# US 10,311,246 B1 · System and method for secure USIM wireless network access

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,311,246 B1
- Document ID: US10311246B1
- Status: Granted
- Kind: B1
- Application number: 15/719,813
- Filed: 2017-09-29
- Granted: 2019-06-04
- Earliest claimed: 2015-11-20
- Assignees: Sprint Communications Company L.P.
- Applicants: Sprint Communications Company L.P.
- Inventors: Lyle W. Paczkowski; Robert L. Spanel; Robert E. Urbanek
- Web page: https://patentgrep.com/patent/US10311246B1

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 12/1416: {by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights (G06F12/1458 takes precedence)}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/88: Detecting or preventing theft or loss
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/086: using security domains
- H04W 12/10: Integrity
- H04W 12/12: Detection or prevention of fraud
- H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
- G06F 2212/1052: Security improvement
- G06F 2212/154: Networked environment
- G06F 2221/2105: Dual mode as a secondary aspect
- H04W 12/71: Hardware identity
- H04W 88/02: Terminal devices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A user equipment (UE). The UE comprises a memory module, wherein the memory module is one of a subscriber identity module (SIM), a universal integrated circuit card (UICC), a universal subscriber identity module (USIM), or a removable user identity module (R-UIM), wherein clock signals from a second clock component are input to the memory module. The memory module comprises an application stored in a trusted security zone in the second non-transitory memory, that when executed by the second processor in the trusted security zone, wherein the second operating system accesses the second processor to implement instructions for applications in the second operating system, wherein the trusted security zone provides hardware assisted trust, compares a first mobile equipment identifier (MEID) stored in the first non-transitory memory with a second MEID stored in the memory module.

## Claims

### Claim 1

A method of monitoring by a user equipment (UE), comprising:
monitoring, by a monitor application, activities of applications outside a subscriber identity module (SIM) on the UE, wherein the monitor application is stored in a dedicated non-transitory memory of the SIM, and wherein the SIM comprises a dedicated processor and a dedicated operating system and the SIM is independent of and isolated from the UE by receiving clock signals as an input from a dedicated clock component that is isolated from a clock component of the UE and a processor of the UE; and
responsive to an input to the UE via an application outside the SIM to connect to a website that is on a blacklist stored on the UE, blocking, by the monitor application, link of the application to a radio transceiver of the UE to access the blacklisted website.

### Claim 2 (depends on 1)

The method of claim 1, wherein control policies are stored in the SIM, and wherein the control policies comprise parental control policies or enterprise control policies.

### Claim 3 (depends on 2)

The method of claim 2, wherein one parental control policy of the parental control policies prevents texting in restricted time periods.

### Claim 4 (depends on 1)

The method of claim 1, wherein the SIM is a physical SIM or a virtual SIM.

### Claim 5 (depends on 1)

The method of claim 1, wherein the SIM is independent of and isolated from the UE by receiving a power input through a dedicated power line, and wherein the SIM is on as long as the dedicated power line is active regardless of whether the rest of the UE is on.

### Claim 6 (depends on 1)

The method of claim 1, wherein the monitor application is stored in a trusted security zone in the dedicated non-transitory memory of the SIM, and wherein the trusted security zone provides hardware assisted trust.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
comparing, by the monitoring application, a first mobile equipment identifier (MEID) stored in a non-transitory memory of the UE with a second MEID stored in the SIM; and
responsive to the first MEID not matching the second MEID, blocking, by the monitoring application, access of applications outside the SIM to the radio transceiver.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
periodically examining, by the monitoring application, whether a ping message is received associated with the second MEID from a server in a network of a service provider associated with the UE; and
responsive to no such ping messages being received from the server in the network within a predefined period of time based on clock signals from the second clock component, blocking, by the monitoring application, access of applications outside the memory module to the radio transceiver.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
periodically transmitting, by the monitoring application, a message to a lost-and-stolen server associated with a lost-and-stolen database to inquire whether the UE is stolen,
responsive to a reply from the lost-and-stolen server indicating that the UE is lost, changing, by the monitoring application, a network access key of the UE, wherein the network access key grants network access to the UE, and
responsive to no reply from the lost-and-stolen server within a predefined period of time based on clock signals from the second clock component, changing, by the monitoring application, the network access key of the UE.

### Claim 10 (depends on 9)

The method of claim 9, wherein the message to the lost-and-stolen server is transmitted periodically using a dedicated secure communication channel via the radio transceiver of the UE.

### Claim 11 (depends on 10)

The method of claim 10, wherein the dedicated secure communication channel utilizes a dedicated communication protocol stack.

### Claim 12 (depends on 10)

The method of claim 10, wherein access of applications stored outside a trusted security zone to the radio transceiver is blocked while transmitting the message.

### Claim 13 (depends on 1)

The method of claim 1, wherein control policies are stored in the SIM, and wherein the control policies comprise enterprise control policies.