Method and system for policy based authentication

• US 20060095953A1
• Filed: 09/22/2005
• Published: 05/04/2006
• Est. Priority Date: 10/28/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Edward H.
• Granted Patent: US 9,032,192 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A mobile device capable of performing a plurality of functions. The mobile device includes a memory for storing a plurality of different security policies; an input device for invoking a function from the plurality of functions by a user; a processor for assigning a first security policy from the stored plurality of security policies to the invoked function; and a security module for requiring the user to satisfy the assigned first security policy, before the invoked function is performed by the mobile device.

Claims

1. A mobile device capable of performing a plurality of functions comprising:

a memory for storing a plurality of different security policies;

an input device for invoking a function from the plurality of functions by a user;

a processor for assigning a first security policy from the stored plurality of security policies to the invoked function; and

a security module for requiring the user to satisfy the assigned first security policy, before the invoked function is performed by the mobile device.

2. The mobile device of claim 1 further comprising means for determining a location of the mobile device and wherein the processor assigns a second security policy from the stored plurality of security policies to the invoked function, based on the location of the mobile device.

3. The mobile device of claim 2 wherein the processor changes some of the plurality of functions available to be performed by the mobile device, based on the location of the mobile device.

4. The mobile device of claim 1 wherein the invoked function is accessing data.

5. The mobile device of claim 4 wherein the data is locally stored in the mobile device.

6. The mobile device of claim 4 wherein the data is stored in a remote location from the mobile device.

7. The mobile device of claim 1 wherein the invoked function is making a phone call.

8. The mobile device of claim 1 wherein the security module requires the user to enter a user name to satisfy the assigned first security policy.

9. The mobile device of claim 1 wherein the security module requires the user to enter a PIN to satisfy the assigned first security policy.

10. The mobile device of claim 9 wherein the PIN is a biometric PIN.

11. The mobile device of claim 1 wherein the security module requires the user to be authenticated using a digital signature to satisfy the assigned first security policy.

12. A method for data security of a mobile device capable of performing a plurality of functions, the method comprising:

storing a plurality of different security policies;

invoking a function from the plurality of functions by a user;

assigning a first security policy from the stored plurality of security policies to the invoked function; and

requiring the user to satisfy the assigned first security policy, before the invoked function is performed by the mobile device.

13. The method of claim 12 further comprising determining a location of the mobile device and assigning a second security policy from the stored plurality of security policies to the invoked function, based on the location of the mobile device.

14. The method of claim 13 further comprising changing some of the plurality of functions available to be performed by the mobile device, based on the location of the mobile device.

15. The method of claim 12 wherein the invoked function is accessing data.

16. The method of claim 12 wherein the invoked function is making a phone call.

17. The method of claim 12 wherein the requiring the user to satisfy the assigned first security policy comprises requiring the user to enter a user name.

18. The method of claim 12 wherein the requiring the user to satisfy the assigned first security policy comprises requiring the user to enter a PIN.

19. The method of claim 12 wherein the PIN is a biometric PIN.

20. The method of claim 12 wherein the requiring the user to satisfy the assigned first security policy comprises requiring the user to be authenticated using a digital signature.

21. A mobile device capable of performing a plurality of functions comprising:

a memory for storing a three-dimensional matrix of security policies, wherein the three-dimensional matrix includes a plurality of security requirements as a first dimension, a plurality of functions as a second dimension, and a plurality of locations for the mobile device as a third dimension;

an input device for invoking a function from the plurality of functions by a user;

a processor for assigning a security requirement from the stored three-dimensional matrix to the invoked function, depending on the invoked function and the location of the mobile device; and

a security module for requiring the user to satisfy the assigned security requirement, before the invoked function is performed by the mobile device.

22. The mobile device of claim 21 further comprising means for determining a location of the mobile device.

23. The mobile device of claim 22 wherein the means for determining a location of the mobile device consists of one or more of the group a GPS, a RF-based location finder, and a transponder.

24. The mobile device of claim 21 wherein the security module requires the user to enter a user name to satisfy the assigned first security policy.

25. The mobile device of claim 21 wherein the security module requires the user to enter a PIN to satisfy the assigned first security policy.

26. The mobile device of claim 25 wherein the PIN is a biometric PIN.

27. The mobile device of claim 21 wherein the security module requires the user to be authenticated using a digital signature to satisfy the assigned first security policy.

28. A method for data security of a mobile device capable of performing a plurality of functions, the method comprising:

storing a three-dimensional matrix of security policies, wherein the three-dimensional matrix includes a plurality of security requirements as a first dimension, a plurality of functions as a second dimension, and a plurality of locations for the mobile device as a third dimension;

invoking a function from the plurality of functions by a user;

assigning a security requirement from the stored three-dimensional matrix to the invoked function, depending on the invoked function and the location of the mobile device; and

requiring the user to satisfy the assigned security requirement, before the invoked function is performed by the mobile device.

29. The method of claim 28 wherein the requiring the user to satisfy the assigned first security policy comprises requiring the user to enter a PIN.

30. The method of claim 29 wherein the PIN is a biometric PIN.

31. The method of claim 28 wherein the requiring the user to satisfy the assigned first security policy comprises requiring the user to be authenticated using a digital signature.

32. A mobile device capable of performing a plurality of functions comprising:

means for storing a plurality of different security policies;

means for invoking a function from the plurality of functions by a user;

means for assigning a first security policy from the stored plurality of security policies to the invoked function; and

means for requiring the user to satisfy the assigned first security policy, before the invoked function is performed by the mobile device.

33. A mobile device capable of performing a plurality of functions comprising:

means for storing a three-dimensional matrix of security policies, wherein the three-dimensional matrix includes a plurality of security requirements as a first dimension, a plurality of functions as a second dimension, and a plurality of locations for the mobile device as a third dimension;

means for invoking a function from the plurality of functions by a user;

means for assigning a security requirement from the stored three-dimensional matrix to the invoked function, depending on the invoked function and the location of the mobile device; and

means for requiring the user to satisfy the assigned security requirement, before the invoked function is performed by the mobile device.