CA2592702A1 - Use of configurations in device with multiple configurations - Google Patents
Use of configurations in device with multiple configurations Download PDFInfo
- Publication number
- CA2592702A1 CA2592702A1 CA002592702A CA2592702A CA2592702A1 CA 2592702 A1 CA2592702 A1 CA 2592702A1 CA 002592702 A CA002592702 A CA 002592702A CA 2592702 A CA2592702 A CA 2592702A CA 2592702 A1 CA2592702 A1 CA 2592702A1
- Authority
- CA
- Canada
- Prior art keywords
- access
- application
- configuration data
- data set
- processing device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
Abstract
The invention relates to a method for arranging use of configurations in a device with multiple configuration data sets manageable by one or more external managing entities. The device comprises access control information originated and/or controlled by an external managing entity for defining a right to access a configuration data set. The access control information is checked in response to an indication from an application requiring access to a configuration data set. If the application is, on the basis of the access control information, entitled to access the configuration data set, access to the configuration data set is arranged for the application.
Description
USE OF CONFIGURATIONS IN DEVICE WITH MULTIPLE CONFIGURATIONS
FIELD OF THE INVENTION
The invention relates to arranging use of configurations in devices with multiple configurations, more specifically to arranging access control into configuration data sets manageable by one or more external management de-vices.
BACKGROUND OF THE INVENTION
As different data processing devices, such as mobile stations, be-come more complex, the significance of device management becomes more pronounced. Devices require several different settings, such as settings related to Internet access points, and it is arduous and difficult for a user to set them manually. To solve this problem, device management solutions have been de-veloped so that the administrator of a company's information system or a teleoperator can set an appropriate configuration in the device. Device man-agement generally refers to actions by which a person not using the device can change the configuration of the device; for instance change the settings or even a protocol used by the device. In addition to device-specific settings, it is also possible to transmit user-specific data, such as user profiles, logos, ring-ing tones, and menus with which the user can personally modify the settings of the device, or the modification takes place automatically in connection with device management.
One of the device management standards is OMA (Open Mobile Al-liance) DM (Device management), which is partly based on the SyncML (Syn-chronization Markup Language) protocol. For instance, a personal computer (PC) may act as a device management server in a device management proto-col, and a mobile station as a device management client. The items managed in the device management client are arranged as management objects. The management objects are entities that can be managed by server management commands in the device management client. The management object can for instance be a number or a large entity, such as a background image or a screensaver. In OMA device management, the management objects are ar-ranged in a management tree.
Some typical manageable items comprise operator specific connec-tion settings, for instance GPRS (General Packet Radio Service) connection settings. By OMA DM procedures, these operator specific sets of settings, which may also be referred to as configurations, in a user terminal device can be maintained by an operator controlled management server. For instance, WAP (Wireless Application Protocol) settings for using WAP services of a ser-vice provider may be provisioned as a configuration context for the terminal device.
Some managed items may comprise user specific and controlled in-formation, such as screen savers and ringing tones. Further, the device may be used for accessing a corporate information system, for instance a file sys-tem, intranet pages and an e-mail system therein. For this purpose the device needs to comprise one or more configurations for arranging access to these corporate information system services. For security purposes it is desirable for corporate IT personnel to be able to control these settings. Therefore, a device may comprise multiple configurations from different managing parties and it should be possible to enable access to a specific configuration only for an au-thorized management party. In accordance with the OMA DM protocol, speci-fied in OMA specification "SyncML Device Management Protocol", version 1.1.2, 12 December 2003, 41 pages, in the set-up phase of a management session, a management server is authenticated on the basis of credentials re-ceived from the management server. Further, as illustrated in OMA specifica-tion "SyncML Management Tree and Description", version 1.1.2, 2 December 2003, 44 pages, a node of a management tree may be specified by an access control list (ACL) comprising a list of identifiers and access rights associated with each identifier. As described in Chapter 7.7.1, the access rights granted by ACL define management server identifiers authorized to get, add, replace, and/or remove a node. Thus, different access rights may be given to various device management servers, and device management commands from non-entitled management servers are not performed on the management tree.
However, besides a capability to control access of management servers to nodes of a management tree, a general need further exists to limit the use of the configurations in the device. For instance, companies wish to control termi-nals used for accessing company IT services in a better way in order to protect corporate data and services.
FIELD OF THE INVENTION
The invention relates to arranging use of configurations in devices with multiple configurations, more specifically to arranging access control into configuration data sets manageable by one or more external management de-vices.
BACKGROUND OF THE INVENTION
As different data processing devices, such as mobile stations, be-come more complex, the significance of device management becomes more pronounced. Devices require several different settings, such as settings related to Internet access points, and it is arduous and difficult for a user to set them manually. To solve this problem, device management solutions have been de-veloped so that the administrator of a company's information system or a teleoperator can set an appropriate configuration in the device. Device man-agement generally refers to actions by which a person not using the device can change the configuration of the device; for instance change the settings or even a protocol used by the device. In addition to device-specific settings, it is also possible to transmit user-specific data, such as user profiles, logos, ring-ing tones, and menus with which the user can personally modify the settings of the device, or the modification takes place automatically in connection with device management.
One of the device management standards is OMA (Open Mobile Al-liance) DM (Device management), which is partly based on the SyncML (Syn-chronization Markup Language) protocol. For instance, a personal computer (PC) may act as a device management server in a device management proto-col, and a mobile station as a device management client. The items managed in the device management client are arranged as management objects. The management objects are entities that can be managed by server management commands in the device management client. The management object can for instance be a number or a large entity, such as a background image or a screensaver. In OMA device management, the management objects are ar-ranged in a management tree.
Some typical manageable items comprise operator specific connec-tion settings, for instance GPRS (General Packet Radio Service) connection settings. By OMA DM procedures, these operator specific sets of settings, which may also be referred to as configurations, in a user terminal device can be maintained by an operator controlled management server. For instance, WAP (Wireless Application Protocol) settings for using WAP services of a ser-vice provider may be provisioned as a configuration context for the terminal device.
Some managed items may comprise user specific and controlled in-formation, such as screen savers and ringing tones. Further, the device may be used for accessing a corporate information system, for instance a file sys-tem, intranet pages and an e-mail system therein. For this purpose the device needs to comprise one or more configurations for arranging access to these corporate information system services. For security purposes it is desirable for corporate IT personnel to be able to control these settings. Therefore, a device may comprise multiple configurations from different managing parties and it should be possible to enable access to a specific configuration only for an au-thorized management party. In accordance with the OMA DM protocol, speci-fied in OMA specification "SyncML Device Management Protocol", version 1.1.2, 12 December 2003, 41 pages, in the set-up phase of a management session, a management server is authenticated on the basis of credentials re-ceived from the management server. Further, as illustrated in OMA specifica-tion "SyncML Management Tree and Description", version 1.1.2, 2 December 2003, 44 pages, a node of a management tree may be specified by an access control list (ACL) comprising a list of identifiers and access rights associated with each identifier. As described in Chapter 7.7.1, the access rights granted by ACL define management server identifiers authorized to get, add, replace, and/or remove a node. Thus, different access rights may be given to various device management servers, and device management commands from non-entitled management servers are not performed on the management tree.
However, besides a capability to control access of management servers to nodes of a management tree, a general need further exists to limit the use of the configurations in the device. For instance, companies wish to control termi-nals used for accessing company IT services in a better way in order to protect corporate data and services.
BRIEF DESCRIPTION OF THE INVENTION
A method, a device management system, data processing devices, and a computer program product are now provided, which are characterized by what is stated in the independent claims. Some embodiments of the invention are described in the dependent claims.
According to an aspect of the invention, a device with multiple con-figuration data sets comprises access control information originated and/or controlled by an external managing entity for defining a right of an application to access a configuration data set. The access control information is checked in response to an indication from an application requiring access to a configu-ration data set. If the application is, on the basis of the access control informa-tion, entitled to access the configuration data set, access to the configuration data set is arranged for the application.
The term "configuration data set" generally refers to a set of data comprising configuration information having direct or indirect effect on one or more functions of the device or an application in the device. For instance, the configuration data set may comprise an IP address or a domain name of a server on the basis of which a connection is arranged from the device.
The invention makes it possible to control access of applications to configuration data. More particularly, access rights may be specified and/or controlled by an external entity. A device may comprise multiple configuration data sets with different access control properties. For instance, a configuration data set specifying access settings for a corporate information system may be controlled by configuration management software operated by corporate IT
personnel.
