KR20070089970A - Use of configurations in device with multiple configurations - Google Patents

Abstract

The invention relates to a method for arranging use of configurations in a device with multiple configuration data sets manageable by one or more external managing entities. The device comprises access control information originated and/or controlled by an external managing entity for defining a right to access a configuration data set. The access control information is checked in response to an indication from an application requiring access to a configuration data set. If the application is, on the basis of the access control information, entitled to access the configuration data set, access to the configuration data set is arranged for the application.

Description

Use of configurations in device with multiple configurations

The present invention relates to setting use of configurations in devices with multiple configurations, and in particular to setting access control with configuration data sets that can be managed by one or more external management devices. .

As different data processing devices such as mobile base stations become more complex, the importance of device management has been further asserted. Devices require several different settings, such as settings associated with Internet access points, and it is difficult and difficult for a user to set them manually. In order to solve this problem, device management solutions have been developed to allow an administrator or teleoperator of a company information system to set up an appropriate configuration within the device. In general, device management refers to operations by which a person who does not use a device can change the configuration of the device, for example, settings or even protocols used by the device. In addition to device-specific settings, it is possible to transmit user-specific data, such as user profiles, logos, ring tones, and menus, in which the user can personally modify the settings of the device. It is done automatically in relation to management.

One of the device management standards is Open Mobile Alliance (OMA) Device management (DM), which is based in part on the Synchronization Markup Language (SyncML) protocol. For example, a personal computer (PC) may operate as a device management server in a device management protocol, and the mobile base station may operate as a device management client. Items managed in the device management client are set according to the management targets. The management objects are elements that can be managed by server management commands in the device management client. The object to be managed may be many or many elements, for example a background image or a screen saver. In OMA device management, management objects are set in the management tree.

Some typical manageable items include operator specific connection settings such as, for example, General Packet Radio Service (GPRS) connection settings. By OMA DM procedures, these operator specific sets of settings, which may be referred to as configurations, may be maintained by an operator control management server at the user terminal device. For example, Wireless Application Protocol (WAP) settings for using the service provider's WAP services may be supplied as a configuration context for the terminal device.

Some items that are managed may include user specific information and user control information information such as screen savers and ring tones. Moreover, devices can be used to access an integrated information system, such as file systems, intranet pages, and e-mail systems, for example. For this purpose, it is necessary to include one or more configurations in order to configure the devices to access such integrated information system devices. For security purposes, it is desirable to allow the company's IT staff to control these settings. Therefore, the devices may include multiple configurations from different management parties, and it should be possible to allow only authorized management parties to access a particular configuration. In accordance with the OMA DM protocol specified in the "SyncML Device Management Protocol", version 1.1.2, December 12, 2003, OMA specification on page 41, in the set-up state of a management session, the management server receives a message from the management server. Furthermore, as described in the OMA specification "SyncML Management Tree and Description", Version 1.1.2, December 2, 2003, page 44, a node in the management tree is a list of identifiers and each May be defined by an access control list (ACL) that includes access rights associated with the identifier, as described in chapter 7.7.1, access rights authenticated by an ACL acquire, add, replace, and / or a node. Define authorized management server identifiers for removal, so different access rights can be provided to multiple device management servers, and device management commands from non-qualified management servers However, in addition to the ability to control the management servers' access to management tree nodes, there is a general need to limit the use of configurations within the device, for example, companies protect integrated data and services. To do this, you want to control the terminals used to access corporate IT services in a better way.

A method, a device management system, data processing devices, and a computer program product are now provided, which are characterized by what is described in the independent claims. Certain embodiments of the invention are described in the dependent claims.

In accordance with an aspect of the present invention, an apparatus having multiple configuration data sets includes access control information generated and / or controlled by an external management element to define a right of an application to access the configuration data set. Access control information is checked in response to an indication from an application requesting access to the configuration data set. If an application based on access control information is entitled to access the configuration data set, access to the configuration data set is established for that application.

