Remote Secure Unlock Modem Verification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for controlling the operation mode of mobile devices are vulnerable to malicious circumvention, allowing unauthorized operation modes despite network operator restrictions.

Innovation Solution

A secure verification process involving a trusted application, modem, or remote server to validate subscriber identity modules, ensuring the device remains in a limited operational mode unless verified, with secure channels and periodic checks to maintain security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If network operator control of operation mode is implemented, then device operation control is improved, but security against malicious circumvention deteriorates

Engineering Contradiction:
Improveoperation mode controlVSAvoidsecurity against circumvention
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The system segments the verification process into multiple independent components: a trusted application layer, modem layer, and network server layer. Each layer performs specific verification functions, creating a distributed security architecture that prevents single-point circumvention while maintaining operational control.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

A trusted application acts as an intermediary between the modem and network server, mediating the verification process. This intermediary enforces security policies by requiring application presence and participation in verification, preventing direct bypass attempts while enabling controlled operation mode transitions.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If verification process is made more secure, then security against bypass is improved, but device complexity increases

Engineering Contradiction:
Improveverification securityVSAvoidverification system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The trusted application serves multiple functions: it acts as a security verifier, operation mode controller, and communication intermediary. This multi-functionality consolidates security logic into a single universal component rather than requiring separate specialized modules, reducing overall system complexity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system performs preliminary verification checks at the application layer before allowing modem operation mode changes. By establishing security controls in advance through the trusted application, the system prevents unauthorized operations without requiring complex real-time monitoring mechanisms.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If secure channels are established between all components, then verification security is improved, but communication overhead increases

Engineering Contradiction:
Improvecommunication securityVSAvoidverification time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

Secure channels are established preliminarily between the trusted application and network server before verification begins. This pre-establishment of secure communication paths avoids the need for repeated channel setup during verification, reducing time overhead while maintaining security.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP4093074B1Remote secure unlock
Publication Date: 2025.06.25 TRUSTONIC
  • EP4093074B1 patent drawingFigure 1
  • EP4093074B1 patent drawingFigure 2A
  • EP4093074B1 patent drawingFigure 2B

AI summary

A method for remotely performing secure change of operational mode of a telecommunications device, the method comprising: establishing a first secure channel between a modem of the telecommunications device and an application executing in an Execution Environment of the telecommunications device; establishing a second secure channel between the application and a remote server; enabling the modem in a limited operational mode; generating a request, by the modem or the application, to verify the validity of a subscriber identity module of the telecommunications device; retrieving, by the modem, module identification information from the subscriber identity module; retrieving verification information, by the application and from the remote server, using the second secure channel, sending the module identification information from the modem to the application using the first secure channel, verifying at the application whether the subscriber identity module is valid using the module identification information and the verification information, and sending the verification result from the application to the modem using the first secure channel, or retrieving verification information, by the application and from the remote server, using the second secure channel, sending the verification information from the application to the modem using the first secure channel and verifying at the modem whether the subscriber identity module is valid using the module identification information and the verification information, or sending the module identification information from the modem to the remote server, verifying at the remote server whether the subscriber identity module is valid using the module identification information and verification information available at the server, sending the verification result from the remote server to the application using the second secure channel, and sending the verification result from the application to the modem using the first secure channel; responsive to a positive verification of the subscriber identity module transitioning the modem from the limited operational mode to an enhanced operational mode.