Method of software configuration assurance in programmable terminal devices

[0001] The present invention relates generally to the field of radio communications. More specifically, the present invention relates to a method of assuring software configuration in programmable terminal devices.

[0002] For a wireless terminal device, such as a wireless radiotelephone, an ability to download software including Over-the-Air (OTA) is an emerging requirement. With software defined radio (SDR) technology, a terminal device such as a subscriber radiotelephone will be able to download software including core software. Core software, or native software, is software which runs in an unprotected environment, and could have unlimited access to data and resources loaded on the terminal. This ability of core software to access such information will present problems and concerns to network operators who provide communication to the radiotelephone. The operators' problems and concerns, relating to configuration control of terminals in their networks, will include how to recognize the safety and qualification of the software versions and configurations, and to allow or to disallow such software operation. A supplier for these terminals will also face problems and concerns including how to identify its software to the network and how to have the terminal software securely respond to the network's direction to allow or disallow the software operation.

[0003] Another area of concern is when a terminal is roaming outside of its home network. The terminal may contain a software version and configuration incompatible with the roaming host network. Similarly, if the terminal had downloaded a software configuration from the roaming host network then returned to its home network, the terminal might no longer be compatible with its home network.

[0004] Software version and configuration, which were originally considered acceptable, may later be determined unacceptable. In such case, a network operator may wish to disallow the software from operating by some means.

[0005] Accordingly there is a need for the network operators to be able to control the allowed range of operations of the terminals within the network.

[0006] FIG. 1 is a block diagram of a communication system comprising a communication network and a terminal device;

[0007] FIG. 2 is a flowchart of a preferred embodiment of the present invention for the communication network;

[0008] FIG. 3 is a flowchart of a preferred embodiment of the present invention for the terminal device;

[0009] FIG. 4 is a flowchart of another aspect of the preferred embodiment of the present invention for the communication network; and

[0010] FIG. 5 is a flowchart of another preferred embodiment of the present invention for the terminal device.

[0011] The present invention describes a method for a communication network to selectively grant a terminal device a privilege allowing a use of a specific version and configuration of software to access the communication network when the terminal device makes a request to operate within a targeted network. The privilege is granted by the use of an execution certificate which is a numerical value derived by using a cryptographic technique. The execution certificate contains information regarding allowable versions of software and allowable configuration of software, and configures the terminal device consistent with the target network in which the terminal device is to operate. If a version of software unapproved for use in the targeted network is detected, an approved version may be downloaded to the terminal device, or the network may send another execution certificate revoking the previously granted privilege.

[0012] The present invention provides a method for a communication network to grant privileges to a terminal device, such as a radiotelephone having a specific version of software and software and hardware configuration, to access and operate in the communication network. The communication network allows the terminal device to download a version of software from the network if the terminal device contains disapproved software.

[0013] FIG. 1 illustrates a block diagram of a communication system (100) employing a preferred embodiment of the present invention comprising a communication network (102) and a terminal device (104). The communication network (102) comprises an Access Network (106), a Core Communication Network (108), a host computer or server (110), which comprises a Configuration Management Server (112), a Terminal Device Management Server (114), and a Manufacturer's Software Download Server (116). The communication network (102) stores in its memory a version list which contains information regarding currently type-approved versions of software and configurations that the terminal device may use to access and to operate in the communication system. The communication network updates the version list by receiving an updated version list from the host computer (110) by way of the Core Communication Network (108).

[0014] The Configuration Management Server (112) contains a database which describes approved and disapproved hardware and software configurations. The database contains, at a minimum, a unique software identifier (type), a software version indicator (revision), and a cryptographic checksum (checksum) which collectively identify the software, and allow verification that it has been fetched correctly. This information may be presented to the Manufacturer's Software Download Server (116) to fetch a copy of the designated software.

[0015] The Terminal Device Management Server (114) enables the communication network to remotely manage the terminal device. The remote management may include a device configuration interrogation and software download. This server uses the type, revision, and checksum, as well as other information that may be available to uniquely identify the terminal device, and computes an execution certificate which is then sent to the terminal device (104).

