I 1111111111111111 1111111111 11111 111111111111111 IIIII IIIII IIIIII IIII IIII IIII
`
`US010027619B2
`
`(IO) Patent No.: US 10,027,619 B2
`
`c12) United States Patent
`
`(45)Date of Patent:
`
`Backholm et al.
`*Jul. 17, 2018
`
`(54)MESSAGING CENTRE FOR FORWARDING
`E-MAIL
`
`(52)U.S. Cl.
`CPC .......... H04L 51138 (2013.01); H04L 63/0428
`
`
`
`(2013.01); H04L 63/08 (2013.01);
`
`(71) Applicant: Seven Networks, LLC, Marshall, TX
`
`
`
`
`
`(US)
`
`(Continued)
`
`(58)Field of Classification Search
`
`CPC ...... G06Q 10/107; H04L 12/585; H04L 12/58
`(72)Inventors: Ari Backholm, San Carlos, CA (US);
`
`
`
`
`
`Seppo Salorinne, Helsinki (FI); Antti
`
`
`Saarilahti, Helsinki (FI); Marko
`
`
`Ketonen, Helsinki (FI); Lauri Vuornos,
`(56)
`
`Helsinki (FI); Petri Salmi, Espoo (FI)
`
`(Continued)
`
`
`
`References Cited
`
`U.S. PATENT DOCUMENTS
`
`(73)Assignee: Seven Networks, LLC, Marshall, TX
`
`
`
`
`
`(US)
`
`( *) Notice: Subject to any disclaimer, the term ofthis
`
`
`
`
`
`
`patent is extended or adjusted under 35
`
`
`U.S.C. 154(b) by O days.
`
`
`
`This patent is subject to a terminal dis­
`
`EP
`claimer.
`
`
`
`6,078,908 A 6/2000 Schmitz
`
`6,745,326 Bl 6/2004 Wary
`(Continued)
`
`FOREIGN PATENT DOCUMENTS
`
`
`
`0772327 A2 6/2005
`
`OTHER PUBLICATIONS
`
`(21)Appl. No.: 14/609,189
`
`
`
`(22)Filed:Jan. 29, 2015
`
`(65)
`
`
`
`Prior Publication Data
`
`
`Final Office Action dated May 1, 2009 for U.S. Appl. No.
`11/282,607.
`
`(Continued)
`
`US 2015/0149575 Al May 28, 2015
`
`Primary Examiner - Alan S Chou
`
`
`
`
`
`(74)Attorney, Agent, or Firm - NK Patent Law, PLLC
`
`
`
`
`Related U.S. Application Data
`
`ABSTRACT
`
`(57)
`
`
`
`(60) Continuation of application No. 12/228,325, filed on
`
`
`Aug. 11, 2008, now abandoned, which is a division of
`A method for forwarding an e-mail message from an e-mail
`
`
`
`
`
`
`
`
`
`
`server to a mobile terminal is provided. An e-mail address of
`(Continued)
`
`
`the mobile terminal is associated with an identifier and
`
`
`
`
`
`encryption information, receiving the e-mail message asso­
`
`
`
`
`ciated with the e-mail address and sent by the e-mail server.
`
`Nov. 22, 2004 (FI) ...................................... 20045451
`
`
`
`
`The method includes encrypting the e-mail message using
`
`
`
`the encryption information associated with the e-mail
`
`
`
`
`address and transmitting the encrypted e-mail message to the
`mobile terminal.
`
`
`
`
`
`(30) Foreign Application Priority Data
`
`
`
`(51)Int. Cl.
`G06F 15116
`
`(2006.01)
`(2006.01)
`H04L 12158
`(Continued)
`
`
`
`52 Claims, 4 Drawing Sheets
`
`
`
`External e-mail terminal
`
`122
`
`110
`
`
`
`e-mail address terminal id encryption information temporary access netw. id
`
`
`
`
`
`
`
`
`
`122A
`
`122B
`122C
`�----------
`
`122D
`
`APPLE 1001
`
`1
`
`

