Methods and apparatuses for protecting positioning related information

• US 9,946,883 B2
• Filed: 04/11/2014
• Issued: 04/17/2018
• Est. Priority Date: 05/22/2013
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Edge, Stephen William, Wachter, Andreas Klaus
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/250,824
• Publication Number:
  US 20140351886A1
• Time in Patent Office: 1,467 Days
• Field of Search: 713168-174, 713182-186, 713202, 709206, 709225, 709229, 709249, 709389, 726 2- 8
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

Various methods, apparatuses and articles of manufacture are provided which may be implemented to authenticate the provider of a positioning engine provisioned within a mobile station to enable the positioning engine to obtain and use protected positioning assistance data. In certain examples, a relationship between the provider of a location server and the provider of a positioning engine provisioned within a mobile station may be authenticated, and protected positioning data may be obtained from said positioning engine by said location server.

Claims

1. A method comprising, at a mobile station:

exchanging one or more messages with a location server to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine;

receiving said protected positioning assistance data from said location server in response to said authentication of said positioning engine,

providing said protected positioning assistance data to said positioning engine; and

obtaining an estimate of a position of said mobile station utilizing said protected positioning assistance data.

2. The method recited in claim 1, wherein, in authenticating said provider of said positioning engine, an identity for said provider of said positioning engine is authenticated and wherein said identity is associated with a provider with a trust relationship to said provider of said location server.

3. The method recited in claim 2, wherein said identity for said provider is authenticated, at least in part, applying at least one of Message Digest 5 (MD5), Hash Message Authentication Code (HMAC) and Cipher-based Message Authentication Code (CMAC).

4. The method as recited in claim 1 wherein at least one of said one or more messages comprises a Secure User Plane Location (SUPL) INIT, SUPL RESPONSE, SUPL POS INIT and SUPL TRIGGERED RESPONSE message.

5. The method as recited in claim 1, wherein said protected positioning assistance data is indicative of a location of a non-mobile transmitting device.

6. The method as recited in claim 5, wherein said non-mobile transmitting device comprises a wireless wide area network (WWAN) access point (AP), a wireless local area network (WLAN) AP, a wireless personal area network (WPAN) AP, a WiFi AP, a BlueTooth AP or a Femtocell, or a combination thereof.

7. The method as recited in claim 1, wherein said protected positioning assistance data is received via a Secure User Plane Location (SUPL) communication session.

8. The method as recited in claim 1, wherein said protected positioning assistance data is received from a non-mobile transmitting device.

9. The method as recited in claim 8, and further comprising, at said mobile station:

obtaining a deciphering key received from said location server;

acquiring a ciphered broadcast signal transmitted by said non-mobile transmitting device; and

applying said deciphering key to said ciphered broadcast signal to obtain said protected positioning assistance data.

10. The method as recited in claim 1, wherein said protected positioning assistance data corresponds to a trust level selected from a plurality of different trust levels.

11. The method as recited in claim 1, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or a combination thereof.

12. An apparatus for use in a mobile station, the apparatus comprising:

means for exchanging one or more messages with a location server to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising a verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine;

means for receiving said protected positioning assistance data from said location server in response to said authentication of said positioning engine;

means for providing said protected positioning assistance data to said positioning engine; and

means for obtaining an estimate of a position of said mobile station utilizing said protected positioning assistance data.

13. A mobile station comprising:

a positioning engine;

a communication interface; and

a processing unit configured to;

exchange one or more messages with a location server via said communication interface to authenticate said positioning engine, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine;

receive said protected positioning assistance data via said communication interface from said location server in response to said authentication of said positioning engine;

provide said protected positioning assistance data to said positioning engine; and

obtain an estimate of a position of said mobile station utilizing said protected positioning assistance data.

14. The mobile station as recited in claim 13, wherein, to authenticate said provider of said positioning engine, an identity for said provider of said positioning engine is authenticated and wherein said identity is associated with a provider with a trust relationship to said provider of said location server.

15. The mobile station as recited in claim 14, wherein said identity for said provider is authenticated, at least in part, via application of at least one of Message Digest 5 (MD5), Hash Message Authentication Code (HMAC) and Cipher-based Message Authentication Code (CMAC).

