GB2416956A

GB2416956A - Method of testing integrity of a mobile radio communications device and related apparatus

Info

Publication number: GB2416956A
Application number: GB0416993A
Authority: GB
Inventors: Martin Ellis
Original assignee: NEC Technologies UK Ltd
Current assignee: NEC Technologies UK Ltd
Priority date: 2004-07-29
Filing date: 2004-07-29
Publication date: 2006-02-08
Anticipated expiration: 2024-07-29
Also published as: GB0416993D0; GB2416956B

Abstract

The present invention provides for a method of testing the integrity of operation of at least part of the mobile radio communications device and comprising the steps of transmitting a test sequence generally comprising a hash function to the device, determining and then transmitting the correct result of the test embodied by the test sequence to the device, applying the test sequence to a selected part of the device, and conducting a comparison of the result of the application of the test sequence with the said transmitted correct result so as to identify a potential compromise in the integrity of the said at least one part of the device if the said comparison indicates that the two said results are different.

Description

24 1 6956

METHOD OF TESTING INTEGRITY OF A MOBILE RADIO

COMMUNICATIONS DEVICE AND RELATED

APPARATUS

The present invention relates to a method of testing the integrity of a mobile radio communications device and to a related apparatus.

Mobile radio communication devices such as cellular phones have become such popular and useful accessories that potentially illegal and fraudulent activities relating to an attack on the integrity of one or more operational aspects of the cell phone handset have become identified problems.

In particular, cell phones are becoming increasingly subject to attacks on integrity of their firmware, for example in order to remove the Subscriber Identification Module (SlM)-lock, and to remove Digital Rights Management (DRM) checking components etc. It has therefore become desirable for those with intent to circumvent security mechanisms and revenue protection mechanisms etc found within current cell phones to seek to compromise the integrity of the operation of the handset and, in particular, the configuration, applications, and services of the cell phone.

The present invention seeks to provide for a method of testing the integrity of operation of at least part of the mobile radio communications device and to a related device, network server device and network arrangement, seeking to at least limit the problems and disadvantages currently arising and as discussed above.

In accordance with a first aspect of the present invention, there is provided a method of testing integrity of operation of at least part of a mobile radio communications device comprising the steps of: transmitting a test sequence to the device; transmitting the correct result of the test embodied by the test sequence to the device; applying a test sequence to a selected part of the device; comparing the result of the application of the test sequence with the said transmitted correct result so as to identify potentially comprised integrity of the said at least part of the device if the said comparison indicates that the two results are different.

The invention is advantageous in providing for a relatively simple, and adaptable, method for testing the integrity of the operation of at least part of a mobile radio communications device since the appropriate test, and the correct result, can readily be identified and sent to the device for effective self testing.

Preferably, the said at least part of a mobile radio communications device whose integrity is to be tested comprises at least a portion of the software or firmware of the device.

In particular, a memory segment is tested in accordance with the method of the present invention.

The test sequence transmitted to the device can advantageously comprise a hash function.

Advantageously, the method includes the step of determining the correct result of the test sequence having regard to the particular mobile radio communications device concerned and prior to the transmission of the test sequence.

Also, the method can include the step of identifying the said at least one part relative to the said device for application of the appropriate test sequence.

The method can further include the step of signalling the result of the comparison to a remote location.

Further, the method can then include the step of effectively barring further operation of the mobile radio communications device or, alternatively, initiating steps seeking to offer a fix to the said part of the device.

Advantageously, the transfer of the test sequence can employ a WAP push procedure.

As a further advantage, a form of secure transmission can be employed when transmitting the test sequence to the device.

Alternatively, or in addition, the result of the comparison of the two tests can be transmitted in a manner employing a layer of security and, for example, the transmission can be digitally signed.

The method can also include the step of monitoring for a result of the comparison of the two tests and initiating further control procedure should no response be forthcoming after a determined number of transmissions of the test sequence.

The said control function can comprise disabling use of the device As a further advantage, the method can employ a secure boot mechanism in an attempt to ensure that the test sequence itself is not compromised.

According to another aspect of the present invention, there is provided a mobile radio communications device arranged for the self testing of integrity of operation of at least part thereof, and including means arranged for receiving a test sequence, and a correct result for the test sequence having regard to the said part of the device which is to be tested, means for applying the test sequence to the said part of the device, means for comparing result of the applied test sequence with the said received correct result so as to identify potential compromise in integrity of the said at least part of the device if the said results are different.

Preferably, the said at least part of the device to be tested comprises at least a portion of the firmware within the device and, in particular, the device is then arranged for the self testing of a memory segment thereof.

In particular, the device can be arranged to receive a test sequence including the hash function.

