WO2003058880A1

WO2003058880A1 - Method at access right control within mobile communication

Info

Publication number: WO2003058880A1
Application number: PCT/SE2002/002424
Authority: WO
Inventors: Jonas Eriksson; Rolf KÅWE
Original assignee: Telia Ab (Publ)
Priority date: 2002-01-10
Filing date: 2002-12-20
Publication date: 2003-07-17
Also published as: SE0200061L; SE0200061D0; EP1466438A1; AU2002359203A1; SE519072C2; NO20042773L

Abstract

The present invention related to a method in a mobile radio communication system with mobile units and connected service providers who provide services over said communication system, where the access from a mobile terminal of a service at a service provider requires a password. The method includes the steps to: - from a service provider, or by him/her appointed certificate authority, electronically transmit/send a password policy to a mobile unit, - in a mobile unit electronically receive said policy and handle and create/configure password connected/associated with said service provider according to rules specified in, the from the service provider or by him/her appointed certificate authority, said policy. The method also includes that the mobile unit or a specific gateway authenticates and authorizes the transmitter/sender of the policy in order to prevent illegal utilization of the possibility to change a policy.

Description

METHOD AT ACCESS RIGHT CONTROL WITHIN MOBILE COMMUNICATION

TECHNICAL FIELD The present invention relates to the field access right control within mobile communication systems.

PRIOR ART

There is a number of connections/situations within a mobile radio communication system with mobile units and connected units which provide services over said communication systems, where the access from a mobile terminal of a service at such a service provider requires a password for access right control/check in a mobile unit for access to different functions, data files or for use of encryption keys. These passwords frequently can be changed by the user. Usually there is a need for certain restrictions regarding among other things configuration and validity for these passwords.

In the patent document WO 01/35685 a system to deliver a PIN-code (PIN = Personal Identification Number) to a mobile terminal by means of an SMS-message (SMS = Short Message Service) is described. The system makes it possible that a SIM-card (SIM = Subscriber Identity Module) is equipped with a PIN-code after the card having been delivered to customer .

In the patent document US 6,202,157 a system to distribute and execute a policy for password in a network for data communication is described.

In the patent document US 4,924,514 a device for handling of encryption keys is described. Control vectors control the handling of the keys at which the cryptographic facility is given possibility to change its policy. The invention is among other things based on the knowledge of the inventors about that there usually is a need to put a policy into practice about which codes that can be selected. In order to today apply a policy for password, which is connected to local functions in the mobile unit, is required that this policy in entered into the mobile unit or additional units, for instance a smart card at, or just before, distribution of these units.

Both mobile operators and banks are interested in, and are working on, solutions where a user shall be authenticated (be identified to have declared/stated identity) and by his/her mobile unit create digital signatures which cannot be rejected. Typically the mobile unit consists of a mobile telephone with one or more so called smart cards. The mobile unit (or usually a smart card in the mobile unit) in its turn contains one or more private keys, which can be used for authentication and to create "non-rejection" only when a CA (Certificate Authority) has issued certificate which verifies that a specific user holds these private keys .

The use of the private keys are all but always protected by a password, which users often have possibility to change or select themselves. CA has in many cases points of view on which rules that shall apply for which passwords a user is allowed to select. CA then has what is generally called a password policy. The password policy can for instance apply to rules regarding length, allowed characters and updating intervals. Such a policy only has been possible to apply to the cases where it already at the issuing of the card has been made clear which CA that shall issue the certificate connected/associated to the keys on the card. In the mobile case, the smart card often will be distributed to the user before anyone knows what CA that shall issue the certificate connected/associated to pair of keys on the card; so the method of entering/applying CA's password policy on the card before it is distributed to the user is not applicable.

SUMMARY OF THE INVENTION

The aim of the invention is to provide a method to electronically distribute a password policy over a mobile communication system to a mobile unit so that said policy directly can start being applied in the mobile unit or an additional unit. The invention consequently includes a method within a mobile radio communication system with mobile units and connected service providers who provide services over said communication system, where the access from a mobile terminal of a service at a service provider requires a password. The method includes the steps to:

- from a service provider, or by him/her appointed certificate authority, electronically transmit a password policy to a mobile unit;

- in a mobile unit electronically receive said policy and handle and draw up/configure passwords associated with/to said service provider according to rules specified in the from the service provider or by him/her appointed certificate authority, said issued/transmitted policy. The method also includes that the mobile unit or a specific gateway authenticates and authorizes the sender of the policy in order to prevent illegal utilization of the possibility to change a policy.