16. The mobile station as recited in claim 13, wherein at least one of said one or more messages comprises a Secure User Plane Location (SUPL) INIT, SUPL RESPONSE, SUPL POS INIT and SUPL TRIGGERED RESPONSE message.

17. The mobile station as recited in claim 13, wherein said protected positioning assistance data is indicative of a location of a non-mobile transmitting device.

18. The mobile station as recited in claim 17, wherein said non-mobile transmitting device comprises a wireless wide area network (WWAN) access point (AP), a wireless local area network (WLAN) AP, a wireless personal area network (WPAN) AP, a WiFi AP, a BlueTooth AP or a Femtocell, or a combination thereof.

19. The mobile station as recited in claim 13, wherein said protected positioning assistance data is received via said communication interface in a Secure User Plane Location (SUPL) communication session.

20. The mobile station as recited in claim 13, wherein said protected positioning assistance data is received from a non-mobile transmitting device via said communication interface.

21. The mobile station as recited in claim 20, said processing unit configured to further:

obtain a deciphering key received from said location server via said communication interface;

obtain a ciphered broadcast signal transmitted by said non-mobile transmitting device via said communication interface; and

apply said deciphering key to said ciphered broadcast signal to obtain said protected positioning assistance data.

22. The mobile station as recited in claim 13, wherein said protected positioning assistance data corresponds to a trust level selected from a plurality of different trust levels.

23. The mobile station as recited in claim 13, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or a combination thereof.

24. An article comprising:

a non-transitory computer readable medium having stored therein computer implementable instructions executable by a processing unit in a mobile station, comprising;

code to participate in an exchange of one or more messages with a location server to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine;

code to obtain said protected positioning assistance data received from the location server in response to said authentication of said positioning engine;

code to provide said protected positioning assistance data to said positioning engine; and

code to obtain an estimate of a position of said mobile station utilizing said protected positioning assistance data.

25. A method comprising, at a location server:

exchanging one or more messages with a mobile station to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine;

in response to said authentication of said positioning engine, enabling said mobile station to obtain said protected positioning assistance data for said positioning engine by communicating said protected positioning assistance data to said mobile station, said mobile station utilizing said protected positioning assistance data to obtain an estimate of a location of said mobile station.

26. The method as recited in claim 25, and further comprising, at the location server:

authenticating said positioning engine based, at least in part, on authenticating an identity for said provider of said positioning engine and determining that said identity is associated with a provider with a trust relationship to said provider of said location server.

27. The method as recited in claim 26, wherein said authenticating said identity for said provider of said positioning engine comprises using at least one of:

a Message Digest 5 (MD5), a Hash Message Authentication Code (HMAC), or a Cipher-based Message Authentication Code (CMAC).

28. The method as recited in claim 25, wherein at least one of said one or more messages comprises a Secure User Plane Location (SUPL) INIT message, a SUPL RESPONSE message, a SUPL POS INIT message, or a SUPL TRIGGERED RESPONSE message.

29. The method as recited in claim 25, wherein said protected positioning assistance data is indicative of a location of a non-mobile transmitting device.

30. The method as recited in claim 29, wherein said non-mobile transmitting device comprises:

a wireless wide area network (WWAN) access point (AP), a wireless local area network (WLAN) AP, a wireless personal area network (WPAN) AP, a WiFi AP, a BlueTooth AP or a Femtocell, or a combination thereof.

31. The method as recited in claim 25, wherein said protected positioning assistance data is transmitted via a Secure User Plane Location (SUPL) communication session.

32. The method as recited in claim 25, wherein enabling said mobile station to obtain said protected positioning assistance data further comprises:

providing a deciphering key to said mobile station, said deciphering key for use in deciphering a ciphered broadcast signal comprising said protected positioning assistance data.

33. The method as recited in claim 32, wherein said ciphered broadcast signal is acquired by said mobile station from a non-mobile transmitting device.

34. The method as recited in claim 33, wherein enabling said mobile station to obtain said protected positioning assistance data further comprises:

transmitting said protected positioning assistance data to said non-mobile transmitting device for use in said ciphered broadcast signal.

35. The method as recited in claim 34, wherein said protected positioning assistance data has been ciphered by said location server.

36. The method as recited in claim 25, wherein enabling said mobile station to obtain said protected positioning assistance data further comprises:

transmitting a message to a device, said message indicating that said mobile station is to receive said protected positioning assistance data from said device.

