Management of network devices utilizing an authorization token

• US 20140165155A1
• Filed: 03/06/2013
• Published: 06/12/2014
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: ZHANG, Jiang
• Granted Patent: US 9,264,413 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Aspects of the invention may relate to an apparatus, system, and method for the management of network devices utilizing an authorization token. In one embodiment, an authorization token received from a service provider may be verified using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device. Further, operation privileges may be enforced that are contained in the authorization token.

Claims

1. A network device comprising:

a network interface;

a memory including an authorization credential; and

a processor to execute functions including;

verifying an authorization token received from a service provider using the authorization credential to determine if the service provider is authorized to perform requested operations with the network device; and

enforcing operation privileges contained in the authorization token.

2. The network device of claim 1, wherein the processor further executes an operation comprising commanding the transmission of the authorization token to a device management authority or to the service provider if authorized by the device management authority.

3. The network device of claim 1, wherein the processor and the memory are configured in an embedded universal integrated circuit card of the network device.

4. The network device of claim 3, wherein the authorization credential is selected and programmed into the memory of the embedded universal integrated circuit card.

5. The network device of claim 1, wherein the authorization token is generated within the network device based on the authorization credential or outside of the network device based on the authorization credential wherein a device management authority includes a copy of the authorization credential.

6. The network device of claim 5, wherein the device management authority transmits the authorization token to the service provider, if the authorization token is not transmitted to the service provider by the network device.

7. The network device of claim 1, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

8. The network device of claim 1, wherein the processor further executes functions to specify operation privileges associated with the service provider included in the authorization token.

9. The network device of claim 8, wherein the operation privileges include loading, deleting, enabling, or disabling a set of data or services of the service provider.

10. The network device of claim 9, wherein the services provided by the service provider include at least mobile network connectivity service.

11. The network device of claim 9, wherein the service provider associated with the operation privileges is specified in the authorization token.

12. The network device of claim 9, wherein the validity of the operation privileges is specified in the authorization token.

13. The network device of claim 1, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

14. A method implemented by a network device comprising:

verifying an authorization token received from a service provider using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device; and

enforcing operation privileges contained in the authorization token.

15. The method of claim 14, further comprising commanding the transmission of the authorization token to a device management authority or to the service provider if authorized by the device management authority.

16. The method of claim 14, wherein the authorization credential is stored in an embedded universal integrated circuit card of the network device or with the device management authority.

17. The method of claim 14, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

18. The method of claim 14, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

19. The method of claim 18, wherein the device management authority transmits the authorization token to the service provider.

20. The method of claim 14, further comprising specifying operation privileges associated with the service provider included in the authorization token.

21. The method of claim 20, wherein the operation privileges include loading, deleting, enabling, or disabling a set of data or services of the service provider.

22. The method of claim 21, wherein the services provided by the service provider include at least mobile network connectivity service.

23. The method of claim 21, further comprising specifying the service provider that includes the operation privileges in the authorization token.

24. The method of claim 21, further comprising specifying the validity of the operation privileges in the authorization token.

25. The method of claim 14, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

26. A computer program product executed at a network device comprising:

a computer-readable medium comprising code for;

verifying an authorization token received from a service provider using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device; and

enforcing operation privileges contained in the authorization token.

27. The computer program product of claim 26, further comprising code for commanding the transmission of the authorization token to a device management authority or to the service provider if authorized by the device management authority.

28. The computer program product of claim 26, wherein the authorization credential is stored in an embedded universal integrated circuit card of the network device or with the device management authority.

29. The computer program product of claim 26, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

30. The computer program product of claim 26, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

31. The computer program product of claim 30, wherein the device management authority transmits the authorization token to the service provider.

32. The computer program product of claim 26, further comprising code for specifying operation privileges associated with the service provider included in the authorization token.

33. The computer program product of claim 32, wherein the operation privileges include loading, deleting, enabling, or disabling a set of data or services of the service provider.

34. The computer program product of claim 33, wherein the services provided by the service provider include at least mobile network connectivity service.

35. The computer program product of claim 33, further comprising code for specifying the service provider that includes the operation privileges in the authorization token.

36. The computer program product of claim 33, further comprising code for specifying the validity of the operation privileges in the authorization token.

37. The computer program product of claim 26, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

38. A network device comprising:

means for verifying an authorization token received from a service provider using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device; and

means for enforcing operation privileges contained in the authorization token.

39. The network device of claim 38, further comprising means for commanding the transmission of the authorization token to a device management authority or to the service provider if authorized by the device management authority.

40. The network device of claim 38, wherein the authorization credential is stored in an embedded universal integrated circuit card of the network device or with the device management authority.

41. The network device of claim 38, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

42. The network device of claim 38, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

43. The network device of claim 42, wherein the device management authority transmits the authorization token to the service provider.

44. The network device of claim 38, further comprising means for specifying operation privileges associated with the service provider included in the authorization token.

45. The network device of claim 44, wherein the operation privileges include loading, deleting, enabling, or disabling a set of data or services of the service provider.

46. The network device of claim 45, wherein the services provided by the service provider include at least mobile network connectivity service.

47. The network device of claim 45, further comprising means for specifying the service provider that includes the operation privileges in the authorization token.

48. The network device of claim 45, further comprising means for specifying the validity of the operation privileges in the authorization token.

49. The network device of claim 38, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.