WO2010000924A1

WO2010000924A1 - Client provisioning

Info

Publication number: WO2010000924A1
Application number: PCT/FI2009/050504
Authority: WO
Inventors: Jukka Tuomi; Mika Rantanen
Original assignee: ERACE SECURITY SOLUTIONS Ltd Oy
Current assignee: ERACE SECURITY SOLUTIONS Ltd Oy
Priority date: 2008-07-02
Filing date: 2009-06-12
Publication date: 2010-01-07
Anticipated expiration: 2011-01-02
Also published as: FI20085688A0; FI20085688L; FI121046B

Abstract

A method, comprising receiving, in a receiver, a provisioning message including one or more configuration settings for configuration of the receiver, analysing one or more characteristics of a sender of the provisioning message, analysing the security settings used in transmission of the provisioning message, assessing a security level of the provisioning message on the basis of the one or more characteristics of the sender and the security settings of the provisioning message, and saving configuration settings from the provisioning message into the receiver if the security level of the provisioning message fulfils a predetermined security level requirement.

Description

CLIENT PROVISIONING

FIELD

The invention relates to mobile device security arrangements for arranging remote device configuration over a communications network.

BACKGROUND

Current mobile phones are often remotely configured by using Open Mobile Alliance Client Provisioning protocol (OMA CP). The protocol enables fast and easy settings delivery to the mobile devices over the air. Client provisioning protocol utilizes short message (SMS) technology as a carrier and the settings are described by using wbxml (xml) notation.

Even though the protocol includes certain security features it still exposes mobile device security in various ways. It is possible to have full control of settings and configurations in mobile device by sending malicious settings document using the client provisioning protocol. Currently anyone having mobile subscription is able and allowed to send client provisioning messages to someone's phone. The client provisioning message may include malicious configuration settings which may cause significant harm and problems for the end users.

OMA Client Provisioning introduces mechanism how the message sending would be able to restrict from the other than mobile operators. NET- WPIN is the IMSI code of the SIM card attached to the receiving mobile device and in practice the IMSI code is only known by the end user's home mobile operator. Using NETWPIN as a secret key in the message the receiving client can be sure that message has been sent by its mobile operator. Unfortunately the drawback in this case is that no other mobile service provider would be able send configurations to end users anymore. This would be a showstopper for their mobile service businesses due to a fact that average end user don't know how to modify the mobile device settings to reach the services. Automatically discarding configuration messages other than NETWPIN protected would greatly influence current business models in telecom industry.

Even though the OMA CP is widely adopted protocol the mobile devices receiving the message behave in various different ways. Some implementations don't even show the actual message to the end user - instead the configurations inside the message are stored to the system without end user acceptance. In the best case the system warns about the possibility that the settings might be harmful, but end user is still able to save the settings and thereby change the device settings accordingly. It is also noticeable that majority of mobile phones does not comply with Client Provisioning protocol security definitions.

BRIEF DESCRIPTION

In an aspect, there is provided a method, comprising receiving, a provisioning message including one or more configuration settings for configuration of a receiver, analysing from the provisioning message one or more characteristics of a sender of the provisioning message, analysing the security settings used in transmission of the provisioning message, assessing a security level of the provisioning message on the basis of the one or more characteristics of the sender and the security settings of the provisioning message, and processing the provisioning message further to be used in configuring the receiver if the security level of the provisioning message fulfils a predetermined security level requirement.

In another aspect, there is provided a network element, comprising means for receiving, a provisioning message including one or more configuration settings for configuration of a receiver, means for analysing one or more characteristics of a sender of the provisioning message, means for analysing the security settings used for transmission of the provisioning message, means for assessing a security level of the provisioning message on the basis of the one or more characteristics of the sender and the security settings of the provisioning message, and means for processing the provisioning message further to be used in configuring the receiver if the security level of the provisioning message fulfils a predetermined security level requirement.

DRAWINGS

In the following the invention will be described in greater detail by means of preferred embodiments with reference to the accompanying drawings, in which Figure 1 shows an embodiment of a communication system;

Figure 2 shows an embodiment of a method;

Figure 3 shows another embodiment of a method; and

Figure 4 shows another embodiment of the method. DETAILED DESCRIPTION

Some embodiments of the invention are explained in the following. It is to be understood that these embodiments are only examples. The present features may be applied in any mobile communications system, where settings provisioning messages may be sent to device from another device or server over one or more communications networks. A network element implementing the features disclosed in the following embodiments may be either a mobile station or a relay server. The mobile station, that is the receiver, is the receiver of the configuration message. The relay station may be a device between the sender and the receiver of the configuration message.