37. The method as recited in claim 36, wherein said device comprises a non-mobile transmitting device.

38. The method as recited in claim 25, wherein said protected positioning assistance data corresponds to a trust level selected from a plurality of different trust levels.

39. The method as recited in claim 25, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or a combination thereof.

40. An apparatus for use in a location server, the apparatus comprising:

means for exchanging one or more messages with a mobile station to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine; and

means for enabling said mobile station to obtain said protected positioning assistance data for said positioning engine, in response to said authentication of said positioning engine, by transmitting said protected positioning assistance data to said mobile station, said mobile station utilizing said protected positioning assistance data to obtain an estimate of a location of said mobile station.

41. A location server comprising:

a communication interface; and

a processing unit configured to;

initiate an exchange of one or more messages with a mobile station, via said communication interface, to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine; and

in response to said authentication of said positioning engine, enable said mobile station to obtain said protected positioning assistance data for said positioning engine and

initiate transmission of said protected positioning assistance data, via said communication interface, to said mobile station, wherein said mobile station to utilize said protected positioning assistance data to obtain an estimate of a location of said mobile station.

42. The location server as recited in claim 41, said processing unit configured to further:

authenticate said positioning engine based, at least in part, on authenticating an identity for said provider of said positioning engine and determining that said identity is associated with a provider with a trust relationship to said provider of said location server.

43. The location server as recited in claim 42, said processing unit further configured to authenticate said identity of said positioning engine based, at least in part, on at least one of:

a Message Digest 5 (MD5), a Hash Message Authentication Code (HMAC), or a Cipher-based Message Authentication Code (CMAC).

44. The location server as recited in claim 41, wherein at least one of said one or more messages comprises a Secure User Plane Location (SUPL) INIT message, a SUPL RESPONSE message, a SUPL POS INIT message, or a SUPL TRIGGERED RESPONSE message.

45. The location server as recited in claim 41, wherein said protected positioning assistance data is indicative of a location of a non-mobile transmitting device.

46. The location server as recited in claim 44, wherein said non-mobile transmitting device comprises:

a wireless wide area network (WWAN) access point (AP), a wireless local area network (WLAN) AP, a wireless personal area network (WPAN) AP, a WiFi AP, a BlueTooth AP or a Femtocell, or a combination thereof.

47. The location server as recited in claim 41, wherein said protected positioning assistance data is transmitted via said communication interface in a Secure User Plane Location (SUPL) communication session.

48. The location server as recited in claim 41, said processing unit to:

provide a deciphering key to said mobile station via said communication interface, said deciphering key for use in deciphering a ciphered broadcast signal comprising said protected positioning assistance data.

49. The location server as recited in claim 48, wherein said ciphered broadcast signal is acquired by said mobile station from a transmitter device.

50. The location server as recited in claim 49, said processing unit to:

initiate transmission of said protected positioning assistance data, via said communication interface, to said transmitter device for use in said ciphered broadcast signal.

51. The location server as recited in claim 50, wherein said protected positioning assistance data has been ciphered by said location server.

52. The location server as recited in claim 41, said processing unit to:

initiate transmission of a message to a device, via said communication interface, said message indicating that said mobile station is to receive said protected positioning assistance data from said device.

53. The location server as recited in claim 52, wherein said device comprises a transmitter device.

54. The location server as recited in claim 41, wherein said protected positioning assistance data corresponds to a trust level selected from a plurality of different trust levels.

55. The location server as recited in claim 41, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or a combination thereof.

56. An article comprising:

a non-transitory computer readable medium having stored therein computer implementable instructions executable by a processing unit in a location server, to;

initiate an exchange of one or more messages with a mobile station to authenticate a positioning engine provisioned within said mobile station, wherein said positioning engine is authenticated independently of an authentication of said mobile station, authentication of said positioning engine comprising verification that a provider of said positioning engine and a provider of said location server agree to allow for provision of protected positioning assistance data from said location server for use by said positioning engine; and

enable said mobile station to obtain said protected positioning assistance data for said positioning engine, in response to said authentication of said positioning engine by transmitting said protected positioning assistance data to said mobile station, wherein said mobile station to utilize said protected positioning assistance data to obtain an estimate of a location of said mobile station.

57. A method comprising, at a mobile station:

exchanging one or more messages with a location server to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station;

obtaining protected positioning data generated by or from said positioning engine; and

transmitting said protected positioning data to said location server.

