Method and apparatus for providing access control to local services of mobile devices

• US 6,292,833 B1
• Filed: 07/17/1998
• Issued: 09/18/2001
• Est. Priority Date: 07/17/1998
• Status: Expired due to Term

• Current Assignee: Unwired Planet LLC (JP Morgan Chase & Co)
• Original Assignee: Openwave Systems Incorporated (JP Morgan Chase & Co)
• Inventors: Liao, Hanqing, King, Peter F., Martin, Jr., Bruce K.
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US09/118,640
• Time in Patent Office: 1,159 Days
• Field of Search: 709/219, 709/225, 709/229
• US Class Current: 709/229
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Techniques for ensuring secure access to local service of mobile devices of a wireless communication system are disclosed. The techniques control access to local services of mobile devices such that only authorized services are able to remotely alter the local services of the mobile devices. Before permitting access to local services of a mobile device, the identity of the network site seeking to have access is checked to determine whether the network site is authorized for such access. If the network site is authorized, then access is permitted and the network site is able to modify or alter the local services of the mobile device. On the other hand, when the network site is not authorized, then the network site is denied access to the local service so that the local services provided by the network site are not open to attack or corruption from unscrupulous network sites.

Claims

1. A method for restricting access to local services of a mobile device, said method comprising:

(a) receiving a message from a computing device through a network, the message having a service identity associated therewith;

(b) determining whether the message seeks access to the local services of the mobile device;

(c) comparing the service identity associated with the message against one or more authorized service identities at least when said determining (b) determines that the message seeks access to the local services of the mobile device; and

(d) permitting the message to access the local services of the mobile device only when said comparing (c) indicates that the service identity associated with the message matches at least one of the one or more of authorized service identities.

2. A method as recited in claim 1, wherein the local services pertain to services provided on the mobile device.

3. A method as recited in claim 1, wherein the message contains executable code.

4. A method as recited in claim 3, wherein said permitting (d) comprises processing the message when the service identity associated with the message matches at least one of the one or more of authorized service identities.

5. A method as recited in claim 3, wherein where said acts of determining (b), comparing (c) and permitting (d) occur as the message is being processed.

6. A method as recited in claim 1, wherein the service identity for the message pertains to the computing device on the network that supplies the message.

7. A method as recited in claim 1, wherein the service identity for the message is a Universal Resource Locator.

8. A method as recited in claim 1, wherein the service identity for the message is one of a string derived from a domain name, a Universal Resource Locator, a network address, an alphanumeric text string and a phone number.

9. A method as recited in claim 1, wherein said determining (d) operates to scan at least a portion of the message to determine whether the message seeks access to the local services of the mobile device.

10. A method as recited in claim 1,

wherein the message contains executable code that causes the local services to be processed so that system parameters in the mobile device are modified to alter the operation of the mobile device, and

wherein said permitting (d) comprises executing the message when the service identity associated with the message matches at least one of the one or more of authorized service identities, and

wherein the stored parameters are altered by the execution of the message.

11. A computer readable medium having computer program code for ensuring secure access to local services of a mobile device, said computer readable medium comprising:

computer program code for receiving executable code from a computing device through a network, the executable code having a service identity associated therewith;

computer program code for executing the executable code; and

computer program code for preventing the executable code from accessing the local services of the mobile device during execution unless the service identity associated with the executable code matches at least one of a plurality of authorized service identities.

12. A computer readable medium as recited in claim 11, wherein said computer readable medium is provided within the mobile device.

13. A computer readable medium as recited in claim 11, wherein the executable code is a compressed markup language file.

14. A computer readable medium as recited in claim 11, wherein the executable code is selected from a group consisting of a markup language file, a script, an applet, an object file, an ASCII file, a binary data file and a scripting language object.

15. A computer readable medium as recited in claim 11, wherein said computer program code for preventing is performed while said computer program code for executing is performed so as to prevent unauthorized access to the local services of the mobile device by any portion of the executable code.

16. A computer readable medium as recited in claim 11, wherein said computer readable medium further comprises:

computer program code for determining whether the executable code seeks access to the local services of the mobile device; and

computer program code for comparing the service identity associated with the executable code against one or more authorized service identities at least when said computer program code for determining determines that the executable code seeks access to the local services of the mobile device.

17. A computer readable medium as recited in claim 16, wherein said computer program code for determining and said computer program code for comparing are performed before said computer program code for executing.