The term “configuration data set” is generally referred to as a set of data that includes configuration information that directly or indirectly affects one or more functions of an apparatus or an application within the apparatus. For example, the configuration data set may include an IP address or domain name of a server based on a connection established from the device.

The invention makes it possible to control the access of applications to configuration data. In particular, access rights can be defined and / or controlled by external elements. The apparatus may include multiple configuration data sets with different control characteristics. For example, a configuration data set that defines access settings for an integrated information system can be controlled by configuration management software operated by a company's IT staff.

According to an embodiment, at least one service contact is stored on the device, the service contact comprising at least a configuration data set. Access to the service contact is allowed only for applications scheduled in the access control information associated with the service contact by an external management element based on the access control information. Various uses of contacts may be provided at the device that may include data not related to settings, such as user related data stored by an application in the device.

The invention is now described in more detail with reference to certain embodiments and the accompanying drawings,

1 shows a management system,

2 shows an apparatus with multiple configurations,

3 illustrates a method according to an embodiment of the present invention; And

4A and 4B illustrate a method according to an embodiment of the present invention.

In the following, an embodiment of the present invention will be described with respect to a system supporting OMA device management; However, note that the present invention can be applied to any device management system in which the components in the management device can be managed by an external management element.

1 shows a network system. A network server or PC is typically provided as server S. For example, a mobile base station, a PC, a laptop computer, a personal digital assistant (PDA) device, or a module thereof may be provided as the terminal TE. In the following embodiments, with respect to the device management, the terminal TE is the device management. It is assumed that it is provided as a client and that the server S is provided as a device management server, which can manage several clients TE.

In the first embodiment of Fig. 1, the client TE and management servers S are connected to a local area network (LAN). A client TE connected to a network LAN includes functions such as software to control the network card and data transmission, in order to communicate with the devices in the network LAN. The local area network LAN can be any type of local area network, and the TE can also be connected to server S, typically through the Internet, using a firewall (FW). The terminal TE may also be connected to the local area network wirelessly via an access point (SP).

In a second embodiment, the client TE communicates with the server S via a mobile network (MNW). The terminal TE connected to the network MNW includes a mobile base station function for wirelessly communicating with the network MNW. There may also be other networks between the mobile network (MNW) and the server S, such as a local area network LAN. The mobile network MNW can be any wireless network, for example a network supporting GSM services; A network supporting General Packet Radio Service (GPRS) services; It may be a third generation mobile network such as a network according to the network specification of the 3rd Generation Partnership Project (3GPP), a wireless local area network WLAN, a private network, or a combination of several networks. In addition to the above examples, by using a wireless or wired connection without other network components, many other device management configurations are also possible, such as a management connection between terminals TE and a direct management connection between terminal TE and server S. .

Terminal TE and server S comprise a central processing unit comprising a memory, a user interface, I / O means for data transfer, and one or more processes. The memory stores the applications controlling the central processing unit, and has an inactive part in which other information is stored and an active part used in temporary data processing.

Computer program code portions executed in the central processing unit cause server S to execute the inventive means of establishing and managing service contacts at terminal TE, some embodiments of which are shown in connection with FIG. 4A. The computer program code portions executed in the central processing unit of the terminal TE also cause the terminal TE to implement the means of the present invention to set up the configurations to the terminals and to set up the use of the configurations at the terminal TE. Embodiments are shown in connection with FIGS. 2, 3, 4A, and 4B. Note that one or more elements may perform the functions of the present invention. For example, some of the features shown in FIG. 3 are performed by a particular access controller in terminal TE, and some other features are performed by an application in terminal TE. The computer program can be stored in any storage medium, from which it can be loaded into the memory of the device TE; S runs a computer program. The computer program can also be loaded over the network, for example using the TCP / IP protocol stack. It is also possible to use hardware solutions or a combination of hardware and software solutions to implement the means of the present invention. In one embodiment, the chip unit or any other type of module and / or S for controlling the device TE may cause the device TE and / or S to perform the functions of the present invention. The data structure including the service contact specific information may be transmitted, for example, via a data transmission network from the server S to the terminal TE, and may be stored in the memory of the terminal TE.