[0016] The Manufacturer's Software Download Server (116) contains new software releases including core software. Contents from the server may be electronically signed by the manufacturer allowing the terminal device to process the contents according to security protocol running in the terminal device. This server may be accessed by the Terminal Device Management Server (114).

[0017] Whenever information is sent or received among the blocks (102, 104, 106, 108, 110, 112, 114, and 116) in the communication system (100), the information may be coded using cryptographic techniques to avoid forgery of the information.

[0018] At any given time, the terminal device possesses one or more terminal execution certificates, each of which contains information regarding the configuration of software and hardware as well as the version information of software that are currently loaded in the terminal device. In the description below, the phrase, terminal execution certificates, implies one or more terminal execution certificates.

[0019] FIG. 2 illustrates a flowchart of a first preferred embodiment of the present invention which is for the communication network. When the communication network (102) establishes communication (202) with the terminal device (104), it receives a terminal execution certificate (204) from the terminal device. The communication network also receives a terminal execution certificate when a terminal device is handed off from another communication network to the present communication network. Upon receiving the terminal execution certificate, the communication network compares it with its version list (206). If it determines that the terminal device is configured properly and fully compatible (208), then it transmits to the terminal device a network execution certificate (210) which grants the terminal device privileges to fully operate with the communication network (212).

[0020] If the communication network determines that the terminal device is not compatible and requires downloading new software and/or configuration (214), it transmits to the terminal device a network type-approved execution certificate (216), which contains information regarding type-approved versions of software and configurations for the terminal device consistent with the version list, and instructs the terminal device to update its software and configuration to be compatible with the communication network. This step may include allowing the terminal device to download an approved version of software from the communication network. When the terminal device is a new one and establishes communication for the first time, its terminal execution certificate has a form of a provisional certificate. The provisional certificate contains the hardware and software configuration of the new terminal device and permits the new terminal device to operate only a restricted set of operations with the communication network. If the provisional certificate is not fully compatible, the communication network will also transmit to the terminal device a type-approved execution certificate, and will instruct the terminal device to update its software and configuration to a type-approved version, using only the permitted restricted set of operations.

[0021] If the communication network determines that the terminal device is not fully compatible but does not require new software or configuration (214), then it may set the range of allowable operation (218) and transmit a message to the terminal device revoking privileges (220) to operate outside of the allowable operation range without requiring to update software or configuration.

[0022] After transmitting the request to update or the allowable range of operation to the terminal device, the communication network receives an updated terminal execution certificate from the terminal device (204), and the process begins over. The communication network will not allow the terminal device to operate in the network till the network execution certificate is transmitted to the terminal device. A limit may be placed on the number of re-submission of the terminal execution certificate by the terminal device (204) to prevent unnecessary system tie-ups.

[0023] FIG. 3 illustrates a flowchart of a second preferred embodiment of the present invention which is for the terminal device. When the terminal device (104) establishes communication (302) with the communication network (102), it transmits a terminal execution certificate (304) to the communication network. The terminal device also transmits a terminal execution certificate when it is handed off from one communication network to another communication network. The terminal device then receives a response form the communication network (306). If the response is a network execution certificate (308), indicating that the communication network has determined that the terminal device is fully compatible with the communication network based upon the comparison between the terminal execution certificate and the version list, then the terminal device is allowed to fully operate with the communication network (310).

[0024] If the response is a network type-approved execution certificate (312), requesting or commanding the terminal device to update to appropriate new software and/or configuration provided by it, the terminal device downloads (314) and stores (316) in a terminal memory appropriate software and/or configuration as requested. The terminal device then updates the terminal execution certificate (318) to reflect the updating, resends this terminal execution certificate back to the communication network, and the process starts over.

[0025] If the response sets an allowable range (320) of the terminal device operation by revoking the privileges granted to the terminal device to operate certain software and/or configuration, the terminal device suspends such operations (322) conforming to the allowable range of operation set by the communication network without having to download new software or configuration. The terminal device then updates the terminal execution certificate (318) to reflect the updating, resends this terminal execution certificate back to the communication network, and the process starts over. The process of setting the allowable range and suspending certain operation may be required in addition to downloading new software and/or configuration. A limit may be placed on the number of re-submission of the terminal execution certificate by the terminal device (304) to prevent unnecessary system tie-ups.

