Data security in a mobile e-mail service

• US 20060240804A1
• Filed: 11/21/2005
• Published: 10/26/2006
• Est. Priority Date: 11/22/2004
• Status: Active Grant

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks International Oy (SoftBank Group Corp.)
• Inventors: Ahonen, Jukka, Salorinne, Seppo, Vuornos, Lauri, Backholm, Ari, Ketonen, Marko, Saarilahti, Antti, Salmi, Petri, Groeber, Marcus
• Granted Patent: US 7,706,781 B2
• Time in Patent Office: Days
• US Class Current: 455/412.100
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

A method for conveying e-mail traffic between an e-mail server (108) and a mobile terminal (102) which has an e-mail address (122A) under the e-mail server and permanent terminal identity (122B) and a temporary identity (122D) in an access network (114). A connectivity function (600) is operationally coupled to the e-mail server (108) and the access network (114). The connectivity function (120) encrypts e-mail traffic to the mobile terminal and decrypt e-mail traffic from the mobile terminal, by using encryption information (122C). The mobile terminal generates (2-1) a service activation code which comprises an identifier (124D) of the mobile terminal, encryption information (122C) and checksum information. The service activation code is conveyed (2-3, 2-4) via a secure channel (2-3) to an authenticating terminal (100), from which the identifier (124D) of the mobile terminal and the encryption information (122C) are conveyed to the connectivity function (600).

Claims

1. A method for conveying e-mail traffic between an e-mail server and a mobile terminal, wherein the mobile terminal has an e-mail address under the e-mail server and a permanent terminal identity and a temporary identity in an access network;

the method comprising;

installing a connectivity function which is operationally coupled to the e-mail server and the access network, wherein the connectivity function is configured to encrypt e-mail traffic to the mobile terminal and decrypt e-mail traffic from the mobile terminal, by using encryption information;

generating a service activation code at the mobile terminal, wherein the service activation code comprises an identifier of the mobile terminal, encryption information and checksum information;

conveying the service activation code via a secure channel to an authenticating terminal;

conveying the identifier of the mobile terminal and the encryption information to the connectivity function.

2. A method according to claim 1, wherein the encryption information is based on an equipment identity of the mobile terminal.

3. A method according to claim 1, wherein said conveying the encryption information via a secure channel comprises displaying the encryption information on a display of the mobile terminal and entering it into the authenticating terminal.

4. A method according to claim 1, wherein said conveying the encryption information via a secure channel comprises conveying the encryption information on a detachable memory.

5. A computer program set on at least one carrier, the computer program set comprising:

a first routine for causing a mobile terminal to generate a service activation code and to transfer it to an off-line channel, wherein the service activation code comprises an identifier of the mobile terminal, encryption information and checksum information;

a second routine for receiving the service activation code via the off-line channel at an authenticating terminal;

a third routine for conveying the identifier of the mobile terminal and the encryption information to a connectivity function that is operationally coupled to an e-mail server and an access network serving the mobile terminal; and

a set of fourth routines for establishing an encrypted data channel between the connectivity function and the mobile terminal, based on the identifier of the mobile terminal and the encryption information.