System for enforcing security policies on mobile communications devices

• US 8,413,209 B2
• Filed: 03/27/2006
• Issued: 04/02/2013
• Est. Priority Date: 03/27/2006
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: De Lutiis, Paolo, Leone, Manuel, Grillo, Maria Teresa, Aldera, Carlo, Basso, Alessandro, Miraglia, Michele
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US12/225,685
• Publication Number:
  US 20100064341A1
• Time in Patent Office: 2,563 Days
• Field of Search: 726/1, 726/22, 726/23, 726/9, 726/20, 726/21, 713/151, 713/185
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 8/245 from a network towards a terminal
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system for enforcing security policies on mobile communications devices is adapted to be used in a mobile communications network in operative association with a subscriber identity module. The system having a client-server architecture includes a server operated by a mobile communications network operator and a client resident on a mobile communications device on which security policies are to be enforced. The server is adapted to determine security policies to be applied on said mobile communications device, and to send thereto a security policy to be applied. The client is adapted to receive the security policy to be applied from the server, and to apply the received security policy. The server includes a server authentication function adapted to authenticate the security policy to be sent to the mobile communications device; the client is further adapted to assess authenticity of the security policy received from the server by exploiting a client authentication function resident on the subscriber identity module.

Claims

1. A system for enforcing security policies on mobile communications devices, the mobile communications devices being adapted to be used in a mobile communications network in operative association with a subscriber identity module, the system having a client-server architecture and comprising:

a server including a computer operated by a mobile communications network operator; and

a client resident on a mobile communications device on which security policies are to be enforced,

wherein said server is adapted to;

determine security policies to be applied on said mobile communications device;

send thereto a security policy to be applied; and

send to the client a policy apply message instructing the client to apply a specified security policy already stored in the client,

the server comprising a server authentication function adapted to authenticate the security policy to be sent to the mobile communications device; and

wherein the mobile communication device, when instructed by said client, is adapted to;

receive the security policy to be applied from the server;

assess authenticity of the security policy received from the server by exploiting a client authentication function resident on the subscriber identity module; and

apply the received security policy;

the mobile communication device further comprising;

an interface component, which, when the subscriber identity module is executed by the mobile communications device, interacts with the subscriber identity module;

the interface component invoking the client authentication function on the subscriber identity module when the client receives the security policy; and

the client authentication function resident on the subscriber identity module calculating authentication information on the security policy received from the server; and

a manager module, upon receipt from the server of the policy apply message, causes the client to;

invoke the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information; and

pass the specified security policy to an enforcer module for applying the specified security policy.

2. The system of claim 1, wherein said server authentication function is adapted to calculate authentication information adapted to allow assessing the authenticity of the security policy to be sent to the mobile communications device, and to add the authentication information to the security policy to be sent to the mobile communications device.

3. The system of claim 2, wherein said authentication information is also adapted to allow assessing the integrity of the security policy to be sent to the mobile communications device.

4. The system of claim 2, wherein said authentication information comprises at least one of a message authentication code or a digital signature calculated on a block of data corresponding to the security policy to be sent to the mobile communications device.

5. The system of claim 2, wherein said client authentication function is adapted to:

compare calculated authentication information to the authentication information contained in the received security policy.

6. The system of claim 5, wherein the server authentication function is adapted to encrypt said authentication information using a secret cryptographic key shared with the client authentication function, and the client authentication function is adapted to decrypt the authentication information in the security policy received from the server.

7. The system of claim 6, wherein the client comprises a non-transitory computer readable medium for storing:

the manager module, which when executed by the mobile communications device, causes the client to manage messages received from the server;

a local database of security policies to be applied by the mobile communications device; and

an enforcer module, which when executed by the mobile communications device, causes the client to enforce selected security policies on the mobile communications device.

8. The system of claim 7, wherein the manager module, when executed by the mobile communications device, further causes the interface component to invoke the client authentication function upon receipt from the server of a message containing a security policy to be applied, and to store the received security policy in the local database in case the security policy is assessed to be authentic.

9. The system of claim 8, wherein the received security policy is stored with the respective authentication information.

10. The system of claim 1, wherein the specified security policy is stored in the local database.

11. The system of claim 10, wherein the manager module, upon receipt from the server of the policy apply message, causes the client to identify the specified security policy in the local database.

12. The system of claim 7, wherein the server is further adapted to send to the client an update message instructing the client to update a specified security policy already stored in the local database, said update message comprising update information for updating the specified policy, and authentication information calculated by the server authentication function on the updated security policy.