In one embodiment, the terminal TE and the server S are set up to support OMA device management (DM). The terminal TE, which serves as an OMA management client, includes a client agent function that handles functions related to the management session at the client. Server S, which serves as a device management server, includes a server agent or server master that manages management sessions. However, note that the application of these functions is not limited to any particular device, and that the client and server functions can be executed on a single physical device. One or more management trees stored in the TE's memory represent objects manageable in the terminal TE. The management tree is composed of nodes, and defines at least one management object formed from at least one parameter among one or more nodes or one node. Nodes can be individual parameters, subtrees, or data collection. The node may include at least one parameter, which may be a configuration value or file, such as a background image file at the node. The contents of a node may also be linked to other nodes. Each node may be addressed by a uniform resource identifier (URI). The authorized device management server can (dynamically) add and change the contents of nodes in the management tree.

2 shows a terminal TE environment 200 with multiple configurations. Environment 200 is provided to one or more service contacts 203. The service contact 203 may be considered as an area in the terminal TE whose access is controlled. Thus, the information stored in the service contact specific storage area in the terminal TE may define or form the service contact 203. In one embodiment, the service contacts 203 represent different configurations within the terminal TE used to access services such as, for example, an internet access service. As shown by the arrow from the service contact 203, the service contact 203 representing the configuration may include certificates 206, settings 205, and / or any other type of data specific to the service contact 208. ) May be included. As shown in FIG. 2, information pertaining to service contact 203 may be stored in multiple storage locations, or in a single storage location. For example, service contact 203 may have sensitive user data stored in file system 207, settings 205 and certificates 206 stored in central repository 204, which may be a specific repository for server contact information. Or may be associated with them. The data 208 belonging to the service contact 203 can be any data received at the terminal TE and can be generated by the application 202. For example, a user may enter a stored calendar entry as data 208 belonging to service contact 203.

The secure execution environment 201 may control access to service contact 203 information, and the locations of the repository containing the service contact contents may be secured. Although not shown in FIG. 2, execution environment 201 may include an access controller configured to control access to service contact information. In one embodiment of the service contact manager 211, the external management element may grant rights to the applications 202 accessing information belonging to the service contact 203. The access control information (ACI) 212 generated and / or controlled by the external management element 211 may be stored in the terminal TE to define the rights to access the service contacts 203. Moreover, execution environment 201 may securely perform data transfer between service contact 203 and authorized applications that access one or more storage locations that include service contact information. In one embodiment, at least certain security services are established by the operating system of the terminal TE.

The applications 202 can run in the secure execution environment 201 of the terminal environment 200. If the access control information 212 enables the application 202, access to one or more service contacts 203 for the application 202 to initiate a service for the user of the terminal TE. Is set. This access control information 212 can be defined in many different ways at the terminal TE. For example, file identification elements that qualify for access to the service contact 203 may be stored in the terminal TE, where the terminal TE may only service element 203 for those elements identified directly or indirectly in the file. Is configured to provide access. The access control information 212 may be defined at the terminal TE as parameters for, for example, a software component that executes service contact connection control functions. Thus, the terminal TE may be provided in access control rules to define the entitlement to access the service contact 203. The access control information file may be a list of application identifiers or a list of application source identifiers. However, instead of or in addition to the application identifiers, the access control information may define other elements of access control information in the terminal TE, such as application groups or application execution environments. The access control information 212 may be a service contact or a specific service contact group. For example, access control information 212 may include a plurality of different profiles for joint access tailored for different usage situations. In one embodiment, this management access control information 212 belongs to service contact information.