Further, the device can be arranged to provide an output signal to a remote location confirming the result of the comparison between the two test results.

The device advantageously can be arranged to receive a signal seeking to address the identified compromise in integrity.

Yet further, the device can be arranged so as to add a level of security to the output signal serving to indicate the result of the comparison of the test results and, in particular, the device can be arranged so as to digitally sign the said signal.

Also, the device can be arranged so as to employ a secure boot mechanism serving to confirm that the test sequence itself has not been compromised.

According to yet another aspect of the present invention, there is provided a network server device arranged for delivering a test sequence seeking to test the integrity of operation of at least part of a mobile radio communications device and comprising means for transmitting the test sequence to the device for application to the said at least part of the device, means for determining within the network server device the correct result of the test sequence on the basis of at least part of the device to be tested and means for transmitting the said correct result of the test to the device for subsequent comparison with the result of the said application of the test within the mobile radio communications device.

In particular, the network server device can be arranged for testing integrity of at least part of the firmware of the device and, in particular, for testing a memory segment of the device.

The network server device can be arranged to transmit a test sequence including a hash function.

Also, the correct result of the test sequence having regard to the particular mobile radio communications device, and the operation of a part thereof, is determined within the network server device and prior to transmission to the mobile radio communication device.

The network sever device is further advantageously arranged to receive a signal from the mobile radio communications device confirming whether or not the results of the two test are the same.

The network server device can then advantageously be arranged to either disable use of the mobile radio communications device within the network, or offer an appropriate fix to the mobile radio communications device, if it is identified that a potential compromise in the integrity of the mobile radio communications device has occurred.

The network server device is also advantageously arranged to provide a layer of security to the test sequence, and which sequence can be digitally signed.

Also, the network server device can be arranged to repeat the transmission of the test sequence for a predetermined number of times and to initiate a control procedure if a result of a comparison of test results is not received from the mobile radio communications device after the predetermined number of test sequence transmission. The control function can of course include disabling operation of the mobile radio communications device within the network.

According to another aspect of the present invention, there is provided a network arrangement including a mobile device and a network server device such as defined and discussed above.

Thus, as will be appreciated, the concept of the present invention provides for a network based server arrangement arranged to issue a particular task or challenge to a mobile radio communications device, whereby, in one example, the device has to examine a portion of its memory and apply a hash function to the said portion. The result of the application of the hash function is then compared to an expected hash result also sent from the server and, if the two values are identified as different, this is then taken as a ready indication that the firmware within the device has been compromised and/or modified at least in the specific area to which the hash function has been applied. l

Further checks could also be carried out in order to examine the extent of the potential compromise and/or to identify the appropriate fixes that should be sent out.

The invention is described further hereinafter, by way of example only, with reference to the accompanying drawings in which: Fig. 1 is a schematic representation of a network arrangement embodying the present invention; and Fig. 2 is a flow diagram illustrating a method arising in accordance with the present invention.

Turning first to Fig. 1, there is illustrated a schematic representation of a network arrangement 10 embodying the present invention, which comprises a management console 12 arranged to provide overall control of a method in accordance with the invention and for delivering an appropriate test sequence as indicated by arrows A and B. by way of a WAP push-proxy server 14 to a cellular phone handset 16 operating within the network arrangement 10.

As will be described in further detail below, the handset 16 is arranged to run the test sequence and compare it with a test result also delivered from the management console 12 by way of the WAP push-proxy server 14, and to deliver the result of comparison of the two test results as indicated by arrow C to WAP gateway 18 for onward delivery by way of arrow D back to the management console 12.

The management console 12 is arranged to detect a potential compromise in the integrity of, for example, a portion of the firmware of the handset 16 and to identify the correct version of firmware operating within the handset 16 so as to generate an appropriate test sequence relevant to that handset and its firmware.

The operation initially illustrated in Fig. 1 is described further with reference with to Fig. 2 and, of course comprises use of WAR for the transport of the messages required for employment of the method.

Again, turning first to step 20, a compromise is detected within the management console 12 of Fig. 1, or indeed an attack on the integrity of a firmware sector can be predicted, within the management console 12. Since the management console 12 is aware of all the appropriate handsets that might used on the network, primarily since all such devices will be Open Mobile Alliance (OMA) Device Management enabled and configured, the particular handset possessing the potentially compromised firmware is inspected by way of data within the console so as to determine the particular segment whose integrity may have been compromised at step 22. Of course alternatives for identifying the devices for the management console comprise web registration and/or operator specific proprietary means.

At step 24, an appropriate challenge in the form of a test sequence including for example a hash function is applied to the master copy of the relevant firmware memory segment within the measurement console 12 so as to identify a correct result for application of the hash function to that segment.

