Secured privileged access to an embedded client on a mobile device

• US 20130054969A1
• Filed: 08/30/2012
• Published: 02/28/2013
• Est. Priority Date: 08/31/2011
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: AetherPal, Inc. (Broadcom, Inc.)
• Inventors: Parmar, Ramesh, Ayyalasomayajula, Subramanyam, Charles, Calvin, Gonsalves, Deepak, Oh, Byung Joon
• Granted Patent: US 8,782,412 B2
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Disclosed is an apparatus and method to access privileges of Virtual Mobile Management (VMM) client in mobile device. A disclosed example method contains an assigning embedded stub to raise the access privilege of the tool on a mobile device, the embedded stub is integrated by an operating system of the mobile device with “root” privilege, determining via a secured key exchange algorithm that the VMM client and tools is authorized to be installed on the mobile device then, the VMM client and tools of a mobile device are authorized to access a network interface of the Communication Endpoint Gateway (CEG) server, configuring the embedded stub to install the key exchange procedure for the shared certification between the embedded stub, VMM client and the session mediation server, enabling the embedded stub to communicate through a secure link via VMM client.

Claims

1. A method for obtaining a secured privileged access for an embedded client of mobile device comprising the steps of:

embedding a stub into the mobile device with “

root”

privilege;

installing a Virtual Mobile Management (‘

VMM”

) client and tools on the mobile device;

attempting a Session Mediation Server connection with the mobile device;

detecting whether the VMM Client has a privilege to invoke any of the installed tools;

invoking said stub and elevating an access level of a tool stub to make a connection with the Session Mediation Server;

receiving a stub connection request from the Session Mediation server; and

performing a mutual authentication between the stub, the VMM Client and the Session Mediation Server.

2. The method according to claim 1 wherein the VMM client and tools of a mobile device are authorized to access a network interface of a Communication Endpoint Gateway (CEG) server.

3. The method according to claim 1 wherein the embedded stub enables the VMM client to connect with the Session Mediation Server.

4. The method according to claim 1 wherein the embedded stub can communicate through a secure link via VMM client.

5. The method according to claim 1 including a security key data flow between the session mediation server and the embedded stub in which remote control authorization is provided by an embedded stub to the VMM client comprising the steps of:

VMM Client sends a connection request to the embedded stub;

embedded stub sends a random session token to VMM Client;

VMM Client sends a NULL authentication vector to indicate to the embedded stub that it does not have the session key;

embedded stub sends a challenge request with encrypted random number and the crypto suite that was used to encrypt the random number;

VMM Client forwards the message to the Server;

session Mediation Server computes hash on the random value r2 with decrypted er1 as key.

server creates a signature of r1 and r2 random numbers and sends the signature to VMM Client;

VMM Client forwards the signature to embedded stub;

embedded stub verifies the signature and sends the Shared Secret Key (SSK) which is encrypted;

server decrypts the SSK and sends the response to VMM Client; and

VMM Client computes hash on token t1 with the SSK and requests the session token from the embedded stub;

wherein the embedded stub sends the session token information to the VMM Client and completes the mutual authentication process before the session starts.

6. The method of claim 3 wherein said embedded client stub supports the remote control authentication between session mediation server and VMM client without security threats.

7. The method of claim 1 wherein said installed tool captures a device screen by the mobile device.

8. The method of claim 1 wherein said installed tool collects desired device diagnostics and provides self-care support for remote session activation and manage security protocol.

9. The method of claim 7 including the injection of key events into the device screen by an RD Mobile application.

10. The method of claim 7 including the simulation of touch events on the device screen by an RD Mobile application.

11. The method of claim 8 wherein said desired device diagnostics from the group comprising:

network status, power status, Mobile Network Code (MNC), Mobile Country Code (MCC), International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), Electronic Serial Number (ESN), and battery level of the smart phone.