Control of terminal applications in a network environment

DC CAFC

US 7,218,923 B2
Filed: 06/08/2004
Issued: 05/15/2007
Est. Priority Date: 12/18/2003
Status: Active Grant

- Alert
- Pin

Associated Cases

Associated Defendants

First Claim

Patent Images

1. A method for controlling application programs in a communication terminal, the method comprising:

sending messages from an application program towards a communication network, the application program residing in a communication terminal;

diverting a message of the messages to a controlling entity residing in the communication terminal; and

based on the message, controlling in the controlling entity whether the application program behaves in a predetermined manner in the communication terminal, the controlling being performed before the message is transmitted from the communication terminal to the communication network.

View all claims

7 Assignments

Timeline View

Assignment View

Litigations

3 Petitions

Accused Products

Abstract

A mechanism and method for controlling the rights and/or behavior of applications in a terminal, especially in a mobile terminal, are disclosed. At least some of the messages generated by an application residing in the terminal and destined for a communication network are diverted to an independent controlling entity also residing in the terminal. In the controlling entity, the messages are controlled before being transmitted to the network. Depending on the application and its behavior in the terminal, the control entity may modify the messages or even prevent their sending to the network. The modification may include inserting control data, such as a digest, which can be used to authenticate the application.

Citations

40 Claims

1. A method for controlling application programs in a communication terminal, the method comprising:
- sending messages from an application program towards a communication network, the application program residing in a communication terminal;
  
  diverting a message of the messages to a controlling entity residing in the communication terminal; and
  
  based on the message, controlling in the controlling entity whether the application program behaves in a predetermined manner in the communication terminal, the controlling being performed before the message is transmitted from the communication terminal to the communication network.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
- - 2. The method according to claim 1, further comprising:
    - checking, prior to the sending of the messages, a right related to the application program, the right indicating whether the application program is authorized to run in the terminal.
  - 3. The method according to claim 2, wherein the controlling comprises modifying the message diverted to the controlling entity.
  - 4. The method according to claim 1, wherein the controlling comprises preventing the message diverted to the controlling entity from being transmitted to the communication network.
  - 5. The method according to claim 1, further comprising:
    - storing a plurality of application programs in the communication terminal; and
      
      maintaining a repository including application program identifiers for the plurality of application programs for which the diverting and controlling are to be performed.
  - 6. The method according to claim 5, further comprising:
    - examining whether the diverting and controlling are performed for the message sent from the application program towards the network,wherein the examining comprises comparing an application program identifier of the application program identifiers within the message with the application program identifiers stored in the repository.
  - 7. The method according to claim 6, wherein the examining further comprises examining a message type.
  - 8. The method according to claim 1, wherein the diverting comprises diverting the messages to the controlling entity.

9. A method for controlling application programs in a communication terminal, the method comprising:
- sending messages from an application program towards a communication network, the application program residing in a communication terminal;
  
  diverting a message of the messages to a controlling entity residing in the communication terminal;
  
  controlling the message in the controlling entity before the message is transmitted from the communication terminal to the communication network, wherein the controlling comprises modifying the message diverted to the controlling entity;
  
  checking, prior to the sending the messages, a right related to the application program, the right indicating whether the application program is authorized to run in the terminal; and
  
  authenticating the application program in response to reception of the message modified by the modifying.
- View Dependent Claims (10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)
- - 10. The method according to claim 9, further comprising:
    - creating a token for the authenticating.
  - 11. The method according to claim 10, further comprising:
    - retrieving the token from a first network node,wherein the creating is performed in the first network node.
  - 12. The method according to claim 11, wherein the retrieving is responsive to the checking.
  - 13. The method according to claim 11, further comprising:
    - downloading the application program from a second network node to the communication terminal.
  - 14. The method according to claim 13, wherein the modifying comprises:
    - calculating a digest based on the token and a secret key; and
      
      adding the digest in the message diverted to the controlling entity.
  - 15. The method according to claim 14, further comprising:
    - generating the secret key in the second network node; and
      
      transferring the secret key to the communication terminal.
  - 16. The method according to claim 15, wherein the transferring comprises performing the transferring in connection with the downloading.
  - 17. The method according to claim 15, wherein the downloading comprises downloading the application program from the second network node, in which the first and second network nodes are the same.
  - 18. The method according to claim 14, wherein the authenticating comprises verifying the digest.
  - 19. The method according to claim 18, wherein the verifying comprises verifying the digest in the first network node.
  - 20. The method according to claim 9, wherein the modifying comprises adding an identifier in the message diverted to the controlling entity, wherein the identifier identifies the application program.
  - 21. The method according to claim 20, wherein the authenticating comprises:
    - generating a token in response to reception of the message including the identifier; and
      
      sending the token to the communication terminal.
  - 22. The method according to claim 21, further comprising:
    - calculating, in the communication terminal, a digest based on the token and a secret key.
  - 23. The method according to claim 22, wherein the authenticating comprises verifying the digest calculated in the communication terminal.