The test sequence comprising a specific challenge to the memory segment within the handset 16 can then be issued and which can contain a start address, an end address, the hash function to use and the expected hash result. Also, if required, an indication as to where and how to report the result of the test comparison can be provided.

It should be appreciated that there is likely to be a variety of slightly different test sequences required for different software and/or firmware versions arising within the handsets currently in use. However, the appropriate test sequence, as noted above, is identified within the management console 12 prior to transmission to the handset 16 via the WAP push-proxy server 14.

As an alternative, when transferring the particular challenge to the handset 16, OMA Device Management could be used in place of the WAP pushproxy procedure indicated. In any case, the test sequence to be delivered to the handset 16 can advantageously be secured in an appropriate manner if required.

At step 26, the challenge is applied at the device and the result of the application of the test sequence is determined. In this manner, upon receipt of the challenge, the handset 16 is arranged to calculate the hash function of the identified memory segment and compare the result of the application of the function with the expected hash result as indicated within the signal from the management console 12.

From a comparison of the results occurring at step 28, it is identified whether or not the results are the same. If the results are different, this serves to indicate that the integrity of the memory segment has been compromised and an appropriate indication can be issued to the network at step 30.

It should be noted that the challenge offered by the test sequence, and the response arising from the application thereof, could be digitally signed in order to provide extra security if required.

Subsequent to receipt of the response at the management console 12, and as illustrated by step 31, a signal is then indicated to effectively blacklist the device as indicated at step 32 or to send an appropriate patch to fix the apparent problem as indicated at step 34 and dependent upon operator/network requirements.

Should, however, the comparison of the results at step 28 indicate that the results are the same, this can be employed within the management console 12 at step 30 to confirm that the integrity of, for example, the memory segment has not been compromised.

Should a situation of potential compromise however be identified, the management console 12 can operate to effectively blacklist the handset 16 identified. Also, if no response is received from the handset 16 after a predetermined number of challenges have been issued from the management console 12, it can likewise be determined that the handset 16 should be blacklisted.

It should be appreciated that the method of the present invention can be repeated at predetermined, or random, intervals, or indeed initiated in response to known potential threats to the integrity of operation of the handset.

The particular embodiment illustrated by reference to Fig. 2 illustrates clearly how an Individual cell phone handset can be challenged to determine the integrity of at least part thereof once a potential compromise in integrity has been detected and so as to confirm whether or not the handset has in fact been effected.

It should however be appreciated that the method of the present invention can itself be used initially to detect a possible compromise in integrity of a firmware and/or software segment thereof.

In such an alternative embodiment, a firmware and/or software segment is selected at random such that in this alternative embodiment steps 20, 22 of Fig. 2 do not generally arise. Once a particular firmware and/or software segment has been randomly selected, the procedure continues as indicated in accordance with steps 24, 26 and 28.

Once a comparison of the results such as at step 26 has indicated that a potentially new compromise has been identified, this alternative process can continue by way of further investigation in an attempt to identify a particular mobile device having the firmware and/or software segment that has become compromised. These final stages could comprise repetition of steps 20-34 as illustrated in relation to Fig. 2.

The present invention provides for a relatively simple and readily adaptable potential solution to the increasing problem of mobile phone security and could, if required, be employed in combination with other, and potentially more complicated, solutions such as those offered by way of a secure boot procedure.

For example, a secure boot mechanism could advantageously be employed to check whether or not the test sequence itself has been compromised by way, for example, of a code signing technique.

The present invention therefore advantageously provides means for detecting if an attack on the integrity of the operation of a mobile radio communications device such as a cell phone has occurred and readily provides a means to attempt a recovery from the attack and/or to blacklist the mobile against further operation within the network.

It should however be appreciated that the invention is not restricted to the details of the foregoing embodiment since the integrity of operation of any required feature of the mobile radio communications device can be tested in the manner of the present invention. Also, further control and security aspects can be included, for example, based on OMA device management, linkage with firmware update solutions, and generally more complex security protection can be included within the concept of the present invention if appropriate.

Also, the invention can be employed for testing the integrity of device software including downloaded applications assuming means exists for locating the code in memory.