Figure 1 depicts devices involved in sending the Client Provisioning messages. The message may be originated by a service provider's personal computer software and a normal mobile phone that is configured to act as a GSM (Global System for Mobile Communication) modem. It is also possible for the service provider (100) that the messages are sent directly to mobile operator SMSC (106) (Short Message Service Center) via TCP/IP based network using so called SMSC application protocol. SMSC queries SMS routing information from the SMS-GMSC (110) (Short Message Gateway Mobile Switching Center). SMS-GMSC replies with necessary routing information to all SMSCs in the Global PSTN network (112). The message is delivered to the corresponding Mobile Switching Center (108) and cellular radio network to the receiving mobile phone.

Figure 1 depicts also the devices involved in sending relayed provisioning messages. Service Provider server (100) has a network connection to the mobile operator provisioning relay server (102). Relayed provisioning messages are sent from the Service Provider's server (100) to the relaying server. Provisioning relay server fetches service provider authentication, authorization and accounting information from the database (104). It is possible that provisioning relaying functionality is handled by SMSC (106). Provisioning relay server resolves characteristics of the receiver; in some embodiments the IMSI is being requested from the HLR/HSS (108).

In an embodiment, there is provided a runtime analysis of the incoming provisioning message in the receiving mobile device. In case the analysis of the message sender, used security method and the content of the message show that it may expose end user device security, the message content or part of the content is discarded accordingly. Analysis of the message is performed against pre-defined rules. Certain settings characteristics may be allowed from un-trusted senders and with less protective security methods. Settings that expose the end user device to greater risk require authorized sender. Authorization may be performed explicitly or implicitly depending on implementation of the used system.

One embodiment of such run-time analysis for settings provisioning message is illustrated in Figure 2. It is to be understood that the illustrated features are not limited to any particular protocol.

In step 200, the device receives a provisioning message including configuration settings. In step 202, the provisioning message is parsed and a possible fingerprint is saved. In step 206, the fingerprint validity is checked. If the fingerprint cannot be validated the whole message is discarded. If the message does not include the fingerprint of the sender or the fingerprint is analyzed to be valid the sender information is analyzed in step 212. The analysis may, for instance, include analyzing if the sender MSISDN number belongs to a range of trusted MSISDN numbers.

In step 214, the security mode used for transmission of the message is analyzed. The analysis may include checking of a USERPIN or a NETWPIN of the client provisioning protocol, for instance. In step 216, according to previous analysis of the sender and the security settings of the message, the required security authorization level is set for the message. In the step 218, the first configuration element is analyzed. In one embodiment, the configuration element is the whole CHARACTERISTIC > element part of the configuration message specified in Open Mobile Alliance Client Provisioning protocol. In another embodiment the configuration element may be either <CHARACTERISTIC> or <PARM> element. Each configuration element has a predefined authorization level depending on what type of configuration in receiving device the element represents. For instance, the system may have different authorization level for internet connection settings and for multimedia services.

In step 220, the authorization information of the configuration element is compared to the security authorization level set in step 216. In case the required authorization level is stronger than the set level, the element is discarded. In case the authorization level is adequate, the element is accepted. If the accepted or discarded element is not the last element in the configuration context, the next element is processed and the steps 218-224 are repeated until the last element is reached. In some embodiments the accepted elements are saved even if one or more of the configuration elements are discarded. In case the configuration element under analysis is unknown the element is discarded. In another embodiment, there is provided a system to send configuration messages from an originating device or a server to a server for relaying the message to a receiving device. The relayed message may be carried over any communications network between the originator and the relaying server. Parameters needed for relaying the configuration message may be carried us- ing any communications protocol and parameters may be included into provisioning message or may be carried in separate message to the relaying server. In step 300, the server receives the provisioning message for further relaying. In step 302, the relaying server authenticates the message sender. In step 304, the authorization of the sender is checked. In one aspect of the pre- sent method, the sender is charged for the relay service. Depending on the sender authorization, the relaying system may perform content analysis of the configuration message. If the message contains more sensitive settings than the sender is authorized to send, the message may be discarded. In step 316, the relaying server resolves OMA Client Provisioning protocol specific NETWPIN value. The NETWPIN may be resolved from its own database or it may be fetched from other server or database in the mobile operator cellular network 114. In step 318, the used configuration message security mechanism is resolved.

