SYSTEMS AND METHODS FOR MONITORING AN OPERATING SYSTEM OF A MOBILE WIRELESS COMMUNICATION DEVICE FOR UNAUTHORIZED MODIFICATIONS

• US 20170026840A1
• Filed: 07/21/2015
• Published: 01/26/2017
• Est. Priority Date: 07/21/2015
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Eyal, Eilon
• Granted Patent: US 9,736,693 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier

Abstract

A method and system for securely monitoring an operating system of a mobile wireless communication device for unauthorized modifications. A secure application is provided on universal integrated circuit card of the mobile wireless communication device. The secure application is configured to control the wireless connectivity of the mobile wireless communication device, and communicate with a wireless communications network. A monitoring application is provided in a trusted sub-processor of the processor of the mobile wireless communication device. A secure communication link is established between the secure application and the monitoring application. A heartbeat token is generated by the trusted sub-processor, based on a modification status for the operating system and at least one system variable. The secure application receives the heartbeat token, and determines that an unauthorized software modification exists based on the heartbeat token. The secure application activates at least one countermeasure when an unauthorized software modification exists.

Claims

1. A method for secure monitoring an operating system of a mobile wireless communication device for unauthorized modifications, the mobile wireless communication device including an electronic processor and a universal integrated circuit card, the method comprising:

providing a secure application in the universal integrated circuit card, the secure application configured to disable or block wireless connectivity of the mobile wireless communication device, and communicate with a wireless communications network;

providing a monitoring application in a trusted sub-processor of the electronic processor; and

establishing a secure communication link between the secure application and the monitoring application.

2. The method of claim 1, further comprising generating a heartbeat token based on a modification status and at least one system variable;

and receiving, with the secure application, the heartbeat token.

3. The method of claim 2, wherein generating the heartbeat token includes generating the heartbeat token further based on a message authentication code.

4. The method of claim 2, wherein generating the heartbeat token includes selecting the at least one system variable from the group consisting of a temporary mobile subscriber identity, a location area identity, and an international mobile subscriber identity.

5. The method of claim 2, further comprising:

determining, with the secure application, that an unauthorized software modification exists based on the heartbeat token; and

activating, with the secure application, at least one countermeasure.

6. The method of claim 5, wherein determining that the unauthorized software modification exists includes verifying a message authentication code.

7. The method of claim 5, wherein activating the at least one countermeasure includes selecting the at least one countermeasure from the group consisting of sending a message to the wireless communications network, and disabling user-accessible wireless services on the mobile wireless communication device.

8. The method of claim 2, further comprising:

determining, with the secure application, that an unauthorized software modification exists when the heartbeat token is not received; and

activating, with the secure application, at least one countermeasure.

9. The method of claim 8, wherein activating the at least one countermeasure includes selecting the at least one countermeasure from the group consisting of sending a message to the wireless communications network, and disabling user-accessible wireless services on the mobile wireless communication device.

10. A system for secure monitoring of an operating system of a mobile wireless communication device for unauthorized modifications, the system comprising:

a universal integrated circuit card configured to disable or block wireless connectivity of the mobile wireless communication device, and communicate with a wireless communications network; and

an electronic processor having a trusted sub-processor, the trusted sub-processor configured to establish a secure communication link between the trusted sub-processor and the universal integrated circuit card.

11. The system of claim 10, wherein the trusted sub-processor is further configured to generate a heartbeat token based on a modification status and at least one system variable;

and the universal integrated circuit card is further configured to receive the heartbeat token.

12. The system of claim 11, wherein the trusted sub-processor is further configured to generate a message authentication code;

and wherein generating the heartbeat token includes generating the heartbeat token further based on the message authentication code.

13. The system of claim 11, wherein the at least one system variable includes at least one selected from the group consisting of a temporary mobile subscriber identity, a location area identity, and an international mobile subscriber identity.

14. The system of claim 11, wherein the universal integrated circuit card is further configured to determine that an unauthorized software modification exists based on the heartbeat token;

and

activate at least one countermeasure.

15. The system of claim 14, wherein determining that the unauthorized software modification exists includes verifying a message authentication code.

16. The system of claim 14, wherein the at least one countermeasure includes at least one selected from the group consisting of sending a message to the wireless communications network, and disabling user-accessible wireless services on the mobile wireless communication device.

17. The system of claim 11, wherein the universal integrated circuit card is further configured to determine that an unauthorized software modification exists when the heartbeat token is not received;

and

activate at least one countermeasure.

18. The system of claim 17, wherein the at least one countermeasure includes at least one selected from the group consisting of sending a message to the wireless communications network, and disabling user-accessible wireless services on the mobile wireless communication device.

19. A system for secure monitoring of an operating system of a mobile wireless communication device for unauthorized modifications, the system comprising:

a universal integrated circuit card that disables or blocks wireless connectivity of the mobile wireless communication device, and communicates with a wireless communications network; and

an electronic processor having a trusted sub-processor, the trusted sub-processor establishes a secure communication link between the trusted sub-processor and the universal integrated circuit card.