Apparatus and methods for protecting data on a wireless device

• US 20060293029A1
• Filed: 05/19/2006
• Published: 12/28/2006
• Est. Priority Date: 05/25/2005
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Jha, Sanjay K., Cassett, Tia Manning, Abdi, Behrooz L., Scott, Clifton Eugene, Fok, Kenny, Chung Yip, Eric Chi
• Granted Patent: US 8,874,082 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04M 3/42178 by downloading data to substation equipment
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

Apparatus, methods, and programs for protecting data on a wireless device may include a wireless device having a computer platform with a processing engine operable, based upon configurable parameters, to log data access attempt on the wireless device and transmit the log to a remote device. Furthermore, the wireless device may be configured to execute locally and remotely generated control commands on the wireless device, the commands operable to modify an operation of the wireless device. The embodiment may also include an apparatus operable to receive the transmitted log, analyze the received log and transmit a control command to the wireless device. The apparatus may further generate a data access report and make the report available to an authorized user.

Claims

1. A wireless communication device, comprising:

a memory comprising protected data and a monitoring and lock management configuration; and

a lock management engine resident in the memory and operable to monitor a protected data access attempt and record data access information based upon execution of the monitoring and lock management configuration.

2. The device of claim 1, wherein the configuration comprises at least one of a tracking parameter, a reporting parameter, a predetermined activity standard and a control command parameter.

3. The device of claim 1, wherein the access information comprises information relating to at least one of when protected data is accessed, a number of access attempts, an input entered during an access attempt, when protected data is changed, and a new content of the protected data.

4. The device of claim 1, wherein the configuration is received by the wireless device from across a wireless network.

5. The device of claim 1, wherein the configuration comprises at least one predetermined tracking parameter and a predetermined activity standard, and wherein the lock management engine is operable to record the data access information based upon the at least one predetermined tracking parameter and to compare the predetermined activity standard to the recorded data access information to determine an authorized data access attempt.

6. The device of claim 1, wherein the configuration comprises a reporting parameter, wherein the lock management engine is operable to transmit the data access information to another predetermined device for analysis based on the reporting parameter.

7. The device of claim 6, wherein the lock management engine is operable to transmit the data access information across a wireless network.

8. The device of claim 1, wherein the data access information comprises at least one of a subscriber identifier, a monitored lock identifier, a data access attempt, and a time associated with the data access attempt.

9. The device of claim 1, wherein the configuration further comprises at least one of a tracking parameter selected from a plurality of tracking parameters and a reporting parameter selected from a plurality of reporting parameters, wherein the tracking parameter identifies protected data to monitor and record, and wherein the reporting parameter identifies when to transmit the recorded data access information across a wireless network.

10. The device of claim 1, wherein the lock management engine is further operable to establish a limited-access communications channel across a wireless network and to transmit the data access information across the limited-access communications channel, wherein the limited-access communications channel is based on at least one predefined data service parameter.

11. The device of claim 10, wherein the limited-access communications channel is not available to an end user of the device.

12. The device of claim 1, further comprising a device control module operable to execute a control command to change an operational characteristic of the wireless device.

13. The device of claim 12, wherein the device control module is operable to receive the control command from across a wireless network.

14. The device of claim 12, wherein the control command is selected from a group consisting of a disable command, an enable command, and a reconfigure command, wherein the disable command is operable to configure the wireless device non-operable for non-emergency communications, wherein the enable command is operable to configure the wireless device operational for communications, and wherein the reconfigure command is operable to set a protected data value.

15. The device of claim 12, wherein the device control module is operable to verify the control command before executing the control command.

16. The device of claim 15, wherein the control command comprises a user identification and a control activity, and wherein the device control module further comprises permission logic operable to determine an authorization for executing the control command based on at least one of the user identification and the control activity.

17. The device of claim 15, wherein the lock management engine is further operable to record information associated with an execution of the control command.

18. The device of claim 1, wherein the protected data comprises at least one of a subscriber identification module (SIM) data, a universal subscriber identification module (USIM) data, a removable user identify module (RUIM) data, and a service programming code (SPC) data.

19. A method of protecting data on a wireless device, comprising:

receiving on a wireless device a monitoring and lock management configuration operable to configure the wireless device to monitor protected data stored thereon;

collecting data access information based on an execution of the configuration on the wireless device; and

transmitting the collected data access information to another device to determine whether or not the data access is authorized.

20. The method of claim 19, further comprising receiving the lock management configuration over the wireless network.

21. The method of claim 19, further comprising:

comparing the collected data access information with a predetermined activity standard; and

generating a control command based upon the comparison of the collected data access information with the predetermined activity standard.

22. The method of claim 19, further comprising:

receiving a control command from another device across the wireless network, wherein the control command is based upon the collected data access information;

validating the control command; and

executing the control command on the wireless device.