In accordance with the present invention, the certificate 206 of the application 202 is checked to reliably define an identifier associated with the application 202. Based on this identifier, the terminal TE is then configured to check whether the application 202 is entitled to access the service contact 203. Such certificates 206 may be stored within service contact information (eg, a certificate in central repository 204) and / or outside service contact 203, for example within application 202 data in file system 207. have. Certificate 206 is associated with at least one application in terminal TE. Certificate 206 is issued and digitally signed by a trusted third party, such as a general certification authority or application developer, to prove the completeness and origin of the associated application. The certificate 206 may be obtained for the terminal TE separately from the access control information 212 during installation of the application, or may form part of the service contact information or access control information from the management element. It should be noted that in one embodiment, the certificate 206 may be obtained during an access control procedure to check the right of the application 206 to access a particular service contact 203. The certificate 206 may include at least some of the following: the name, serial number, expiration date, copy of the certificate holder's public key, and the digital signature of the issuer so that the recipient can verify that the certificate is authentic. It may include some of them.

As shown by dashed lines in FIG. 2, service contacts 203 may be managed by an externally authenticated management element 211. This may mean that all or part of the information belonging to the service contact 203 may be read, added, modified and / or removed by the external management element 211. In one embodiment, the OMA DM may be applied to manage service contacts 203. At least some of the service contact 203 information may be stored in the management tree, which may be modified by the device management agent based on device management commands from the OMA management server (S).

3 illustrates an embodiment method for using service contacts in a terminal TE. In step 301, it may be necessary to initiate a service by the application 2020, such that the application 202 is stored under one or more service contacts 203 for service set-up or some other purpose. This is typically based on user input, but the service can also be initiated based on some other trigger, such as commands from an external device. 203 may be checked in step 302. If the checks 302 and 303 indicate one or more available service contacts, the preferred service contact 203 is selected 305. For example, the terminal TE first A priority list may be stored that indicates service contacts 203 by rank, and default service contact 203 may be selected in step 305. Yes. If not, an available service contact 203 is selected 304. The application 202, or application manager, may be adapted to perform steps 301-305. Although not shown in Figure 3, the service Note that the contact selection process may include prompting the user of the terminal TE to select a service contact and / or confirm the selection of the service contact.

The method then proceeds to step 306 where an access to the selected service contact is requested or otherwise a request to access service contact specific data is indicated. Based on the access control information from the management element and / or the access control information 212 controlled by the management element, it is checked whether the application 202 is authorized to access the service contact 203. Associated access control information 212 may be obtained from the memory of the TE, or in one embodiment, the terminal TE may be configured to request and receive access control information from an external element such as an external management element 212. The management element may be the service contact manager 211 or some other element, for example, an element that issues a certificate 206. If the application 202 is not authenticated, access to the application 202 is denied by the service contact 203 (308).

According to an embodiment, step 307 comprises two substeps. First, the certificate 206 associated with the application 202 requesting access to the service contact 203 is checked. By checking the certificate 206, it is possible for the integrity and / or origin of the application 202 to be guaranteed. In a second substep, the identifier obtained from the certificate 206 of the application 202 is compared with the identifiers in the intended access control information 212. In one embodiment, the application origin identifier from the certificate 206 may be compared with the predetermined application origin identifiers in the access control information 212 in a second substep. The access control information 212 of the present invention defines such applications, groups of applications, or application sources that are authorized to use the service contact 203. Thus, if an identifier from the certificate 206 of the application 202 is found in the access control information 212, the application is authorized.

If the application 202 is authorized based on the check 307, the application may access 309 information related to the service contact 203, and the application 202 may then service based on the associated service contact information. May initiate 310.

In one embodiment, service contact 203 includes or is associated with settings required to establish a connection from terminal TE to one or more network resources to access a service. Thus, the application 202 can be connected at step 310 using these settings. These settings may define access integrating intranet resources such as electronic servers and electronic accounts. However, many other services also exist to allow this service contact 203 to be used.

In an embodiment, the terminal TE includes access control application (specific) data 208 belonging to or associated with the service contact 203, so that access to the application data 208 is authorized by an external management element 211. It may be set only for the designated applications 202. Such application data 208 may typically be a user stored or associated by application 202 at terminal TE based on user input. In step 310, application data 208, such as a file containing unified emails, may be capable of being displayed or further processed by application 202 (an email client application in the above example).