`

`US 10 , 027 , 619 B2
`Page 2
`
`( 51 )
`
`( 52 )
`
`( 56 )
`
`( 2006 . 01 )
`( 2009 . 01 )
`( 2009 . 01 )
`( 2009 . 01 )
`( 2009 . 01 )
`
`Related U . S . Application Data
`application No . 11 / 282 , 950 , filed on Nov . 21 , 2005 ,
`now Pat . No . 7 , 643 , 818 .
`( 60 ) Provisional application No . 60 / 650 , 975 , filed on Feb .
`9 , 2005 .
`Int . CI .
`H04L 29 / 06
`H04W 12 / 02
`H04W 12 / 06
`H04W 4 / 12
`H04 8 / 26
`U . S . CI .
`CPC . . . . . . . . . . . . . H04L 63 / 18 ( 2013 . 01 ) ; H04W 12 / 02
`( 2013 . 01 ) ; H04W 12 / 06 ( 2013 . 01 ) ; H04W 4 / 12
`( 2013 . 01 ) ; H04W 8 / 26 ( 2013 . 01 )
`( 58 ) Field of Classification Search
`. . . . . . . . . . . . . . . 709 / 206
`USPC . . . . . . . . . . .
`See application file for complete search history .
`References Cited
`U . S . PATENT DOCUMENTS
`6 , 993 , 658 B1
`1
`/ 2006 Engberg et al .
`7 , 289 , 792 B1 * 10 / 2007 Turunen . . . . . . . . . . . . . . H04L 12 / 5895
`370 / 254
`2002 / 0147918 A1 * 10 / 2002 Osthoff . . . . . . . . . . . . . .
`G06F 21 / 71
`713 / 193
`2004 / 0098597 A1 *
`5 / 2004 Giobbi . . . . . . . . . . . . . . . . . . G06F 21 / 10
`713 / 185
`2004 / 0205248 A1 *
`10 / 2004 Little . . . . . . . . . . . . . . H04L 63 / 0428
`709 / 246
`2005 / 0015432 AL
`1 / 2005 Cohen
`2005 / 0139680 A1 *
`6 / 2005 Anttila
`GO6K 1 / 18
`235 / 462 . 46
`2005 / 0152525 A1 *
`7 / 2005 Kent , Jr . . . . . . . . . . . H04M 3 / 42374
`379 / 207 . 02
`2006 / 0031300 A1 *
`2 / 2006 Kock
`G06Q 10 / 107
`709 / 206
`2006 / 0085503 A14 / 2006 Stoye
`2006 / 0265595 AL 11 / 2006 Scottodiluzio
`2013 / 0268384 A1 *
`10 / 2013 Salonen . . . . . . . . . . . .
`
`. . . . . . . . . . . . . . . . . .
`
`GO6Q 10 / 02
`705 / 26 . 1
`
`OTHER PUBLICATIONS
`Non - final Office Action dated Nov . 19 , 2008 for U . S . Appl . No .
`11 / 282 , 607 .
`Non - final Office Action dated Feb . 5 , 2008 for U . S . Appl . No .
`11 / 282 , 607 .
`Final Office Action dated Apr . 3 , 2009 for U . S . Appl . No .
`11 / 282 , 950 .
`Non - final Office Action dated Sep . 26 , 2008 for U . S . Appl . No .
`11 / 282 , 950 .
`
`Final Office Action dated Dec . 4 , 2013 for U . S . Appl . No .
`12 / 205 , 747 .
`Non - final Office Action dated Jun . 17 , 2013 for U . S . Appl . No .
`12 / 205 , 747 .
`Final Office Action dated Nov . 8 , 2011 for U . S . Appl . No .
`12 / 205 , 747 .
`Non - final Office Action dated Apr . 19 , 2011 for U . S . Appl . No .
`12 / 205 , 747 .
`Non - final Office Action dated Jan . 15 , 2015 for U . S . Appl . No .
`12 / 228 , 325 .
`Final Office Action dated Apr . 1 , 2014 for U . S . Appl . No .