23. A wireless device, comprising:

a means for receiving on a wireless device a monitoring and lock management configuration operable to configure the wireless device to monitor protected data stored thereon;

a means for collecting data access information based on an execution of the configuration on the wireless device; and

a means for transmitting the collected data access information to another device to determine whether or not the data access is authorized.

24. A computer-readable medium including instructions stored thereon, comprising:

a first set of the instructions for receiving on a wireless device a monitoring and lock management configuration operable to configure the wireless device to monitor protected data stored thereon;

a second set of the instructions for collecting data access information based on an execution of the configuration on the wireless device; and

a third set of the instructions for transmitting the collected data access information to another device to determine whether or not the data access attempt is authorized.

25. At least one processor configured to perform the actions of:

receiving on a wireless device a monitoring and lock management configuration operable to configure the wireless device to monitor protected data stored thereon;

collecting data access information based on an execution of the configuration on the wireless device; and

transmitting the collected data access information to another device to determine whether or not the data access attempt is authorized.

26. A method of protecting data on a wireless device, comprising:

receiving data access information from a wireless device, based on execution of a monitoring and lock management configuration by the wireless device;

analyzing the received data access information based upon a predetermined standard; and

transmitting a control command to the wireless device, the control command operable to change a predetermined operational functionality of the wireless device based on the analysis.

27. The method of claim 26, further comprising:

generating a data access report based on the data access information and predetermined standards.

28. The method of claim 27, further comprising at least one of transmitting the generated data access report and providing access to the generated data access report to a predetermined entity.

29. The method of claim 28, further comprising receiving the control command from the predetermined entity based upon the data access report.

30. The method of claim 26, further comprising:

generating the monitoring and lock management configuration, which comprises at least one of a control command parameter, a tracking parameter, and a reporting parameter; and

forwarding the configuration to a wireless device across a wireless network.

31. The method of claim 26, further comprising transmitting at least a portion of a programmable lock manager engine to the wireless device across a wireless network.

32. A computer program resident in a computer readable medium that, when executed, directs a computer device to perform the actions of:

receiving data access information from a wireless device, based on execution of a monitoring and lock management configuration by the wireless device;

analyzing the received data access information based upon a predetermined standard; and

transmitting a control command to the wireless device, the control command operable to change a predetermined operational functionality of the wireless device based on the analysis.

33. A data manager module, comprising:

a means for receiving data access information from a wireless device, based on execution of a monitoring and lock management configuration by the wireless device;

a means for analyzing the received data access information based upon a predetermined standard; and

a means for transmitting a control command to the wireless device, the control command operable to change a predetermined operational functionality of the wireless device based on the analysis.

34. An apparatus for protecting data on a wireless device, comprising:

a processor;

a data manager module executable by the processor, the data manager further comprising;

an information repository operable to receive and store data access information collected from the wireless device based upon execution on the wireless device of a monitoring and lock management configuration;

an analyzer operable to generate a data access report based on the access information; and

a remote device control module operable to transmit a control command to the wireless device, the control command operable to generate and send a control command to change an operational characteristic of the wireless device based on at least one of the data access report and the access information.

35. The apparatus of claim 34, wherein the data manager module further comprising a configuration generator operable to generate the monitoring and lock management configuration and transmit the configuration to the wireless device, the configuration defining data-related activities to record on the wireless device, wherein the data-related activities are associated with an access attempt to the protected data on the wireless device.

36. The apparatus of claim 35, wherein the configuration comprises at least one of a tracking parameter, a reporting parameter, a predetermined activity standard and a control command parameter.

37. The apparatus of claim 34, wherein the data manager module is further operable to transmit the configuration across a wireless network.

38. The apparatus of claim 34, wherein the remote device control module is operable to receive and verify the control command from a remote apparatus.

39. The apparatus of claim 38, wherein the remote device control module is operable to verify the control command based on a user identification and at least one control permission.

40. The apparatus of claim 34, wherein the protected data comprises at least one of SIM data, USIM data, RUIM data, and a service programming code (SPC).

41. The apparatus of claim 34, wherein the control command comprises a command to disable the wireless device when at least one of protected data is changed and a predetermined number of attempts to change protected data have been made.

42. The apparatus of claim 34, wherein the analyzer comprises a predetermined activity standard, and wherein the analyzer is operable to compare the data access information to the predetermined activity standard and to generate the data access report.

43. The apparatus of claim 34, wherein the data manager module is further operable to perform at least one of transmitting the generated data access report and providing access to the generated data access report to a predetermined entity.

44. The apparatus of claim 34, wherein the data manager module is further operable to receive a control command from the predetermined entity based on the report.

45. The apparatus of claim 34, wherein the data manager module further comprises a configuration generator that sets the configuration based on receiving a selection of at least one of a plurality of predetermined parameters.

46. The apparatus of claim 45, wherein the predetermined parameters include at least one of a control command parameter, a tracking parameter, and a reporting parameter.

47. The apparatus of claim 34, wherein the control command comprises at least one of a user identifier and a control activity, wherein the device control module is operable to verify at least one of a user and a control activity portion of the control command.