access to a second application is revoked by the agent using a second revocation procedure.

Claims

1. A wireless network comprising:

a server;

a mobile device for communicating with the server, the mobile device providing a plurality of applications receiving data from the server; and

an agent for providing a plurality of revocation procedures for revoking access by the mobile device to the plurality of applications running on the mobile device,

wherein access to each of the plurality of applications is revoked by the agent using one of the plurality of revocation procedures different from the revocation procedure used to revoke access to any of the other of the plurality of applications.

2. The system of claim 1, wherein the agent revokes access to one of the plurality of applications provided by the mobile device to prevent the transmission of data associated with the one of the plurality of applications between the server and the mobile device.

3. The system of claim 1, wherein the plurality of applications provided by the mobile device include e-mail services comprising retrieval and display of e-mail messages as a first application, and modification, forwarding and drafting of e-mail messages as a second application, and downloading and opening attachments to e-mail messages as a third application.

4. The system of claim 1, wherein the plurality of revocation procedures comprise a failure of a user to enter a first pass code, a failure of the user to enter a second pass code, a failure of the user to biometrically authenticate to the mobile device, a failure to authenticate a geographic location of the mobile device, and a failure to meet a certain time requirement.

5. The system of claim 4, wherein access to at least one of the plurality of applications is revoked by the failure of the user to enter the first pass code, the failure of the user to enter the second pass code, the failure of the user to biometrically authenticate to the mobile device, the failure to authenticate the geographic location of the mobile device and/or the failure to meet the certain time requirement.

6. A method for revoking user access to a mobile communications network, the method comprising:

providing a server;

providing a mobile device communicating with the server;

providing a matrix having a plurality of authentication parameters in one dimension and a plurality of applications provided by the mobile device in another dimension;

associating each of the plurality of applications provided by the mobile device with one or more of the plurality of authentication parameters of the matrix;

authenticating the mobile device to the server for one or more of the applications using, for each of the one or more applications, the one or more of the plurality of authentication parameters associated therewith;

polling the authentication parameters associated with the authenticated applications during a defined time interval to determine the continued validity thereof; and

revoking access to one or more of the authenticated applications based on a change in validity of one or more of the plurality of authentication parameters associated therewith.

7. The method of claim 6, wherein the change in validity of one or more of the plurality of authentication parameters is due to a change in an environmental parameter.

8. The method of claim 7, wherein the change in an environmental parameter comprises a change in the time of day.

9. The method of claim 7, wherein the change in an environmental parameter comprises a change in the geographical location of the mobile device.

10. The method of claim 6, wherein the change in validity of one or more of the plurality of authentication parameters is due to a failure of a user of the mobile device to manually re-authenticate to the device.

11. The method of claim 6, wherein each of the plurality of applications is associated with an authentication parameter in response to a user selection.

12. A system for revoking access to a mobile device, comprising:

a mobile device for providing a plurality of applications; and

an agent for providing a plurality of revocation procedures for revoking access by the mobile device to the plurality of applications running on the mobile device;

wherein access to a first one of the plurality of applications is revoked by the agent using a first one of the plurality of revocation procedures; and

wherein access to a second one of the plurality of applications is revoked by the agent using a second one of the plurality of revocation procedures.

13. The system of claim 12 further comprising a server communicating with the mobile device;

and

wherein the plurality of applications provided by the mobile device receive data from the server.

14. The system of claim 13, wherein access by the mobile device to a particular one of the plurality of applications provided by the mobile device allows data to be sent between the server and the mobile device.

15. The system of claim 12 wherein the plurality of applications provided by the mobile device include e-mail services.

16. The system of claim 15, wherein the plurality of applications provided by the mobile device comprise the retrieval and display of e-mail messages as one application, and wherein the plurality of applications provided by the mobile device also comprises modification, forwarding and drafting of e-mail messages as another application.

17. The system of claim 15, wherein the plurality of applications provided by the mobile device comprise downloading and opening attachments to e-mail messages as one application.

18. The system of claim 12, wherein the plurality of revocation procedures comprise a failure of a user to enter a first pass code as one revocation procedure, and a failure of the user to enter a second pass code as another revocation procedure.

19. The system of claim 12, wherein the plurality of revocation procedures comprise a failure of a user to biometrically authenticate to the mobile device.

20. The system of claim 12, wherein the plurality of revocation procedures comprise a failure to authenticate a geographic location of the mobile device.

21. The system of claim 12, wherein the plurality of revocation procedures comprise time based revocation procedures.