In an embodiment, a USERPIN mode may be used. In the USER- PIN mode, the sender or the service provider's server informs a USERPIN to the relay station, which may use it when addressing a message to the mobile station. If OMA CP USERPIN security mode is used, the system combines USERPIN and NETWPIN according to OMA CP standard, calculates message authentication code using the USERNETWPIN and then changes the message security mode accordingly. In case USERPIN is not used, the system calculates MAC using NETWPIN. In step 328, the server sends the relayed message to the receiving device.

There is provided a method, comprising steps of receiving, in a relay station, a provisioning message from a sender including one or more configu- ration elements for configuration of a receiver, analysing one or more characteristics of a sender of the provisioning message, resolving one or more char- acteristics of the receiver, changing a security setting of the provisioning message according the resolved one or more receiver characteristic, and preparing the provisioning message for transmission to the receiver if the one or more characteristics of the sender indicate that the sender is allowed to provide a provisioning message to the receiver.

In an embodiment, the method comprises analyzing the configuration settings in the provisioning message, and preparing the provisioning message for transmission to the receiver if the one or more characteristics of the sender indicate that the sender is allowed to provide such configuration set- tings to the receiver.

In an embodiment, the resolved receiver characteristic is an international mobile subscriber identity of the receiver.

In an embodiment, the changed security setting of the provisioning message is parameter NETWPIN of an open mobile alliance client provisioning protocol.

In an embodiment, the relayed provisioning message security mode is USERPIN, the sender informs the used PIN-code to the relay station.

In an embodiment, the changed security setting of the provisioning message is parameter USERNETWPIN of an open mobile alliance client pro- visioning protocol.

In an embodiment the method comprises analysing one or more characteristics of a sender of the provisioning message includes authenticating the sender based on network address of the sender.

In an embodiment, the method comprises analysing of one or more characteristics of a sender of the provisioning message, and authenticating the sender based on a userid and a password.

There is provided a network element, such as a relay station, comprising means for receiving a provisioning message from a sender including one or more configuration elements for configuration of a receiver, means for analysing one or more characteristics of a sender of the provisioning message, means for resolving one or more characteristics of the receiver, means for changing a security setting of the provisioning message according the resolved one or more receiver characteristic, means for preparing the provisioning message for transmission to the receiver if the one or more characteristics of the sender indicate that the sender is allowed to provide a provisioning message to the receiver. In an embodiment, the network element comprises means for analyzing the configuration settings in the provisioning message, and means for preparing the provisioning message for transmission to the receiver if the one or more characteristics of the sender indicate that the sender is allowed to pro- vide such configuration settings to the receiver.

In an embodiment, the network element comprises means for resolving an international mobile subscriber identity of the receiver.

In an embodiment, the network element comprises means for changing as a security setting of the provisioning message the parameter NETWPIN of an open mobile alliance client provisioning protocol.

In an embodiment, the relayed provisioning message security mode is USERPIN, which the sender or the service provider's server has informed to the relay station.

In an embodiment, the changed security setting of the provisioning message is parameter USERNETWPIN of an open mobile alliance client provisioning protocol.

In an embodiment, the network element further comprises means for analysing one or more characteristics of a sender of the provisioning message, and authenticating the sender based on a network address of the sender.

In an embodiment, the network element further comprises means for analysing one or more characteristics of a sender of the provisioning message, and authenticating the sender based on a userid and a password.

In another embodiment illustrated by Figure 4, there is provided a method to send configuration messages from an originating device or a server to a server for a re-signing the configuration message. The sender informs (400) to the mobile operator relay server the MSISDN of the mobile station receiving the configuration message. Based on the MSISDN number, the receiving server resolves the corresponding IMSI, which is then used as OMA Client Provisioning protocol specific NETWPIN value (402). The IMSI may be resolved from its own database or it may be fetched from other server or database in the mobile operator cellular network.

In an embodiment, a USERPIN may be used. If the USERPIN is present, the sender or service provider's server informs a USERPIN to the re- lay station, which may use it when addressing a message back to sender. If

USERPIN is present in the received message, the system combines USERPIN and NETWPIN according to OMA CP standard, calculates message authentication code using the USERNETWPIN and then changes the message security mode accordingly. In case USERPIN is not used, the system calculates MAC using NETWPIN. In step 406, the server sends the message with calcu- lated credentials and the accordingly changed security settings to the message originating device. In step 408 the originating server sends the configuration message to the receiving mobile station.

