System for enforcing security policies on mobile communications devices

A method of enforcing security policies on mobile communications devices, wherein the mobile communications devices are adapted to be used in a mobile communications network in operative association with a subscriber identity module, comprising:

• determining, by a server of the mobile communications network, a security policy to be applied on a mobile communications device, and sending the security policy to the mobile communications device;
• and
• receiving, by the mobile communications device, the security policy and enforcing the security policy;
• said sending the security policy comprising authenticating the security policy to be sent to the mobile communications device;
• and
• receiving the security policy and enforcing the security policy comprising:
• interacting, by an interface component of the mobile communications device, with a subscriber identity module;
• and
• invoking, by the interface component of the mobile communications device, a client authentication function on the subscriber identity module when the mobile communications device receives the security policy to calculate authentication information on the security policy received from the server;
• and
• the method further comprising:
• sending, by the server to the mobile communication device, a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;
• invoking, by the mobile communication device, the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information;
• and
• passing, by the mobile communication device, the specified security policy to an enforcer module for applying the specified security policy.

A non-transitory computer-readable medium comprising instructions, which when executed by a mobile communications device, cause the mobile communications advice to perform a method comprising:

• receiving from a server of a mobile communications network a security policy to be enforced on the mobile communications device;
• executing an interface component of a manager module to interact with a subscriber identity module associated with the mobile communications network, the subscriber identity module providing an identification of the mobile communications device with the mobile communications network;
• invoking through the interface component of the manager module a client authentication function on the subscriber identity module to calculate authentication information on the security policy, received from the server;
• assessing an authenticity of the security policy through the client authentication function on the subscriber identity module;
• and
• applying the authenticated security policy;
• and
• the method further comprising:
• receiving a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;
• invoking the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information;
• and
• passing the specified security policy to an enforcer module for applying the specified security policy.

A non-transitory computer-readable medium comprising instructions, which when executed by a subscriber identity module associated with a mobile communication device, cause the subscriber identity module to perform a method comprising:

• interacting with an interface component of the mobile communication device;
• receiving a command from the interface component to invoke a client authentication function on the subscriber identity module;
• receiving a security policy from a manager module of the mobile communications device;
• calculating authentication information on the security policy;
• assessing an authenticity of the security policy in response to the command;
• indicating to the manager module whether the security policy is authentic;
• receiving a policy apply message instructing the mobile communication device to apply a specified security policy already stored thereon;
• invoking the client authentication function for assessing an integrity of the identified security policy by exploiting the authentication information;
• and
• passing the specified security policy to an enforcer module for applying the specified security policy.