According to an embodiment, at least one service context is stored in the device, wherein the service context comprises at least the configuration data set. Access to the service context is allowed for the application on the basis of the access control information only if the application is, by the external managing entity, predetermined in access control information associated with the service context. Various usage contexts, possibly comprising also non-settings related data, such as user related data stored by an application in the device, may then be provided in the device.
A method, a device management system, data processing devices, and a computer program product are now provided, which are characterized by what is stated in the independent claims. Some embodiments of the invention are described in the dependent claims.
According to an aspect of the invention, a device with multiple con-figuration data sets comprises access control information originated and/or controlled by an external managing entity for defining a right of an application to access a configuration data set. The access control information is checked in response to an indication from an application requiring access to a configu-ration data set. If the application is, on the basis of the access control informa-tion, entitled to access the configuration data set, access to the configuration data set is arranged for the application.
The term "configuration data set" generally refers to a set of data comprising configuration information having direct or indirect effect on one or more functions of the device or an application in the device. For instance, the configuration data set may comprise an IP address or a domain name of a server on the basis of which a connection is arranged from the device.
The invention makes it possible to control access of applications to configuration data. More particularly, access rights may be specified and/or controlled by an external entity. A device may comprise multiple configuration data sets with different access control properties. For instance, a configuration data set specifying access settings for a corporate information system may be controlled by configuration management software operated by corporate IT
personnel.
According to an embodiment, at least one service context is stored in the device, wherein the service context comprises at least the configuration data set. Access to the service context is allowed for the application on the basis of the access control information only if the application is, by the external managing entity, predetermined in access control information associated with the service context. Various usage contexts, possibly comprising also non-settings related data, such as user related data stored by an application in the device, may then be provided in the device.
BRIEF DESCRIPTION OF THE FIGURES
The invention is now described in greater detail by means of some embodiments and with reference to the attached drawings, in which Figure 1 illustrates a management system, Figure-2 illustrates a device with multiple configurations, Figure 3 illustrates a method according to an embodiment of the in-vention; and Figures 4a and 4b illustrate a method according to an embodiment of the invention.
DETAILED DESCRIPTION OF SOME EMBODIMENTS OF THE INVENTION
One embodiment of the invention will be described in the following in a system supporting OMA device management; it should, however, be noted that the invention can be applied to any device management system in which configurations in a managed device may be managed by an external man-agement entity.
Figure 1 illustrates a networked system. A network server or a PC
typically serves as a server S. For instance, a mobile station, PC, laptop com-puter, a PDA (Personal Digital Assistant) device, or a module thereto may serve as a terminal TE. In the following embodiments, it is assumed that for device management, the terminal TE serves as a device management client and the server S as a device management server. The server S can manage several clients TE.
In the first example of Figure 1 clients TE and management servers S are connected to a local area network LAN. A client TE connected to the network LAN comprises a functionality, such as a network card and software controlling data transmission, for communicating with the devices in the net-work LAN. The local area network LAN can be any kind of local area network and TE can also be connected to the server S through the Internet typically using a firewall FW. The terminal TE can also be connected to the local area network LAN wirelessly through an access point AP.
In the second example, the client TE communicates with the server S through a mobile network MNW. A terminal TE connected to the network MNW comprises a mobile station functionality for communicating wirelessly with the network MNW. There may also be other networks, such as a local area network LAN, between the mobile network MNW and the server S. The mobile network MNW can be any wireless network, for instance a network sup-porting GSM services, a network supporting GPRS (General Packet Radio Service) services, a third-generation mobile network, such as a network ac-cording to the network specifications of 3GPP (3d Generation Partnership Pro-ject), a wireless local area network WLAN, a private network, or a combination of several networks. In addition to the examples above, many other device management configurations are also possible, such as a management connec-tion between terminals TE or a direct management connection between the terminal TE and server S by using a wireless or a wired connection with no other network elements.
The terminal TE and the server S comprise memory, a user inter-face, I/O means for data transmission, and a central processing unit compris-ing one or more processors. The memory has a non-volatile portion for storing applications controlling the central processing unit and for other information to be stored, and a volatile portion to be used in temporary data processing.
Computer program code portions executed in the central processing unit can cause the server S to implement the inventive means for establishing and managing service contexts in the terminal TE, some embodiments of which are illustrated in connection with Figure 4a. Computer program code portions executed in the central processing unit of the terminal TE can cause the terminal TE also to implement the inventive means for arranging configura-tions into the terminal and for arranging use of configurations in the terminal TE, some embodiments of which are illustrated in connection with Figures 2, 3, 4a, and 4b. It is to be noted that one or more entities may carry out the inven-tive functions. For instance, some of the features illustrated in Figure 3 are car-ried out by a specific access controller in the terminal TE, whereas some other features are carried out by an application in the terminal TE. The computer program can be stored on any storage medium, from which it can be loaded into the memory of the device TE; S running the computer program. The com-puter program can also be loaded through the network by using a TCP/IP pro-tocol stack, for instance. It is also possible to use hardware solutions or a combination of hardware and software solutions to implement the inventive means. A chip unit or some other type of module for controlling the device TE
and/or S may, in one embodiment, cause the device TE and/or S to perform the inventive functions. A data structure comprising service context specific information can be transferred over a data transmission network, for instance, from the server S to the terminal TE and stored in the memory of the terminal TE.
In one embodiment, the terminal TE and the server S are arranged to support the OMA device management (DM). The terminal TE serving as an OMA device management client comprises a client agent functionality that takes care of functions related to the management session in the client. The server S serving as a device management server comprises a server agent or a server master functionality managing the management session. However, it is to be noted that the application of these functionalities is not limited to any specific devices, and it is even possible that the client and server functionalities are implemented in a single physical device. One or more management trees stored in the memory of TE represents the manageable objects in the terminal TE. The management tree is made up of nodes and it defines at least one management object formed of one or more nodes or at least one parameter of a node. The node can be an individual parameter, a subtree or a data collec-tion. The node may comprise at least one parameter that may be a configura-tion value or a file, such as a background image file in the node. The contents of the node can also be a link to another node. Each node can be addressed by a uniform resource identifier (URI). An authorized device management server can add (dynamic) and change contents of nodes in the management tree.
Figure 2 illustrates a terminal TE environment 200 with multiple con-figurations. The environment 200 is provided with one or more service contexts 203. A service context 203 may be regarded as an area in the terminal TE to which access is controlled. Hence, information stored in a service context spe-cific storage area in the terminal TE may specify or form the service context 203. In one embodiment service contexts 203 represent different configura-tions in the terminal TE used for accessing services, for instance an Inte.rnet access service. As illustrated by arrows from the service context 203, a service context 203 representing a configuration may comprise certificates 206, set-tings 205, and/or some other type of data 208 specific to the service context.
As illustrated in Figure 2, information belonging to a service context 203 may be stored in multiple storage locations, or in a single storage position. For in-stance, a service context 203 may comprise or be associated with sensitive user data 208 stored in a file system 207, settings 205 and certificates 206 stored in a central repository 204, which may be a specific storage for service context information. Data 208 belonging to a service context 203 may be any data received in the terminal TE or originated by an application 202. For in-stance, a user may enter a calendar entry which is stored as data 208 belong-ing to the service context 203.
A secure execution environment 201 may control access to service context 203 information, and storage positions comprising service context con-tents may be secured. Although not shown in Figure 2, the execution environ-ment 201 may comprise an access controller arranged to control access to service context information. An external management entity, in one embodi-ment of a service context manager 211, may grant rights for applications 202 to access information belonging to a service context 203. Access control in-formation (ACI) 212 originated and/or controlled by the external management entity (211) may be stored in the terminal TE for defining rights to access ser-vice contexts 203. Further, the execution environment 201 may attend to se-curing data transfer between the application 202 authorized to access the ser-vice context 203 and one ore more storage positions comprising the service context information. In one embodiment, at least some security services are arranged by an operating system of the terminal TE.
Applications 202 may be executed inside the secure execution envi-ronment 201 of the terminal environment 200. Access to one or more service contexts 203 is arranged for an application 202 in order to initiate a service for a user of the terminal TE, if the access control information 212 enables this.
This access control information 212 may be defined in many ways in the termi-nal TE. For instance, a file identifying entities entitled to access a service con-text 203 may be stored in the terminal TE, and the terminal TE is arranged to provide access to the service context 203 only for entities directiy or indirectly identified in the file. The access control informatiori 212 could be defined in terminal TE as parameters for a software component implementing service context access control functions, for instance. Thus, the terminal TE is pro-vided with access control rules for defining entitlement to access a service con-text 203. The access control information file may be a list of application identi-fiers or a list of application source identifiers. However, instead of or in addition to application identifiers, the access control information could specify access control information of other entities in the terminal TE, such as application groups or application execution environments. The access control information 212 may be service context or service context group specific. For instance, access control information 212 may comprise a plurality of different profiles for corporate access, tailored for different usage situations. In one embodiment, this administrative access control information 212 belongs to the service con-text information.