`12 / 228 , 325 .
`Non - final Office Action dated Jun . 3 , 2013 for U . S . Appl . No .
`12 / 228 , 325
`Final Office Action dated Dec . 20 , 2012 for U . S . Appl . No .
`12 / 228 , 325 .
`Non - final Office Action dated May 16 , 2012 for U . S . Appl . No .
`12 / 228 , 325 .
`Final Office Action dated May 11 , 2011 for U . S . Appl . No .
`12 / 228 , 325 .
`Non - final Office Action dated Nov . 4 , 2010 for U . S . Appl . No .
`12 / 228 , 325 .
`Final Office Action dated Oct . 7 , 2009 for U . S . Appl . No .
`12 / 228 , 424 .
`Non - final Office Action dated Jun . 2 , 2009 for U . S . Appl . No .
`12 / 228 , 424 .
`EPO , Application No . 05813041 . 0 , File history from Nov . 21 , 2005
`to Apr . 7 , 2016
`EPO , Application No . 05813045 . 1 , File history from Nov . 21 , 2005
`to Apr . 7 , 2016 .
`Willis , Will , et al , Implementing and Managing Microsoft Exchange
`Server 2003 , Self - Paced Training Kit , Microsoft , http : / / www . post .
`ir / ITCenter / Documents / c4b0ff43 - 0235 - 4e62 - a615 - 818f6834989a .
`pdf , pp . 1 - 826 , Microsoft Press , Redmond , WA .
`Microsoft , Exchange Server 2003 Features Comparison , https : / /
`www . microsoft . com / middleeast / windowsserversystem / exchange /
`evaluationifeatures / ex _ compare . mspx , Updated : May 25 , 2004 , pp .
`1 - 6 .
`Microsoft Exchange , Exchange Server Version and Features
`TechNet Articles United States ( English ) TechNet Wiki , https : / /
`social . technet . microsoft . com / wiki / contents / articles / 346 . exchange
`server - version - and - features . aspx , First Published : Mar . 9 , 2010 ;
`Last Revision : Dec . 11 , 2016 , pp . 1 - 3 .
`Microsoft , Exchange Documentation Team , Exchange Server 2003
`Administrative Guide , Microsoft Windows Server System , http : / /
`www . pc - hulp - online . nl / upload /
`Microsoft _ Exchange _ Server _ 2003 _ Administration _ Guide . pdf ,
`Sep . 2003 , pp . 1 - 503 .
`Fajman , R . , RFC 2298An Extensible Message Format for Mes
`sage Disposition Notifications , National Institutes of Health , Mar .
`1998 , pp . 1 - 29 , Network Working Group , 2998 , Standard Track .
`Crispin , M . , RFC 3501 — Internet Message Access Protocol — Ver
`sion 4revi , University of Washington , Mar . 2003 , pp . 1 - 109 , Net
`work Working Group , 3501 , Obsoletes : 2060 , Standard Track .
`Hansen , Ed . , T . , et al . , RFC 3798 — Message Disposition Notifica
`tion , AT & T Laboratories , Lucent Technologies , May 2004 , pp . 1 - 31 ,
`Network Working Group , 3798 , Obsoletes : 2298 , Standard Track .
`* cited by examiner
`
`2
`
`

