Method and Apparatus For Monitoring and Theft Prevention

• US 20120289193A1
• Filed: 02/08/2012
• Published: 11/15/2012
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: BERGENWALL, Henric
• Granted Patent: US 8,874,077 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/45 using multiple identity modules
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

There is provided a device comprising a mobile broadband module comprising radio communication means. The device further comprises at least a first SIM for providing user domain services and at least a second SIM for providing service domain services. The second SIM is isolated from an end user of the device. According to an embodiment, the first SIM is associated with the end user of the device, wherein the end user may be associated with a first identity, and wherein the second SIM is associated with a service provider, the service provider being associated with a second identity. A method comprising: identifying which of the first and the second communication paths a command is issued from; and continuing with the command or discontinuing with the command in dependence on the identified path, such that the end user is not able to perform operation on to access the isolated second SIM.

Claims

1. A device, comprising:

a mobile broadband module comprising radio communication means;

at least a first subscriber identity module, SIM, for providing user domain services; and

at least a second subscriber identity module, SIM, for providing service domain services, the second SIM being isolated from an end user of the device.

2. The device according to claim 1, wherein

the first SIM is associated with the end user of the device, and

the second SIM is associated with a service provider.

3. The device according to claim 1, further comprising:

an application or a component;

a first communication path for providing communication between the application or the component and the mobile broadband module; and

a second communication path for providing communication between the application or the component and the mobile broadband module, wherein

the first SIM is configured to communicate over at least the first communication path with at least first application or the component, and

the second SIM is configured to communicate over at least the second communication path with at least the application or the component without using the first communication path.

4. The device according to claim 1, further comprising:

a decision processor for continuing with a command or discontinuing with a command by identifying which of the first and the second communication paths the command is issued from, such that the end user is not able to perform operation on to access the isolated second SIM.

5. The device according to claim 2, wherein communication between the service provider and the device is not noticeable to the end user of the device.

6. The device according to claim 2, wherein the second SIM enables the service provider to control applications in the broadband module or on the device via communication with the device over the radio communication means, such as by a short message service, SMS, or by communication over an external interface to the device.

7. The device according to claim 3, wherein the first communication path is a first interface and the second communication path is a second interface.

8. The device according to claim 7, wherein the first interface and second interface is a Peripheral Component Interconnect Express, PCIe, interface wherein one of the first and send interface is arranged on the Universal Serial Bus, USB, interface pins and the other is arranged on the System Management Bus, SMBus.

9. The device according to claim 3, wherein the first communication path is a first logical data channel and wherein the second communication path is a second logical data channel.

10. The device according to claim 1, wherein the second SIM comprises a physical component embedded in the broadband module or in another part of the device, the physical component accommodating a SIM application or virtual SIM component.

11. The device according to claim 10, wherein the physical component of the second SIM is a Universal Integrated Circuit Card, UICC, MCIM or eSIM, embedded on the device or in the broadband module.

12. The device according to claim 1, further comprising a third SIM.

13. The device according to claim 1, wherein the first SIM and the second SIM communicates with the broadband module via at least one internal interface and wherein communication on said internal interface for the first and the second SIM is multiplexed, such that applications and/or components in the device or broadband module can read SIM related information at least sequentially.

14. The device according to claim 1, wherein the radio communication means comprises at least two radio stacks, permitting two user entities being associated with the first and second SIM to be at least attached to a radio network simultaneously.

15. The device according to claim 9, wherein the first and the second logical channels at least are interfacing to virtual components or applications.

16. A method for a device comprising:

(a) a mobile broadband module comprising radio communication means;

(b) at least a first subscriber identity module, SIM, for providing user domain services;

(c) a second subscriber identity module, SIM, separate from the first SIM, for providing service domain services;

(d) an application or a component;

(e) a first communication path for providing communication between the application or the component and the mobile broadband module;

(f) a second communication path for providing communication between the application or the component and the mobile broadband module, wherein the first SIM communicates over at least the first communication path with the application or the component, and the second SIM communicates over at least the second communication path with the application or the component without using the first communication path, the method comprising;

identifying which of the first and the second communication paths a command is issued from; and

continuing with the command or discontinuing with the command in dependence on the identified path, such that the end user is not able to perform operation on to access the isolated second SIM.

17. The method according to claim 16, further comprising initially setting up the device prior to performing the identifying step, wherein

the step of initially setting up the device comprises:

downloading the second SIM;

activating the second SIM;

transferring an encrypted command comprising the identity associated with the service domain services; and

enabling a security feature of the service domain services.

18. A method for use in a device comprising:

(a) a mobile broadband module comprising radio communication means;

(b) at least a first subscriber identity module, SIM, for providing user domain services;

(c) a second subscriber identity module, SIM, separate from the first SIM, for providing service domain services;

(d) an application or a component;

(e) a first communication path for providing communication between the application or the component and the mobile broadband module;

(f) a second communication path for providing communication between the application or the component and the mobile broadband module, wherein the first SIM communicating over the communication path with the application or the component, and the second SIM communicating over the second communication path with the application or the component without using the first communication path, the method comprising initially setting up the device by;

downloading the second SIM;

activating the second SIM;

transferring an encrypted command comprising the identity associated with the service domain services; and

enabling a security feature of the service domain services.