Techniques for Updating Security-Related Parameters for Mobile Stations

• US 20080235386A1
• Filed: 01/14/2005
• Published: 09/25/2008
• Est. Priority Date: 01/15/2004
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Oommen, Paul
• Application Number:
  US10/586,014
• Publication Number:
  US 20080235386A1
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A method is performed on a first server for communicating with a mobile station in order for the mobile station to update a security-related parameter. The method includes determining that a request expressed in a first protocol has been made by a second server for updating the security-related parameter on the mobile station. In response to the determination, the request is packaged in a message expressed in a second protocol and is communicated to the mobile station. Another method is disclosed that is performed on a mobile station for updating a security-related parameter. The method includes receiving a message that is expressed in a first protocol from a server and that includes a request for the mobile station to update the security-related parameter. The request is expressed in a second protocol. In response to the message, at least one operation is performed in order to update the security-related parameter.

Claims

1. A method performed on a first server for communicating with a mobile station in order for the mobile station to update a security-related parameter, comprising:

determining that a request expressed in a first protocol has been made by a second server for updating the security-related parameter on the mobile station; and

in response to determining, packaging the request in a message expressed in a second protocol and communicating the message to the mobile station.

2. The method of claim 1, wherein the first protocol comprises a signaling protocol and the second protocol comprises an internet protocol.

3. The method of claim 2, wherein the signaling protocol further comprises an over-the-air management protocol, and wherein the internet protocol further comprises an over-the-air internet protocol.

4. The method of claim 3, wherein the over-the-air management protocol comprises an IS-683 management protocol, and wherein the over-the-air internet protocol further comprises an Internet Protocol (IP)-based Over-The-Air (IOTA) Device Management protocol.

5. The method of claim 1, further comprising determining that the mobile station has updated the security-related parameter, and communicating a response expressed in the second protocol to the second server, the response indicating that the mobile station has updated the security-related parameter.

6. The method of claim 1, wherein:

the first and second protocols comprise different transport protocols;

the request is further expressed in a first management protocol; and

packaging further comprises packaging the request in the message, where the message is expressed in a second management protocol in addition to the second protocol.

7. The method of claim 1, wherein:

the first and second protocols comprise different transport protocols;

the request comprises a trigger to cause the mobile station to begin operations to update the security-related parameter; and

packaging further comprises packaging the request in the message, where the message is expressed in a management protocol in addition to the second protocol.

8. The method of claim 1, wherein the security-related parameter comprises an authentication key.

9. The method of claim 1, wherein the security-related parameter comprises a security key.

10. The method of claim 1, wherein:

the security-related parameter comprises one of an authentication key or a security key; and

the security-related parameter is defined by a Code-Division Multiple Access (CDMA) standard.

11. The method of claim 1, further comprising communicating at least one additional message expressed in the second protocol to the mobile station, the at least one additional message comprising at least one command defined to cause the mobile station to determine the security-related parameter.

12. The method of claim 1, further comprising communicating a first message and a second message expressed in the second protocol with the mobile station, the first message comprising a first command defined to cause the mobile station to compute a first value, and the second message comprising a second value and a second command defined to cause the mobile station to compute the security-related parameter by using the first and second values.

13. The method of claim 1, wherein:

the message is a first message; and

the method further comprises;

receiving a second message comprising an indication of a version of the security-related parameter, the second message expressed in the second protocol; and

communicating a third message, expressed in the first protocol and comprising the indication, to the second server.

14. The method of claim 1, further comprising receiving an additional message comprising at least one parameter, the at least one parameter indicating whether or not the mobile station supports a certain provisioning protocol.

15. The method of claim 14, further comprising:

in response to the at least one parameter indicating that the mobile station does support the certain provisioning protocol, performing a first collection of steps; and

in response to the at least one parameter indicating that the mobile station does not support the certain provisioning protocol, performing a second collection of steps.

16. The method of claim 15, wherein the message is a first message, and wherein the second collection of steps comprises:

receiving a second message expressed in the second protocol from the mobile station, the second message comprising a first value;

computing a second value; and

computing, in response to the second message, the security-related parameter based on the first and second values; and

communicating a response expressed in the first protocol to the second server, wherein the response comprises the security-related parameter.