`

`U . S . Patent
`
`Jul . 17 , 2018
`
`Sheet 1 of 4
`
`US 10 , 027 , 619 B2
`
`Extemal e - mail terminal
`
`Fig . 1
`
`50 Host system
`
`AS ,
`
`100
`
`118
`
`Mobile
`terminal 102
`
`106 106
`108
`108
`E - mail server
`
`Data network
`
`112
`
`Gateway
`
`114
`
`116
`
`A
`
`WID
`
`Access network
`
`Database
`( mailbox )
`
`Connectivity function
`Messaging centre
`
`120
`
`Tunnel
`
`122
`
`110
`e - mail address
`
`terminal id
`
`encryption information
`
`temporary access netw . id
`
`122A
`
`122B
`
`122C
`
`122D
`
`Messaging centre
`
`110
`
`Host system
`100
`
`Mobile
`terminal
`102
`
`2 - 1
`
`Fig . 2
`
`2 - 2
`
`Mobile client
`generates
`service activation code
`
`Muebencation
`
`Authentication
`Mobile ' s service activation
`code to host system
`via secure channel
`
`Mobile ' s service activation
`code registered with
`messaging centre
`
`2 - 4
`
`-
`
`-
`
`-
`
`2 - 3
`
`3
`
`

`

`atent
`
`Jul . 17 , 2018
`
`Sheet 2 of 4
`
`US 10 , 027 , 619 B2
`
`to report
`
`Extemal
`e - mail terminal
`104
`
`e - mail message
`
`online con
`
`e - mail server
`108
`
`Mesumping cente
`
`Messaging centre
`110
`
`Fig . 3
`Mobile terminal
`102
`
`3 - 10
`
`Retrieval of e - mail message
`
`Tunnel establishment
`3 - 11
`
`3 - 13
`
`3 - 18
`Mark as read
`-
`-
`- -
`
`3 - 22
`Mark as unread
`
`3 - 12
`
`Encryption and packing
`of e - mail message
`Transmission of
`e - mail message
`Decryption &
`unpacking
`3 - 15
`3 - 16
`Automatic control
`message ( e - mail read )
`
`Mark e - mail message
`as read
`
`-
`
`-
`
`+
`
`Mark e - mail message
`as unread
`
`3 - 21
`
`-
`-
`-
`User - generated control
`message ( e - mail unread )
`3 - 26
`
`-
`User - generated
`reply message
`3 - 30
`Encrypted & packed
`reply message
`
`3 - 32
`Decryption and unpacking
`of reply message
`Conventional reply message
`
`3 - 31
`
`Reply message
`stored in
`" sent items "
`3 - 34
`
`3 - 43
`3 - 43
`E - mail message
`moved to
`
`" deleted items " a
`
`3 - 33
`
`-
`
`Delete e - mail
`Delete e - mail message
`
`30
`
`3 - 42
`
`User - generated control
`message ( delete e - mail msg )
`
`3 - 41
`
`4
`
`

`

`U . S . Patent
`
`Jul . 17 , 2018
`
`Sheet 3 of 4
`
`US 10 , 027 , 619 B2
`
`( Terminal )
`
`( Terminal )
`
`
`
`Destination address
`
`Subject
`
`
`
`Message body ( Attachment ( s ) )
`
`424
`
`Fig . 4
`412
`411
`
`413
`
`414
`
`415
`
`410 *
`
`
`
`Source address
`
`
`
`Generated internally
`
`118
`
`422
`
`1
`
`Wireless interface
`
`Encryption & packing
`
`400
`
`
`
`Source address
`
`
`
`Destination address
`
`
`
`Message body Attachment ( s )
`
`Subject
`403
`404
`
`401
`
`402
`
`405
`
`Fig .
`LI
`
`Destination address
`
`
`
`Source address
`
`Subject
`
`
`
`Message body ( Attachment ( s ) )
`
`522
`
`Encryption & packing
`
`Decryption & unpacking
`
`430
`
`
`
`Size - based filtering ( configurable )
`
`
`
`Generated internally
`
`510
`
`+
`
`Decryption & unpacking
`
`524
`
`
`
`Message body Attachment ( s )
`
`
`
`Destination address
`
`
`
`Source address
`
`Subject
`?? ???? ?? ?
`
`
`
`( Fixed network )
`
`
`
`( Fixed network )
`
`5
`
`

`

`U . S . Patent
`
`Jul . 17 , 2018
`
`Sheet 4 of 4
`
`US 10 , 027 , 619 B2
`
`Extemal e - mail terminal
`
`Host system
`Co - 100
`E
`n
`
`112
`
`108
`
`106
`
`Fig . 6
`11 Mobile
`terminal 102
`
`114
`
`116
`
`A
`
`E - mail server
`
`Data network
`
`Connectivity function
`Messaging centre
`
`Gateway
`600
`
`Access network
`
`_ 120
`
`<
`
`Tunnel
`Tunnel
`
`612
`
`Database
`( mailbox )
`
`610
`
`e - mail address
`122A
`
`terminal id
`
`encryption information
`
`terminal id
`
`temp . access netw . id
`
`122B
`
`1220
`
`122B
`
`122D Fig . 7
`
`Mobile terminal
`102
`
`E - mail server
`108
`e - mail message
`7 - 10
`L
`
`Messaging centre
`110
`
`Connectivity function
`600
`7 - 11
`encryption , packing
`encrypted / packed message
`
`encrypted / packed message
`
`decryption , unpacking
`
`7 - 12
`
`7 - 13
`7 - 14
`7 - 20
`7 - 21
`
`message generation
`encryption , packing
`encrypted / packed message L encrypted / packed message
`7 - 22
`7 - 23
`decryption , unpacking
`e - mail message
`
`7 - 24
`
`7 - 25
`
`e - mail address 122A
`
`terminal id 1228
`
`1 temp . access netw , id 122D
`
`6
`
`