In accordance with an embodiment, a certificate 206 of an applica-tion 202 is checked in order to reliably define an identifier associated with the application 202. On the basis of this identifier, the terminal TE is then arranged to check whether or not the application 202 is entitled to access the service context 203. These certificates 206 may be stored within service context infor-mation (for instance the certificate 206 in the central repository 204) and/or outside the service context 203, for instance within application 202 data in the file system 207. The certificate 206 is associated with at least one application 202 in the terminal TE. The certificate 206 has been issued and digitally signed by a trusted third party, such as a general certification authority or an applica-tion developer, to prove the integrity and source of the associated application 202. The certificate 206 could be obtained for the terminal TE separately from the access control information 212, for instance during installation of applica-tion, or it may even form a part of the service context information or access control information from the managing entity. It is to be noted that the certifi-cate 206 may in one embodiment be acquired during the access control pro-cedure for checking the right of the application 206 to access certain service context 203. The certificate 206 may include at least some of the following: a name of the certificate holder, a serial number, an expiration date, a copy of the certificate holder's public key, and the digital signature of the issuer so that a recipient can verify that the certificate is authentic.
As also illustrated by the broken lines in Figure 2, the service con-texts 203 may be managed by the external authorized managing entity 211.
This may mean that some or all of the information belonging to the service context 203 may be read, added, modified, and/or removed by the external managing entity 211. In one embodiment, the OMA DM is applied to managing service contexts 203. At least some of the service context 203 information may be stored in a management tree, which is modified by a device management agent on the basis of device management commands from an OMA device management server (S).
Figure 3 illustrates a method of an embodiment for using service contexts in terminal TE. In step 301, there may be a need to initiate a service by an application 202 such that the application 202 requires information stored under one or more service contexts 203 for service set-up, or for some other purpose. This need typically arises based on a user input, but a service may also be initiated based on some other trigger, such as a command from an ex-ternal device. Service contexts 203 available for the service may be checked in step 302. If the check 302, 303 reveals more than one available service con-text 203, a preferred service context 203 is selected 305. For instance, the terminal TE may store a preference list indicating the service contexts 203 in a preference order. A default service context 203 could be selected in step 305.
Otherwise, an available service context 203 is selected 304. The application 202, or an application manager, may be adapted to perform steps 301 to 305.
Although not shown in Figure 3, it is to be noted that the service context selec-tion procedure may involve prompting a user of the terminal TE to select a ser-vice context and/or to confirm the selection of the service context.
The method then proceeds to step 306, wherein access to a se-lected service context is requested or a need to access the service context specific data is otherwise indicated. On the basis of access control information 212 from and/or controlled by a managing entity, it is checked 307 whether the application 202 is authorized to access the service context 203. The relevant access control information 212 may be obtained from the memory of the TE, or in one embodiment the terminal TE may be arranged to request and receive access control information from an external entity, such as the external manag-ing entity 212. The managing entity may be the service context manager 211 or some other entity, for instance an entity that has issued the certificate 206. If the application 202 is not authorized, access for the application 202'is denied 308 to the service context 203.
According to an embodiment, step 307 comprises two sub-steps.
First, a certificate 206 associated with the application 202 requiring access to the service context 203 is checked. By checking the certificate 206 it is possi-ble to ensure the integrity and/or source of the application 202. In a second sub-step, an identifier obtained from the application's 202 certificate 206 is compared with identifiers in predetermined access control information 212. An application source identifier from the certificate 206 may in one embodiment be compared in the second sub-step with predetermined application source identi-fiers in the access control information 212. The access control information in the present embodiment specifies those applications, groups of applications or application sources that are authorized to use the service context 203.
Thus, if the identifier from the certificate 206 of the application 202 can be found in the access control information 212, the application is authorized.
If the application 202 is authorized on the basis of a check 307, the application may access 309 information associated with the service context 203, and the application 202 may then initiate 310 the service on the basis of the associated service context information.
In one embodiment, the service context 203 comprises or is associ-ated with settings required for arranging a connection from the terminal TE to one or more network resources for accessing a service. Thus, the application 202 may in step 310 establish a connection using these settings. These set-tings could specify access to corporate intranet resources, such as an email server and an email account. However, also many other services exist for which the service context 203 may be used.
In an embodiment, the terminal TE comprises access controlled ap-plication (specific) data 208 belonging to or,associated with a service context 203 such that access to the application data 208 is arranged only for applica-tions 202 authorized by the external managing entity 211. This application data 208 is typically user related and stored by an application 202 in the terminal TE
on the basis of a user input. In step 310 the application data 208, such as a file comprising corporate e-mails, may be displayed and possibly further proc-essed by an application 202 (an e-mail client application in this example). .
A service context 203 may be selected or defined when using an application 202. A service context 203 may be selected when an application 202 is activated and/or when new contents are to be specified as service con-text information. For instance, when an e-mail application is activated, the user selects a desired profile or e-mail account, whereby a service context associ-ated with the profile or e-mail account is also selected. Thus, when the applica-tion 202 later requires access to service context 203 information, steps 302 to 305 are unnecessary but information in the associated service context 203 may be used, for instance for establishing a connection to a remote e-mail server. In another embodiment, a service context 203 may be specified for a user data item, such as an e-mail message. This service context 203 could be selected in connection with storing of a data item. For instance, when the user has finished preparing an e-mail item and selects to store the item, available service contexts 203 (for the e-mail application) are shown to the user. The user may then select the service context 203 with which the data item is to be associated and thus possibly the storage position of the data item, and the data item is stored accordingly. Later, the data item may be used as any other service context 203 specific data, i.e. access to the data item is allowed only for authorized applications 202.
In one embodiment, access to the service contexts 203 is controlled (steps 307 to 309) by a security procedure in the secure execution environ-ment 201, such as a specific access controller entity. It is also feasible that the execution environment 201 checks 303 and selects 304, 305 a service context "203 for the application 202. A specific service context selector may be pro-vided in the secure execution environment 201.
In another embodiment, service contexts 203 available for the appli-cation 202 requiring access to the service context 203 are checked already in step 302. In this embodiment, only service contexts 203 for which the certifi-cate of the application 202 allows access (or for which the application has ac-cess authorization by some other means) are considered for the service. In this embodiment, access to a service context 203 is attempted only by authorized applications 202 and unnecessary requests are thus avoided.
Figures 4a and 4b illustrate a method for establishing and/or modify-ing a service context 203 in the terminal TE by the server S according to an embodiment. In Figure 4a, features of the server S functioning as the device management server are illustrated. In step 401, a need exists to create a new service context 203 and/or to modify an existing service context 203 in the managed terminal device TE. In another embodiment, a need exists to add or modify access control information 212 related to a service context 203.
A device management session is then arranged 402 between the device management server functionality in the server S and the device man-agement client functionality in the terminal TE. Conventional OMA DM session establishment functions illustrated in the OMA specification "SyncML Device Management ProtocoP', version 1.1.2, 12 December 2003, 41 pages, may be utilized.
Service context related information, for instance connection settings 205, and/or access control information 212, are specified 403 in one or more device management commands. In the present embodiment, at least some of the service context information in the device management command(s) is ad-dressed to one or more service context specific device management tree nodes. The management command is transmitted 404 to the terminal TE.
Figure 4b illustrates functions in the terminal TE receiving service context related information. In step 410, a device management command is received from a device management server (S). The service context related data, including access control information, may be stored in the terminal TE.
More specifically, in step 411 the device management client in the terminal TE
defines the required actions on the basis of the received device management command. The device management tree in the terminal TE may then be modi-fied by the new and/or modified information related to the service context 203.
For instance, a new node may be added with an ACL list defining the server S
as being the only authorized device management server to modify the node. It is to be noted that the management tree may only serve as a view to the man-aged information, whereby the managed information may be stored outside the management tree.
If the service context 203 is created for the first time and device management has not been provisioned for the terminal TE, OMA client provi-sioning methods may be used first to initiate and configure the device man-agement before service context specific management commands. Thus, in steps 402 and 410, a connection for arranging provisioning may be utilized.