18. A computer readable medium as recited in claim 16, wherein said computer program code for determining and said computer program code for comparing are performed during said computer program code for executing.

19. A computer readable medium having computer program code for ensuring secure access to local services of a mobile device, said computer readable medium comprising:

computer program code for receiving a message from a computer through a network, the message having a service identity associated therewith; and

computer program code for preventing the message from accessing the local services of the mobile device unless the service identity associated with the message matches at least one of a plurality of authorized service identities.

20. A computer readable medium as recited in claim 19, wherein said computer readable medium further comprises:

computer program code for preventing the message from accessing the local services of the mobile device when a connection between the mobile device and the computer on the network that supplies the message is determined to be unsecure.

21. A computer readable medium as recited in claim 19,

wherein said computer readable medium is provided within the mobile device, and

wherein the network is the Internet and where the computer is a server computer coupled to the Internet.

22. A computer readable medium as recited in claim 19, wherein the message comprises provisioning information that causes the local services of the mobile device to update system parameters therein so that the mobile device is provisioned with respect to the provisioning information.

23. A computer readable medium as recited in claim 19, wherein said computer readable medium further comprises:

computer program code for determining whether the message seeks access to the local services of the mobile device; and

computer program code for comparing the service identity associated with the message against one or more authorized service identities at least when said computer program code for determining determines that the message seeks access to the local services of the mobile device.

24. A mobile device capable of connecting to a network of computers through a wireless link, said mobile device comprising:

a display screen that displays graphics and text;

a message buffer that temporarily stores a message from a computer on the network of computers, the message having a service identity associated therewith;

an application that utilizes the message received from the computer on the network of computers;

a local services data area that stores local services data which controls operation of said mobile device;

an authorization storage area that stores authorized service identities that are permitted to access said local services data area;

an access controller that controls access to said local services data area such that the local services data cannot be altered by said application utilizing the message, unless the service identity associated with the message matches at least one of the authorized service identities.

25. A mobile device as recited in claim 24, wherein said application is a browser application that permits a user to retrieve information from the computers on the network.

26. A mobile device as recited in claim 25, wherein said browser application processes the message.

27. A mobile device as recited in claim 24, wherein said authorization storage area stores an access control table, the access control table includes the authorized service identities that are permitted to access said local services data area.

28. A mobile device as recited in claim 27, wherein when the service identity associated with the message does not match at least one of the authorized service identities stored in the access control table, then said access controller can request verification of the service identity of the message from a third-party verification entity located on the network of computers, and then permits access to said local services data area when the third-party verification entity provides verification such that the local services supported by said mobile device can be altered by said application.

29. A mobile device as recited in claim 28, wherein the access control table further includes a third-party verification identity.

30. A mobile device as recited in claim 27, wherein the service identity associated with the message is added to the authorized service identities stored in the access control table when the third-party verification entity provides verification of the service identity associated with the message which did not previously match at least one of the authorized service identities stored in the access control table.

31. A wireless communication system, comprising:

a wired network having a plurality of server computers;

a wireless carrier network operatively connected to said wired network;

a plurality of wireless mobile devices, each supporting certain local services, the certain local services that are used in determining system parameters that are independently set in each of said wireless mobile devices,

wherein messages are supplied to said wireless mobile devices from the server computers of said wired network via said wireless carrier network, and

wherein each of said wireless mobile devices operates, upon receiving one of the messages, to prevent the one of the messages from accessing the system parameters of said each of said wireless mobile devices unless a service identity associated with the one of the messages matches at least one of a plurality of authorized service identities.

32. A system as recited in claim 31, wherein the authorized service entities are stored in said wireless mobile device.

33. A system as recited in claim 31, wherein each of said wireless mobile devices further operates, upon receiving one of the messages, to prevent the one of the messages from accessing the system parameters of said wireless mobile device when a connection between said wireless mobile device and the server computer of said wired network that supplies the one of the messages is determined to be unsecure.

34. A system as recited in claim 31, wherein each of said plurality of wireless mobile devices has an access control table comprising said plurality of authorized service identities.

35. A system as recited in claim 31, wherein said system further comprises:

a proxy server coupled between said wired network and said wireless carrier network, said proxy server responsible for verifying if the one of the messages is from an authorized one of said plurality of server computers.

36. A system as recited in claim 35, wherein each of said plurality of wireless mobile devices has an access control table comprising the plurality of authorized service identities, said access control table being able to be updated by said proxy server when a communication session between said wireless mobile device and said proxy server is secure and authenticated.