`

`US 10 , 027 , 619 B2
`
`related problem is that e - mail messages that the user has read
`MESSAGING CENTRE FOR FORWARDING
`at the terminal may appear as unread messages at the host
`E - MAIL
`system .
`CROSS - REFERENCE TO RELATED
`Yet another problem is that configuring an e - mail client
`APPLICATIONS
`5 software at the mobile terminal is difficult because of user
`interface restrictions in typical mobile terminals .
`This application is a continuation of U . S . patent applica
`SUMMARY OF THE INVENTION
`tion Ser . No . 12 / 228 , 325 filed Aug . 11 , 2008 , which is a
`divisional and claims the priority benefit of U . S . patent
`Embodiments of the present invention provide for meth
`application Ser . No . 11 / 282 , 950 filed Nov . 21 , 2005 , which 10
`ods and systems for messaging centres for forwarding an
`claims the priority benefit of U . S . provisional patent appli -
`e - mail message from an e - mail server . A permanent terminal
`cation No . 60 / 650 , 975 filed Feb . 9 , 2005 and the priority
`identifier of the mobile - terminal and an associated tempo
`benefit of Finnish patent application number 20045451 filed
`rary identifier of the mobile terminal may be stored . An
`Nov . 22 , 2004 , the disclosures of the aforementioned appli -
`cations being incorporated herein by reference .
`15 e - mail message including an indication of a permanent
`identifier of the mobile terminal may be received . The e - mail
`message may then be transmitted to the mobile terminal
`BACKGROUND OF THE INVENTION
`using the temporary identifier associated with the permanent
`Field of the Invention
`identifier of the mobile terminal .
`Various embodiments of the present invention include
`The invention relates to methods and equipment for 20
`methods for forwarding an e - mail message from an e - mail
`transmitting electronic mail ( e - mail ) messages to or from a
`server to a mobile terminal . Such methods may include
`mobile terminal . More specifically , the present invention
`storing a permanent terminal identifier of the mobile termi
`relates to a messaging centre for transmitting e - mail mes
`nal and an associated temporary identifier of the mobile
`sages to and from a mobile terminal .
`Description of the Related Art
`25 terminal , receiving the e - mail message , wherein the e - mail
`message includes an indication of the permanent terminal
`U . S . Pat . No . 6 , 701 , 378 to Barry Gilhuly et al . discloses
`identifier , and transmitting the e - mail address to the mobile
`a system and method for pushing information , such as e - mail
`terminal using the temporary identifier associated with the
`messages , from a host system to a mobile data communi
`permanent identifier of the mobile terminal . Some embodi
`cation device ( mobile terminal ) . The technique permits
`e - mail processing at a mobile terminal in addition to a more 30 ments may further include storing the e - mail address of the
`stationary computer , referred to as a host system in the
`e - mail message in association with the stored permanent and
`Gilhuly patent . Specifically , a redirector program operating
`temporary identifier of the mobile terminal . The message
`at the host system enables a user to continuously redirect
`may have been encrypted , packed , and received from a
`certain user - selected data items from the host system to the
`connectivity application in some embodiments of the present
`user ' s mobile data communication device upon detecting 35 invention . The mobile terminal receiving the e - mail message
`that one or more user - defined triggering events has occurred .
`may decrypt and unpack the message .
`The redirector program operates in connection with event -
`Some embodiments of the present invention further
`generating applications and repackaging systems at the host
`include a system of a memory for storing a permanent
`system to configure and detect a particular user - defined
`identifier of the mobile terminal and an associated temporary
`event , and then to repackage the user - selected data items in 40 identifier of the mobile terminal , a processor configured to
`an electronic wrapper prior to pushing the data items to the
`execute software stored in memory , the execution of the
`mobile device . The mobile data communication device may
`software resulting in the identification of the mobile terminal
`originate new messages or reply messages to previously
`based on a received e - mail message including an indication
`received information , such messages being transmitted to a
`of the permanent identifier of the mobile terminal and the
`wireless redirector host system , which then transmits a copy 45 stored association between the permanent identifier and the
`of the messages to both the intended recipient and a first
`temporary identifier of the mobile terminal , and a commu
`electronic mail account associated with the mobile data
`nications interface configured to transmit the e - mail message
`communication device .
`to the identified mobile terminal .
`The above - described prior art technique suffers from
`Some embodiments may further include a computer
`certain limitations . For example , the host system , such as an 50 readable storage media upon which is embodied programs
`office computer , and the mobile terminal require separate
`including instructions for performing methods for forward
`e - mail accounts . Some e - mail systems support a forward -
`ing an e - mail message from an e - mail server .
`type file for forwarding e - mail messages from a first e - mail
`BRIEF DESCRIPTION OF THE DRAWINGS
`account to a second e - mail account , but some systems do not
`support it . It is difficult to set up e - mail systems that do not 55
`support such forwarding techniques .
`In the following the invention will be described in greater
`Furthermore , the Gilhuly patent does not address issues
`detail by means of preferred embodiments with reference to
`that relate to manipulating e - mail messages at the second
`the attached drawings , in which
`e - mail account at the mobile terminal ) . For instance , it is
`FIG . 1 shows an exemplary system architecture in which
`difficult or impossible to use the terminal to arrange incom - 60 the invention can be used ;
`ing e - mail messages into different folders at the host system .
`FIG . 2 shows provisioning of an e - mail system ;
`Also , if the terminal user deletes an incoming e - mail mes -
`FIG . 3 shows a hypothetical scenario in which the e - mail
`sage at the terminal , a copy of the deleted message is not
`system is used ;
`present in a " deleted items ” folder at the host system , which
`FIG . 4 shows information flows in mobile - terminated
`typically is the case in e - mail systems . Likewise , when the 65 e - mail transmission ;
`terminal sends an e - mail message , a copy of the message is
`FIG . 5 shows information flows in mobile - originated
`not added to the host system ' s “ sent items ” folder . A further
`e - mail transmission ;
`
`7
`
`

