Security Protocols for Mobile Operator Networks

• US 20100151822A1
• Filed: 06/18/2009
• Published: 06/17/2010
• Est. Priority Date: 12/12/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mercer, David E.W., Medvinsky, Gennady
• Granted Patent: US 9,270,700 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

Security protocols for mobile operator networks are described. In embodiments, mobile communication link is established between a mobile phone and a media content provider via a communication service provider with which the mobile phone is registered for mobile communications, and via at least one roaming node network with which the communication service provider has a roaming service agreement. The media content provider receives a security policy request from the mobile phone to establish a security policy for end-to-end security of the mobile communication link between the media content provider and the mobile phone for data communication security. The media content provider then communicates a security policy response to the mobile phone to establish the security policy for the end-to-end security of the mobile communication link that is adaptable to security restrictions of the roaming node network.

Claims

1. A method implemented by a computer device at a media content provider, the method comprising:

establishing a mobile communication link with a mobile phone via a communication service provider with which the mobile phone is registered for mobile communications, and via at least one roaming node network with which the communication service provider has a roaming service agreement;

receiving a security policy request from the mobile phone to establish a security policy for end-to-end security of the mobile communication link between the media content provider and the mobile phone for data communication security; and

communicating a security policy response to the mobile phone to establish the security policy for the end-to-end security of the mobile communication link that is adaptable to security restrictions of the roaming node network.

2. A method as recited in claim 1, wherein the security policy request that is received from the mobile phone includes a region code corresponding to the roaming node network.

3. A method as recited in claim 2, further comprising determining an encryption policy for the roaming node network based on the region code, and wherein the security policy response includes the encryption policy that is utilized to establish the end-to-end security of the mobile communication link.

4. A method as recited in claim 1, wherein the security policy request that is received from the mobile phone is included with authentication data messages that are communicated between the mobile phone and the media content provider.

5. A method as recited in claim 4, wherein the security policy request includes a region code corresponding to the roaming node network, the region code being included with the authentication data messages.

6. A method as recited in claim 5, further comprising determining an encryption policy for the roaming node network based on the region code, and wherein the security policy response is included with the authentication data messages.

7. A method as recited in claim 1, wherein the security policy request that is received from the mobile phone includes an encryption policy for the roaming node network, the mobile phone obtaining the encryption policy from a cache stored locally on the mobile phone.

8. A method as recited in claim 1, further comprising:

receiving a region code corresponding to the roaming node network, the region code being received from the communication service provider; and

determining an encryption policy for the roaming node network based on the region code, the security policy response including the encryption policy that is utilized to establish the end-to-end security of the mobile communication link.

9. A method as recited in claim 1, further comprising:

receiving an indication that the roaming node network is changing to a different roaming node network to maintain the mobile communication link; and

adapting the security policy for the end-to-end security of the mobile communication link for alternative security restrictions of the different roaming node network.

10. A method as recited in claim 1, further comprising:

communicating a challenge to the mobile phone via the mobile communication link that is secure based on the security policy, the mobile communication link including the roaming node network and a mobile operator network that is managed by the communication service provider; and

receiving the challenge back from the mobile phone via the mobile operator network and the communication service provider, the challenge including data added by the communication service provider.

11. A method as recited in claim 10, wherein the data received from the communication service provider is a billing identifier that is associated with the mobile phone, the billing identifier being securely received from the communication service provider via the mobile communication link.

12. A method implemented by a mobile phone, the method comprising:

establishing a mobile communication link with a media content provider via a communication service provider with which the mobile phone is registered for mobile communications, and via at least one roaming node network with which the communication service provider has a roaming service agreement;

communicating a security policy request to the media content provider to establish a security policy for end-to-end security of the mobile communication link between the media content provider and the mobile phone for data communication security; and

receiving a security policy response from the media content provider to establish the security policy for the end-to-end security of the mobile communication link that is adaptable to security restrictions of the roaming node network.

13. A method as recited in claim 12, wherein the security policy request includes a region code that corresponds to the roaming node network, and wherein the security policy response includes an encryption policy that the media content provider determines based on the region code.

14. A method as recited in claim 12, wherein the security policy request and the security policy response are included with authentication data messages that are communicated between the mobile phone and the media content provider.

15. A mobile communication system, comprising:

a media content provider configured to establish a mobile communication link with a mobile phone via a communication service provider with which the mobile phone is registered for mobile communications, and via at least one roaming node network with which the communication service provider has a roaming agreement;

a security protocol service implemented by a computer device at the media content provider, the security protocol service configured to;

receive a security policy request from the mobile phone to establish a security policy for end-to-end security of the mobile communication link between the media content provider and the mobile phone for data communication security;

determine an encryption policy for the roaming node network based on a region code that corresponds to the roaming node network; and

initiate communication of a security policy response to the mobile phone, the security policy response including the encryption policy that is utilized to establish the security policy for the end-to-end security of the mobile communication link that is adaptable to security restrictions of the roaming node network.

16. A mobile communication system as recited in claim 15, wherein the security policy request and the security policy response are included with authentication data messages that are communicated between the mobile phone and the media content provider.

17. A mobile communication system as recited in claim 15, wherein the security protocol service is further configured to receive the encryption policy for the roaming node network from the mobile phone that maintains a cache of encryption policies stored locally on the mobile phone.

18. A mobile communication system as recited in claim 15, wherein the security protocol service is further configured to receive the region code that corresponds to the roaming node network from the communication service provider.

19. A mobile communication system as recited in claim 15, wherein the security protocol service is further configured to:

receive an indication that the roaming node network is changing to a different roaming node network to maintain the mobile communication link; and

adapt the security policy for the end-to-end security of the mobile communication link for alternative security restrictions of the different roaming node network.

20. A mobile communication system as recited in claim 15, wherein the media content provider is further configured to:

communicate a challenge to the mobile phone via the mobile communication link that is secure based on the security policy, the mobile communication link including the roaming node network and a mobile operator network that is managed by the communication service provider; and

receive the challenge back from the mobile phone via the mobile operator network and the communication service provider, the challenge including data added by the communication service provider.