17. The method of claim 16, wherein the second collection of steps further comprises:

receiving a third message expressed in the second protocol, the third message comprising an indication that the first value has been computed by the mobile station; and

computing a second value further comprises computing, in response to the third message, the second value.

18. The method of claim 15, wherein the message is a first message, and wherein the first collection of steps comprises:

receiving from the mobile station a second message, expressed in the second protocol, comprising a first value;

communicating, in a third message expressed in the first protocol, the first value to the second server; and

receiving, in a fourth message expressed in the first protocol, a second value from the second server; and

communicating, in response to receiving the second value, a fifth message expressed in the second protocol to the mobile station, the fifth message comprising the second value.

19. The method of claim 18, wherein the first collection of steps further comprises:

receiving a sixth message expressed in the second protocol from the mobile station, the sixth message comprising an indication that the first value has been determined by the mobile station; and

in response to the sixth message, communicating the indication to the server in a seventh message expressed in the first protocol.

20. The method of claim 1, wherein:

the message is a first message; and

the method further comprises;

communicating to the mobile station a second message expressed in the second protocol, the second message comprising a first command defined to cause the mobile station to compute a first value;

receiving a third message expressed in the second protocol from the mobile station, the third message comprising the first value;

computing a second value;

computing, in response to the third message, the security-related parameter based on the first and second values; and

communicating a fourth message expressed in the second protocol to the mobile station, the fourth message comprising the second value and a second command, the second command defined to cause the mobile station to compute the security-related parameter using the first and second values.

21. The method of claim 20, further comprising:

receiving a fifth message expressed in the second protocol, the fifth message comprising an indication that the first value has been computed by the mobile station; and

computing a second value further comprises computing, in response to the fifth message, the second value.

22. The method of claim 1, wherein:

the message is a first message; and

the method further comprises;

communicating to the mobile station a second message expressed in the second protocol, the second message comprising a first command defined to cause the mobile station to compute a first value;

receiving a third message expressed in the second protocol, the third message comprising the first value;

communicating, using a fourth message expressed in the first protocol, the first value to the second server;

receiving, in a fifth message expressed in the first protocol, a second value from the second server;

communicating, in response to receiving the second value, a sixth message to the mobile station, the sixth message expressed in the second protocol and comprising the second value and a second command, the second command defined to cause the mobile station to compute the security-related parameter using the first and second values.

23. The method of claim 18, further comprising:

receiving, using the second transport, a seventh message from the mobile station, the seventh message comprising an indication that the first value has been determined by the mobile station; and

in response to the seventh message, communicating the indication to the server in an eighth message expressed in the first protocol.

24. An apparatus for communicating with a mobile station in order for the mobile station to update a security-related parameter, the apparatus comprising:

at least one memory; and

at least one processor coupled to the at least one memory, the at least one processor configured to perform the steps of;

determining that a request expressed in a first protocol has been made by a server for updating the security-related parameter on the mobile station; and

in response to determining, packaging the request in a message expressed in a second protocol and communicating the message to the mobile station.

25. An apparatus for communicating with a mobile station in order for the mobile station to update a security-related parameter, comprising:

means for determining that a request expressed in a first protocol has been made by a server for updating the security-related parameter on the mobile station; and

means, responsive to the means for determining, for packaging the request in a message expressed in a second protocol and communicating the message to the mobile station.

26. The apparatus of claim 25, wherein:

the first and second protocols comprise different transport protocols;

the request is further expressed in a first management protocol; and

the means for packaging further packages the request in the message, where the message is expressed in a second management protocol in addition to the second protocol.

27. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to communicate with a mobile station in order for the mobile station to update a security-related parameter, the operations comprising:

determining that a request expressed in a first protocol has been made by a second server for updating the security-related parameter on the mobile station; and

in response to determining, packaging the request in a message expressed in a second protocol and communicating the message to the mobile station.

28. A method performed on a management server for communicating with a mobile station in order for the mobile station to update a security-related parameter, comprising:

receiving from a second server a first message expressed in a signaling protocol, the first message comprising a first request message, the first request message expressed in a first data management protocol and defined to request updating the security-related parameter on the mobile station; and

in response to determining, packaging the first request message in a second request message expressed in a second data management protocol, and communicating the second request message in a second message expressed in an internet protocol to the mobile station.

