Vodafone Group Plc.

Hewlett-packard Development Company, L.P.

Caroline Belrose

Nicholas Bone

Timothy James Wright

Liqun Chen

Graeme John Proudler

Wenbo Mao

Stephen H Babbage

James Irwin

Mark Priestley

A terminal () for use with a cellular or mobile telecommunications network () includes authentication means () such as a SIM, USIM, UICC etc. for authenticating the terminal with the network. The terminal further includes a normal execution environment () and a secure execution environment (). An interface controller () is provided in the secure execution environment and intercepts all communications directed to the authentication means to control access to the authentication means by these communications.

Telecommunications device security

A method of verifying the validity of a message received by a telecommunications terminal () having a processor () and which is operable in a boot mode and a runtime mode is disclosed. In the embodiments the message is a SIM unlock message, for removing or modifying a restriction of the types of subscriber identity module (SIM) with which the mobile terminal may be used. In response to reception of the SIM unlock message when the terminal () is in the runtime mode, the processorof the terminal () causes the terminal to enter the boot mode and verify the validity of the message during the boot mode. Because the validity of the message is checked during the boot mode, the check can be performed with greater security.

Received message verification

A method is described by which the possessor of a secret certified in a particular manner can prove to a party with which the possessor of a secret needs to interact that it does indeed possess a secret formed in the proper manner. In the context of trusted computing apparatus, this can be used to show that the secret has been provided by a legitimate manufacturer of such apparatus. A method and an architecture for revocation operable in this context is also described.

Use of certified secrets in communication

A mobile terminal for use with a cellular or mobile telecommunications network includes a normal execution environment (operating system) () and a secure execution environment () comprising a Mobile Trusted Module (MTM). The mobile terminal enables the software of the terminal in the secure execution environment () to be updated. The terminalmay be provided with minimal software initially in the secure execution environment (), and is operable to subsequently update the software by over the air transmission of software. Also disclosed is a method for managing rights in respect of broadcast, multicast and/or unicast (downloaded) data, relevant in particular to managing access to a broadcast video data stream complying with a mobile digital broadcast scheme. The method defines a service protection platform implemented on mobile terminals having both normal execution environment (i.e. the operating system) and secure execution environment. Service protection is provided by separating the operation of service protection application components into those that operate in the normal environment and those that are adapted to execute only in the secure execution environment. Making the secure execution environment application component interchangeable allows the method to be adapted to any of a number of service protection protocols or 'profiles' by downloading only the secure execution environment application component.

A framework whereby mobile terminals are configured and managed by a central server. In accordance with one aspect of the present invention, there is provided a mobile telecommunications terminal including a first execution environment and a second execution environment, each execution environment being arranged to execute a respective device management agent and each agent issuing, in accordance with instructions from a device management server, management actions that act upon one or more respective management entities running within one or more of the execution environments; wherein the management entities of the second execution environment are grouped into a management structure, the management structure being one of the management entities within the first execution environment, whereby the he first and second execution environments permit the device management server is permitted to manage applications and/or services running within both.

Growing community of inventors

Marlborough, United Kingdom

Caroline Belrose