Device activation and access
Remote access management for a mobile device includes an activation process where a digitally signed activation record is created by a remote activation service and provided to the mobile device. The activation record is used to determine an activation state for the mobile device. Upon activation, a security process running on the mobile device enforces a security policy regarding remote access to the mobile device.
1. A method performed by a mobile device, the method comprising:
receiving an activation record from an activation service, the activation record including data that identifies the mobile device and identifies a carrier network associated with the mobile device;
authenticating the activation record; and
responsive to successfully authenticating the activation record, comparing the data in the activation record to data associated with the mobile device prior to receiving the activation record, wherein the comparing comprises:
comparing an Integrated Circuit Card Identifier (ICCID) in the activation record to an ICCID of a Subscriber Identity Module (SIM) card installed on the mobile device, and determining, based on the comparing, whether the mobile device is in a mismatched SIM state in which a user has placed a different SIM in the mobile device,
disabling a radio or modem in the mobile device in response to determining that the mobile device is in the mismatched SIM state,
comparing an International Mobile Equipment Identity (IMEI) in the activation record to an IMEI stored in a memory of the mobile device, and determining, based on the comparison, whether the mobile device is in a mismatched IMEI state in which a radio has changed, and
locking down a telephony application, while allowing other applications to operate, in response to determining that the mobile device is in the mismatched IMEI state.
2. The method of claim 1 , further comprising allowing access only to a media application loaded on the mobile device.
3. The method of claim 1 , further comprising allowing access to all of a plurality of applications loaded on the mobile device except a telephony application.
4. The method of claim 1 , where the mobile device includes a multi-touch-sensitive display.
5. The method of claim 1 , further comprising:
managing remote access through a secure communications channel.
6. The method of claim 1 , where the communications channel is a secure socket layer.
7. A mobile device, comprising:
a processor;
a computer-readable medium coupled to the processor and including instructions, which, when executed by the processor, cause the processor to perform operations comprising:
receiving an activation record from an activation service, the activation record including data that identifies the mobile device and identifies a carrier network associated with the mobile device;
authenticating the activation record; and
responsive to successfully authenticating the activation record, comparing the data in the activation record to data associated with the mobile device prior to receiving the activation record, wherein the comparing comprises:
comparing an Integrated Circuit Card Identifier (ICCID) in the activation record to an ICCID of a Subscriber Identity Module (SIM) card installed on the mobile device, and determining, based on the comparing, whether the mobile device is in a mismatched SIM state in which a user has placed a different SIM in the mobile device,
disabling a radio or modem in the mobile device in response to determining that the mobile device is in the mismatched SIM state,
comparing an International Mobile Equipment Identity (IMEI) in the activation record to an IMEI stored in a memory of the mobile device, and determining, based on the comparison, whether the mobile device is in a mismatched IMEI state in which a radio has changed, and
locking down a telephony application, while allowing other applications to operate, in response to determining that the mobile device is in the mismatched IMEI state.
8. The mobile device of claim 7 , wherein the processor performs an operation comprising preventing access only to a telephony application when the activation state is not activated as a result of a device identification mismatch.
9. The mobile device of claim 7 , wherein the processor performs an operation comprising including access to all applications loaded on the mobile device except a telephony application.
10. The mobile device of claim 7 , where the mobile device includes a multi-touch-sensitive display.
11. The mobile device of claim 7 , where the processor performs an operation comprising:
managing remote access through a secure communications channel.
12. The mobile device of claim 7 , where the communications channel is a secure socket layer.
13. A non-transitory computer-readable medium of a mobile device having instructions stored thereon, which, when executed by a processor of a mobile device, cause the processor to perform operations comprising:
receiving an activation record from an activation service, the activation record including data that identifies the mobile device and identifies a carrier network associated with the mobile device;
authenticating the activation record; and
responsive to successfully authenticating the activation record, comparing the data in the activation record to data associated with the mobile device prior to receiving the activation record, wherein the comparing comprises:
comparing an Integrated Circuit Card Identifier (ICCID) in the activation record to an ICCID of a Subscriber Identity Module (SIM) card installed on the mobile device, and determining, based on the comparing, whether the mobile device is in a mismatched SIM state in which a user has placed a different SIM in the mobile device,
disabling a radio or modem in the mobile device in response to determining that the mobile device is in the mismatched SIM state,
comparing an International Mobile Equipment Identity (IMEI) in the activation record to an IMEI stored in a memory of the mobile device, and determining, based on the comparison, whether the mobile device is in a mismatched IMEI state in which a radio has changed, and
locking down a telephony application, while allowing other applications to operate, in response to determining that the mobile device is in the mismatched IMEI state.
14. The non-transitory computer readable medium of claim 13 , the operations further comprising preventing access only to a telephony application when the activation state is not activated as a result of an unrecognized SIM card being placed in the mobile device.
15. The non-transitory computer readable medium of claim 13 , the operations further comprising allowing temporary access to all applications of the mobile device for a predetermined time interval when the activation state is not activated as a result of a missing SIM card.
16. The non-transitory computer readable medium of claim 13 , the operations further comprising preventing access only to a telephony application when the activation state is not activated as a result of a device identification mismatch.
17. The non-transitory computer readable medium of claim 16 , the operations further comprising:
prior to receiving an activation record from the activation service, providing no access to the mobile device.