Secure virtualized mobile cellular device

• US 9,342,331 B2
• Filed: 10/21/2013
• Issued: 05/17/2016
• Est. Priority Date: 10/21/2013
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Verma, Dinesh C, Agrawal, Dakshi, Anthony, Bruce O. Jr., Bisdikian, Chatschik, Srivatsa, Mudhakar
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/058,649
• Publication Number:
  US 20150110270A1
• Time in Patent Office: 939 Days
• Field of Search: 380/247
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 88/12 Access point controller devices

Abstract

Secure virtualizing of a mobile cellular device uses a cellular communication network having base transceiver station edge node servers. A virtualized-instance host server contains a virtualized instance of an enterprise environment. Base station controllers are in communication with and control the base transceiver stations. A mobile switching center in communication with the base station controllers contains the virtualized-instance host server. A cellular communication device is in communication with an edge node server, and an auxiliary data display entry device is in communication with the cellular communication device such that the virtualized instance of the enterprise environment is on the edge node server. Communications between the auxiliary display and data entry device are encrypted. In addition, movement of the cellular communication device within the cellular communication network are anticipated so that additional remote virtualized instances of the enterprise environment are provided on candidate future edge servers.

Claims

1. A method for secure virtualizing of a mobile cellular device, the method comprising:

instantiating a virtualized instance of an enterprise environment comprising at least one enterprise application on a virtualized-instance host server disposed in a computing system, the computing system comprising a cellular communication network wireless cellular communication networking, the cellular communication network comprising a plurality of base transceiver stations, each base transceiver station comprising an edge node server within the cellular communication network, the virtualized-instance host server in communication with each edge node server;

providing an auxiliary data display and data entry device at a wireless communication device comprising a cellular communication device in communication with a current edge node server and the computing system through the wireless networking;

encrypting the virtualized instance of the enterprise environment at the virtualized-instance host server;

predicting pending movement of the cellular communication device based on at least one of a history of movement patterns of the cellular communication device, a current location of the cellular communication device and signaling information received from adjacent edge node servers to the current edge node server;

notifying the virtualized-instance host server of pending movement of the cellular communication device out of a communication range associated with the current edge node server;

identifying from the plurality of base transceiver stations a plurality of candidate future edge node servers having associated communication ranges into which the cellular communication device could travel;

instantiating a remote virtualized instance of the enterprise environment on the current edge node server and each one of the plurality of candidate future edge servers;

delivering the encrypted virtualized instance of the enterprise environment comprising the remote virtualized instance of the enterprise environment from the current edge node server to the auxiliary data display and data entry device through the wireless cellular communication device, wherein only encrypted data pass through the cellular communication device;

decrypting the encrypted virtualized instance of the enterprise environment at the auxiliary data display and data entry device; and

displaying the virtualized instance of the enterprise environment on the auxiliary data display and data entry device.

2. The method of claim 1, wherein the method further comprises:

entering data using the auxiliary data display and data entry device;

encrypting the data at the auxiliary data display and data entry device;

delivering the encrypted data to the virtualized-instance host server through the wireless communication device; and

decrypting the encrypted data at the virtualized-instance host server.

3. The method of claim 2, wherein the method further comprises using the enterprise application to process the data.

4. The method of claim 1, wherein the cellular communication device comprises a smartphone.

6. The method of claim 1, further comprising ranking the plurality of candidate future edge node servers based on a likelihood of movement of the cellular communication device into the communication ranges associated with each one of the candidate future edge node servers.

7. The method of claim 1, wherein the auxiliary data display and data entry device comprises a touch screen display.

8. The method of claim 1, wherein:

providing the auxiliary data display and data entry device further comprises attaching the auxiliary data display and data entry device to the wireless communication device using a tether cable; and

decrypting the encrypted virtualized instance of the enterprise environment at the auxiliary data display and data entry device further comprising decrypting the encrypted virtualized instance of the enterprise environment at the tether cable.

9. The method of claim 1, wherein providing the auxiliary data display and data entry device further comprises installing a secure plug-in in the wireless communication device to utilize an existing display and existing data entry capabilities of the wireless communication device as the auxiliary data display and data entry device.

