METHOD FOR ALTERATION OF INTEGRITY PROTECTED DATA IN A DEVICE, COMPUTER PROGRAM PRODUCT AND DEVICE IMPLEMENTING THE METHOD
The invention relates to a method for enabling modifications of integrity protected data, such as SIM lock settings, in a device. The method comprises: in a device, creating a data entity containing signed change information about allowable alterations, the change information being bound to the device, a certificate with a public key corresponding to the private key used to sign the change information; accessing the device and requesting alteration; verifying the requested alteration against the data entity; and if the verification succeeds, performing the requested alteration. By centrally preparing dedicated replacement devices, which locally can be altered in a simple and secure way, without compromising sensitive information or data, a more secure handling of alteration is achieved. Also, the invention relates to a corresponding computer program product and a device implementing the method.
1 - 22 . (canceled)
23 . A method for alteration of integrity protected data in a device comprising:
in the device, creating and storing a data entity containing signed change information about allowable alterations, the change information being bound to the device, a certificate with a public key corresponding to the private key used to sign the change information;
accessing the device and requesting alteration;
verifying the requested alteration against the data entity; and
if the verification succeeds, performing the requested alteration.
24 . A method according to claim 23 , further comprising:
verifying the signature of the data entity; and verifying that the data entity is bound to the device, before performing the requested alteration.
25 . A method according to claim 24 , wherein the data entity contains a device unique value.
26 . A method according to claim 24 , wherein the data entity contains a chip unique MAC calculated over the data entity.
27 . A method according to claim 23 , further comprising:
if the verification succeeds, disabling further alterations by deleting or alteration of the data entity.
28 . A method according to claim 23 , wherein the device is accessed from a computer.
29 . A method according to claim 28 , wherein the device is accessed by means of AT commands.
30 . A method according to claim 28 , wherein the device is accessed by means of a program loaded into the device.
31 . A method according to claim 28 , wherein the requested alteration is sent from the computer, as part of a command or a program.
32 . A method according to claim 23 , further comprising in the device, storing possible alterations.
33 . A method according to claim 32 , wherein the device is accessed by means of a user interface of the device.
34 . A method according to claim 23 , the data entity further comprising password information, and accessing the device further comprises inputting a password, which is checked by the device against the password information of the data entity.
35 . A method according to claim 23 , wherein the requested alteration comprises a change of SIM lock.
36 . A method according to claim 35 , wherein the device unique value is the IMEI.
37 . A method according to claim 23 , wherein the requested alteration comprises a change of IMEI.
38 . A computer program product stored in a computer-readable medium and comprising a data entity containing signed change information about allowable alterations for alteration of integrity protected data in a device, the change information being bound to the device, and a certificate with a public key corresponding to the private key used to sign the change information.
39 . A computer program product according to claim 38 , wherein the data entity contains a device unique value.
40 . A computer program product according to claim 39 , wherein the device unique value is an IMEI.
41 . A computer program product according to claim 38 , wherein the data entity contains a chip unique MAC calculated over the data entity.
42 . A computer program product according to claim 38 , wherein the data entity further comprises password information.
43 . A computer program product according to claim 38 , comprising a computer-readable medium having stored thereon the data entity.