Management of network devices utilizing an authorization token

• US 9,264,413 B2
• Filed: 03/06/2013
• Issued: 02/16/2016
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Zhang, Jiang
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/787,522
• Publication Number:
  US 20140165155A1
• Time in Patent Office: 1,077 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

Aspects of the invention may relate to an apparatus, system, and method for the management of network devices utilizing an authorization token. In one embodiment, an authorization token received from a service provider may be verified using an authorization credential to determine if the service provider is authorized to perform requested operations with the network device. Further, operation privileges may be enforced that are contained in the authorization token.

Claims

1. A network device comprising:

a network interface;

a memory including an authorization credential, the memory being configured in a universal integrated circuit card (UICC); and

a processor configured in the UICC to execute functions including;

specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within the UICC;

commanding a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;

verifying the authorization token received from the mobile network operator using the authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and

enforcing operation privileges contained in the authorization token.

2. The network device of claim 1, wherein the integrated circuit card UICC comprises an embedded universal integrated circuit card (eUICC).

3. The network device of claim 1, wherein the authorization token is generated within the network device based on the authorization credential or outside of the network device based on the authorization credential wherein a device management authority includes a copy of the authorization credential.

4. The network device of claim 3, wherein the device management authority transmits the authorization token to the mobile network operator, if the authorization token is not transmitted to the mobile network operator by the network device.

5. The network device of claim 1, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

6. The network device of claim 1, wherein the services provided by the mobile network operator include at least mobile network connectivity service.

7. The network device of claim 1, wherein the mobile network operator associated with the operation privileges is specified in the authorization token.

8. The network device of claim 1, wherein a validity of the operation privileges is specified in the authorization token.

9. The network device of claim 1, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

10. A method implemented by a network device comprising:

specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within a universal integrated circuit card (UICC) of the network device;

commanding, at the UICC of the network device, a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;

verifying, at the UICC of the network device, the authorization token received from the mobile network operator using an authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and

enforcing, at the UICC of the network device, operation privileges contained in the authorization token.

11. The method of claim 10, wherein the authorization credential is stored in the UICC of the network device or with the device management authority.

12. The method of claim 10, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

13. The method of claim 10, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

14. The method of claim 13, wherein the device management authority transmits the authorization token to the mobile network operator.

15. The method of claim 10, wherein the services provided by the mobile network operator include at least mobile network connectivity service.

16. The method of claim 10, further comprising specifying the mobile network operator that includes the operation privileges in the authorization token.

17. The method of claim 10, further comprising specifying a validity of the operation privileges in the authorization token.

18. The method of claim 10, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

19. A computer program product executed at a network device comprising:

a non-transitory computer-readable medium comprising code for;

specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within a universal integrated circuit card (UICC) of the network device;

commanding, at the UICC of the network device, a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;

verifying, at the UICC of the network device, the authorization token received from the mobile network operator using an authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and

enforcing, at the UICC of the network device, operation privileges contained in the authorization token.

20. The computer program product of claim 19, wherein the authorization credential is stored in the UICC of the network device or with the device management authority.

21. The computer program product of claim 19, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

22. The computer program product of claim 19, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

23. The computer program product of claim 22, wherein the device management authority transmits the authorization token to the mobile network operator.

24. The computer program product of claim 19, wherein the services provided by the mobile network operator include at least mobile network connectivity service.

25. The computer program product of claim 19, further comprising code for specifying the mobile network operator that includes the operation privileges in the authorization token.

26. The computer program product of claim 19, further comprising code for specifying a validity of the operation privileges in the authorization token.

27. The computer program product of claim 19, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.

28. A network device comprising:

means for specifying operation privileges associated with a mobile network operator included in an authorization token, wherein the operation privileges include at least one of loading, deleting, enabling, or disabling a set of data or services of the mobile network operator within a universal integrated circuit card (UICC) of the network device;

means for commanding, at the UICC of the network device, a transmission of the authorization token to a device management authority or to the mobile network operator if authorized by the device management authority;

means for verifying, at the UICC of the network device, the authorization token received from the mobile network operator using an authorization credential to determine if the mobile network operator is authorized to perform requested operations with the network device; and

means for enforcing, at the UICC of the network device, operation privileges contained in the authorization token.

29. The network device of claim 28, wherein the authorization credential is stored in the UICC of the network device or with the device management authority.

30. The network device of claim 28, wherein the authorization credential is at least one of a binary string, a password, a symmetric key, or a public key.

31. The network device of claim 28, wherein the network device generates the authorization token based upon the authorization credential or a device management authority generates the authorization token based upon the authorization credential.

32. The network device of claim 31, wherein the device management authority transmits the authorization token to the mobile network operator.

33. The network device of claim 28, wherein the services provided by the mobile network operator include at least mobile network connectivity service.

34. The network device of claim 28, further comprising means for specifying the mobile network operator that includes the operation privileges in the authorization token.

35. The network device of claim 28, further comprising means for specifying a validity of the operation privileges in the authorization token.

36. The network device of claim 28, wherein the authorization token is a one-time use authorization token or a multiple-time use authorization token.