Key revocation in a mobile device

• US 7,860,486 B2
• Filed: 10/04/2005
• Issued: 12/28/2010
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Buer, Mark, Frank, Edward H.
• Primary Examiner(s): MEHRPOUR, NAGHMEH
• Application Number:
  US11/243,830
• Publication Number:
  US 20060089126A1
• Time in Patent Office: 1,911 Days
• Field of Search: 455/411, 455/430, 455/450, 455/405, 455/456.6, 455/509, 455/414.1, 455/422.1, 455/410, 455/558, 455/415, 455/412.2, 340/572.4, 340/5.8, 340 581- 586, 710 44- 47, 710/220, 713/158, 713/172, 713/168, 713/186, 713/193, 713/153, 713/150, 713/151, 713/152, 713/155, 726/19, 726/4, 726/26, 726/29, 726/12, 726/13
• US Class Current: 455/410
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72454 according to context-related or environment-related conditions
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A system for revoking access to a mobile device comprises a mobile device providing a plurality of applications and an agent providing a plurality of revocation procedures for revoking access by the mobile device to the plurality of applications running on the mobile device. Access to a first application is revoked by the agent using a first revocation procedure, and access to a second application is revoked by the agent using a second revocation procedure.

Claims

1. A network services revocation system comprising:

a device configured to access a plurality of network-based services, the device further configured to store one or more authentication credentials for authenticating the device, and data associated with an access to a network-based service in the plurality of network-based services;

an agent provided by a network server, the agent configured to provide a plurality of revocation procedures for revoking access to the plurality of network-based services;

wherein the agent is configured to store for each network-based service, an identification of a revocation procedure in the plurality of revocation procedures associated with the network-based service,

wherein the agent is further configured to access the identification of the revocation procedure associated with a requested network-based service and to revoke access to the requested network-based service based on the revocation procedure,

wherein the agent is further configured to prevent re-authentication of the requested network-based service by revoking an authentication credential used for authenticating the device to the requested network-based service, and configured to cause deletion of data associated with previous access to the requested network-based service.

2. The system of claim 1, wherein the agent is configured to revoke access to the requested service to prevent the transmission of data associated with the requested service.

3. The system of claim 1, wherein the plurality of network-based services comprises retrieval and display of e-mail messages as a first service, and modification, forwarding and drafting of e-mail messages as a second service, and downloading and opening attachments to e-mail messages as a third service.

4. The system of claim 1, wherein the agent revokes access to the requested network-based service based on at least one of a failure of a user to enter a first pass code, a failure of the user to enter a second pass code, a failure of the user to biometrically authenticate, a failure to authenticate a geographic location, and/or a failure to meet a certain time requirement.

15. The system of claim 1, wherein a revocation procedure in the plurality of revocation procedures is based on authentication procedures.

5. A system for revoking access to a plurality of network-based services, comprising:

a device configured to access the plurality of network-based services, the device further configured to store one or more authentication credentials for authenticating the device, and data associated with an access to a network-based service in the plurality of network-based services;

an agent provided by a network server, the agent configured to provide a plurality of revocation procedures for revoking access to the plurality of network-based services;

wherein the agent is configured to revoke access to a first one of the plurality of services using a first set of the plurality of revocation procedures;

wherein the agent is further configured to revoke access to a second one of the plurality of services using a second set of the plurality of revocation procedures;

wherein a revocation procedure in the first set of the plurality of revocation procedures is based on authentication procedures; and

wherein the agent is further configured to prevent re-authentication of a revoked network-based service in the plurality of network-based services by deleting an authentication credential stored at the device used for authenticating the device to the revoked network-based service and configured to cause deletion of data associated with previous access to the revoked network-based service.

6. The system of claim 5,

wherein a set of the plurality of network-based services provide data from the network.

7. The system of claim 6, wherein access to a particular one of the plurality of network-based services allows data to be sent between the network and a mobile device.

8. The system of claim 5, wherein the plurality of network-based services comprises e-mail services.

9. The system of claim 8, wherein the plurality of network-based services comprises retrieval and display of e-mail messages as one service, and wherein the plurality of network-based services further comprises modification, forwarding and drafting of e-mail messages as another service.

10. The system of claim 8, wherein the plurality of network-based services comprises downloading and opening attachments to e-mail messages as one service.

11. The system of claim 5, wherein the plurality of revocation procedures comprises a failure of a user to enter a first pass code as one revocation procedure, and a failure of the user to enter a second pass code as another revocation procedure.

12. The system of claim 5, wherein the plurality of revocation procedures comprises a failure of a user to biometrically authenticate.

13. The system of claim 5, wherein the plurality of revocation procedures comprises a failure to authenticate a geographic location of the mobile device.

14. The system of claim 5, wherein the plurality of revocation procedures comprises time based revocation procedures.