Claims

Claims 1. A method of testing integrity of operation of at least part of a

mobile radio communications device comprising the steps of: transmitting a test sequence to the device; transmitting the correct result of the test embodied by the test sequence to the device; applying a test sequence to a selected part of the device; comparing the result of the application of the test sequence with the said transmitted correct result so as to identify potentially comprised integrity of the said at least part of the device if the said comparison indicates that the two results are different.
2. A method as claimed in Claim 1, wherein the said at least part of the mobile radio communications device whose integrity is to be tested comprises at least a portion of the firmware of the device.
3. A method as claimed in Claim 1 or 2, wherein the said at least part of the mobile radio communications device whose integrity is to be tested comprises at least a portion of software within the device.
4. A method as claimed in Claim 1, 2 or 3, and employed for testing a memory segment of the device.
5. A method as claimed in Claim 1, 2, 3 or 4, wherein the test sequence transmitted to the device comprises a hash function.
6. A method as claimed in any one or more of Claims 1 to 5, and including the step of determining the correct result of the test sequence having regard to the said mobile radio communications device and prior to the transmission of the test sequence.
7. A method as claimed in any one or more of Claims 1 to 6, and including the step of identifying the said at least one part relative to the said device for application of the appropriate test sequence.
8. A method as claimed in any one or more of the preceding claims and including the step of signalling the result of the comparison to a remote location.
9. A method as claimed in any one or more of the preceding claims and wherein the transfer of the test sequence employs a WAR push procedure.
10. A method as claimed in any one or more of the preceding claims and including the step of monitoring for a result of the comparison of the two tests and initiating further control procedure should no response be forthcoming from the device after a determined number of transmissions of the test sequence.
11. A method as claimed in Claim 10, wherein the said control function can comprise disabling use of the device within the network.
12. A method as claimed in any one or more of the preceding claims and employing a secure boot mechanism seeking to ensure that the test sequence itself is not compromised.
13. A mobile radio communications device arranged for the self testing of integrity of operation of at least part thereof, and including means arranged for receiving a test sequence, and a correct result for the test sequence having regard to the said part of the device which is to be tested, means for applying the test sequence to the said part of the device, means for comparing result of the applied test sequence with the said received correct i result so as to identify potential compromise in integrity of the said at least part of the device if the said results are different.
14. A device as claimed in Claim 13, wherein the said at least part of the device to be tested comprises at least a portion of the firmware within the device.
15. A device as claimed in Claim 13 or 14, wherein the said at least part of the device to be tested comprises at least a portion of the software within the device.
16. A device as claimed in Claim 13, 14 or 15, and arranged for the self testing of a memory segment thereof.
17. A device as claimed in Claim 13, 14, 15 or 16, and arranged to receive a test sequence including a hash function.
18. A device as claimed in any one or more of Claims 13 to 17, and arranged to provide an output signal to a remote location confirming the result of the comparison between the two test results.
19. A device as claimed in any one or more of Claims 13 to 18, and arranged to employ a secure boot mechanism serving to confirm that the test sequence itself has not been compromised.
20. A network server device arranged for delivering a test sequence seeking to test the integrity of operation of at least part of a mobile radio communications device and comprising means for transmitting the test sequence to the device for application to the said at least part of the device, means for determining within the network server device the correct result of the test sequence on the basis of at least part of the device to be tested and means for transmitting the said correct result of the test to the device for subsequent comparison with the result of the said application of the test within the mobile radio communications device.
21. A network server device as claimed in Claim 20, and arranged for testing the integrity of at least part of the firmware of the mobile radio communications device.
22. A network server device as claimed in Claim 20 or 21, and arranged for testing the integrity of at least part of the software within the mobile radio communications device.
23. A device as claimed in Claim 20, 21 or 22, and arranged for testing a memory segment of the mobile radio communication device.
24. A device as claimed in Claim 20, 21, 22 or 23, and arranged to transmit a test sequence including a hash function.
25. A device as claimed in Claim 20, 21, 22, 23 or 24, and arranged to determine the correct result of the test sequence having regard to the mobile radio communications device, and the operation of the part thereof prior to transmission to the mobile radio communications device.
26. A device as claimed in Claim any one or more of Claims 20 to 25, and arranged to receive a signal from the mobile radio communications device confirming whether or not the results of the two test were the same.
27. A device as claimed in any one or more of Claims 20 to 26, and arranged to repeat the transmission of the test sequence for a predetermined number of times and initiate a control procedure if a result of a comparison of test results not received from the mobile radio communications device after the predetermined number of test sequence transmissions.
28. A device as claimed in Claim 27, wherein the control function can of course include disabling operation of the device within the network.
29. A network arrangement including a mobile radio communications device as claimed in any one or more of Claims 13 to 18 and a network server device as claimed in any one or more of Claims 20 to 28.
30. A method of testing the integrity of the operation of at least part of an mobile radio communications device and substantially as hereinbefore described with reference to, and as illustrated in, Fig. 1 and Fig. 2 of the accompanying drawings.
31. A mobile radio communications device substantially as hereinbefore described with reference to, and as illustrated in, Fig. 1 of the accompanying drawings.
32. A network server device arranged for delivering a test sequence seeking to test the integrity of operation of at least part of a mobile radio communications device as substantially as here before described with reference to Fig.1 and Fig. 2 of the accompanying drawings.