The management tree may comprise one or more nodes for access control information 212, even if the access control information 212 is not part of the service context 203. In a manner similar to that illustrated above, by utiliz-ing a device management command addressed to a node for access control information 212, it is possible to arrange the modification, deletion, or addition of access control information 212. Thus, an external managing entity may eas-ily change the access control configuration in the managed device TE. It is to be noted that Figures 4a and 4b are only exemplary. For instance, the device management command could be formed before the establishment of the man-agement session. In one embodiment, a service context 203 may be created or modified by an authorized party in the terminal TE, for instance a user.
Simi-lar procedures as already illustrated in connection with Figure 3, steps 306-may be utilized when accessing service context information. It is thus unnec-essary to apply device management mechanisms to modify service context 203 information.
In one embodiment, the service context manager 211 or a service provider, in the embodiment of Figure 4a the server S, may check that a suit-able service context is in place and/or used appropriately in the terminal TE.
The service provider may thus check that correct settings are in place and only applications from a trusted source are used. This check could be implemented by using OMA DM GET commands to the nodes comprising this service con-text data. This embodiment may be implemented after steps 404 and 412 or at some other point of time, for instance after receiving a service request from an application 202 in the terminal TE.
In steps 402, 403, 410, and 411, it is possible to utilize the mecha-nisms of the device management protocol and the messages defined for it; for a more detailed description of the OMA device management protocol and other commands, for instance, reference is made to the OMA specification "SyncML
Device Management Protocol", version 1.1.2, 12 December 2003, 41 pages, and the OMA specification "SyncML Representation Protocol Device Manage-ment Usage", version 1.1.2, 12 June 2003, 39 pages.
In accordance with an embodiment, the contents, of a service con-text 203 may be associated with different access control rules and/or access right levels on the basis of the access control information 212. In a further em-bodiment, different access rules are applied to different portions of the service context 203. For instance, settings 205 of the service context 203 specifying a connection to a corporate email server may be read (by an application 202 au-thorized to access the service context 203) but not modified, whereas access to data 208 in a file system 207 associated with the service context 203 may be both read and modified. In this embodiment, the contents of service con-texts 203 may be differentiated in respect of access control.
Some exemplary rules that may be applied as the above-illustrated embodiment are: right to read (all or only a specific part of the service context data), right to remove, and right to add. The access control rules and/or right levels may be specified within the access control information 212 or some other storage. In one embodiment, access policies are specified by XACML
(Extensible Access Markup Language). If OMA DM is applied, access control lists may be specified in a management tree for determining one or more ex-ternal device management servers authorized to access associated service context related data, i.e. the external management entities may be specified by OMA DM access control lists.
In an alternative or complementing embodiment, different access control rules are associated with different users of the service contexts 203 on the basis of the access control information 212. In this embodiment, it is possi-ble to apply different access rights for different applications 202 and users of the terminal TE, for instance. As an example, a service context 203 (or part thereof) may be set to be modifiable only by the user of or the subscriber to the terminal TE and an external managing entity originating and/or controlling the service context 203.
In one embodiment, the user of or the subscriber to the terminal TE
is always entitled to remove or delete service contexts 203 from the terminal TE. Since a service context 203 is required for obtaining a service, the terminal TE cannot be used for accessing the service after the service context 203 has been deleted. Thus no full control needs to be given for any administrator 211 of a service context 203, and users do not have to give up a right to control their terminals. No service context needs to be forced to any terminal but the user/subscriber may wish to use a service and therefore accept a service con-text into the terminal TE. Since the service context 203 itself may be set to be modifiable only by the authorized management entity (211), it is possible to prevent access of the user to modify the service context 203.
In a further embodiment, a capability to inform the authorized man-aging entity 211 about user deleted service contexts 203 is provided. A
feature or application 203 handling deletion of a service context 203 on the basis of a user input may be configured to transmit a message to the authorized manag-ing entity 211 informing about the deletion of the service context 203 from the terminal TE. In another embodiment, the authorized managing entity 211 is configured to check the service contexts 203 (which it is authorized to view) in the terminal TE in order to detect deleted ones. For instance, periodic checks.
may be performed by OMA DM procedures on the nodes comprising service context data.
It should be noted that the embodiments described above could also be applied in any combination thereof. It is apparent to a person skilled in the art that while technology advances, the basic idea of the invention can be implemented in many different ways. The invention and its embodiments are thus not restricted to the examples described above, but can vary within the scope of the claims.
The invention is now described in greater detail by means of some embodiments and with reference to the attached drawings, in which Figure 1 illustrates a management system, Figure-2 illustrates a device with multiple configurations, Figure 3 illustrates a method according to an embodiment of the in-vention; and Figures 4a and 4b illustrate a method according to an embodiment of the invention.
DETAILED DESCRIPTION OF SOME EMBODIMENTS OF THE INVENTION
One embodiment of the invention will be described in the following in a system supporting OMA device management; it should, however, be noted that the invention can be applied to any device management system in which configurations in a managed device may be managed by an external man-agement entity.
Figure 1 illustrates a networked system. A network server or a PC
typically serves as a server S. For instance, a mobile station, PC, laptop com-puter, a PDA (Personal Digital Assistant) device, or a module thereto may serve as a terminal TE. In the following embodiments, it is assumed that for device management, the terminal TE serves as a device management client and the server S as a device management server. The server S can manage several clients TE.
In the first example of Figure 1 clients TE and management servers S are connected to a local area network LAN. A client TE connected to the network LAN comprises a functionality, such as a network card and software controlling data transmission, for communicating with the devices in the net-work LAN. The local area network LAN can be any kind of local area network and TE can also be connected to the server S through the Internet typically using a firewall FW. The terminal TE can also be connected to the local area network LAN wirelessly through an access point AP.
In the second example, the client TE communicates with the server S through a mobile network MNW. A terminal TE connected to the network MNW comprises a mobile station functionality for communicating wirelessly with the network MNW. There may also be other networks, such as a local area network LAN, between the mobile network MNW and the server S. The mobile network MNW can be any wireless network, for instance a network sup-porting GSM services, a network supporting GPRS (General Packet Radio Service) services, a third-generation mobile network, such as a network ac-cording to the network specifications of 3GPP (3d Generation Partnership Pro-ject), a wireless local area network WLAN, a private network, or a combination of several networks. In addition to the examples above, many other device management configurations are also possible, such as a management connec-tion between terminals TE or a direct management connection between the terminal TE and server S by using a wireless or a wired connection with no other network elements.
The terminal TE and the server S comprise memory, a user inter-face, I/O means for data transmission, and a central processing unit compris-ing one or more processors. The memory has a non-volatile portion for storing applications controlling the central processing unit and for other information to be stored, and a volatile portion to be used in temporary data processing.
Computer program code portions executed in the central processing unit can cause the server S to implement the inventive means for establishing and managing service contexts in the terminal TE, some embodiments of which are illustrated in connection with Figure 4a. Computer program code portions executed in the central processing unit of the terminal TE can cause the terminal TE also to implement the inventive means for arranging configura-tions into the terminal and for arranging use of configurations in the terminal TE, some embodiments of which are illustrated in connection with Figures 2, 3, 4a, and 4b. It is to be noted that one or more entities may carry out the inven-tive functions. For instance, some of the features illustrated in Figure 3 are car-ried out by a specific access controller in the terminal TE, whereas some other features are carried out by an application in the terminal TE. The computer program can be stored on any storage medium, from which it can be loaded into the memory of the device TE; S running the computer program. The com-puter program can also be loaded through the network by using a TCP/IP pro-tocol stack, for instance. It is also possible to use hardware solutions or a combination of hardware and software solutions to implement the inventive means. A chip unit or some other type of module for controlling the device TE
and/or S may, in one embodiment, cause the device TE and/or S to perform the inventive functions. A data structure comprising service context specific information can be transferred over a data transmission network, for instance, from the server S to the terminal TE and stored in the memory of the terminal TE.
In one embodiment, the terminal TE and the server S are arranged to support the OMA device management (DM). The terminal TE serving as an OMA device management client comprises a client agent functionality that takes care of functions related to the management session in the client. The server S serving as a device management server comprises a server agent or a server master functionality managing the management session. However, it is to be noted that the application of these functionalities is not limited to any specific devices, and it is even possible that the client and server functionalities are implemented in a single physical device. One or more management trees stored in the memory of TE represents the manageable objects in the terminal TE. The management tree is made up of nodes and it defines at least one management object formed of one or more nodes or at least one parameter of a node. The node can be an individual parameter, a subtree or a data collec-tion. The node may comprise at least one parameter that may be a configura-tion value or a file, such as a background image file in the node. The contents of the node can also be a link to another node. Each node can be addressed by a uniform resource identifier (URI). An authorized device management server can add (dynamic) and change contents of nodes in the management tree.