In order to improve the security of the provisioning messages in the network, the embodiments of Figures 2 and 3/4 may be used in combination. That is, a relaying station may be involved in the transmission of the provisioning messages as explained in conjunction with Figures 3 and 4, and the messages are additionally subjected to a security check in the mobile station as explained in conjunction with Figure 2.

The embodiments may be implemented on the network element as a computer program by software, hardware, or a combination thereof.

It will be obvious to a person skilled in the art that, as the technology advances, the inventive concept can be implemented in various ways. The invention and its embodiments are not limited to the examples described above but may vary within the scope of the claims.

Claims

1 . A method, comprising: receiving, a provisioning message including one or more configuration settings for configuration of a receiver; analysing from the provisioning message one or more characteristics of a sender of the provisioning message; analysing the security settings used in transmission of the provisioning message; assessing a security level of the provisioning message on the basis of the one or more characteristics of the sender and the security settings of the provisioning message; and processing the provisioning message further to be used in configuring the receiver if the security level of the provisioning message fulfils a predetermined security level requirement.

2. A method according to claim 1 , wherein the processing of the provisioning message comprises saving configuration settings from the provisioning message into the receiver.

3. A method according to claim 1 , wherein the processing of the provisioning message comprises: changing the security setting level of the provisioning message; and transmitting the provisioning message to the receiver.

4. A method according to claim 1 , wherein the analysing of the one or more sender characteristics comprises: identifying a mobile station international subscriber directory number of the sender; checking, on the basis of the mobile station international subscriber directory number of the sender, if the sender is authorized to change configuration settings in the receiver.

5. A method according to claim 1 , wherein the analysing of the one or more sender characteristics comprises: analysing a digital fingerprint of the provisioning message; and checking, on the basis of the digital fingerprint, if the sender is authorized to change configuration settings in the receiver.

6. A method according to claim 1 , wherein the receiver includes a plurality of configuration settings and the method comprises: assessing, for each configuration setting of the receiver, if the security level of the provisioning message fulfils a predetermined security level requirement of the configuration setting; and saving such configuration settings where the security level of the provisioning message fulfils a predetermined security level requirement of the configuration setting.

7. A method according to claim 1 , further comprising: rejecting the whole provisioning message or one or more configuration settings in the provisioning message if the security level of the provisioning message fails to fulfil the security requirement of the configuration element.

8. A computer program product configured to perform a method according to any preceding method claim 1 to 7 when run on a computer.

9. A network element, comprising: means for receiving, a provisioning message including one or more configuration settings for configuration of a receiver; means for analysing one or more characteristics of a sender of the provisioning message; means for analysing the security settings used for transmission of the provisioning message; means for assessing a security level of the provisioning message on the basis of the one or more characteristics of the sender and the security settings of the provisioning message; and means for processing the provisioning message further to be used in configuring the receiver if the security level of the provisioning message ful- fils a predetermined security level requirement.

10. A network element according to claim 9, wherein the network element is the receiver, comprising: means for saving the configuration settings from the provisioning message into the receiver if the security level of the provisioning message ful- fils a predetermined security level requirement.

1 1 . A network element according to claim 9, wherein the network element is the receiver, comprising: means for storing a plurality of configuration settings; means for assessing, for each configuration setting of the receiver, if the security level of the provisioning message fulfils a predetermined security level requirement of the configuration setting; and means for saving such configuration settings where the security level of the provisioning message fulfils a predetermined security level requirement of the configuration setting.

12. A network element according to claim 9, wherein the network element is a relay station between the sender and the receiver, the network element comprising: means for changing the security setting level of the provisioning message; and means for transmitting the provisioning message to the receiver.

13. A network element according to claim 9, wherein the network element comprises: means for identifying a mobile station international subscriber directory number of the sender; and means for checking, on the basis of the mobile station international subscriber directory number of the sender, if the sender is authorized to change configuration settings in the receiver.

14. A network element according to claim 9, comprising: means for analysing a digital fingerprint of the provisioning message; and means for checking, on the basis of the digital fingerprint, if the sender is authorized to change configuration settings in the receiver.

15. A network element according to claim 9, further comprising: means for rejecting the whole provisioning message or one or more configuration settings in the provisioning message if the security level of the provisioning message fails to fulfil the security requirement of the configuration element.