5. The method of 1, wherein:

the cellular communication network further comprises;

a plurality of base station controllers, each based station controller in communication with and controlling at least one of the plurality of base transceiver stations such that each one of the plurality of base transceiver stations are in communication with and controlled by a base station controller; and

a mobile switching center in communication with each one of the plurality of base station controllers, the virtualized-instance host server disposed in the mobile switching center.

10. A method for secure virtualizing of a mobile cellular device, the method comprising:

instantiating a virtualized instance of an enterprise environment comprising at least one enterprise application on a virtualized-instance host server in a cellular communication network comprising;

a plurality of base transceiver stations, each base transceiver station comprising an edge node server within the cellular communication network, the virtualized-instance host server in communication with each edge node server;

a plurality of base station controllers, each based station controller in communication with and controlling at least one of the plurality of base transceiver stations such that each one of the plurality of base transceiver stations are in communication with and controlled by a base station controller; and

a mobile switching center in communication with each one of the plurality of base station controllers, the virtualized-instance host server disposed in the mobile switching center and in communication with each edge node server;

providing an auxiliary data display and data entry device at a cellular communication device that is in communication with a current edge node server;

using the virtualized-instance host server to instantiate a remote virtualized instance of the enterprise environment on the current edge node server;

delivering the remote virtualized instance from the current edge node server to the auxiliary data display and data entry device through the cellular communication device, wherein only encrypted data pass through the cellular communication device;

displaying the virtualized instance of the enterprise environment on the auxiliary data display and data entry device,

identifying a plurality of candidate future edge node servers having associated communication ranges into which the cellular communication device could travel based on a history of movement of the cellular communication device, the plurality of candidate future edge node servers identified from the plurality of base transceiver stations; and

instantiating a plurality of additional remote virtualized instances of the enterprise environment, each one of the additional remote virtualized instances disposed on one of the plurality of candidate future edge servers.

11. The method of claim 10, wherein the method further comprises:

notifying the virtualized-instance host server of pending movement of the cellular communication device out of a communication range associated with the current edge node server.

12. The method of claim 11, wherein the method further comprises predicting the pending movement of the cellular communication device based on at least one the history of movement patterns of the cellular communication device, a current location of the cellular communication device and signaling information received from adjacent edge nodes to the current edge nodes.

13. The method of claim 11, further comprising ranking the plurality of candidate future edge node servers based on a likelihood of movement of the cellular communication device into the communication ranges associated with each one of the candidate future edge node servers.

14. A system for secure virtualizing of a mobile cellular device, the system comprising:

a cellular communication network comprising;

a plurality of base transceiver stations, each base transceiver station comprising an edge node server within the cellular communication network;

a virtualized-instance host server comprising a virtualized instance of an enterprise environment comprising at least one enterprise application;

a plurality of base station controllers, each based station controller in communication with and controlling at least one of the plurality of base transceiver stations such that each one of the plurality of base transceiver stations are in communication with and controlled by a base station controller; and

a mobile switching center in communication with each one of the plurality of base station controllers, the virtualized-instance host server disposed in the mobile switching center and in communication with each edge node server;

a cellular communication device in communication with a current edge node server, wherein only encrypted data pass through the cellular communication device;

an auxiliary data display and data entry device in communication with and separate from the cellular communication device;

a remote virtualized instance of the enterprise environment on the current edge node server;

a display of the virtualized instance of the enterprise environment on the auxiliary data display and data entry device;

a plurality of candidate future edge node servers having associated communication ranges into which the cellular communication device could travel based on a history of movement of the cellular communication device, the plurality of candidate future edge node servers identified from the plurality of base transceiver stations; and

a plurality of additional remote virtualized instances of the enterprise environment, each one of the additional remote virtualized instances disposed on one of the plurality of candidate future edge servers.

15. The system of claim 14, wherein the system further comprises an encryption and decryption system disposed only on the virtualized-instance host server and the auxiliary data display and data entry device.