Figure 2 illustrates a terminal TE environment 200 with multiple con-figurations. The environment 200 is provided with one or more service contexts 203. A service context 203 may be regarded as an area in the terminal TE to which access is controlled. Hence, information stored in a service context spe-cific storage area in the terminal TE may specify or form the service context 203. In one embodiment service contexts 203 represent different configura-tions in the terminal TE used for accessing services, for instance an Inte.rnet access service. As illustrated by arrows from the service context 203, a service context 203 representing a configuration may comprise certificates 206, set-tings 205, and/or some other type of data 208 specific to the service context.
As illustrated in Figure 2, information belonging to a service context 203 may be stored in multiple storage locations, or in a single storage position. For in-stance, a service context 203 may comprise or be associated with sensitive user data 208 stored in a file system 207, settings 205 and certificates 206 stored in a central repository 204, which may be a specific storage for service context information. Data 208 belonging to a service context 203 may be any data received in the terminal TE or originated by an application 202. For in-stance, a user may enter a calendar entry which is stored as data 208 belong-ing to the service context 203.
A secure execution environment 201 may control access to service context 203 information, and storage positions comprising service context con-tents may be secured. Although not shown in Figure 2, the execution environ-ment 201 may comprise an access controller arranged to control access to service context information. An external management entity, in one embodi-ment of a service context manager 211, may grant rights for applications 202 to access information belonging to a service context 203. Access control in-formation (ACI) 212 originated and/or controlled by the external management entity (211) may be stored in the terminal TE for defining rights to access ser-vice contexts 203. Further, the execution environment 201 may attend to se-curing data transfer between the application 202 authorized to access the ser-vice context 203 and one ore more storage positions comprising the service context information. In one embodiment, at least some security services are arranged by an operating system of the terminal TE.
Applications 202 may be executed inside the secure execution envi-ronment 201 of the terminal environment 200. Access to one or more service contexts 203 is arranged for an application 202 in order to initiate a service for a user of the terminal TE, if the access control information 212 enables this.
This access control information 212 may be defined in many ways in the termi-nal TE. For instance, a file identifying entities entitled to access a service con-text 203 may be stored in the terminal TE, and the terminal TE is arranged to provide access to the service context 203 only for entities directiy or indirectly identified in the file. The access control informatiori 212 could be defined in terminal TE as parameters for a software component implementing service context access control functions, for instance. Thus, the terminal TE is pro-vided with access control rules for defining entitlement to access a service con-text 203. The access control information file may be a list of application identi-fiers or a list of application source identifiers. However, instead of or in addition to application identifiers, the access control information could specify access control information of other entities in the terminal TE, such as application groups or application execution environments. The access control information 212 may be service context or service context group specific. For instance, access control information 212 may comprise a plurality of different profiles for corporate access, tailored for different usage situations. In one embodiment, this administrative access control information 212 belongs to the service con-text information.
In accordance with an embodiment, a certificate 206 of an applica-tion 202 is checked in order to reliably define an identifier associated with the application 202. On the basis of this identifier, the terminal TE is then arranged to check whether or not the application 202 is entitled to access the service context 203. These certificates 206 may be stored within service context infor-mation (for instance the certificate 206 in the central repository 204) and/or outside the service context 203, for instance within application 202 data in the file system 207. The certificate 206 is associated with at least one application 202 in the terminal TE. The certificate 206 has been issued and digitally signed by a trusted third party, such as a general certification authority or an applica-tion developer, to prove the integrity and source of the associated application 202. The certificate 206 could be obtained for the terminal TE separately from the access control information 212, for instance during installation of applica-tion, or it may even form a part of the service context information or access control information from the managing entity. It is to be noted that the certifi-cate 206 may in one embodiment be acquired during the access control pro-cedure for checking the right of the application 206 to access certain service context 203. The certificate 206 may include at least some of the following: a name of the certificate holder, a serial number, an expiration date, a copy of the certificate holder's public key, and the digital signature of the issuer so that a recipient can verify that the certificate is authentic.
As also illustrated by the broken lines in Figure 2, the service con-texts 203 may be managed by the external authorized managing entity 211.
This may mean that some or all of the information belonging to the service context 203 may be read, added, modified, and/or removed by the external managing entity 211. In one embodiment, the OMA DM is applied to managing service contexts 203. At least some of the service context 203 information may be stored in a management tree, which is modified by a device management agent on the basis of device management commands from an OMA device management server (S).
Figure 3 illustrates a method of an embodiment for using service contexts in terminal TE. In step 301, there may be a need to initiate a service by an application 202 such that the application 202 requires information stored under one or more service contexts 203 for service set-up, or for some other purpose. This need typically arises based on a user input, but a service may also be initiated based on some other trigger, such as a command from an ex-ternal device. Service contexts 203 available for the service may be checked in step 302. If the check 302, 303 reveals more than one available service con-text 203, a preferred service context 203 is selected 305. For instance, the terminal TE may store a preference list indicating the service contexts 203 in a preference order. A default service context 203 could be selected in step 305.
Otherwise, an available service context 203 is selected 304. The application 202, or an application manager, may be adapted to perform steps 301 to 305.
Although not shown in Figure 3, it is to be noted that the service context selec-tion procedure may involve prompting a user of the terminal TE to select a ser-vice context and/or to confirm the selection of the service context.
The method then proceeds to step 306, wherein access to a se-lected service context is requested or a need to access the service context specific data is otherwise indicated. On the basis of access control information 212 from and/or controlled by a managing entity, it is checked 307 whether the application 202 is authorized to access the service context 203. The relevant access control information 212 may be obtained from the memory of the TE, or in one embodiment the terminal TE may be arranged to request and receive access control information from an external entity, such as the external manag-ing entity 212. The managing entity may be the service context manager 211 or some other entity, for instance an entity that has issued the certificate 206. If the application 202 is not authorized, access for the application 202'is denied 308 to the service context 203.
According to an embodiment, step 307 comprises two sub-steps.
First, a certificate 206 associated with the application 202 requiring access to the service context 203 is checked. By checking the certificate 206 it is possi-ble to ensure the integrity and/or source of the application 202. In a second sub-step, an identifier obtained from the application's 202 certificate 206 is compared with identifiers in predetermined access control information 212. An application source identifier from the certificate 206 may in one embodiment be compared in the second sub-step with predetermined application source identi-fiers in the access control information 212. The access control information in the present embodiment specifies those applications, groups of applications or application sources that are authorized to use the service context 203.
Thus, if the identifier from the certificate 206 of the application 202 can be found in the access control information 212, the application is authorized.
If the application 202 is authorized on the basis of a check 307, the application may access 309 information associated with the service context 203, and the application 202 may then initiate 310 the service on the basis of the associated service context information.
In one embodiment, the service context 203 comprises or is associ-ated with settings required for arranging a connection from the terminal TE to one or more network resources for accessing a service. Thus, the application 202 may in step 310 establish a connection using these settings. These set-tings could specify access to corporate intranet resources, such as an email server and an email account. However, also many other services exist for which the service context 203 may be used.
In an embodiment, the terminal TE comprises access controlled ap-plication (specific) data 208 belonging to or,associated with a service context 203 such that access to the application data 208 is arranged only for applica-tions 202 authorized by the external managing entity 211. This application data 208 is typically user related and stored by an application 202 in the terminal TE
on the basis of a user input. In step 310 the application data 208, such as a file comprising corporate e-mails, may be displayed and possibly further proc-essed by an application 202 (an e-mail client application in this example). .
A service context 203 may be selected or defined when using an application 202. A service context 203 may be selected when an application 202 is activated and/or when new contents are to be specified as service con-text information. For instance, when an e-mail application is activated, the user selects a desired profile or e-mail account, whereby a service context associ-ated with the profile or e-mail account is also selected. Thus, when the applica-tion 202 later requires access to service context 203 information, steps 302 to 305 are unnecessary but information in the associated service context 203 may be used, for instance for establishing a connection to a remote e-mail server. In another embodiment, a service context 203 may be specified for a user data item, such as an e-mail message. This service context 203 could be selected in connection with storing of a data item. For instance, when the user has finished preparing an e-mail item and selects to store the item, available service contexts 203 (for the e-mail application) are shown to the user. The user may then select the service context 203 with which the data item is to be associated and thus possibly the storage position of the data item, and the data item is stored accordingly. Later, the data item may be used as any other service context 203 specific data, i.e. access to the data item is allowed only for authorized applications 202.