BRIEF DESCRIPTION OF THE DRAWINGS The invention will be described more in detail in the following, with references to enclosed drawings, in which: Figure 1 shows an administration route/path according to one embodiment of the invention for PIN-policy. Figure 2 shows an administration route/path for PIN-policy according to another embodiment of the invention; and Figure 3 shows a flow chart for a method according to the invention .

Figure 4A and 4B show schematically the location/placing of authentication and authorization units according to two embodiments of the invention.

DESCRIPTION OF PREFERRED EMBODIMENTS

One embodiment of the invention relates to a method to distribute a password in form of a PIN-policy for cryptographic keys in mobile units "over the air", that is via the communication system in which the unit is intended to operate. The keys are in the typical case held/kept in a device/smart card in the mobile unit which cannot be juggled with, but it is not necessary. The cryptographic keys are in the typical case private keys in asymmetric pair of keys. The cryptographic keys, or the unit in which these are generated, have been distributed to the user already before it is known which party that will issue certificate which associates/connects the user to a certain pair of keys .

When a CA shall issue a certificate, the user is linked/associated to a private key in usual way via an "over the air proof of possession"-procedure . Before, after or during this procedure CA distributes its PIN-policy via the cellular mobile communication system to the mobile unit which holds/contains the private key. An application in the mobile unit attends to that the PIN-policy comes into force, and forces the user to select a PIN-code according to the policy for utilization of the certified key. In Figure 1 the flow is illustrated:

1. CA 101 has decided to distribute its PIN-policy to a certain mobile unit. 2. CA addresses the PIN-policy to a certain mobile unit and a certain private key in the mobile unit 115 and transmits/sends this to a gateway 105 for the purpose. This gateway 105 authenticates CA 101 and decides whether CA 101 is entitled to distribute a PIN-policy to the mobile unit 115 (authorization) . Said gateway 105 is preferably arranged at the operator of the mobile communication system.

3. Gateway 105 sends/transmits the PIN-policy further over the mobile communication network 110.

4. The mobile unit 115 receives the PIN-policy, secures that it is coming from the mobile operator' s gateway

105, and activates the policy for key in question. If the user since before has a PIN-code which does not fulfil the policy, he/she is requested to select a new PIN-code according to the policy. 5. Alternatively, when the user changes PIN-code next time, it has to fulfill the requirements in the PIN- policy.

Step 1 is preferably preceded by an inquiry from the client/user to CA about issuing of a client certificate. A password policy preferably includes rules about, in the general case:

- number of characters/symbols (min . , max.) prohibited characters/symbols - prohibited combination of characters/symbols intervals for how often change of password has to be done (for instance the number of times a password is allowed to be used) . The policy of course can be general for all users, but also "personalized", for instance include controls of that a certain user does not utilizes his/her personal code number as PIN etc.

In one embodiment a PIN-policy consists of a data structure which is interpreted by an application for the purpose which has been arranged in the mobile unit. In another embodiment a PIN-policy is realized as an executable application which is transmitted to the mobile unit. In the first case it is conceivable that a plurality of PIN-polices can be active at the same time, but some mechanism to solve conflicting policies, if any, then is needed.

The mobile unit 115 then preferably includes one or more integrated or removable smart cards or any other form of device which is protected against manipulations. The invention of course is applicable also in the cases when the private key is not stored in a device which is protected against manipulation, but in any other way in the mobile unit.

In one embodiment the specific gateway which is mentioned in step 2 does not exist, compare Figure 2. Instead CA 201 transmits its policy via a general traffic gateway for the mobile communication network (GGSN for GPRS/UMTS) 210, without mechanisms for authentication and authorization of CA 201. In this embodiment mechanisms for authentication and authorization are instead implemented in the mobile unit 215

In Figure 3 the method steps corresponding to the distribution path in Figure 1 and Figure 2 are shown. CA creates 310 a policy specification, and addresses 320 a mobile unit and addresses 330 a private key within said mobile unit. Further, the specification is transmitted 340 over the mobile network, possibly via a specific gateway as has been mentioned above. The specification is received 350 and the transmitter/sender is authenticated 360, respective, whenever applicable, authorized 370. Depending on the number of units between CA and mobile unit which need own authentication and authorization, the steps to transmit 340, receive 350, authenticate 360 and authorize 370 are repeated 375. Finally, the policy is stored and activated in the mobile station.

Of course in alternative embodiments other parties than CA can load down a PIN-policy. Particularly in one embodiment the operator of the mobile communication service is capable of loading down his/her PIN-policy to the mobile units in his/her network.

PIN-policy for other purposes than unlocking/use of private keys of course also can be distributed to the mobile unit according to the invention. For instance PIN- codes and passwords for: use of symmetrical keys - write/read rights to/of data files

- GSM execution of applications etc.

