Motorola Corporation

Symantec Corporation

Recourse Technologies, Inc.

Robert L Geiger

Jyh-Han Lin

Ronald R Smith

James Edward Van Peursem

Sanjay Wanchoo

Avinash C Palaniswamy

Larry C Puhl

Richard A Comroe

Ezzat A Dabbish

Kenneth J Crisler

Jeremy Bennett

Michael Joseph Crowley

Alex C Wang

Miles Randall Jackson

Alan Wai Chan

Ambiga Subramanian

Rajiv Mehta

Anna Battenhouse

Jy-Han Lin

Wai Alan Chan

Alan W Chan

Enhancing security capability of a network is described. In some embodiments, the method comprises detecting a security threat, sending a request to a networked device on the network to perform a deputized function that is not ordinarily performed by the networked device, receiving response data from the networked device and processing the response data. In some embodiments, the method comprises receiving a request from a security authority on the network to perform a deputized function that is not ordinarily performed, performing the deputized function as requested and sending response data to the security authority to be further processed.

Dynamic security deputization

A mobile communication device () loads an application bundle (), which includes a software application () and an indication of a time limited license (). To enforce the time limited license, the mobile communication device, upon attempting to invoke the application code (), obtains a secure time reading (). It is contemplated that a secure time server () may be used to facilitate license enforcement. Once the secure time reading is obtained, the mobile communication device compares the time with the license period, and executes the code only if the time reading is within the license period.

Method for enforcing a time limited software license in a mobile communication device

A wireless domain ( ) sets a security policy for all mobile communication devices ( ) within the domain by use of a system entry proxy server ( ). A developer makes an application or code segment available at a developer station ( ). The application is certified by a certificate defining a developer security setting. The user of the mobile communication device initiates a download of the application so that it can be installed onto the mobile communication device. The application is downloaded through the system entry proxy server which authenticates the application, then re-certifies it with a compact certificate including an operator defined security policy. In this way the operator can control which resources of the mobile communication device are accessed by all applications coming into the wireless domain.

Method for validating an application for use in a mobile communication device

A signed application descriptor file ( ) is used instead of X.509 certificates to authenticate a portable application code, such as a JAVA archive (JAR) file. The signed ADF includes an application descriptor file ( ), file hash ( ) of the JAR file ( ), a developer descriptor file ( ), signed time stamp ( ), and a developer's certificate ( ). A network client device ( ) includes limited computing resources ( ) and a virtual machine environment for executing the portable code ( ). Furthermore the client device contains a set of cryptographic, digital keys for authenticating parts of the signed ADF, which are further used to authenticate the JAR file.

Method for authenticating a JAVA archive (JAR) for portable devices

A new process for determining the administrator of a mobile communications device, e.g., a wireless cellular telephone, two-way pager, or laptop computer, connectable to a telecommunications network. The system and methods described provide processes for determining whether a Subscriber Entity Module (SIM) is present with a digital certificate for a domain of an administrator, e.g., a network operator, for designating administrative responsibilities in a mobile communications device. A mechanism is provided to designate administrative privileges to an entity by the owner of the mobile communications device.

Method and apparatus for designating administrative responsibilities in a mobile communications device

A method of conducting transactions in a wireless electronic commerce system, where the system comprises a wireless network operator certification authority ( ) having a root public key certificate and at least one attribute authority ( ) having a digital certificate that is dependent from the root public key certificate. The attribute authority is accessible by a wireless client device ( ) via a wireless network. The digital certificate is delivered from the attribute authority to the wireless device, the attribute authority is verified to the wireless client device using the digital certificate and the root public key certificate pre-loaded in the wireless client device under authority of the wireless network operator. An attribute (software, service, right/permission or other content item) is delivered to the wireless client device over the wireless network and ultimately enabled at the wireless client device.

Secure wireless electronic-commerce system with wireless network domain

Location information is generated for a mobile device using a global positioning system (GPS) receiver ( ) or by other means. A request for receipt of location information is received at the mobile device, over a wireless communications channel from a requesting entity ( ), and a confirmation of permission to receive location information is sent to the requesting entity, over the wireless communication channel. The confirmation includes a digital signature for the requesting entity to use as verifiable proof of confirmation of permission. The requesting entity can use the digital signature to obtain the location information from a location server ( ). The requesting entity and/or the location server are optionally located in the mobile communications device.

Method of operation of mobile wireless communication system with location information

A data communication system employs a method (400) for transmitting packetized data (100) using a combination of well known transmission techniques, such as TCP/IP and a novel compression process. A message type identifier (300) for the packet to be transmitted is first identified, which identifier comprises a packet type identifier (113) and a protocol identifier (114). The packet type identifier (113) distinguishes between control information and user information in the data packet. The packet is then selectively encoded (407, 411) using either a first or a second header compression technique, depending on the packet type identifier (113) and the protocol identifier (114). In this manner, an improved packet transmission scheme is envisaged, which gives a reliable solution for data transmission in a noisy RF environment and/or a bandwidth-limited environment. The method (400) for transmitting packetized data (100) further anticipates a third header compression technique (417) for use when the packet to be transmitted includes a UDP message.

Method for transmitting multiple-protocol packetized data

A key management system includes a hierarchy (10) of independent key arbitration centers (KAC) for providing access to a user's session keys through key management centers (KMC). When a court order is issued for a user's session keys, a message requesting the keys is transferred down through hierarchy until a terminal KAC (16,36) is reached. Each KAC in the hierarchy adds its ID and signs (116) the message, verifying prior signatures (114). The user's ID is encrypted with the terminal KAC's public key. The terminal KAC engages in a blind key access procedure (129) with the KMC (18,38) to receive the user's session key. The key is provided encrypted with the requesting party's or agency's public key. Accordingly, privacy is assured because only the KMC and the requesting agency have access to the actual key value, and only the terminal KAC and requesting agency have access to the user's ID. No other KACs in the hierarchy have access to the user ID or key value, and the KMC does not know which user's key has been provided.

Method and system for hierarchical key access and recovery

A data communication system (100) employs a method and apparatus for adaptively companding (compressing and expanding) data packets therein. A first communication device (e.g., 107) generates a plurality of data packets (201-207) and selects one or more, but not all, of the data packets. The first device then performs a compression of each data packet in a first group of data packets that includes the selected data packets (202-205). The first device transmits the compressed data packets to a second communication device (e.g., 108). Upon receiving the compressed data packets, the second device determines whether the received compressed data packets include one or more of the data packets selected by the first device. When the received data packets include one or more of the selected data packets, the second device transmits a response packet (301) to the first device indicating which, if any, of the selected data packets were received. Upon receipt of the response packet, the first device performs an adaptive compression of each data packet in a second group of data packets based on the response packet and transmits the adaptively compressed data packets to the second device. The second device expands the adaptively compressed data packets based on which selected data packets were received in the previous transmission.

Growing community of inventors

Redwood City, CA, United States of America

Robert L Geiger