[0026] FIG. 4 illustrates a flowchart of a third preferred embodiment of the present invention which is for the communication network. When the communication network (102) establishes communication (402) with the terminal device (104), it transmits to the terminal device a network type-approved execution certificate (404), which contains information regarding type-approved versions of software and configurations for the terminal device consistent with the version list. This step may include allowing the terminal device to download an approved version of software from the communication network. The communication network also transmits the network type-approved execution certificate when a terminal device is handed off from another communication network to the present communication network. The communication network then receives a terminal execution certificate (406) from the terminal device. Upon receiving the terminal execution certificate, the communication network compares it with its version list (408). If it determines that the terminal device is configured properly and fully compatible (410), then it transmits to the terminal device a network execution certificate (412) which grants the terminal device privileges to fully operate with the communication network (414).

[0027] If the communication network determines that the terminal device is not fully compatible (410), then it re-transmit to the terminal device the type-approved execution certificate (404), and the process begins over. The communication network will not allow the terminal device to operate in the network till the network execution certificate is transmitted to the terminal device. A limit may be placed on the number of re-submissions of the terminal execution certificate by the terminal device (406) to prevent unnecessary system tie-ups.

[0028] FIG. 5 illustrates a flowchart of a fourth preferred embodiment of the present invention which is for the terminal device. When the terminal device (104) establishes communication (502) with the communication network (102), it receives a network type-approved execution certificate, which contains information regarding type-approved versions of software and configurations for the terminal device for operation with the communication network, from the communication network (504). When the terminal device is handed off from one communication network to another, it also receives a network type-approved execution certificate from the other communication network. The terminal device then compares its current software and configuration against the network type-approved execution certificate (506), and determines its compatibility with the communication network.

[0029] If the terminal device determines that it is fully compatible (508) with the communication network, it transmits its current terminal execution certificates reflecting its current software and configuration to the communication network (510). It then waits to receive a network execution certificate from the communication network grating privileges to the terminal device full operation of its current software and configuration (512). When the terminal device receives the network execution certificate, it begins its operation with the communication network (514). If the terminal device does not receive the network execution certificate after a preset time period, or it receives a message indicating that the communication network has refused to issue the network execution certificate, then the terminal device starts over the process from comparing its current software and configuration against the network type-approved execution certificate (506). A limit may be placed on the number of re-submission of the terminal execution certificate by the terminal device (510) to prevent unnecessary system tie-ups.

[0030] If the terminal device is not fully compatible (508) with the communication network, it then determines if downloading software and/or configuration from the communication network is required to become compatible with the communication network (516). If downloading is required, the terminal device downloads appropriate software and/or configuration from the communication network as required (518), and stores in its memory (520). The terminal device then updates its terminal execution certificates (522), and starts over the process from comparing its current software and configuration against the network type-approved execution certificate (506). A limit may be placed on the number of re-submission of the terminal execution certificate by the terminal device (510) to prevent unnecessary system tie-ups.

[0031] If downloading is not required but modifying its current software and/or configuration setup is required, the terminal device sets an allowable range of operation that is compatible and suspends operations that are incompatible with the communication network. The terminal device then updates its terminal execution certificates (522), and starts over the process from comparing its current software and configuration against the network type-approved execution certificate (506). The process of setting the allowable range and suspending certain operation may be required in addition to downloading new software and/or configuration. A limit may be placed on the number of re-submission of the terminal execution certificate by the terminal device (510) to prevent unnecessary system tie-ups.

[0032] The present invention focuses on a method for a communication network to grant privileges to a terminal device such as a radiotelephone. However, it may be used in other areas of communication systems such as, but not limited to, a wired or wireless LAN system with a master server and a client terminal.

[0033] While the preferred embodiment of the invention has been illustrated and described, it is to be understood that the invention is not so limited. Numerous modifications, changes, variations, substitutions and equivalents will occur to those skilled in the art without departing from the broad scope of the present invention as defined by the appended claims.