In one embodiment, access to the service contexts 203 is controlled (steps 307 to 309) by a security procedure in the secure execution environ-ment 201, such as a specific access controller entity. It is also feasible that the execution environment 201 checks 303 and selects 304, 305 a service context "203 for the application 202. A specific service context selector may be pro-vided in the secure execution environment 201.
In another embodiment, service contexts 203 available for the appli-cation 202 requiring access to the service context 203 are checked already in step 302. In this embodiment, only service contexts 203 for which the certifi-cate of the application 202 allows access (or for which the application has ac-cess authorization by some other means) are considered for the service. In this embodiment, access to a service context 203 is attempted only by authorized applications 202 and unnecessary requests are thus avoided.
Figures 4a and 4b illustrate a method for establishing and/or modify-ing a service context 203 in the terminal TE by the server S according to an embodiment. In Figure 4a, features of the server S functioning as the device management server are illustrated. In step 401, a need exists to create a new service context 203 and/or to modify an existing service context 203 in the managed terminal device TE. In another embodiment, a need exists to add or modify access control information 212 related to a service context 203.
A device management session is then arranged 402 between the device management server functionality in the server S and the device man-agement client functionality in the terminal TE. Conventional OMA DM session establishment functions illustrated in the OMA specification "SyncML Device Management ProtocoP', version 1.1.2, 12 December 2003, 41 pages, may be utilized.
Service context related information, for instance connection settings 205, and/or access control information 212, are specified 403 in one or more device management commands. In the present embodiment, at least some of the service context information in the device management command(s) is ad-dressed to one or more service context specific device management tree nodes. The management command is transmitted 404 to the terminal TE.
Figure 4b illustrates functions in the terminal TE receiving service context related information. In step 410, a device management command is received from a device management server (S). The service context related data, including access control information, may be stored in the terminal TE.
More specifically, in step 411 the device management client in the terminal TE
defines the required actions on the basis of the received device management command. The device management tree in the terminal TE may then be modi-fied by the new and/or modified information related to the service context 203.
For instance, a new node may be added with an ACL list defining the server S
as being the only authorized device management server to modify the node. It is to be noted that the management tree may only serve as a view to the man-aged information, whereby the managed information may be stored outside the management tree.
If the service context 203 is created for the first time and device management has not been provisioned for the terminal TE, OMA client provi-sioning methods may be used first to initiate and configure the device man-agement before service context specific management commands. Thus, in steps 402 and 410, a connection for arranging provisioning may be utilized.
The management tree may comprise one or more nodes for access control information 212, even if the access control information 212 is not part of the service context 203. In a manner similar to that illustrated above, by utiliz-ing a device management command addressed to a node for access control information 212, it is possible to arrange the modification, deletion, or addition of access control information 212. Thus, an external managing entity may eas-ily change the access control configuration in the managed device TE. It is to be noted that Figures 4a and 4b are only exemplary. For instance, the device management command could be formed before the establishment of the man-agement session. In one embodiment, a service context 203 may be created or modified by an authorized party in the terminal TE, for instance a user.
Simi-lar procedures as already illustrated in connection with Figure 3, steps 306-may be utilized when accessing service context information. It is thus unnec-essary to apply device management mechanisms to modify service context 203 information.
In one embodiment, the service context manager 211 or a service provider, in the embodiment of Figure 4a the server S, may check that a suit-able service context is in place and/or used appropriately in the terminal TE.
The service provider may thus check that correct settings are in place and only applications from a trusted source are used. This check could be implemented by using OMA DM GET commands to the nodes comprising this service con-text data. This embodiment may be implemented after steps 404 and 412 or at some other point of time, for instance after receiving a service request from an application 202 in the terminal TE.
In steps 402, 403, 410, and 411, it is possible to utilize the mecha-nisms of the device management protocol and the messages defined for it; for a more detailed description of the OMA device management protocol and other commands, for instance, reference is made to the OMA specification "SyncML
Device Management Protocol", version 1.1.2, 12 December 2003, 41 pages, and the OMA specification "SyncML Representation Protocol Device Manage-ment Usage", version 1.1.2, 12 June 2003, 39 pages.
In accordance with an embodiment, the contents, of a service con-text 203 may be associated with different access control rules and/or access right levels on the basis of the access control information 212. In a further em-bodiment, different access rules are applied to different portions of the service context 203. For instance, settings 205 of the service context 203 specifying a connection to a corporate email server may be read (by an application 202 au-thorized to access the service context 203) but not modified, whereas access to data 208 in a file system 207 associated with the service context 203 may be both read and modified. In this embodiment, the contents of service con-texts 203 may be differentiated in respect of access control.
Some exemplary rules that may be applied as the above-illustrated embodiment are: right to read (all or only a specific part of the service context data), right to remove, and right to add. The access control rules and/or right levels may be specified within the access control information 212 or some other storage. In one embodiment, access policies are specified by XACML
(Extensible Access Markup Language). If OMA DM is applied, access control lists may be specified in a management tree for determining one or more ex-ternal device management servers authorized to access associated service context related data, i.e. the external management entities may be specified by OMA DM access control lists.
In an alternative or complementing embodiment, different access control rules are associated with different users of the service contexts 203 on the basis of the access control information 212. In this embodiment, it is possi-ble to apply different access rights for different applications 202 and users of the terminal TE, for instance. As an example, a service context 203 (or part thereof) may be set to be modifiable only by the user of or the subscriber to the terminal TE and an external managing entity originating and/or controlling the service context 203.
In one embodiment, the user of or the subscriber to the terminal TE
is always entitled to remove or delete service contexts 203 from the terminal TE. Since a service context 203 is required for obtaining a service, the terminal TE cannot be used for accessing the service after the service context 203 has been deleted. Thus no full control needs to be given for any administrator 211 of a service context 203, and users do not have to give up a right to control their terminals. No service context needs to be forced to any terminal but the user/subscriber may wish to use a service and therefore accept a service con-text into the terminal TE. Since the service context 203 itself may be set to be modifiable only by the authorized management entity (211), it is possible to prevent access of the user to modify the service context 203.
In a further embodiment, a capability to inform the authorized man-aging entity 211 about user deleted service contexts 203 is provided. A
feature or application 203 handling deletion of a service context 203 on the basis of a user input may be configured to transmit a message to the authorized manag-ing entity 211 informing about the deletion of the service context 203 from the terminal TE. In another embodiment, the authorized managing entity 211 is configured to check the service contexts 203 (which it is authorized to view) in the terminal TE in order to detect deleted ones. For instance, periodic checks.
may be performed by OMA DM procedures on the nodes comprising service context data.
It should be noted that the embodiments described above could also be applied in any combination thereof. It is apparent to a person skilled in the art that while technology advances, the basic idea of the invention can be implemented in many different ways. The invention and its embodiments are thus not restricted to the examples described above, but can vary within the scope of the claims.
Claims (20)
1. A method for a device management system for arranging use of configurations in a device with multiple configuration data sets manageable by one or more external managing entities, and a plurality of applications, characterized in that the system comprises access control information originated and/or controlled by an external managing entity for defining a right to access a configuration data set, the method comprising:
checking the access control information in response to an indication from an application requiring access to a configuration data set, and in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set, arranging access to the configuration data set for the application.
checking the access control information in response to an indication from an application requiring access to a configuration data set, and in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set, arranging access to the configuration data set for the application.
2. A method as claimed in claim 1, characterized in that at least one service context is stored in the device, wherein the service context comprises at least the configuration data set and whereby access to the ser-vice context is allowed for the application on the basis of the access control information if the application is, by the external managing entity, predetermined in access control information associated with the service context.
3. A method as claimed in claim 1, characterized by arrang-ing selection of a configuration data set for the application in response a plural-ity of configuration data sets being available for the application.
4. A method as claimed in any one of the preceding claims, characterized by arranging a service by the application on the basis of at least part of the configuration data set.
5. A method as claimed in any one of the preceding claims, characterized by arranging the configuration data set and/or the ac-cess control information thereon into the device by:
establishing a device management session or a connection for ar-ranging provisioning between a device management server of the external managing entity and the device, transmitting the configuration data set and/or the access control in-formation by the device management session or the connection for provision-ing, and storing the configuration data set and/or the access control informa-tion in the device.
establishing a device management session or a connection for ar-ranging provisioning between a device management server of the external managing entity and the device, transmitting the configuration data set and/or the access control in-formation by the device management session or the connection for provision-ing, and storing the configuration data set and/or the access control informa-tion in the device.
