System and method for securing a personalized indicium assigned to a mobile communications device

• US 7,961,883 B2
• Filed: 11/24/2004
• Issued: 06/14/2011
• Est. Priority Date: 11/24/2004
• Status: Expired due to Fees

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Whittington, Graeme, Gao, Wen, Bajar, David, Lewis, Allan David, Plumb, Marc, Adams, Neil Patrick, Godfrey, James, Little, Herb A., Brown, Michael Kenneth
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Kaplan; Benjamin A
• Application Number:
  US10/996,702
• Publication Number:
  US 20060111080A1
• Time in Patent Office: 2,393 Days
• Field of Search: 713/182, 380/270
• US Class Current: 380/270
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

In one embodiment, a scheme is provided for securing a personalized indicium assigned to a mobile communications device. Upon detecting at a network node that an address associated with the mobile communications device has changed, a challenge-and-response procedure is negotiated between the mobile communications device and the network node for authenticating the personalized indicium using a shared authentication key.

Claims

1. A method for securing a Personal Information Number (PIN) that is mapped to at least one identifier associated with a mobile communications device, the method comprising:

detecting, at a network node that comprises a data structure mapping said PIN to an address associated with said mobile communications device, that said address has changed;

responsive to said detecting, issuing a challenge message to said mobile communications device by said network node, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

based on said challenge response from said mobile communications device, determining at said network node whether said PIN is legitimately bound to said mobile communications device.

2. The method as recited in claim 1, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

3. The method as recited in claim 1, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

4. The method as recited in claim 1, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network node via a registration request.

5. The method as recited in claim 1, wherein said challenge message includes a randomly generated challenge string.

6. The method as recited in claim 5, wherein said challenge response includes an authentication value of said challenge string generated by said mobile communications device with its authentication key.

7. The method as recited in claim 6, wherein said network node is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

8. The method as recited in claim 1, further comprising, responsive to said detecting, performing one of dropping packets received from said mobile communications device at said network node and buffering packets received from said mobile communications device at said network node.

9. The method as recited in claim 1, further comprising, upon receiving said challenge message from said network node, ceasing to transmit packets by said mobile communications device.

10. The method as recited in claim 9, further comprising, responsive to receiving an acknowledgment from said network node that said PIN is legitimately bound to said mobile communications device, commencing transmission of packets by said mobile communications device.

11. The method as recited in claim 1, wherein said address comprises an Internet Protocol (IP) address assigned to said mobile communications device.

12. The method as recited in claim 11, wherein said network node includes a packet router structure operable to maintain data structure that is interrogated to detect any changes in said IP address.

13. The method as recited in claim 11, wherein said IP address is dynamically assigned to said mobile communications device.

14. A network node for securing a personalized indicium assigned to a mobile communications device (MCD), comprising:

a component that is configured to register said MCD with a network, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said MCD;

a component that is configured to maintain a mapping between said PIN assigned to said MCD and an address associated with said MCD;

a component that is configured to detect that said address mapped to said PIN has changed;

a component that is configured to issue a challenge message to said MCD responsive to said detection, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

a component that is configured to determine whether said PIN is legitimately bound to said MCD based on said challenge response from said mobile communications device.

15. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 14, wherein said network node is operable with a wireless packet data service network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

16. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 14, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

17. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 14, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network via a registration request.

18. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 14, wherein said challenge message includes a randomly generated challenge string.

19. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 18, wherein said challenge response includes an authentication value of said challenge string.

20. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 19, wherein said component that is configured to determine is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

21. The network node for securing a personalized indicium assigned to a mobile communications device as recited in claim 14, further comprising a component that is configured, responsive to said detecting, to perform one of dropping packets received from said mobile communications device and buffering packets received from said mobile communications device.

22. A computer readable storage medium containing instructions executed by a processor of a network node for securing a personalized indicium assigned to a mobile communications device (MCD), said computer readable medium comprising:

instructions that register said MCD with a network operable with said network node, wherein said mobile communications device'"'"'s personalized indicium comprises a Personal Information Number (PIN) that is mapped to at least one identifier associated with said MCD;

instructions that maintain a mapping between said PIN and an address associated with said MCD;

instructions that detect that said address has changed;

instructions that issue a challenge message to said MCD responsive to said detection, wherein a challenge response is operable to be generated by said mobile communications device using an authentication key; and

instructions that determine whether said PIN is legitimately bound to said MCD based on said challenge response from said mobile communications device.

23. The computer readable storage medium as recited in claim 22, wherein said network is a network comprising one of a General Packet Radio Service (GPRS) network, an Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE) network, a 3rd Generation (3G) network, an Integrated Digital Enhanced Network (IDEN), a Code Division Multiple Access (CDMA) network and a Universal Mobile Telecommunications System (UMTS) network.

24. The computer readable storage medium as recited in claim 22, wherein said at least one identifier comprises at least one of an International Mobile station Equipment Identity (IMEI) parameter, an International Mobile Subscriber Identity (IMSI) parameter, an Electronic Serial Number (ESN) parameter and a Mobile Identification Number (MIN) parameter.

25. The computer readable storage medium as recited in claim 22, wherein said authentication key is generated by a logic structure of said mobile communications device and registered with said network via a registration request.

26. The computer readable storage medium as recited in claim 22, wherein said challenge message includes a randomly generated challenge string.

27. The computer readable storage medium as recited in claim 26, wherein said challenge response includes an authentication value of said challenge string.

28. The computer readable storage medium as recited in claim 27, wherein said instructions for determining is operable to determine whether said PIN is legitimately bound to said mobile communications device by verifying said authentication value in said challenge response.

29. The computer readable storage medium as recited in claim 22, further comprising instructions, responsive to said detecting, for performing one of dropping packets received from said mobile communications device at said network node and buffering packets received from said mobile communications device at said network node.