Abstract: When a network-based wireless device such as a mobile phone or data terminal is reported lost or stolen or is determined to be malfunctioning, a service provider can immediately deny the device access to the network. However, any management operation to secure data carried by the wireless device cannot be carried out as the device is no longer reachable from the network. Therefore, the data should be secured before the device is rendered inoperable. Apparatus and methods are provided to back-up the data or wipe the data before the system denies access to the device. A system and method are provided by which a security manager works in conjunction with an equipment register of the network to lock and wipe data on the wireless device before the device is denied access to the network. Similarly, for a wireless device that is later recovered or determined to be operable, the device can be granted access to the network again and any data that was locked or wiped can be unlocked or restored over the network.

Abstract: Systems and methods are described for establishing credentials at a device and at a device management server for the purpose of exchanging secure credentials in order to mutually authenticate the device and the server. A credential generation algorithm is described which uses a plurality of seeds, including the hardware identity of the device, the server identity, and a shared private key, to generate two sets of credentials, one to be used by the device and the other to be used by the device management server. The credentials are exchanged between the device and the server during any session, thereby assuring mutual authentication.

Abstract: Systems and methods are described for securely downloading management client software onto a device from an embedded stub in the device. In one embodiment, the stub client is activated by a message with credentials from a management server. The stub client, after verification of the credentials, downloads and activates a full management client. The management client then participates in any authorized management session with the device management server. The messages are preferably encrypted using a key that is based on the credentials. The credentials may be specific to the device and to the service provider associated with the device.