Method and apparatus for monitoring and theft prevention

• US 8,874,077 B2
• Filed: 02/08/2012
• Issued: 10/28/2014
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Bergenwall, Henric
• Primary Examiner(s): SHEDRICK, CHARLES TERRELL
• Application Number:
  US13/368,695
• Publication Number:
  US 20120289193A1
• Time in Patent Office: 993 Days
• Field of Search: 954/10, 955/58, 954/55, 954/261, 455/410, 455/558, 455/455, 455/426.1
• US Class Current: 455/410
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/45 using multiple identity modules
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

There is provided a device comprising a mobile broadband module comprising radio communication means. The device further comprises at least a first SIM for providing user domain services and at least a second SIM for providing service domain services. The second SIM is isolated from an end user of the device. According to an embodiment, the first SIM is associated with the end user of the device, wherein the end user may be associated with a first identity, and wherein the second SIM is associated with a service provider, the service provider being associated with a second identity. A method comprising: identifying which of the first and the second communication paths a command is issued from; and continuing with the command or discontinuing with the command in dependence on the identified path, such that the end user is not able to perform operation on to access the isolated second SIM.

Claims

1. A mobile telephone device, comprising:

a mobile broadband module comprising radio communication means;

at least a first subscriber identity module (SIM) for providing user domain services;

at least a second subscriber identity module (SIM) for providing service domain services, the second SIM being separate, apart and distinct from the first SIM and further being isolated from an end user of the mobile telephone device such that the end user is unable to perform any device operation that requires access to the second SIM;

an application or a component;

a first communication path internal to the mobile telephone device for providing communication between the application or the component and the mobile broadband module; and

a second communication path internal to the mobile telephone device for providing communication between the application or the component and the mobile broadband module, wherein

the first SIM is configured to communicate over at least the first communication path with at least the application or the component, and

the second SIM is configured to communicate over at least the second communication path with at least the application or the component without using the first communication path.

2. The mobile telephone device according to claim 1, wherein

the first SIM is associated with the end user of the mobile telephone device, and

the second SIM is associated with a service provider.

3. The mobile telephone device according to claim 2, wherein communication between the service provider and the mobile telephone device is transparent to the end user of the mobile telephone device.

4. The mobile telephone device according to claim 2, wherein the second SIM enables the service provider to control applications on the mobile telephone device via communication with the mobile telephone device over the radio communication means.

5. The mobile telephone device according to claim 1, further comprising:

a decision processor for determining whether to continue or discontinue with a command by identifying which of the first and the second communication paths the command is issued from, such that the end user is not able to perform operation on to access the isolated second SIM.

6. The mobile telephone device according to claim 1, wherein the first communication path is a first interface and the second communication path is a second interface.

7. The mobile telephone device according to claim 6, wherein the first interface and second interface is a Peripheral Component Interconnect Express, PCIe, interface wherein one of the first and send interface is arranged on the Universal Serial Bus, USB, interface pins and the other is arranged on the System Management Bus, SMBus.

8. The mobile telephone device according to claim 1, wherein the first communication path is a first logical data channel and wherein the second communication path is a second logical data channel.

9. The mobile telephone device according to claim 8, wherein the first and the second logical channels at least are interfacing to virtual components or applications.

10. The mobile telephone device according to claim 1, wherein the second SIM comprises a physical component embedded in the broadband module or in another part of the device, the physical component accommodating a SIM application or virtual SIM component.

11. The mobile telephone device according to claim 10, wherein the physical component of the second SIM is a Universal Integrated Circuit Card, UICC, MCIM or eSIM, embedded on the mobile telephone device or in the broadband module.

12. The mobile telephone device according to claim 1, further comprising a third SIM.

13. The mobile telephone device according to claim 1, wherein the first SIM and the second SIM communicates with the broadband module via at least one internal interface and wherein communication on said internal interface for the first and the second SIM is multiplexed, such that applications and/or components in the mobile telephone device or broadband module can read SIM related information at least sequentially.

14. The mobile telephone device according to claim 1, wherein the radio communication means comprises at least two radio stacks, permitting two user entities being associated with the first and second SIM to be at least attached to a radio network simultaneously.

15. The device according to claim 2, wherein the second SIM is configured to allow the service provider to perform one or more of:

i) continued tracking of the device in the event the device is stolen from the end user and ii) disabling the device in the event the device is stolen from the end user.

16. A method for a device comprising:

(a) a mobile broadband module comprising radio communication means;

(b) at least a first subscriber identity module, SIM, for providing user domain services;

(c) a second subscriber identity module, SIM, separate, apart and distinct from the first SIM, for providing service domain services;

(d) an application or a component;

(e) a first communication path for providing communication between the application or the component and the mobile broadband module;

(f) a second communication path for providing communication between the application or the component and the mobile broadband module, wherein the first SIM communicates over at least the first communication path with the application or the component, and the second SIM communicates over at least the second communication path with the application or the component without using the first communication path, the method comprising;

identifying which of the first and the second communication paths a command is issued from; and

determining whether to continue or discontinue with the command, wherein the determination is dependent on the identified path, such that the end user is not able to perform operation on to access the isolated second SIM.

17. The method according to claim 16, further comprising initially setting up the device prior to performing the identifying step, wherein

the step of initially setting up the device comprises:

downloading the second SIM;

activating the second SIM;

transferring an encrypted command comprising the identity associated with the service domain services; and

enabling a security feature of the service domain services.

18. A method for use in a device comprising:

(a) a mobile broadband module comprising radio communication means;

(b) at least a first subscriber identity module, SIM, for providing user domain services;

(c) a second subscriber identity module, SIM, separate, apart and distinct from the first SIM, for providing service domain services;

(d) an application or a component;

(e) a first communication path for providing communication between the application or the component and the mobile broadband module;

(f) a second communication path for providing communication between the application or the component and the mobile broadband module, wherein the first SIM communicating over the first communication path with the application or the component, and the second SIM communicating over the second communication path with the application or the component without using the first communication path, the method comprising initially setting up the device by;

downloading the second SIM;

activating the second SIM;

transferring an encrypted command comprising an identity of a service provider that provides the service domain services; and

enabling a security feature of the service domain services.

19. The method according to claim 18, further comprising:

in the event the device is stolen from an end user of the device, using the second SIM to perform one or more of;

i) continued tracking of the device and ii) disabling the device.