Mobile Radio Terminal Device Having a Filter Means and a Network Element for the Configuration of the Filter Means

• US 20110023108A1
• Filed: 10/24/2008
• Published: 01/27/2011
• Est. Priority Date: 10/31/2007
• Status: Abandoned Application

• Current Assignee: Concept04 GmbH
• Original Assignee: Concept04 GmbH
• Inventors: Jung, Peter, Bruck, Guido, Geldermann, Martin
• Application Number:
  US12/740,601
• Publication Number:
  US 20110023108A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A mobile radio terminal device having a communicator for communicating with network elements via data packets and a filter for monitoring the data packets, wherein the filter is implemented to receive a filter regulation from a first network element and to prevent a communication with a second network element when a data packet for communicating with the second network element does not correspond to the filter regulation.

Claims

1. A mobile radio terminal device (100), comprising

a communication means (110) for communicating with network elements via data packets;

a control means which is implemented to perform an authentication with a first network element; and

a filter means (120) for monitoring the data packets, wherein the filter means (120) is implemented to receive a filter regulation from the first network element and to prevent a communication with a second network element, when a data packet for communicating with the second network element does not correspond to the filter regulation; and

wherein the control means is implemented to accept no filter regulations from the first network element in a failed authentication.

2. The mobile radio terminal device (100) according to claim 1, wherein the filter means (120) is implemented to form a firewall or a security gateway for the data packets.

3. The mobile radio terminal device (100) according to one of claim 1 or 2, wherein the filter regulation comprises a configuration which contains rules according to which the data packets may be classified into allowable and non-allowable data packets.

4. The mobile radio terminal device (100) according to one of claims 1 to 3, wherein the control means is implemented to receive an installation regulation from the first network element and to adapt the filter means (120) based on the installation regulation.

5. The mobile radio terminal device (100) according to claim 4, wherein the communication means (110) is implemented to receive encrypted installation or filter regulations from the first network element, wherein the control means is implemented to decrypt the encrypted installation regulations or filter regulations to provide decrypted filter regulations to the filter means (120) or to adapt the filter means (120) based on decrypted installation regulations, respectively.

6. The mobile radio terminal device (100) according to claim 5, wherein the control means is implemented to decrypt the encrypted installation regulation or the encrypted filter regulation according to a DSA method (DSA=digital signature algorithm).

7. The mobile radio terminal device (100) according to one of claims 1 to 6, wherein the filter means (120) is implemented to obtain information about allowed transmitter addresses, receiver addresses, port numbers, used services or used communication protocols with the filter regulation and check the data packets with regard to this information.

8. The mobile radio terminal device (100) according to one of claims 1 to 7, wherein the communication means (110) is implemented to communicate with network elements of different subnetworks, and wherein the filter means (120) is implemented to receive different filter regulations for the different subnetworks and to monitor data packets at or from different subnetworks according to the different filter regulations.

9. The mobile radio terminal device (100) according to one of claims 1 to 8, comprising a first processing unit for realizing the filter means (120) and at least one second processing unit for realizing an application, wherein the application is implemented to exchange data packets via the filter means (120) and the communication means (110) with a network element.

10. The mobile radio terminal device (100) according to one of claims 1 to 9, which is realized as a pocket PC (PC=Personal Computer), a smart phone, a laptop computer or a PDA (PDA=Personal Digital Assistant).

11. The mobile radio terminal device (100) according to one of claims 1 to 10, wherein the filter means (120) is implemented to monitor data packets according to Bluetooth, TCP (TCP=Transmission Control Protocol), IP (IP=Internet Protocol), UDP (UDP=Universal Datagram Protocol), GSM (GSM=Global System for Mobile communications), WLAN (WLAN=Wireless Local Area Network), DECT (DECT=Digital Enhanced Cordless Telephone), UMTS (UMTS=Universal Mobile Telecommunication System), LTE (LTE=Long Term Evolution).

12. The mobile radio terminal device (100) according to one of claims 1 to 11, further comprising a peripheral device or a further interface for a communication, and wherein the filter means (120) is implemented to monitor a use of the peripheral device or the further interface, respectively, based on the filter regulation.

13. The mobile radio terminal device (100) according to claim 12, wherein the peripheral device includes a camera which may be switched on and off based on the filter regulation.

14. The mobile radio terminal device (100) according to one of claims 4 to 13, wherein the control means is implemented to further perform an authentication with the first network element and to accept neither installation regulations nor filter regulations for the first network element with a failed authentication.