29. A method performed on a mobile station for updating a security-related parameter, comprising:

receiving a message expressed in a first protocol from a server and comprising a request for the mobile station to update the security-related parameter, the request expressed in a second protocol; and

performing, in response to the message, at least one operation in order to update the security-related parameter.

30. The method of claim 29, further comprising communicating an additional message expressed in the first protocol to the server, the additional message indicating the security-related parameter has been updated.

31. The method of claim 29, wherein the first protocol comprises an internet protocol and the second protocol comprises a management protocol.

32. The method of claim 31, wherein the internet protocol comprises an over-the-air internet protocol.

33. The method of claim 31, wherein the over-the-air internet protocol further comprises an Internet Protocol (IP)-based Over-The-Air (IOTA) Device Management protocol, and wherein the management protocol comprises an IS-683 over-the-air management protocol.

34. The method of claim 31, wherein the management protocol is a first management protocol and wherein the message is further expressed in a second management protocol.

35. The method of claim 34, wherein the first and second management protocols are different over-the-air management protocols.

36. The method of claim 29, wherein:

the first protocol comprises a transport protocol; and

the request defines a trigger to cause the mobile station to begin operations to update the security-related parameter.

37. The method of claim 29, wherein the security-related parameter comprises an authentication key.

38. The method of claim 29, wherein the security-related parameter comprises a security key.

39. The method of claim 38, wherein the security key is defined by a Code-Division Multiple Access (CDMA) standard.

40. The method of claim 29, wherein the message is a first message, and wherein the method further comprises communicating a second message expressed in the first protocol to the server, the second message comprising at least one parameter, the at least one parameter indicating whether or not the mobile station supports a certain provisioning protocol.

41. The method of claim 29, wherein:

the method further comprises receiving at least one command message from the server, the at least one command message comprising at least one command defined to cause the mobile station to determine the security-related parameter; and

performing at least one operation further comprises performing, in response to the at least one command message, at least one operation defined by the at least one command in order to determine the security-related parameter.

42. The method of claim 29, wherein:

the method further comprises receiving a first message expressed in the first protocol from the server, the first message comprising a first command defined to cause the mobile station to compute a first value; and

performing at least one operation further comprises performing at least one first operation defined by the first command in order to compute the first value.

43. The method of claim 42, further comprising communicating a second message expressed in the first protocol to the server, the second message comprising an indication that the first value has been computed.

44. The method of claim 42, wherein:

the method further comprises receiving a second message expressed in the second protocol from the server, the second message comprising a second value and a second command defined to cause the mobile station to compute the security-related parameter by using the first and second values; and

performing at least one operation further comprises performing at least one second operation defined by the second command to compute the security-related parameter, the at least one second operation using the first and second values during the computation of the security-related parameter.

45. The method of claim 44, wherein one or more of performing at least one first operation and performing at least one second operation uses at least one node in a management tree to store information.

46. The method of claim 45, wherein the node is a temporary node and wherein performing at least one operation further comprises deleting the at least one node in response to performing a predetermined operation of the at least one first operation and the at least one second operation.

47. A mobile station that updates a security-related parameter, the mobile station comprising:

at least one memory; and

at least one processor coupled to the at least one memory, the at least one processor configured to perform the steps of;

receiving a message expressed in a first protocol from a server and comprising a request for the mobile station to update the security-related parameter, the request expressed in a second protocol; and

performing, in response to the message, at least one operation in order to update the security-related parameter.

48. The mobile station of claim 47, wherein the at least one memory further comprises a signal bearing medium tangibly embodying a program of machine-readable instructions executable by the at least one processor to perform the receiving and performing operations.

49. A mobile station that updates a security-related parameter, comprising:

means for receiving a message expressed in a first protocol from a server and comprising a request for the mobile station to update the security-related parameter, the request expressed in a second protocol; and

means for performing, in response to the message, at least one operation in order to update the security-related parameter.

50. The apparatus of claim 49, wherein the first protocol comprises an internet protocol, the second protocol comprises a first management protocol, and wherein the message is further expressed in a second management protocol.