Method of handling access control information and related communication device

• US 20130159526A1
• Filed: 12/20/2012
• Published: 06/20/2013
• Est. Priority Date: 12/20/2011
• Status: Abandoned Application

• Current Assignee: HTC Corporation
• Original Assignee: HTC Corporation
• Inventors: Yu, Chun-Ta, Tseng, Yin-Yeh
• Application Number:
  US13/721,061
• Publication Number:
  US 20130159526A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A method of handling access control information of a management object in a device management (DM) client of a service system is disclosed. The method comprises creating a management tree for storing the access control information of the management object; arranging a first node in the management tree, for storing an identifier of the management object; arranging a second node in the management tree, for storing an identifier of a DM server of the service system; arranging a third node in the management tree, for storing a path of a node in the management object; and arranging a fourth node in the management tree, for storing access right of the DM server related to the node.

Claims

1. A method of handling access control information of a first management object in a device management (DM) client of a service system, the method comprising:

creating a management tree for storing the access control information of the first management object;

arranging a first node in the management tree, for storing an identifier of the first management object;

arranging a second node in the management tree, for storing an identifier of a first DM server of the service system;

arranging a third node in the management tree, for storing a path of a node in the first management object; and

arranging a fourth node in the management tree, for storing access right of the first DM server related to the node.

2. The method of claim 1, wherein after receiving a message transmitted by a second DM server of the service system, the DM client determines whether a path in the message is valid according to the path in the third node.

3. The method of claim 2, wherein the DM client determines whether to grant a DM command in the message according to the access right in the fourth node after determining that the path is valid, and the DM client rejects the message after determining that the message is not valid.

4. The method of claim 3, wherein when the access right comprises the DM command and an identifier of the second DM server, the DM client grants the DM command in the message.

5. The method of claim 1, wherein after receiving a message transmitted by a second DM server of the service system, the DM client determines whether an identifier of a second management object corresponding to a path in the message is valid according to the identifier in the first node.

6. The method of claim 5, wherein the DM client determines whether an identifier of the second DM server is valid according to the identifier in the second node after determining that the identifier of the second management object is valid, and the DM client rejects the message after determining that the identifier of the second management object is not valid.

7. The method of claim 6, wherein the DM client determines whether the path in the message is valid according to the path in the third node after determining that the identifier of the second server is valid, and the DM client rejects the message after determining that the identifier of the second server is not valid.

8. The method of claim 7, wherein the DM client determines whether to grant a DM command in the message according to the access right in the fourth node after determining that the path in the message is valid, and the DM client rejects the message after determining that the path in the message is not valid.

9. The method of claim 8, wherein the DM client grants the DM command if behavior of the DM command is the same as the access right in the fourth node, and the DM client rejects the message if the behavior of the DM command is not the same as the access right in the fourth node.

10. The method of claim 9, wherein the DM client determines whether the message is valid according to management object (MO)-level access right of the first management object described according to the DM protocol 2.0, before rejecting the message.

11. The method of claim 5, wherein the DM client starts to check the identifier of the second management object after determining that the message is not valid according to MO-level access right of the first management object described according to the DM protocol 2.0, and the DM client does not start to check the identifier of the second management object and grants a DM command in the message after determining that the message is valid according to the MO-level access right.

12. The method of claim 1, wherein the management tree and the four nodes are created, when the DM client is upgraded from the DM protocol 1.x to the DM protocol 2.0.

13. The method of claim 1, wherein the management tree and the four nodes are created by the first DM server, and are transmitted to the DM client.

14. The method of claim 1, wherein the management tree and the four nodes are created by the DM client.

15. The method of claim 1, wherein the management tree and the four nodes are created according to the DM protocol 2.0 or later versions, for storing the access control information created according to the DM protocol 1.x.