6. A device management system comprising a device management server and a device management client to be managed, the device manage-ment system being arranged to manage at least one device management cli-ent by means of a management structure comprising at least one node, characterized in that the system is arranged to store access control information originated and/or controlled by an external managing entity for de-fining a right to access a configuration data set, the system is arranged to check the access control information in response to an indication from an application requiring access to a configura-tion data set, in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set, the system is ar-ranged to provide the application with access to the configuration data set, and the system is arranged to arrange a service by the application on the basis of at least part of the configuration data set.
7. A data processing device for a device management system, the device comprising means for storing multiple configuration data sets manage-able by one or more external managing entities, and a plurality of applications, characterized in that the data processing device comprises:
memory for storing access control information for defining a right to access a configuration data set, means for checking the access control information in response to an indication from an application requiring access to a configuration data set, and means for arranging access to the configuration data set for the ap-plication in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set.
memory for storing access control information for defining a right to access a configuration data set, means for checking the access control information in response to an indication from an application requiring access to a configuration data set, and means for arranging access to the configuration data set for the ap-plication in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set.
8. A data processing device as claimed in claim 7, character-ized in that the data processing device is arranged to check the access con-trol information in response to a request from the application to access the configuration data set.
9. A data processing device as claimed in claim 7 or 8, charac -terized in that the data processing device comprises means for arranging a service by the application on the basis of at least part of the configuration data set.
10. A data processing device as claimed in any one of claims , 7 to 9, characterized in that at least one service context comprising at least the configuration data set is stored in the data processing device, and the data processing device is arranged to allow the application to access the service context on the basis of the access control information if the application is authorized on the basis of access control information associated with the service context.
11. A data processing device as claimed in claim 10, charac-terized in that the service context further comprises user related data stored by an application of the data processing device.
12. A data processing device as claimed in any one of claims 7 to 11, characterized in that the configuration data set comprises settings required for arranging a connection from the device to one or more network resources for accessing a service, and the data processing device is arranged to establish a connection to one or more network resources on the basis of the settings.
13. A data processing device as claimed in any one of claims 7 to 12, characterized in that the data processing device comprises means for arranging selection of a configuration data set for the application in re-sponse a plurality of configuration data sets being available for the application.
14. A data processing device as claimed in any one of claims 7 to 13, charac terized in that data transfer between the application author-ized to access the configuration data set and a storage position comprising the configuration data set is secured.
15. A data processing device as claimed in any one of claims 7 to 14, characterized in that access to a configuration data set is con-trolled on the basis of comparison between predetermined identifiers in the access control information and an identifier in a certificate associated with the application and certifying a source of the application.
16. A data processing device as claimed in any one of claims 7 to 15, characterized in that the data processing device comprises a de-vice management client according to an OMA device management standard, and the data processing device is arranged to add and/or modify a con-figuration data set on the basis of a device management command from a de-vice management server to a node of a management tree in the data process-ing device.
17. A data processing device for a device management system, the data processing device comprising means for transmitting management com-mands to a managed device, characterized in that the data processing device comprises means for controlling access control information for defining a right of an application in the managed device to access a configuration data set in the managed device.
18. A data processing device as claimed in claim 17, charac-terized in that the data processing device is arranged to establish a device management session with the managed device, the data processing device is arranged to form a device manage-ment command addressed to a node representing the access control informa-tion and/or the configuration data set in a management tree of the managed device, and the data processing device is arranged to transmit the device man-agement command to the managed device.
19. A data processing device as claimed in claim 17 or 18, charac-terized in that the data processing device is a device management server according to the OMA device management standard.
20. A computer program product downloadable into a memory of a data processing device, characterized in that the computer program product comprises a computer program code which, when executed in a proc-essor of the data processing device, causes the data processing device to:
check access control information for defining a right to access a configuration data set in response to an indication from an application requiring access to a configuration data set, and in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set, arrange for ac-cess to the configuration data set for the application.
check access control information for defining a right to access a configuration data set in response to an indication from an application requiring access to a configuration data set, and in response to the application being, on the basis of the access con-trol information, entitled to access the configuration data set, arrange for ac-cess to the configuration data set for the application.
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/FI2004/000810 WO2006070045A1 (en) | 2004-12-30 | 2004-12-30 | Use of configurations in device with multiple configurations |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2592702A1 true CA2592702A1 (en) | 2006-07-06 |
| CA2592702C CA2592702C (en) | 2014-07-29 |
Family
ID=36614536
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA2592702A Active CA2592702C (en) | 2004-12-30 | 2004-12-30 | Use of configurations in device with multiple configurations |
Country Status (10)
| Country | Link |
|---|---|
| US (1) | US8140650B2 (en) |
| EP (1) | EP1839182B1 (en) |
| JP (1) | JP2008527475A (en) |
| CN (1) | CN100489827C (en) |
| BR (1) | BRPI0419267B1 (en) |
| CA (1) | CA2592702C (en) |
| ES (1) | ES2625789T3 (en) |
| PL (1) | PL1839182T3 (en) |
| TW (1) | TWI296777B (en) |
| WO (1) | WO2006070045A1 (en) |
Families Citing this family (34)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070180127A1 (en) * | 2003-11-11 | 2007-08-02 | Nokia Corporation | Preconfigured syncml profile categories |
| KR100941540B1 (en) * | 2005-06-02 | 2010-02-10 | 엘지전자 주식회사 | System and method for setting configuration-value inthereof |
| US20070027971A1 (en) * | 2005-07-26 | 2007-02-01 | Sunil Marolia | Device management network with notifications comprising multiple choice prompts |
| US7870490B2 (en) * | 2005-11-15 | 2011-01-11 | Microsoft Corporation | On-the-fly device configuration and management |
| CN101163309B (en) * | 2006-10-13 | 2012-07-04 | 华为技术有限公司 | Method, system and device for implementing information locking |
| WO2008048905A2 (en) * | 2006-10-16 | 2008-04-24 | Hewlett-Packard Development Company, L.P. | Diagnostic agent in device that retrieves key performance indicators |
| GB0620927D0 (en) | 2006-10-20 | 2006-11-29 | Vodafone Plc | Device management |
| FR2911022A1 (en) * | 2006-12-29 | 2008-07-04 | France Telecom | Resource e.g. value added service, accessing application transmitting method for mobile telephone terminal, involves transmitting application sent from secured access unit accessing resource, and generated certificate to terminal |
| KR101281931B1 (en) * | 2007-04-06 | 2013-08-26 | 삼성전자주식회사 | System and method for device management security of trap management object |
| US8327456B2 (en) * | 2007-04-13 | 2012-12-04 | Microsoft Corporation | Multiple entity authorization model |
| US8819814B1 (en) * | 2007-04-13 | 2014-08-26 | United Services Automobile Association (Usaa) | Secure access infrastructure |
| US7792979B1 (en) * | 2007-06-29 | 2010-09-07 | Emc Corporation | Object tree walking |
