System and method for initiation of a security update

• US 7,769,175 B2
• Filed: 12/16/2005
• Issued: 08/03/2010
• Est. Priority Date: 11/24/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Wise, Simon T., Patterson, Ian M., Bajar, David
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Kaplan; Benjamin A
• Application Number:
  US11/303,296
• Publication Number:
  US 20060248342A1
• Time in Patent Office: 1,691 Days
• Field of Search: 380/270, 713/182
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

In one embodiment, a scheme is provided for securing a personalized indicium assigned to a mobile communications device. Upon detecting at a mobile communications device that one of a list of criteria have been met, a challenge-and-response procedure is initiated by the mobile communications device. During the challenge-and-response procedure, the mobile communications device and a network node will authenticate the personalized indicium using a shared authentication key.

Claims

1. A mobile communications device, comprising:

a component configured to generate an authentication key for transmitting in a registration request to a network node operable with a wireless network, said authentication key for securing a personalized indicium assigned to said mobile communications device, wherein said personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device;

a component configured to execute a challenge response when challenged by a challenge message from said network node, said challenge response including an authentication value of a challenge string transmitted in said challenge message, wherein said authentication value is created using said authentication key; and

a component configured to initiate a security update with said network node upon detection of one of the mobile communications device requiring a key, the mobile communications device acquiring a new communication channel, the mobile communications device receiving a message whose decoding reveals a descrambling error, before transmitting a message the mobile communications device discovering that it doesn'"'"'t have a scrambling key, the mobile communications device receiving a descrambling error, the mobile communications device receiving an improperly versioned packet, the mobile communications device receiving a packet of which it is not the intended recipient, and the expiry of a timer;

wherein each of said components is stored on a computer-readable storage medium in said mobile communications device.

2. The mobile communications device as recited in claim 1, wherein said wireless network comprises a network selected from the group consisting of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

3. The mobile communications device as recited in claim 1, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

4. The mobile communications device as recited in claim 1, further comprising logic means for ceasing transmission of packets to said network node upon receiving said challenge message.

5. The mobile communications device as recited in claim 4, further comprising logic means for commencing transmission of packets to said network node upon receiving an acknowledgment from said network node that said PIN is legitimately bound to said mobile communications device.

6. A method for securing a personalized indicium assigned to a mobile communications device, comprising:

detecting at a network node that said mobile communications device has requested a security update with said network node, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device, wherein said challenge-response protocol sequence is issued by said mobile communication device based upon one of the mobile communications device requiring a key, the mobile communications device acquiring a new communication channel, the mobile communications device receiving a message whose decoding reveals a descrambling error, before transmitting a message the mobile communications device discovering that it doesn'"'"'t have a scrambling key, the mobile communications device receiving a descrambling error, the mobile communications device receiving an improperly versioned packet, the mobile communications device receiving a packet of which it is not the intended recipient, and the expiry of a timer;

responsive to said detecting, issuing a challenge message to said mobile communications device by said network node, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

based on said challenge response from said mobile communications device, determining at said network node whether said PIN is legitimately bound to said mobile communications device.

7. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 6, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.

8. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 6, further comprising, responsive to said detecting, performing one of dropping packets received from said mobile communications device at said network node and buffering packets received from said mobile communications device at said network node.

9. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 6, further comprising, upon receiving said challenge message from said network node, ceasing to transmit packets by said mobile communications device.

10. A method operable at a mobile communications device for securing a personalized indicium assigned to said mobile communications device, said method comprising:

generating an authentication key for transmitting in a registration request to a network node operable with a wireless network, said authentication key for securing a personalized indicium assigned to said mobile communications device, wherein said personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device;

initiating a security update with said network node upon detection of one of the mobile communications device requiring a key, the mobile communications device acquiring a new communication channel, the mobile communications device receiving a message whose decoding reveals a descrambling error, before transmitting a message the mobile communications device discovering that it doesn'"'"'t have a scrambling key, the mobile communications device receiving a descrambling error, the mobile communications device receiving an improperly versioned packet, the mobile communications device receiving a packet of which it is not the intended recipient, and the expiry of a timer;

responsive to said initiating, receiving a challenge message from said network node, wherein a challenge response is generated by said mobile communications device using an authentication key.

11. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 10, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

12. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 11, wherein said challenge message includes a randomly generated challenge string.

13. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 12, wherein said challenge response includes an authentication value of said challenge string generated by said mobile communications device with its authentication key.

14. The method for securing a personalized indicium assigned to a mobile communications device as recited in claim 13, wherein said network node is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

15. A network system for securing a personalized indicium assigned to a mobile communications device, comprising:

a component configured to receive at a network node a request for a security update from said mobile communications device, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said mobile communications device and wherein said mobile communications device generates said challenge request message upon detection of one of the mobile communications device requiring a key, the mobile communications device acquiring a new communication channel, the mobile communications device receiving a message whose decoding reveals a descrambling error, before transmitting a message the mobile communications device discovering that it doesn'"'"'t have a scrambling key, the mobile communications device receiving a descrambling error, the mobile communications device receiving an improperly versioned packet, the mobile communications device receiving a packet of which it is not the intended recipient, and the expiry timer;

a component configured to issue a challenge message to said mobile communications device responsive to said receiving, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

a component configured to determine at said network node whether said PIN is legitimately bound to said mobile communications device responsive to said challenge response from said mobile communications device;

wherein each of said components is stored on a computer-readable storage medium in said network system.

16. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 15, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

17. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 15, wherein said PIN is mapped to at least one identifier at a database associated with said network node, said at least one identifier comprising at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

18. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 15, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

19. The network system for securing a personalized indicium assigned to a mobile communications device as recited in claim 15, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.