`

`US 10 , 027 , 619 B2
`
`DETAILED DESCRIPTION
`
`40
`
`FIG . 6 shows an enhanced embodiment in which some of
`the functions of the messaging centre are performed by a
`separate connectivity function ;
`FIG . 7 shows traffic flow in the embodiment shown in
`FIG . 6 .
`
`centre 110 and the mobile terminal 102 . For instance , the
`tunnel may be set up using GPRS Tunneling Protocol ( GTP )
`or its later derivatives , or any other suitable tunneling
`protocol .
`In a real system , there are naturally a large number of
`mobile terminals 102 and tunnels 120 . In order to keep track
`of which e - mail account and which tunnel belongs to which
`mobile terminal , the messaging centre 110 maintains an
`association 122 for each mobile terminal supported by it .
`FIG . 1 shows an exemplary system architecture in which
`the invention can be used . Reference numeral 100 denotes a 10 Each association 122 joins three fields , namely an e - mail
`host system that is able to send an receive e - mail messages .
`address 122A assigned to the mobile terminal or its user ,
`Reference numeral 102 denotes a mobile terminal , also able
`encryption information 122C and a temporary wireless
`to send an receive e - mail messages . The e - mail messages
`identity 122D of the mobile terminal in the access network .
`may originate or terminate at external e - mail terminals , one
`The embodiment shown in FIG . 1 also employs a terminal
`of which is denoted by reference numeral 104 . The invention 15 identifier 122B which may be the same as the e - mail address
`aims at improving cooperation between the host system 100
`122A of the mobile terminal 102 , in which case the asso
`and mobile terminal 102 such that they can use a single
`ciation 122 actually associates three information items .
`e - mail account as transparently as possible . This means , for
`Alternatively , the terminal identifier 122B may be an iden
`example , that the users of the external e - mail terminals 104 ,
`tifier arbitrarily assigned to the mobile terminal . In a pre
`when sending or receiving e - mail , do not need to know if the 20 ferred implementation the terminal identifier 122B is the
`user of the host system 100 actually uses the host system 100
`mobile terminal ' s equipment identifier or its derivative . The
`or the mobile terminal 102 to communicate via e - mail . The
`encryption information 122C will be generated by the
`transparency also means that e - mail manipulation at the
`mobile terminal , as described later in connection with FIG .
`mobile terminal 102 has , as far as possible , the same effect
`2 . The temporary wireless identity 122D may be the iden
`as the corresponding e - mail manipulation at the host system 25 tifier of the tunnel to the mobile station . Of course , the tunnel
`100 . For example , e - mail messages read at the mobile
`identifier is not permanent and is only known when a tunnel
`terminal 102 should preferably be marked as read at the host
`exists . The creation and use of the association 122 will be
`system .
`further described in connection with FIGS . 2 , 3 and 6 .
`Reference numeral 106 denotes a data network , such as an
`FIG . 2 shows provisioning of an e - mail system in a
`IP ( Internet Protocol ) network , which may be the common 30 system as shown in FIG . 1 . The e - mail provisioning phase
`Internet or its closed subnetworks , commonly called intra -
`comprises the following steps . In a preparatory step ( not
`nets or extranets . Reference numeral 108 denotes an e - mail
`shown ) , appropriate e - mail software is installed in the host
`server and its associated database . The database stores an
`system 100 ( if present ) and mobile terminal 102 , as well as
`e - mail account , addressable by means of an e - mail address ,
`in the e - mail server 108 . For instance , the host system 100 ,