The service contact 203 may be selected or defined when using the application 202. The service contact 203 may be selected when the application 202 is activated and / or when new content is defined as service contact information. For example, when an e-mail application is activated, the user selects the desired profile or e-mail account, and the service contacts associated with that profile or e-mail account are also selected. Thus, when the application 202 then requests access to the service contact 203, steps 302 to 305 are unnecessary, but the information associated with the service contact 203 is lost, for example to connect to a remote e-mail server. Can be used. In another embodiment, service contact 203 may be defined for a user data item, such as an e-mail message. This service contact 203 may be selected in connection with the storage of the data item. For example, when a user finishes setting up e-mail and chooses to save an item, available service contacts 203 (for the e-mail application) are shown to the user. The user can then select the service contact 203 with which the data item is associated, thus making it possible to select a storage location for the data item, which data item is stored accordingly. The data item can then be used as some other service contact 203 specific data. That is, access to data items is allowed only for authorized applications 202.

In one embodiment, access to the service contact 203 is controlled by a security process in a secure execution environment 201, such as a particular access controller element (steps 307-309). It is also possible for the execution environment 201 to check 303 and select 304, 305 the service contact 203 for the application 202. Specific service contact selectors may be provided to the secure execution environment 201.

In another embodiment, the service contacts 203 available to the application 202 requesting access to the service contacts 203 are already checked in step 302. In this embodiment, only the service contact 203 to which the certificate of the application 202 allows access (or the application has access authentication by some other means) is considered a service. In this embodiment, access to the service contact 203 is only attempted by authorized applications 202 and thus unnecessary requests are prevented.

4A and 4B illustrate a method for establishing and / or modifying a service contact 203 at terminal TE by server S according to an embodiment. In Fig. 4A, the features of server S which functions as a device management server are shown. In step 401, it is necessary to create a new service contact 203 and / or modify an existing service contact 203 at the management terminal device TE. In other embodiments, it may be necessary to add or modify access control information 212 associated with service contacts 203.

A device management session is established between the management server function in server S and the device management client function in terminal TE (402). The normal OMA DM session setup functions described in the OMA specification "SyncML Device Management Protocol", version 1.1.2, December 12, 2003, page 41 can be used.

Service contact related information, such as, for example, connection settings 205 and / or access control information 212, is defined 403 in one or more management commands. In this embodiment, at least some of the service contact information in the device management command (s) is addressed to one or more service contact specific device management tree nodes. The management command is sent to the terminal TE (404).

4B illustrates functions at terminal TE receiving service contact related information. In step 410, the device management command is received from the device management server (S). The service contact related data including the access control information may be stored in the terminal TE. In particular, in step 411 the device management client in terminal TE defines the requested operations based on the received device management command. The device management tree in terminal TE may then be modified by new and / or modified information associated with service contact 203. For example, a new node may be added to the ACL list that defines server S as the only authorized device management server that modifies the node. The management tree may only be provided as a view to the management information, and the management information may be stored outside the management tree.

If the service contact 203 is created for the first time and device management is not provided for the terminal TE, then the OMA client provisioning methods initiate device management prior to service contact specific management commands. Can be used to construct. Thus, in steps 402 and 410, a connection can be used to set up provisioning.

The management tree may include one or more nodes for the access control information 212 even though the access control information 212 is not part of the service contact 203. In a manner similar to that described above, it is possible to set modification, deletion, or addition of the access control information 212 by using the device management command addressed to the node for the access control information 212. Thus, the external management element can easily change the access control configuration in the management device TE. 4A and 4B are merely exemplary. For example, the device management command may be formed prior to setting up the management session. In one embodiment, the service contact 203 may be created or modified by an authorized party in the terminal TE, for example a user. Similar procedures as already described with respect to FIG. 3, i.e., steps 306-309, may be used when accessing service contact information. Thus, it is unnecessary to apply device management mechanisms to modify service contact 203 information.

