System and method for securing a personalized indicium assigned to a mobile communications device

• US 20060111080A1
• Filed: 11/24/2004
• Published: 05/25/2006
• Est. Priority Date: 11/24/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Gao, Wen, Bajar, David, Lewis, Allan David, Plumb, Marc, Adams, Neil Patrick, Godfrey, James, Whittington, Graeme, Little, Herb A., Brown, Michael Kenneth
• Granted Patent: US 7,961,883 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

In one embodiment, a scheme is provided for securing a personalized indicium assigned to a mobile communications device. Upon detecting at a network node that an address associated with the mobile communications device has changed, a challenge-and-response procedure is negotiated between the mobile communications device and the network node for authenticating the personalized indicium using a shared authentication key.

Claims

1. A method for securing a personalized indicium assigned to a mobile communications device, comprising:

detecting at a network node that an address associated with said mobile communications device has changed, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device;

responsive to said detecting, issuing a challenge message to said mobile communications device by said network node, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

based on said challenge response from said mobile communications device, determining at said network node whether said PIN is legitimately bound to said mobile communications device.

2. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3^rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

3. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

4. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

5. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.

6. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 5, wherein said network node includes a packet router structure operable to maintain a PIN-IP mapping table that is interrogated to detect any changes in said IP address.

7. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 5, wherein said IP address is dynamically assigned to said mobile communications device.

8. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, wherein said challenge message includes a randomly generated challenge string.

9. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 8, wherein said challenge response includes an authentication value of said challenge string generated by said mobile communications device with its authentication key.

10. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 9, wherein said network node is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

11. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, further comprising, responsive to said detecting, performing one of dropping packets received from said mobile communications device at said network node and buffering packets received from said mobile communications device at said network node.

12. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 1, further comprising, upon receiving said challenge message from said network node, ceasing to transmit packets by said mobile communications device.

13. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 12, further comprising, responsive to receiving an acknowledgment from said network node that said PIN is legitimately bound to said mobile communications device, commencing transmission of packets by said mobile communications device.

14. A mobile communications device, comprising:

logic means operable to generate an authentication key for transmitting in a registration request to a network node operable with a wireless network, said authentication key for securing a personalized indicium assigned to said mobile communications device, wherein said personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device; and

logic means operable to execute a challenge response when challenged by a challenge message from said network node, said challenge response including an authentication value of a challenge string transmitted in said challenge message, wherein said authentication value is created using said authentication key.

15. The mobile communications device as recited in claim 14, wherein said wireless network comprises a network selected from the group consisting of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3^rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

16. The mobile communications device as recited in claim 14, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

17. The mobile communications device as recited in claim 14, further comprising logic means for generating a challenge request for transmitting to said network node upon acquiring a new Internet Protocol (IP) address.

18. The mobile communications device as recited in claim 14, further comprising logic means for ceasing transmission of packets to said network node upon receiving said challenge message.

19. The mobile communications device as recited in claim 18, further comprising logic means for commencing transmission of packets to said network node upon receiving an acknowledgment from said network node that said PIN is legitimately bound to said mobile communications device.

20. A network system for securing a personalized indicium assigned to a mobile communications device, comprising:

means for detecting at a network node that an address associated with said mobile communications device has changed, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device;

means, operable responsive to said detecting, for issuing a challenge message to said mobile communications device, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

means, operable responsive to said challenge response from said mobile communications device, for determining at said network node whether said PIN is legitimately bound to said mobile communications device.

21. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3^rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

22. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said PIN is mapped to at least one identifier at a database associated with said network node, said at least one identifier comprising at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

23. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

24. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.

25. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 24, wherein said network node includes a packet router structure operable to maintain a PIN-IP mapping table that is interrogated to detect any changes in said IP address.

26. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 24, wherein said IP address is dynamically assigned to said mobile communications device.

27. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said means for issuing said challenge message includes means for generating a randomly generated challenge string.

28. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 27, wherein said challenge response includes an authentication value of said challenge string generated by said mobile communications device with its authentication key.

29. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 28, wherein said network node is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

30. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, further comprising means at said network node, operable responsive to said means for detecting, for dropping packets received from said mobile communications device.

31. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, further comprising means at said network node, operable responsive to said means for detecting, for buffering packets received from said mobile communications device.

32. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, further comprising means at said network node, operable responsive to determining that said PIN is legitimately bound to said mobile communications device, for issuing an acknowledgment to said mobile communications device.

33. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 20, wherein said means for detecting comprises logic for detecting that a challenge request was issued by said mobile communications device.

34. A method for securing a personalized indicium assigned to a mobile communications device, comprising:

detecting at a network node that said mobile communications device has issued a challenge-response protocol sequence with said network node, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device;

responsive to said detecting, issuing a challenge message to said mobile communications device by said network node, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

based on said challenge response from said mobile communications device, determining at said network node whether said PIN is legitimately bound to said mobile communications device.

35. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3^rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

36. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

37. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

38. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, wherein said challenge message includes a randomly generated challenge string.

39. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 38, wherein said challenge response includes an authentication value of said challenge string generated by said mobile communications device with its authentication key.

40. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 39, wherein said network node is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

41. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, further comprising, responsive to said detecting, performing one of dropping packets received from said mobile communications device at said network node and buffering packets received from said mobile communications device at said network node.

42. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, further comprising, upon receiving said challenge message from said network node, ceasing to transmit packets by said mobile communications device.

43. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 42, further comprising, responsive to receiving an acknowledgment from said network node that said PIN is legitimately bound to said mobile communications device, commencing transmission of packets by said mobile communications device.

44. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 34, wherein said challenge-response protocol sequence is issued by said mobile communications device based upon determining that an address associated with said mobile communications device has changed.

45. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 44, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.

46. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 45, wherein said network node includes a packet router structure operable to maintain a PIN-IP mapping table that is interrogated to detect any changes in said IP address.

47. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 45, wherein said IP address is dynamically assigned to said mobile communications device.