13. The system of claim 12, wherein the manager module, upon receipt from the server of the update message, causes the client to identify the specified security policy in the local database to update the security policy based on the update information, and to invoke the client authentication function for assessing the authenticity of the updated security policy, based on authentication information contained in the update message.

14. The system according to claim 1, wherein the server authentication function is further adapted to authenticate the messages to be sent to the mobile communications device, and the client authentication function is further adapted to assess authenticity of the messages received from the server.

15. The system of claim 14, wherein said server authentication function is adapted to calculate message authentication information adapted to allow assessing the authenticity of the messages sent to the mobile communications device, and to add the message authentication information to the message, and the client authentication function is adapted to exploit the message authentication information to assess the authenticity of the received message.

16. The system of claim 15, wherein said message authentication information comprises at least one of a message authentication code or a digital signature calculated on a block of data corresponding to the security policy to be sent to the mobile communications device.

17. The system of claim 1, wherein the server and the client are adapted to communicate with one another over at least one communications channel selected from the group of:

a messaging service of the mobile communications network, a GPRS connection, a Wi-Fi connection, a Bluetooth connection, a ZigBee connection, an IrDA connection, and a UMTS connection.

18. The system of claim 1, wherein said client authentication function comprises a SIM application toolkit application implemented on the subscriber identity module.

19. The system of claim 1, wherein the server comprises an event collection and management function adapted to collect and manage events from one or both among systems external to the mobile communications device and systems internal to the mobile communications device, and to determine a security policy to be applied on the mobile communications device responsive to collected events.

20. The system of claim 19, wherein the event collection and management function are adapted to interact with one or more platforms selected from the group comprising:

an early detection platform adapted to early detect malware attacks based on anomaly detection;

one or more geographic localization platforms adapted to determine the geographic localization of the mobile communications device;

an anti-fraud system;

an intrusion detection system;

presence detection systems adapted to detect presence within specified areas of a user of the mobile communications device; and

a context awareness platform.

21. The system of claim 1, wherein said security policy comprises at least one security rule to be enforced on the mobile communications device and is formatted in XML.

22. A method of enforcing security policies on mobile communications devices, wherein the mobile communications devices are adapted to be used in a mobile communications network in operative association with a subscriber identity module, comprising:

determining, by a server of the mobile communications network, a security policy to be applied on a mobile communications device, and sending the security policy to the mobile communications device; and

receiving, by the mobile communications device, the security policy and enforcing the security policy;

said sending the security policy comprising authenticating the security policy to be sent to the mobile communications device; and

receiving the security policy and enforcing the security policy comprising;

interacting, by an interface component of the mobile communications device, with a subscriber identity module; and

invoking, by the interface component of the mobile communications device, a client authentication function on the subscriber identity module when the mobile communications device receives the security policy to calculate authentication information on the security policy received from the server; and

the method further comprising;

sending, by the server to the mobile communication device, a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;

invoking, by the mobile communication device, the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information; and

passing, by the mobile communication device, the specified security policy to an enforcer module for applying the specified security policy.

23. A non-transitory computer-readable medium comprising instructions, which when executed by a mobile communications device, cause the mobile communications advice to perform a method comprising:

receiving from a server of a mobile communications network a security policy to be enforced on the mobile communications device;

executing an interface component of a manager module to interact with a subscriber identity module associated with the mobile communications network, the subscriber identity module providing an identification of the mobile communications device with the mobile communications network;

invoking through the interface component of the manager module a client authentication function on the subscriber identity module to calculate authentication information on the security policy, received from the server;

assessing an authenticity of the security policy through the client authentication function on the subscriber identity module; and

applying the authenticated security policy; and

the method further comprising;

receiving a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;

invoking the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information; and

passing the specified security policy to an enforcer module for applying the specified security policy.

24. A non-transitory computer-readable medium comprising instructions, which when executed by a subscriber identity module associated with a mobile communication device, cause the subscriber identity module to perform a method comprising:

interacting with an interface component of the mobile communication device;

receiving a command from the interface component to invoke a client authentication function on the subscriber identity module;

receiving a security policy from a manager module of the mobile communications device;

calculating authentication information on the security policy;

assessing an authenticity of the security policy in response to the command;

indicating to the manager module whether the security policy is authentic;

receiving a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;

invoking the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information; and

passing the specified security policy to an enforcer module for applying the specified security policy.