24. A terminal for a communication system, the terminal comprising:
- an application program configured to send messages towards a communication network; and
  
  a diverting unit configured to divert a message of the messages sent from the application program and destined for the communication network to a controlling entity residing in the terminal,wherein the controlling entity is configured to control, based on the message and before the message is transmitted to the communication network, whether the application program behaves in a predetermined manner in the communication terminal, andwherein the terminal is a terminal of a communications system.
- View Dependent Claims (25, 26, 27, 28, 29, 30, 31, 32)
- - 25. The terminal according to claim 24, wherein the controlling entity is configured to check a right related to the application program, the right indicating whether the application program is authorized to be run in the terminal.
  - 26. The terminal according to claim 24, wherein the controlling entity is configured to reside in a tamper resistant area of the terminal.
  - 27. The terminal according to claim 24, wherein the controlling entity is configured to add a digest in the message.
  - 28. The terminal according to claim 24, wherein the controlling entity is configured to add an identifier in the message, and wherein the identifier is configured to identify the application program.
  - 29. The terminal according to claim 24, wherein the diverting unit comprises a software module residing between the application program and a protocol stack residing in the terminal.
  - 30. The terminal according to claim 24, wherein the diverting unit is introduced into a protocol stack residing in the terminal.
  - 31. The terminal according to claim 24, further comprising:
    - a repository comprising application program identifiers for determining whether the message sent by the application program is diverted to the controlling entity.
  - 32. The terminal according to claim 24, wherein the terminal comprises a mobile terminal.

33. A system for authentication application programs in a communication network, the system comprising:
- an application program to send messages towards a communication network;
  
  diverting means for diverting a message of the messages sent from the application program and destined for the communication network to a controlling entity residing in a terminal;
  
  the controlling entity configured to add control data to the message;
  
  authentication means for receiving the control data to initiate authentication of the application program in response to reception of the control data; and
  
  connection set-up means, responsive to the authentication means, for setting up a connection when the application program is successfully authenticated by the authentication means.
- View Dependent Claims (34, 35, 36, 37, 38)
- - 34. The system according to claim 33, wherein the authentication means comprises authentication means both for receiving the control data that includes a digest calculated based on a secret key and a token, and for verifying the digest.
  - 35. The system according to claim 33, wherein the system further comprises:
    - a delivery server for delivering application programs to communication terminals, wherein the delivery server located in the communication network.
  - 36. The system according to claim 35, wherein the delivery server is configured to generate a secret key in connection with a download of the application program from the delivery server to the terminal.
  - 37. The system according to claim 33, wherein the control data comprises an identifier identifying the application program.
  - 38. The system according to claim 35, wherein the authentication means is configured to send a token to the terminal in response to reception of an identifier for calculating a digest in the terminal, and wherein the authentication means is configured to verify the digest.

39. A system for controlling application programs in a communication terminal, the system, comprising:
- sending means for sending messages from an application program towards a communication network, the application program residing in a communication terminal;
  
  diverting means for diverting a message of the messages to a controlling entity residing in the communication terminal; and
  
  the controlling entity configured to control, based on the message and before the message is transmitted from the communication terminal to the communication network, whether the application program behaves in a predetermined manner in the communication terminal.

40. A terminal for a communication system, the terminal, comprising:
- an application program configured to send messages towards a communication network;
  
  diverting means for diverting a message of the messages sent from the application program and destined for the communication network to a controlling entity residing in the terminal,wherein the controlling entity is configured to control, based on the message and before the message is transmitted to the communication network, whether the application program behaves in a predetermined manner in the communication terminal, andwherein the terminal is a terminal of a communications system.

Specification

Resources

Litigation Campaign Assessment

Litigation Data

Current Assignee
Acacia Research Group LLC (Acacia Research Corporation)
Original Assignee
Nokia Corporation
Inventors
Kontio, Markku, Miettinen, Kari, De La Pena, Isaac, Aho, Elina, Tiihonen, Arto, Pussinen, Arto, Hartikainen, Juha P., Hartikainen, Auvo, Silfverberg, Kari
Primary Examiner(s)
LE, DANH C

Application Number

US10/862,878
Publication Number

US 20050135388A1
Time in Patent Office

1,071 Days
Field of Search

455/411, 455/410, 455/418, 709/207, 709/246, 717/177, 707/717
US Class Current

455/418
CPC Class Codes

G06F 2221/2141   Access rights, e.g. capabil...

H04L 63/12   Applying verification of th...

H04W 12/06   Authentication

H04W 12/08   Access security

H04W 12/35   Protecting application or s...

H04W 88/02   Terminal devices

Control of terminal applications in a network environment

First Claim

7 Assignments

Litigations

3 Petitions

Accused Products

Abstract

Citations

40 Claims

Specification

Solutions

Use Cases

Quick Links

Control of terminal applications in a network environment

First Claim

7 Assignments

Subscription Required

Subscription Required

Litigations

3 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

Citations

40 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links