`that appears as a mailbox to the owner of the e - mail account . 35 the mobile terminal 102 and the e - mail server 108 may
`In order to communicate with mobile terminals 102 , the data
`comprise and execute conventional e - mail software , such as
`network 106 is connected , via a gateway 112 to an access
`Microsoft® . Outlook , which may be augmented by inven
`network 114 . The access network comprises a set of base
`tive client software that will be described in more detail
`stations 116 to provide wireless coverage over a wireless
`whenever necessary .
`After the software installation , the next task is to create a
`interface 118 to the mobile terminals 102
`Reference numeral 110 denotes a messaging centre that is
`secure binding between the connectivity function and the
`largely responsible for providing the above - mentioned
`mobile terminal 102 . The idea is to ensure that , in addition
`transparency between the host system 100 and the mobile
`to the host system 100 , only the mobile terminal 102 used in
`terminal 102 . The system architecture also comprises a
`the binding process can be used to access and manipulate
`connectivity function , whose task is to push e - mail messages 45 e - mail addressed to the mobile terminal ' s e - mail address .
`to the mobile terminal . In the embodiment shown in FIG . 1 ,
`The binding operation faces two types of security risks .
`the connectivity function is considered a physically integral
`First , the communication used during binding must be
`but logically distinct element of the messaging centre 110 .
`secured against eavesdropping or other types of hacking .
`Later , in connection with FIGS . 6 and 7 , an enhanced
`Second , the only the user of the bound terminal 102 may
`embodiment will be described that explicitly assigns the 50 access e - mail addressed to the e - mail address . The eaves
`security - related functions to the connectivity function and
`dropping problem is not trivial in a phase in which no trust
`traffic - related functions to the messaging centre 110 .
`exists between the mobile terminal 102 and the rest of the
`The mobile terminal 102 may be a pocket or laptop
`system . Yet another problem is that the e - mail server 108 and
`computer with a radio interface , a smart cellular telephone ,
`the messaging centre 110 typically have user interfaces that
`or the like . Depending on implementation , the host system 55 are only accessible to dedicated support persons .
`100 , if present , may have different roles . In some imple -
`FIG . 2 shows a secure e - mail provisioning technique in
`mentations the host system 100 is optional and may be a
`which the host system 100 authenticates the user of the
`conventional office computer that merely acts as the mobile
`mobile terminal 102 . In step 2 - 1 the client software in the
`terminal user ' s principal computer and e - mail terminal . In
`mobile terminal 102 generates and displays a service acti
`other implementations the host system may act as a platform 60 vation code . In step 2 - 2 the host system 100 authenticates
`for a single user ' s connectivity function , in addition to being
`the person who enters the service activation code . Instead of
`an office computer . In yet other implementations the host
`a dedicated authentication step , the technique may rely on
`system
`100 may comprise the connectivity function for
`the authentication of the underlying e - mail system , such as
`several users . Thus it is a server instead of a normal office
`user name and password combination . After all , the e - mail
`computer .
`65 provisioning need not be more secure than the underlying
`We assume here that the access network 114 is able to
`e - mail system . In step 2 - 3 the service activation code is then
`establish and maintain a tunnel 120 between the messaging
`conveyed off - line to the host system 100 . The idea of the
`
`8
`
`

