Radio telephone hand set network restriction

[0002] (1) Field of the Invention

[0003] This invention relates to mobile phones and in particular it relates to a security function for restricting the use of individual radio telephone hand sets to selected operator networks.

[0004] The hand set for which the invention is provided is a digital radio transceiver programmed to operate under the control of a central processing unit (CPU).

[0005] (2) Description of the Prior Art

[0006] Owing to the variations in pricing policy of network operators, the nominal selling price of mobile phones is often heavily discounted in favour of a higher call tariff. The possibility exists therefore of a user obtaining at very low, or even no cost, a hand set for use on a specified network with a relatively high call tariff. If the hand set were then to be used on a low call tariff network for which the charge for hand sets remained at full selling price then both network operators would be deprived of revenue. It is important to network operators therefore that use of hand sets be restricted to specified networks.

[0007] The adaptation of telephone hand sets by copying from or imitating a licensed hand set, normally for unauthorized sale or use, is known as cloning and this definition of cloning is used herein.

[0008] Prior art methods for prevention of unauthorized use and prevention of cloning of telephone hand sets include so called secret numbers and U.S. Pat. No. 5,430,892 for example describes a use of secret numbers stored in a ROM (read only memory).

[0009] Removal of the ROM from the circuit board of a telephone hand set properly connected to a target network would, however, allow unauthorized copies of the ROM to be obtained. An unscrupulous person would then be in a position to alter very many telephone hand sets merely by supplying the appropriate ROM.

[0010] It is an object of this invention to provide, inexpensively, an increased level of protection against unauthorized use or cloning of mobile telephone hand sets.

[0011] According to the invention there is provided a mobile telephone hand set programmed to operate under the control of a CPU and protected against unauthorized use or cloning by means of a security engine, the security engine comprising a re-programmable write only memory, an interface register and a challenge timer and operating by the issue of a challenge from the challenge timer to the CPU, the CPU on receipt of a challenge responding by writing a value to the interface register for comparison therein with a value stored in the re-programmable write only memory and the interface register signaling the result of the comparison.

[0012] The above and other objects, features and advantages of the present invention will become apparent from the following description referring to the accompanying drawing which illustrates an example of a preferred embodiment of the present invention.

[0013] In the accompanying drawing:

[0014] FIG. 1 is a basic block diagram illustrating an example of a preferred embodiment of the present invention.

[0015] An example of the invention will now be given with reference to the sole figure which is a block diagram illustrating the use of a security engine in a mobile phone hand set.

[0016] A mobile phone hand set includes programmable memory 1 a central processing unit (CPU) 2 and a security engine 3. A software program stored in programmable memory 1 operates under the control of the CPU.

[0017] Within the programmable memory 1 there is a location which shall be called the simlock (Subscriber Identity Module Lock) option location 4. The simlock option location 4 is programmed with a set of “public values”. The purpose of the public values P0, P1, . . . Pn is to direct the software to check that the phone may be used within a specified network. These public values are not secret and are readily available and one of these values, say P0, is used to indicate that the phone may be used with any network.

[0018] The security engine 3 has a re-programmable location 7 with write only access. This re-programmable location 7 is called the secret number location and can be written to by the CPU once the CPU has correctly answered a challenge.

[0019] The value stored in the re-programmable write only memory consists of a set of secret numbers derived from and corresponding to the public values entered into the telephone for specified network use. The interface register 6 is an input/output register which can be written to and read from by the CPU.

[0020] A challenge timer 5 also forms a part of the security engine 3. In the secret number location 7 secret numbers S0, S1, S2 . . . Sn are programmed such that each secret number in the secret number location corresponds to a public value in the simlock option location 4. The secret numbers are entered in the secret number location at the time of manufacture. None of the secret numbers are equal to the public values.

[0021] The secret numbers programmed into the secret number location at manufacture must be kept secret by the manufacturer. Similarly any translation algorithm used to translate the public values stored in the simlock option location into the secret number series must also be the subject of strict secrecy by the manufacturer.

[0022] The challenge timer 5 begins the validation process after power is applied to the mobile phone hand set (power on). After a delay, the duration of the delay being set by the challenge timer, the security engine issues a challenge to the CPU 2 by the setting of a bit in the interface register. When the challenge is issued, a response from the CPU 2 writes a value into the interface register.

[0023] The value of the response from the CPU 2 is compared with the secret number in the secret number location and a signal indicative of the validity of the response from the CPU 2 is set in the interface register. A VALID RESPONSE signal is set when the CPU response to the challenge and the secret numbers stored in the secret number location match.

[0024] The CPU 2 reads the signal set in the interface register and if a VALID RESPONSE signal is set, then normal telephone operation continues. A mismatch between the CPU response to a challenge and the secret numbers will give rise to an INVALID RESPONSE indication in the interface register. An INVALID RESPONSE indication read by the CPU will cause the CPU to shut off the telephone operation.

[0025] Further challenges are issued at intervals set by and under the direction of the challenge timer.

[0026] In the mobile telephone hand set as described above, challenge timer 5 issues a challenge to the CPU 2 at fixed time intervals. The challenge is supplied to the CPU 2 by the setting of a bit in the interface register 6. The bit in the interface register 6 is written by the security engine 3. The CPU 2 on receipt of the challenge responds to the security engine 3 by writing the derived secret number to the interface register 6 for comparison with the secret numbers stored in the secret number location 7. In this case, the CPU 2 reads at least one of the public values from the simlock option location 4 to derive a secret number based on the readout value.