Secure storage of protected data in a wireless communication device

• US 8,819,447 B2
• Filed: 03/10/2010
• Issued: 08/26/2014
• Est. Priority Date: 03/10/2010
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Shipley, Trevor Daniel, Spanel, Robert L.
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): ZHAO, DON GORDON
• Application Number:
  US12/720,928
• Publication Number:
  US 20110225418A1
• Time in Patent Office: 1,630 Days
• Field of Search: 713189-194, 713/164, 713/166, 726 2- 21
• US Class Current: 713/189
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories

Abstract

A wireless communication device comprises first processing circuitry configured to execute an RF operating system and second processing circuitry configured to execute an open operating system, wherein the first processing circuitry is linked to a secure memory device inaccessible to the second processing circuitry. The RF operating system is configured to receive protected data and store the protected data in the secure memory device. The open operating system is configured to receive a request for the protected data from one of a plurality of user applications and transfer the request to the RF operating system. In response to the request for the protected data, the RF operating system is configured to retrieve the protected data from the secure memory device, encrypt the protected data, and transfer the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

Claims

1. A wireless communication device comprising:

first processing circuitry having a shared secret encryption key hardcoded therein, the first processing circuitry configured to execute a radio frequency (RF) operating system, wherein the first processing circuitry is linked to a secure memory device inaccessible to second processing circuitry and wherein the shared secret encryption key is shared with a communication service provider associated with the wireless communication device;

the second processing circuitry configured to execute an open operating system and a plurality of user applications executing on the open operating system;

the RF operating system configured to receive protected data comprising critical parameters encrypted by the communication service provider using the shared secret encryption key, decrypt the protected data using the shared secret encryption key, and store the protected data in the secure memory device without encryption;

the open operating system configured to receive a request for the protected data from one of the user applications and transfer the request to the RF operating system; and

in response to the request for the protected data, the RF operating system is configured to retrieve the protected data from the secure memory device, encrypt the protected data with the shared secret encryption key to generate encrypted protected data, and transfer the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

2. The wireless communication device of claim 1 wherein the RF operating system configured to encrypt the protected data comprises the RF operating system configured to encrypt the protected data based on receiving the request from the open operating system.

3. The wireless communication device of claim 1 wherein the RF operating system is configured to execute RF operations.

4. The wireless communication device of claim 1 wherein the RF operating system configured to receive the protected data comprises the RF operating system configured to receive the protected data through a wireless communication interface.

5. The wireless communication device of claim 1 wherein the RF operating system configured to receive the protected data comprises the RF operating system configured to receive the protected data transmitted from the communication service provider according to an over-the-air device management protocol.

6. The wireless communication device of claim 1 wherein the RF operating system configured to store the protected data in the secure memory device comprises an input/output (I/O) interface of the RF operating system configured to store the protected data in the secure memory device.

7. The wireless communication device of claim 1 wherein the RF operating system configured to store the protected data in the secure memory device comprises an input/output (I/O) interface of the RF operating system configured to store the protected data in the secure memory device, and wherein the RF operating system configured to retrieve the protected data from the secure memory device comprises the I/O interface configured to retrieve the protected data from the secure memory device.

8. The wireless communication device of claim 1 wherein the RF operating system is configured to receive the request into an application programming interface (API) of the RF operating system.

9. The wireless communication device of claim 8 wherein the RF operating system configured to encrypt the protected data comprises the API configured to encrypt the protected data, and wherein the RF operating system configured to transfer the encrypted protected data to the open operating system comprises the API configured to transfer the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

10. The wireless communication device of claim 1 wherein the first processing circuitry comprises a first core of a dual-core processor and wherein the second processing circuitry comprises a second core of the dual-core processor.

11. A method of operating a wireless communication device, wherein the wireless communication device comprises first processing circuitry and second processing circuitry, the first processing circuitry having a shared secret encryption key hardcoded therein, the first processing circuitry configured to execute a radio frequency (RF) operating system and the second processing circuitry configured to execute an open operating system and a plurality of user applications executing on the open operating system, wherein the first processing circuitry is linked to a secure memory device inaccessible to the second processing circuitry, and wherein the shared secret encryption key is shared with a communication service provider associated with the wireless communication device, the method comprising:

in the RF operating system, receiving protected data comprising critical parameters encrypted by the communication service provider using the shared secret encryption key, decrypting the protected data using the shared secret encryption key, and storing the protected data in the secure memory device without encryption;

in the open operating system, receiving a request for the protected data from one of the user applications and transferring the request to the RF operating system; and

in the RF operating system, in response to the request for the protected data, retrieving the protected data from the secure memory device, encrypting the protected data with the shared secret encryption key to generate encrypted protected data, and transferring the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

12. The method of claim 11 wherein encrypting the protected data comprises encrypting the protected data based on receiving the request from the open operating system.

13. The method of claim 11 wherein the RF operating system is configured to execute RF operations.

14. The method of claim 11 wherein receiving the protected data comprises receiving the protected data through a wireless communication interface.

15. The method of claim 11 wherein receiving the protected data comprises receiving the protected data transmitted from the communication service provider according to an over-the-air device management protocol.

16. The method of claim 11 wherein storing the protected data in the secure memory device comprises an input/output (I/O) interface of the RF operating system configured to store the protected data in the secure memory device.

17. The method of claim 11 wherein storing the protected data in the secure memory device comprises an input/output (I/O) interface of the RF operating system storing the protected data in the secure memory device, and wherein retrieving the protected data from the secure memory device comprises the I/O interface retrieving the protected data from the secure memory device.

18. The method of claim 11 further comprising receiving the request into an application programming interface (API) of the RF operating system.

19. The method of claim 18 wherein encrypting the protected data comprises the API encrypting the protected data, and wherein transferring the encrypted protected data to the open operating system comprises the API transferring the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request.

20. A computer apparatus to operate a wireless communication device, wherein the wireless communication device comprises first processing circuitry and second processing circuitry, the first processing circuitry having a shared secret encryption key hardcoded therein, the first processing circuitry configured to execute a radio frequency (RF) operating system and the second processing circuitry configured to execute an open operating system and a plurality of user applications executing on the open operating system, wherein the first processing circuitry is linked to a secure memory device inaccessible to the second processing circuitry, and wherein the shared secret encryption key is shared with a communication service provider associated with the wireless communication device, the computer apparatus comprising:

the RF operating system configured, when executed by the first processing circuitry, to direct the first processing circuitry to receive protected data comprising critical parameters encrypted by the communication service provider using the shared secret encryption key, decrypt the protected data using the shared secret encryption key, and store the protected data in the secure memory device without encryption;

the open operating system configured, when executed by the second processing circuitry, to direct the second processing circuitry to receive a request for the protected data from one of the user applications and transfer the request to the RF operating system;

the RF operating system configured to direct the first processing circuitry to, in response to the request for the protected data, retrieve the protected data from the secure memory device, encrypt the protected data with the shared secret encryption key to generate encrypted protected data, and transfer the encrypted protected data to the open operating system for delivery to the one of the user applications associated with the request; and

at least one non-transitory computer-readable storage medium storing the RF operating system and the open operating system.