In one embodiment, the service contact manager 211 or service provider may check in the embodiment of FIG. 4A server S whether a suitable service contact is located and / or used appropriately at terminal TE. Thus, the service provider can locate the settings correctly and check whether only applications from trusted sources are used. This check can be executed by using OMA DM GET commands at the nodes containing the service contact data. This embodiment may be performed after steps 404 and 412 or at some other point in time, for example, after receiving a service request from an application in the terminal TE.

In steps 402, 403, 410, 411, it is possible to use the mechanisms of the device management protocol and the messages defined for it; For a more detailed description of the OMA device management protocol and other commands, see, for example, the OMA specification "SyncML Device Management Protocol", version 1.1.2, December 12, 2003, page 41, and the OMA specification "SyncML Representation Protocol Device Management". Usage ”, version 1.1.2, June 12, 2003, page 39.

According to an embodiment, the contents of the service contact 203 may be associated with different access control rules and / or access rights levels based on the access control information 212. In other embodiments, different access rules apply to different portions of service contact 203. For example, the settings 205 of the service contact 203 that define a connection to the integrated email server may be read (by the application 202 authorized to access the service contact 203), While not modified, access to data 208 in file system 207 associated with service contact 203 may be readable and correctable. In such an embodiment, the contents of the service contact 203 may be differentiated for access control.

Some rules that may be applied as in the embodiment described above may be: (right to read all or only a specific portion of the service contact data), right to remove, right to add. Access control rules and / or rights levels may be defined within access control information 212 or some other repository. In one embodiment, access policies are defined by Extensible Access Markup Language (XACML). If OMA DM is applied, access control lists may be defined within the management tree to determine one or more external device management servers authorized to access the associated service contact related data. That is, external management elements may be defined by OMA DM access control lists.

In an alternative or complementary embodiment, different access control rules are associated with different users of the service contacts 203 based on the access control information 212. In this embodiment, it is possible to apply different access rights for different applications 202, for example to act different access rights for the users of the terminal TE. By way of example, the service contact 203 (or a portion thereof) may be configured to be modified only by the user of the terminal TE or the external management element that creates and / or controls the subscriber and service contact 203 of the terminal TE.

In one embodiment, the user or subscriber of the terminal TE is always entitled to remove or delete the service tax 203 from the terminal TE. Since the service contact 203 is required to secure the service, the terminal TE cannot be used to access the service after the service contact 203 is deleted. Thus, there is no need to give full control to any administrator 211 of service contact 203, and users do not have to give up the right to control their terminals. There is no need for a service contact to be imposed on any terminal, but the user / subscriber may want to use the service and thus accept the service contact on the terminal TE. Because the service contact 203 can be set to be modified only by the authorized management element 211. It is possible to prevent a user's access to modify service contact 203.

In another embodiment, the ability to notify authorized management element 211 that a user has deleted service contacts 203 is provided. The feature or application 203 dealing with the deletion of the service contact 203 based on the user input may be configured to send a message to the authorized management element 211 informing the deletion of the service contact 203 from the terminal TE. In another embodiment, authorized management element 211 is configured to check service contacts 203 (authorized to be seen) in terminal TE to detect deleted service contacts. For example, periodic checks may be performed by OMA DM procedures on nodes containing service contact data.

Note that the embodiments described above can also be applied in any combination thereof. As the technology evolves, it is apparent to those skilled in the art that the basic idea of the present invention can be implemented in many different ways. Accordingly, the invention and its embodiments are not limited to the examples described above but may vary within the scope of the claims.

Claims (20)

