Dynamic security management for mobile communications device

• US 8,272,030 B1
• Filed: 01/21/2009
• Issued: 09/18/2012
• Est. Priority Date: 01/21/2009
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Annan, Brandon C., Jones, John M. III, Indurkar, Dhananjay
• Primary Examiner(s): Smithers, Matthew
• Assistant Examiner(s): Fields, Courtney
• Application Number:
  US12/356,735
• Time in Patent Office: 1,336 Days
• Field of Search: 726/1, 705/26, 709/223
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A method for dynamically changing the security protocol in a hand-held mobile communications device within a network includes providing an application management system in a respective mobile communications device for management of memory use and download functions, providing within the mobile communications device an embedded file system that contains executable files that are controlled by the application management system, providing a browser on the mobile communications device so that a user thereof may access websites available on the network, and providing a policy file that includes a set of rules for managing the download of applications from a remote location, the policy file being enabled to receive authorized updates over the network.

Claims

1. One or more nontransitory computer-readable media having computer-executable instructions for performing a method of dynamically changing the security protocol in a hand-held mobile communications device within a network, said method comprising the steps of:

managing memory use and download functions in a respective mobile communications device with an application management system;

controlling executable files in an embedded file system within said mobile communications device with said application management system, said embedded file system including an updatable policy file that includes a first set of rules for managing the download of applications from a first remote location, wherein the rules are applied, by said application management system, to applications executing on the mobile communications device;

accessing websites available on the network with a browser implemented in said mobile communications;

updating said policy file from a second remote location with a revised set of rules so that an application prevented by said first set of rules from being downloaded is rendered downloadable under said revised set of rules; and

providing a global policy file change, wherein providing a global policy file change includes placing an application descriptor file and a provider policy file on a webserver to provide for downloading of a new policy file.

2. The media according to claim 1 wherein an attribute of said new policy file allows a provider thereof to designate downloadable applications.

3. The media according to claim 2 wherein said updatable policy file includes permissions that are overwritten to allow the downloading of newly designated downloadable applications.

4. The media according to claim 3 wherein a provider trusted signature is required to enable overwrite of said updatable policy file.

5. The media according to claim 1 wherein providing a global policy file change includes launching said device browser to said application descriptor file that contains a provider signature and points to said provider policy text file for a second file download.

6. The media according to claim 5 wherein providing a global policy file change includes enabling said application management system to check for said provider signature to allow replacement of said policy file and downloading of said new policy file.

7. A hand-held mobile communications device for use within a network, said device comprising:

an application management system for managing memory use and download functions;

an embedded file system that contains executable files that are controlled by said application management system;

a browser so that a user may access websites available on the network;

a policy file that includes a set of rules for managing the download of applications from a remote location, said policy file enabled to receive authorized updates over the network, wherein the rules are applied, by said application management system, to applications executing on the mobile communications device; and

an application descriptor file and an archive file, wherein said application descriptor file provides a place for appending a new policy file.

8. The device according to claim 7 wherein said application descriptor file includes an attribute that allows a provider thereof to designate downloadable applications.

9. The device according to claim 8 wherein said policy file includes permissions that are overwritten to allow the downloading of newly designated downloadable applications.

10. The device according to claim 9 wherein a provider trusted signature is required to enable overwrite of said policy file.

11. An improved communications network system, comprising:

a hand-held mobile communications device for use within the network, said device including an application management system for managing memory use and download functions, an embedded file system that contains executable files that are controlled by said application management system, a browser so that a user may access websites available on the network, a policy file that includes a set of rules for managing the download of applications from a remote location, said policy file enabled to receive authorized updates over the network, and an application descriptor file and an archive file, wherein said application descriptor file provides a place for appending a new policy file;

a host server system accessible by said device over the network, said host server system including a selection of on-portal applications that said user may download onto said device, said host server system being maintained by an authorized service provider; and

a website provider server accessible by said device over the network, said website provider server including a selection of off-portal applications that said user may download onto said device after said service provider has updated said policy file in said device so that said off-portal applications are thereby rendered downloadable onto said device.

12. The system according to claim 11 wherein when said user attempts to download an off-portal application that has not been certified by said service provider, said device will display an error message.