| US8375136B2 (en) * | 2007-08-08 | 2013-02-12 | Innopath Software, Inc. | Defining and implementing policies on managed object-enabled mobile devices |
| US20090172187A1 (en) | 2007-12-31 | 2009-07-02 | Eetay Natan | Techniques to enable firewall bypass for open mobile alliance device management server-initiated notifications in wireless networks |
| US8443451B2 (en) * | 2008-03-27 | 2013-05-14 | George Madathilparambil George | Manually controlled application security environments |
| US20090260050A1 (en) * | 2008-04-14 | 2009-10-15 | George Madathilparambil George | Authenticating device for controlling application security environments |
| US10372924B2 (en) * | 2008-05-12 | 2019-08-06 | George Madathilparambil George | Master device for controlling application security environments |
| CN101686458B (en) * | 2008-09-28 | 2013-06-12 | 华为技术有限公司 | Terminal configuration, management method and terminal device |
| CN101730099B (en) * | 2008-10-14 | 2013-03-20 | 华为技术有限公司 | Terminal management method based on authority control and device |
| US9614685B2 (en) * | 2009-03-09 | 2017-04-04 | Nokia Technologies Oy | Methods, apparatuses, and computer program products for facilitating synchronization of setting configurations |
| US8503316B2 (en) * | 2009-03-17 | 2013-08-06 | Qualcomm Incorporated | Method and apparatus for handling inconsistent control information in a wireless communication system |
| EP2271008A1 (en) * | 2009-06-30 | 2011-01-05 | Nxp B.V. | Automatic configuration in a broadcast application apparatus |
| GB2479916A (en) * | 2010-04-29 | 2011-11-02 | Nec Corp | Access rights management of locally held data based on network connection status of mobile device |
| US9021108B2 (en) * | 2010-09-27 | 2015-04-28 | Blackberry Limited | Method, system and apparatus for enabling access of a first mobile electronic device to at least one network accessible by a second mobile electronic device |
| US9064111B2 (en) * | 2011-08-03 | 2015-06-23 | Samsung Electronics Co., Ltd. | Sandboxing technology for webruntime system |
| US8893225B2 (en) | 2011-10-14 | 2014-11-18 | Samsung Electronics Co., Ltd. | Method and apparatus for secure web widget runtime system |
| US8756669B2 (en) * | 2012-06-20 | 2014-06-17 | Futurewei Technologies, Inc. | Security mode for mobile communications devices |
| TWI461958B (en) * | 2012-06-22 | 2014-11-21 | Wistron Corp | Permission management method for applications, electronic device thereof, and computer readable medium |
| US9225715B2 (en) * | 2013-11-14 | 2015-12-29 | Globalfoundries U.S. 2 Llc | Securely associating an application with a well-known entity |
| US9369342B2 (en) * | 2013-11-15 | 2016-06-14 | Microsoft Technology Licensing, Llc | Configuring captive portals with a cloud service |
| US10382305B2 (en) | 2013-11-15 | 2019-08-13 | Microsoft Technology Licensing, Llc | Applying sequenced instructions to connect through captive portals |
| US9554323B2 (en) | 2013-11-15 | 2017-01-24 | Microsoft Technology Licensing, Llc | Generating sequenced instructions for connecting through captive portals |
| US9392438B2 (en) | 2014-09-24 | 2016-07-12 | Motorola Solutions, Inc. | Method and apparatus to manage user/device profiles for public safety applications |
| KR101856930B1 (en) * | 2016-08-29 | 2018-05-11 | 현대자동차주식회사 | Usb communication control method of usb accessory |
Family Cites Families (19)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6272632B1 (en) * | 1995-02-21 | 2001-08-07 | Network Associates, Inc. | System and method for controlling access to a user secret using a key recovery field |
| US7058696B1 (en) * | 1996-11-22 | 2006-06-06 | Mangosoft Corporation | Internet-based shared file service with native PC client access and semantics |
| JP4716644B2 (en) * | 2001-03-02 | 2011-07-06 | 富士通株式会社 | Mobile communication system and apparatus constituting the system |
| AR037011A1 (en) * | 2001-08-13 | 2004-10-20 | Qualcomm Inc | A METHOD FOR STORAGE AN APPLICATION ON A DEVICE, A DEVICE FOR EXECUTING AN APPLICATION WITH SUCH METHOD, METHODS FOR ALLOWING ACCESS TO A DEVICE OF THE DEVICE AND ASSOCIATING AN AUTHORIZATION LIST FOR AN APPLICATION, SYSTEMS FOR APPLICATION FOR APPLICATION |
| CN1270480C (en) * | 2001-12-03 | 2006-08-16 | 诺基亚有限公司 | Appts. and associated method, for retrieving moble-node logic tree information |
| US20030212684A1 (en) | 2002-03-11 | 2003-11-13 | Markus Meyer | System and method for adapting preferences based on device location or network topology |
| JP2003283494A (en) * | 2002-03-27 | 2003-10-03 | Ntt Docomo Inc | Access control method of communication terminal, certification program providing device, management device and communication terminal |
| EP1500228B1 (en) * | 2002-04-30 | 2008-01-23 | Nokia Corporation | Method and device for management of tree data exchange |
| TWI231900B (en) * | 2002-08-19 | 2005-05-01 | Ntt Docomo Inc | Communication terminal providing function against connection with specific website and method thereof and memory media memorizing the program |
| JP3869347B2 (en) * | 2002-10-18 | 2007-01-17 | 株式会社エヌ・ティ・ティ・ドコモ | I / O control system, I / O control method, I / O control program |
| WO2004046963A1 (en) * | 2002-11-21 | 2004-06-03 | Nokia Corporation | Method and device for defining objects allowing to establish a device management tree for mobile communication devices |
| US20040123147A1 (en) * | 2002-12-19 | 2004-06-24 | Christopher White | Control of security or ease-of-use sensitivity for a wireless communication device |
| FI116426B (en) * | 2003-05-02 | 2005-11-15 | Nokia Corp | Initiate device management between the management server and the client |
| JP4202829B2 (en) * | 2003-06-04 | 2008-12-24 | 京セラ株式会社 | Telephone with mail transmission function |
| US20050091346A1 (en) * | 2003-10-23 | 2005-04-28 | Brijesh Krishnaswami | Settings management infrastructure |
| US20060173974A1 (en) * | 2005-02-02 | 2006-08-03 | Victor Tang | System and method for providing mobile access to personal media |
| US20070174429A1 (en) * | 2006-01-24 | 2007-07-26 | Citrix Systems, Inc. | Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment |
| JP4821405B2 (en) * | 2006-03-29 | 2011-11-24 | 富士ゼロックス株式会社 | File access control device and file management system |
| JP4583435B2 (en) * | 2007-12-19 | 2010-11-17 | 株式会社三菱東京Ｕｆｊ銀行 | stand |
-
2004
- 2004-12-30 PL PL04805205T patent/PL1839182T3/en unknown
- 2004-12-30 WO PCT/FI2004/000810 patent/WO2006070045A1/en active Application Filing
- 2004-12-30 ES ES04805205.4T patent/ES2625789T3/en active Active
- 2004-12-30 CA CA2592702A patent/CA2592702C/en active Active
- 2004-12-30 BR BRPI0419267A patent/BRPI0419267B1/en active IP Right Grant
- 2004-12-30 JP JP2007548846A patent/JP2008527475A/en not_active Withdrawn
- 2004-12-30 US US11/794,421 patent/US8140650B2/en active Active
- 2004-12-30 CN CNB2004800447946A patent/CN100489827C/en active Active
- 2004-12-30 EP EP04805205.4A patent/EP1839182B1/en active Active
-
2005
- 2005-12-27 TW TW094146608A patent/TWI296777B/en active
Also Published As
| Publication number | Publication date |
|---|---|
| TWI296777B (en) | 2008-05-11 |
| CN100489827C (en) | 2009-05-20 |
| CA2592702C (en) | 2014-07-29 |
| EP1839182B1 (en) | 2017-04-12 |
| US20080104207A1 (en) | 2008-05-01 |
| TW200634628A (en) | 2006-10-01 |
| BRPI0419267A (en) | 2007-12-18 |
| BRPI0419267B1 (en) | 2017-05-16 |
| WO2006070045A1 (en) | 2006-07-06 |
| EP1839182A1 (en) | 2007-10-03 |
| CN101091176A (en) | 2007-12-19 |
| JP2008527475A (en) | 2008-07-24 |
| US8140650B2 (en) | 2012-03-20 |
| PL1839182T3 (en) | 2017-08-31 |
| ES2625789T3 (en) | 2017-07-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2592702C (en) | Use of configurations in device with multiple configurations | |
| US11153081B2 (en) | System for user-friendly access control setup using a protected setup | |
| US11824859B2 (en) | Certificate based profile confirmation | |
| US6591095B1 (en) | Method and apparatus for designating administrative responsibilities in a mobile communications device | |
| EP2345205B1 (en) | Apparatus and method for mediating connections between policy source servers, corporate repositories, and mobile devices | |
| US20110167470A1 (en) | Mobile data security system and methods | |
| US7340057B2 (en) | Method and apparatus for distributing authorization to provision mobile devices on a wireless network | |
| EP1233636B1 (en) | System and method for over the air configuration security | |
| KR100670723B1 (en) | System and method of multiple-level control of electronic devices | |
| US9319394B2 (en) | System and method for pool-based identity authentication for service access without use of stored credentials | |
| BRPI0419244B1 (en) | “REMOTE ACCESS METHOD AND SYSTEM TO ENABLE A USER TO REMOTELY ACCESS A TERMINAL EQUIPMENT” | |
| EP3930289A1 (en) | Associating user accounts with enterprise workspaces | |
| US7827407B2 (en) | Scoped federations | |
| EP1854260B1 (en) | Access rights control in a device management system | |
| KR100913976B1 (en) | Use of configurations in device with multiple configurations | |
| JP6240253B2 (en) | Configuration usage in devices with multiple configurations | |
| JP5977018B2 (en) | Configuration usage in devices with multiple configurations | |
| US20080178267A1 (en) | Method and system for simplifying role based authorization profile implementation | |
| KR20230155420A (en) | ESIM creation and distribution system and method | |
| Gibson et al. | Secure architectures | |
| WO2000060466A1 (en) | Management agent and system including the same |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request |