CLAIMS 1. A method for a device management system that sets up the use of configurations in a device having multiple configuration data sets manageable by one or more external management elements, the plurality of applications having the right to access the configuration data set by the system. And access control information generated and / or controlled by an external management element to define the method. Checking the access control information in response to an indication from an application requiring access to a configuration data set; And In response to said application being entitled to access said configuration data set based on said access control information, establishing access to said configuration data set for said application. The device of claim 1, wherein at least one service contact is stored in the device, the service contact includes at least the configuration data set, and access to the service contact is based on the access control information to the external management element. For a predetermined application in access control information associated with the service contact. 2. The method of claim 1, wherein the selection of a configuration data set for the application is set in response to a plurality of configuration data sets available for the application. The method of any one of the preceding claims, wherein a service is set up by the application based on at least a portion of the configuration data set. In any one of the foregoing, Establishing a device management session or connection to establish provisioning between the device management server of the external management element and the device; Transmitting the configuration data set and / or the access control information by the device management session or the connection during provisioning; And Storing the configuration data set and / or the access control information in the device; Setting the configuration data set and / or the access control information in the device. A device management system comprising a device management server and a managed device management client, wherein the device management system is configured to manage at least one device management client by a management structure comprising at least one node, the system being And store access control information generated and / or controlled from an external management element to define a right to access a configuration data set, The system is configured to check the access control information in response to an indication from an application requiring access to the configuration data set, In response to the application being entitled to access the configuration data set based on the access control information, the system is configured to provide the application to access to the configuration data set, and And the system is configured to set up a service by the application based on at least a portion of the data set. A data processing apparatus for a device management system, the apparatus comprising means for storing multiple configuration data sets manageable by one or more external management elements and a plurality of applications, the data processing apparatus comprising: A memory that stores access control information to define a right to access a configuration data set, Means for checking said access control information in response to an indication from an application requesting access to a configuration data set, and Means for configuring access to the configuration data set for the application in response to the application being entitled to access the configuration data set based on the access control information. 8. The data processing apparatus of claim 7, wherein the data processing apparatus is configured to check the access control information in response to a request from the application to access the configuration data set. 9. The data processing apparatus of claim 7 or 8, wherein the data processing apparatus includes means for setting up a service by the application based on at least a portion of the configuration data set. 10. The method of any of claims 7-9, wherein at least one service contact comprising at least the configuration data set is stored in the data processing apparatus, and The data processing device is configured to allow the application to access the service contact based on the access control information if the application is authorized based on access control information associated with the service contact; Data processing unit. The data processing apparatus of claim 10, wherein the service contact further includes user related data stored by an application of the data processing apparatus. The apparatus of claim 7, wherein the configuration data set includes settings required to establish a connection to one or more network resources at the device to access a service, and The data processing device is configured to establish a connection to one or more network resources based on the settings. 13. The apparatus according to any of claims 7 to 12, wherein the data processing device comprises means for setting a selection of a configuration data set for the application in response to a plurality of configuration data sets available for the application. A data processing device, characterized in that. 14. Data processing as claimed in any of claims 7 to 13, wherein data transfer between the applications authorized to access the configuration data set, and the storage location containing the configuration data set are protected. Device. 15. The method of any of claims 7-14, wherein access to a configuration data set is controlled based on a comparison between predetermined identifiers in the access control information and an identifier in a certificate associated with the application. A data processing device, characterized in that the source of authentication. 16. The device according to any one of claims 7 to 15, wherein the data processing device comprises a device management client in accordance with an OMA device management standard, And the data processing device is configured to add and / or modify a configuration data set to a node of a management tree in the data processing device based on a device management command from a device management server. A data processing apparatus for a device management system, the data processing apparatus comprising means for sending management commands to the management apparatus, And the data processing device comprises means for controlling access control information for defining a right of an application in a management device to access a set of configuration data in the management device. 18. The apparatus of claim 17, wherein the data processing device is set to establish a device management session using the management device, The data processing apparatus is set to form a device management command addressed to a node representing the access control information and / or the configuration data set in the management tree of the management apparatus, and And the data processing device is set to send the device management command to the management device. 19. The data processing apparatus of claim 17 or 18, wherein the data processing apparatus is a device management server according to an OMA device management standard. A computer program product that can be downloaded to a memory of a data processing device, wherein the computer program product, when executed in a processor of the data processing device, causes the data processing device to: Check access control information that defines a right to access the configuration data set in response to an indication from an application requesting access to the configuration data set, and In response to said application being entitled to access said configuration data set based on said access control information, setting to access said configuration data set for said application, A computer program product comprising computer program code.

Images