58. The method as recited in claim 57, wherein at least one of said one or more messages is configured to authenticate an identity of said provider of said positioning engine, an identity of said provider of said location server, or a combination thereof.

59. The method as recited in claim 57, wherein said protected positioning data is indicative of at least one of a location of a non-mobile transmitting device or a location of said mobile station.

60. The method as recited in claim 57, wherein said protected positioning data is transmitted via a Secure User Plane Location (SUPL) communication session.

61. The method as recited in claim 57, wherein at least one of said one or more messages is indicative of an authentication request, an authentication response, a trust relationship, or some combination thereof.

62. An apparatus for use in a mobile station, the apparatus comprising:

means for exchanging one or more messages with a location server to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station;

means for obtaining protected positioning data generated by or from said positioning engine; and

means for transmitting said protected positioning data to said location server.

63. A mobile station comprising:

a positioning engine;

a communication interface; and

a processing unit configured to;

exchange one or more messages with a location server to authenticate a relationship between a provider of said location server and a provider of said positioning engine, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station;

obtain protected positioning data generated by or from said positioning engine; and

transmit said protected positioning data to said location server via said communication interface.

64. The mobile station as recited in claim 63, wherein at least one of said one or more messages is configured to authenticate an identity of said provider of said positioning engine, an identity of said provider of said location server, or a combination thereof.

65. The mobile station as recited in claim 63, wherein said protected positioning data is indicative of at least one of a location of a non-mobile transmitting device or a location of said mobile station.

66. The mobile station as recited in claim 63, wherein said protected positioning data is transmitted via a Secure User Plane Location (SUPL) communication session.

67. The mobile station as recited in claim 63, wherein at least one of said one or more messages is indicative of an authentication request, an authentication response, a trust relationship, or some combination thereof.

68. An article comprising:

a non-transitory computer readable medium having stored therein computer implementable instructions executable by a processing unit in a mobile station, comprising;

code to exchange one or more messages with a location server to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station;

code to obtain protected positioning data generated by or from said positioning engine; and

code to initiate transmission of said protected positioning data to said location server.

69. A method comprising, at a location server:

exchanging one or more messages with a mobile station to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station; and

receiving protected positioning data obtained from said positioning engine.

70. The method as recited in claim 69, wherein at least one of said one or more messages is configured to authenticate an identity of said provider of said positioning engine, an identity of said provider of said location server, or a combination thereof.

71. The method as recited in claim 69, wherein said protected positioning data is indicative of at least one of a location of a non-mobile transmitting device, or a location of said mobile station.

72. The method as recited in claim 69, wherein said protected positioning data is received via a Secure User Plane Location (SUPL) communication session.

73. The method as recited in claim 69, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or a combination thereof.

74. An apparatus for use in a location server, the apparatus comprising:

means for exchanging one or more messages with a mobile station to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station; and

means for receiving protected positioning data obtained from said positioning engine.

75. A location server comprising:

a communication interface; and

a processing unit configured to;

initiate an exchange of one or more messages with a mobile station, via said communication interface, to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station; and

obtain protected positioning data received from said positioning engine via said communication interface.

76. The location server as recited in claim 75, wherein at least one of said one or more messages is configured to authenticate an identity of said provider of said positioning engine, an identity of said provider of said location server, or a combination thereof.

77. The location server as recited in claim 75, wherein said protected positioning data is indicative of at least one of a location of a non-mobile transmitting device, or a location of said mobile station.

78. The location server as recited in claim 75, wherein said protected positioning data is received via a Secure User Plane Location (SUPL) communication session.

79. The location server as recited in claim 75, wherein at least one of said one or more messages is indicative of:

an authentication request, an authentication response or a trust relationship, or combination thereof.

80. An article comprising:

a non-transitory computer readable medium having stored therein computer implementable instructions executable by a processing unit in a location server, comprising;

code to provide an exchange of one or more messages with a mobile station to authenticate a relationship between a provider of said location server and a provider of a positioning engine provisioned within said mobile station, said provider of said positioning engine being different from a provider of said mobile station and wherein said authentication of said relationship between said provider of said location server and said provider of said positioning engine is independent of an authentication of said mobile station; and

code to obtain protected positioning data received from said positioning engine.