In the case there are more than one CA (we call these A respective B) which certifies the same key, the following method is an embodiment of the invention:

Both A and B can load down its policy to the mobile unit. Both policy from CA A and a policy from CA B are put into practice each time PIN is changed. This requires a mechanism in the mobile unit to solve conflicting demands.

- Both A and B sends/transmits its policy to the operator of the mobile communication network. The operator creates a "summing up" of these rules and decides about which policy that finally is transmitted to the mobile unit.

Both A and B can load down its policy to the mobile unit. Separate PINs are used for the same key depending on which of his/her certificates the user wants to refer to. Policy from CA A applies when the user refers to his/her certificate from CA A, and policy from CA B applies when the user refers to his/her certificate from CA B.

In Figure 4 A and B are shown how units for authentication and authorization have been arranged in preferred embodiments. Fig. 4A shows an authentication unit 402 and an authorization unit 404 arranged in gateway 105. Figure 4B shows an authentication unit 402 and an authorization unit 404 arranged in a mobile unit 115.

Of course there is in most cases a reliable transport mechanism required to transmit a PIN-policy from CA, or other provider/issuer of the policy, to the mobile unit. There are several methods to realize this, but this is out of the scope of the invention.

The scope of protection is only limited by the following patent claims.

Claims

PATENT CLAIMS

1. A method in a mobile radio communication system with mobile units and connected service providers who provide services over said communication system, where the access via a specific mobile terminal of a specific service at a specific service provider requires a password, c h a r a c t e r i z e d in that said method includes the steps to - from a service provider, or by him/her appointed certificate authority electronically transmit a password policy to a mobile unit

- in a mobile unit, electronically receive said policy and handle and create/configure password in connection with said service provider according to rules specified in, from the service provider or by him/her appointed certificate authority, said transmitted/send policy.

2. A method as claimed in patent claim 1, c h a r a c t e r i z e d in the following steps :

- creation of a password policy specification at a service provider or by him/her appointed certificate authority

(CA) production/deriving of the address to a mobile unit, - production/deriving of the address to a private key in said mobile unit, transmission/sending of the specification, reception of the specification, authentication of CA, - authorization of CA, storing of a policy which corresponds to the specification, and activation of said policy.

3. A method as claimed in patent claim 1, c h a r a c t e r i z e d in that it includes the following steps . creation of a password policy specification at a CA, - production/deriving of the address to a mobile unit, production/deriving of the address to a private key in said mobile unit, distribution of the policy specification to a gateway for downloading of policy, - authentication of CA in said gateway, authorization of CA in said gateway, distribution of the specification from gateway to mobile unit over a mobile communication network, reception of the specification, - ensuring that the specification is emanating from approved gateway, storing of a policy which corresponds to the specification, and activation of said policy.

4. A method as claimed in patent claim 3, c h a r a c t e r i z e d in that it further includes the step: forcing the user to immediately change password to one which fulfils the new policy.

5. A method as claimed in patent claim 3, c h a r a c t e r i z e d in that it further includes the step: - awaiting to insert/apply the policy until the user changes password next time.

6. A method as claimed in any of the patent claims 1-5, c h a r a c t e r i z e d in that said password is a PIN- code.

7. A mobile radio communication system with mobile units and connected service providers who provide services over said communication system, where the access via a specific mobile terminal of a specific service at a specific service provider requires a password, c h a r a c t e r i z e d in that said system includes means to, from a service provider, transmit/send a policy specification for password to a mobile unit.

8. A mobile communication system as claimed in patent claim

7, c h a r a c t e r i z e d in that said system includes means to in a mobile unit receive a policy specification for password.

9. A mobile communication system as claimed in patent claim

8, c h a r a c t e r i z e d in that in said system means has been arranged for authentication of a policy sender/transmitter.

10. A mobile communication system as claimed in patent claim 8, c h a r a c t e r i z e d in that in said system means has been arranged for authorization of a policy sender/transmitter .

11. A mobile communication system as claimed in patent claim 7, c h a r a c t e r i z e d in that a gateway including means for authentication and authorization of a policy-sender/transmitter has been arranged to connect a CA to the mobile communication system, and to authorize and authenticate said CA.

12. A mobile communication system as claimed in patent claim 9 or 10, c h a r a c t e r i z e d in that means for authorization of a policy-transmitter/sender has been arranged in a mobile unit.

13. A mobile communication system as claimed in any of the patent claims 7-12, c h a r a c t e r i z e d in that said policy specification is arranged in form of a data structure .

14. A mobile communication system as claimed in any of the patent claims 7-12, c h a r a c t e r i z e d in that said policy specification is arranged in form of an executable application .