DEVICE MANAGEMENT

• US 20080271023A1
• Filed: 10/22/2007
• Published: 10/30/2008
• Est. Priority Date: 10/20/2006
• Status: Active Grant

• Current Assignee: Vodafone Group PLC
• Original Assignee: Vodafone Group PLC
• Inventors: BELROSE, Caroline Jessica, BONE, Nicholas, WRIGHT, Timothy James, Babbage, Stephen Hugh
• Granted Patent: US 8,321,864 B2
• Time in Patent Office: Days
• US Class Current: 718/100
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A framework whereby mobile terminals are configured and managed by a central server. In accordance with one aspect of the present invention, there is provided a mobile telecommunications terminal including a first execution environment and a second execution environment, each execution environment being arranged to execute a respective device management agent and each agent issuing, in accordance with instructions from a device management server, management actions that act upon one or more respective management entities running within one or more of the execution environments; wherein the management entities of the second execution environment are grouped into a management structure, the management structure being one of the management entities within the first execution environment, whereby the he first and second execution environments permit the device management server is permitted to manage applications and/or services running within both.

Claims

1. A mobile telecommunications terminal comprising:

a first execution environment; and

a second execution environment,

wherein each execution environment is configured to execute a respective device management agent;

wherein each agent is configured to issue, in accordance with instructions from a device management server, management actions that act upon one or more respective management entities running within one or more of the execution environments; and

wherein the management entities of the second execution environment are grouped into a management structure, the management structure being one of the management entities within the first execution environment,

whereby the first and second execution environments are configured to permit the device management server to manage applications and/or services running within both.

2. A terminal as claimed in claim 1, wherein the first execution environment is a secure execution environment.

3. A terminal as claimed in claim 1, wherein the first execution environment is the main operating system of the terminal.

4. A terminal as claimed in claim 1, wherein the second execution environment is a secure execution environment.

5. A terminal as claimed in claim 1, wherein the device management server, in operation, instructs at least one of the respective device management agents to deliver management actions to one or more of the management entities.

6. A terminal as claimed in claim 1, further including means for receiving management actions that originate with an original management action author, wherein the receiving means operates to deliver received management actions to the device management server.

7. A terminal as claimed in claim 1, wherein the first execution environment is a proxy device management server for the device management agent of the second execution environment.

8. A terminal as claimed in claim 1, wherein at least one of the execution environments is implemented in a hardware-based secure element.

9. A terminal as claimed in claim 1, wherein at least one of the execution environments is implemented in a removable smartcard.

10. A method for processing management actions received from a device management server by a terminal, comprising:

providing a first execution environment and a second execution environment;

in the first execution environment, executing a first device management agent, the first agent issuing, in accordance with instructions from a device management server, management actions that act upon one or more respective management entities running within the first execution environment;

in the second execution environment, executing a second device management agent, the second agent issuing, in accordance with instructions from a device management server, management actions that act upon one or more respective management entities running within the second execution environment;

wherein the management entities of the second execution environment are grouped into a management structure, the management structure being one of the management entities within the first execution environment.

11. A method as claimed in claim 10, wherein the first execution environment is a secure execution environment.

12. A method as claimed in claim 10, wherein the first execution environment is the main operating system of the terminal.

13. A method as claimed in claim 10, wherein the second execution environment is a secure execution environment.

14. A method as claimed in claim 10, further comprising issuing instructions to at least one of the respective device management agents to deliver management actions to one or more of the management entities, the instructions being received from the device management server.

15. A method as claimed in claim 10, further comprising receiving management actions that originate with an original management action author, and delivering received management actions to the device management server.

16. A method as claimed in claim 10, wherein the first execution environment is a proxy device management server for the device management agent of the second execution environment.