15. The mobile radio terminal device (100) according to one of claims 1 to 14, further comprising an interface for communicating with an administrator, wherein the administrator may be identified via an administrator password, and wherein the filter means (120) is implemented to be activated or deactivated by the administrator.

16. The mobile radio terminal device (100) according to claim 15, further including an interface for representing at least a part of the filter regulation for a user of the mobile radio terminal device (100).

17. The mobile radio terminal device (100) according to one of claims 1 to 16, further comprising a virus filter means for monitoring data packets based on a virus filter regulation.

18. The mobile radio terminal device (100) according to claim 17, wherein the virus filter means is implemented to receive a virus filter regulation from the first network element.

19. The mobile radio terminal device (100) according to one of claims 1 to 18, wherein the filter means (120) is implemented to receive a filter regulation in an XML-format (XML=extensible markup language).

20. The mobile radio terminal device (100) according to one of claims 5 to 19, wherein the control unit is implemented to receive an installation regulation in a CAB format (CAB=cabinet).

40. A mobile radio system having a mobile radio terminal device (100) according to one of claims 1 to 20 and a network element (200) according to one of claims 23 to 37.

21. A method for monitoring data packets, comprising the following steps:

authenticating a first network element;

receiving a filter regulation from the first network element, if the authentication succeeded;

checking data packets, which are exchanged with a second network element, based on the filter regulation; and

discarding data packets, which do not correspond to the filter regulation.

22. A computer program having a program code for performing the method according to claim 21, when the computer program runs on a computer.

23. A network element (200) for the configuration of a filter means of a mobile radio terminal device, comprising

a communication means (210) for communicating with the mobile radio terminal device via data packets;

and

a filter configuration means (220) for providing a filter regulation such that the filter means may identify data packets which do not correspond to the filter regulation based on the filter regulation,

wherein the communication means (210) is implemented to authenticate against the mobile radio terminal device and to transmit the filter regulation via the data packets to the mobile radio terminal device.

24. The network element (200) according to claim 23, further comprising an interface for communicating with an administrator.

25. The network element (200) according to one of claim 23 or 24, wherein the filter configuration means (220) is implemented to provide the filter regulation for a filter means which realizes a firewall or a security gateway.

26. The network element (200) according to one of claims 23 to 25, wherein the filter configuration means (220) is implemented to provide an installation regulation for a filter means on the basis of which a software filter means may be installed in a mobile radio terminal device.

27. The network element (200) according to one of claims 23 to 26, comprising a means for encrypting the data packets.

28. The network element (200) according to one of claims 23 to 27 managing a database for storing filter regulations, installation regulations or keys.

29. The network element (200) according to one of claims 23 to 28, wherein the filter configuration means (220) is implemented to provide an XML file as a filter regulation.

30. The network element (200) according to one of claims 26 to 29, wherein the filter configuration means (220) is implemented to provide a CAB file as an installation regulation.

31. The network element (200) according to one of claims 23 to 30, wherein the filter configuration means (220) is implemented to provide a plurality of filter rules as a filter regulation.

32. The network element (200) according to one of claims 23 to 31, wherein the filter configuration means (220) is implemented to provide information about allowed transmitter addresses, receiver addresses, port numbers, used services or used communication protocols with the filter regulation.

33. The network element (200) according to one of claims 23 to 32, wherein the filter configuration means (220) is implemented to provide filter regulations for Bluetooth, TCP, IP, UDP, GSM, WLAN, DECT, UMTS, LTE data packets.

34. The network element (200) according to one of claims 28 to 33, wherein the database is implemented to store a history of filter regulations, installation regulations or keys for a mobile radio terminal device.

35. The network element (200) according to one of claims 27 to 34, wherein the means for encrypting and the filter configuration means (220) are implemented to generate a key pair with an installation regulation or a filter regulation and to sign or to encrypt, respectively, the installation regulation or the filter regulation with the key pair.

36. The network element (200) according to one of claims 27 to 35, wherein the means for encrypting is implemented to encrypt or to sign, respectively, according to the DSA method.

37. The network element (200) according to one of claims 23 to 36, further comprising a virus filter configuration means for providing a virus filter regulation, and wherein the communication means (210) is implemented to transmit the virus filter regulation via the data packets to the mobile radio terminal device.

38. A method for the configuration of a filter means of a mobile radio terminal device, comprising the steps of:

communicating with the mobile radio terminal device via data packets;

authenticating against the mobile radio terminal device;

providing a filter regulation such that the filter means may identify data packets based on the filter regulation which do not correspond to the filter regulation; and

transmitting the filter regulation to the mobile radio terminal device via the data packets.

39. A computer program having a program code for performing the method according to claim 38, when the computer program runs on a computer.