`

`US 10 , 027 , 619 B2
`
`from the e - mail message to be conveyed to the mobile
`off - line communication is to eliminate any chance of eaves
`terminal . The encryption process uses the mobile terminal ' s
`dropping before secure a communication channel can be
`service activation code 122C , or its derivative , as the
`established . For instance , the service activation code may be
`encryption key . In step 3 - 14 the messaging centre 110
`entered manually or via a local connection , such as a wired
`or optical interface or a short - range wireless interface , such 5 transmits the encrypted and packed e - mail to the mobile
`as BluetoothTM Finally , in step 2 - 4 , the mobile terminal ' s
`terminal that decrypts and unpacks it in step 3 - 15 . The
`service activation code is registered with the connectivity
`messaging centre 110 knows the correct encryption key
`( service activation code ) 122C and the tunnel identifier
`function in the messaging centre 110 .
`The service activation code is closely related to an
`122D on the basis of the association triplet 122 .
`In step 3 - 16 the mobile terminal 102 sends the messaging
`encryption key to be used in future communications between 10
`the connectivity function in the messaging centre 110 and
`centre 110 an automatic control message indicating that the
`the mobile terminal 102 . The service activation code and the
`user has read the e - mail message . In response to the control
`encryption key may be identical , or one may be a subset of
`message , the messaging centre 110 signals the e - mail server
`the other , or the encryption key may be derived from the
`108 to mark the e - mail message as read in step 3 - 17 , which
`service activation code by means of some , preferably unpub - 15 act the e - mail server performs in step 3 - 18 . The control
`lished , algorithm . The fact that the service activation code
`message comprises some identification of the e - mail mes
`and the encryption key are closely related to each other
`s age but not its contents , whereby it loads the radio interface
`ensures that the terminal used in the authentication process
`only lightly . A benefit of the control message is that the user ,
`is the terminal used to access the e - mail service afterwards .
`when beginning to user the host system 100 , immediately
`Thus the idea of conveying the service activation code to 20 sees which messages he / she has already read and does not
`the messaging centre 110 via the host system 100 solves both
`have to read them twice .
`the security - related and user interface - related problems
`Next in this scenario , the user decides that the e - mail
`mentioned above . If there is no host system 100 that can
`message needs further attention when he / she is at the host
`authenticate the mobile terminal and its user . Instead , the
`system 100 . The user may initiate another control message
`user may enter the provisioning data to the connectivity 25 3 - 20 and 3 - 21 that causes the previously read message to be
`function via some suitable connection . The provisioning
`marked as unread at the e - mail server in step 3 - 22 .
`data entered by the user may be checked by sending a trial
`The next phase , steps 3 - 30 through 3 - 34 , relates to e - mail
`e - mail message and attempting to read it . If the check
`message generation at the mobile terminal 102 . We assume
`succeeds , it is regarded as the authentication . Yet another
`here , that the e - mail message to be generated is a reply
`way is to convey the service activation code to a dedicated 30 message to the incoming message described above ( steps
`support person who performs the authentication ( eg by
`3 - 10 to 3 - 17 ) , but the operation is very similar if the message
`recognizing the person ' s face or voice ) and enters the
`to be generated is an original ( non - reply ) message . In step
`service activation code into the connectivity function in the
`3 - 30 the mobile terminal user generates a reply message .
`messaging centre 110 . The messaging centre / connectivity
`Since it is a reply message , its recipient is automatically the
`function 110 now stores an association ( item 122 in FIG . 1 ) 35 sender of the incoming message , and the subject field
`between the e - mail address 122A and encryption informa -
`comprises the original subject with a prefix of “ RE : ” or
`something similar . If the message is not a reply message , the
`tion 122C .
`FIG . 3 shows a hypothetical scenario in which the e - mail
`user will have to fill in the recipient and subject fields . In
`system is used . This scenario comprises four events , which
`step 3 - 31 the client software at the mobile terminal 102
`are delineated by thick dashed lines . The first event , steps 40 encrypts , and optionally packs , the outgoing e - mail message
`3 - 10 through 3 - 16 , relate to incoming e - mail . In step 3 - 10
`and transmits it via the tunnel to the messaging centre 110 .
`the external e - mail terminal 104 sends an e - mail message to
`The messaging centre 110 does not immediately know the
`the e - mail server 108 . The e - mail message is addressed to
`sender of the e - mail message or the required decryption key .
`the user of the host system 100 . Accordingly , a notification
`But the messaging centre 110 does know the identifier of the
`of the incoming e - mail is sent to the host system 100 , but 45 tunnel 120 , and it employs the association triplet 122 to
`that step is omitted from FIG . 3 as purely conventional . In
`retrieve the decryption key 122C and the mobile terminal
`step 3 - 11 the mobile terminal 102 requests the access
`user ' s e - mail address 122A . The latter is not included in the
`network to establish a tunnel between itself and the mes -
`e - mail message transmitted over the wireless interface 118
`saging centre 110 . Step 3 - 11 may take place before or after
`in order to load the wireless interface as little as possible . In
`step 3 - 10 . After the tunnel establishment , the messaging 50 step 3 - 32 , the messaging centre 110 employs the decryption
`centre 110 now stores a complete association triplet ( item
`key 122C to decrypt the e - mail message . It also inserts the
`122 in FIG . 1 ) that joins th