Systems, methods, and computer program products for interfacing multiple service provider trusted service managers and secure elements

• US 10,057,773 B2
• Filed: 09/29/2016
• Issued: 08/21/2018
• Est. Priority Date: 09/18/2012
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Gargiulo, Michael J.
• Primary Examiner(s): SHINGLES, KRISTIE D
• Application Number:
  US15/280,104
• Publication Number:
  US 20170019792A1
• Time in Patent Office: 691 Days
• Field of Search: 709203
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/40 Security arrangements using identity modules
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Abstract

System, methods, and computer program products are provided for interfacing between one of a plurality of service provider (SP) trusted service managers (TSM) and one of a plurality of secure elements (SE). A first request to renew a service is received from an SP system over a communications network. The first request includes a service qualifier associated with the service. A secure element corresponding to the service qualifier is determined. A second request to delete data associated with the service qualifier from the secure element is transmitted to the secure element. A third request to install an application on the secure element is transmitted to the secure element. A fourth request to activate the application on the secure element is transmitted to the secure element.

Claims

1. A method to interface between one of a plurality of service provider computing systems and one of a plurality of secure elements, comprising:

receiving, by a trusted service manager computing system and from a service provider computing system, a request to activate a service;

transmitting, by the trusted service manager computing system and to a management portion of a secure element, a request to create a security domain on the secure element that corresponds to the service provider, the management portion of the secure element storing one or more uninstantiated applications available to be extradited to two or more security domains the secure element and instantiated for two or more service providers in the two or more security domains of the secure element;

transmitting, by the trusted service manager computing system and to the management portion of the secure element, a request to extradite an instance of an uninstantiated application associated with the service to the security domain on the secure element associated with the service provider computing system; and

transmitting, by the trusted service manager computing system and to the service provider computing system, a response comprising an indication whether the request to activate the service was successfully processed.

2. The method of claim 1, wherein the request to activate the service comprises a service qualifier associated with the service.

3. The method of claim 2, further comprising determining, by the trusted service manager computing system, a secure element that corresponds to the service qualifier associated with the service.

4. The method of claim 1, further comprising receiving, by the trusted service manager computing system, a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to create the security domain on the secure element that corresponds to the service provider.

5. The method of claim 1, further comprising receiving, by the trusted service manager computing system, a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to determine whether the secure element comprises the application associated with the service.

6. The method of claim 1, wherein the request to install the instance of the application comprises instructions for creating the instance of the application based on the service identifier.

7. A computer program product, comprising:

a non-transitory computer-readable medium having computer-readable program instructions embodied therein that when executed by a computer cause the computer to interface between one of a plurality of service provider computing systems and one of a plurality of secure elements, the computer-readable program instructions comprising;

computer-readable program instructions to receive, by a trusted service manager computing system and from a service provider computing system, a request to activate a service;

computer-readable program instructions to transmit, by the trusted service manager computing system and to a management portion of a secure element, a request to create a security domain on the secure element that corresponds to the service provider, the management portion of the secure element storing one or more uninstantiated applications available to be extradited to two or more security domains the secure element and instantiated for two or more service providers in the two or more security domains of the secure element;

computer-readable program instructions to transmit, by the trusted service manager computing system and to the management portion of the secure element, a request to extradite an instance of an uninstantiated application associated with the service to the security domain on the secure element associated with the service provider computing system; and

computer-readable program instructions to transmit, by the trusted service manager computing system and to the service provider computing system, a response comprising an indication whether the request to activate the service was successfully processed.

8. The computer-readable medium of claim 7, wherein the request to activate the service comprises a service qualifier associated with the service.

9. The computer-readable medium of claim 8, further comprising computer-readable program instructions to determine a secure element that corresponds to the service qualifier associated with the service.

10. The computer-readable medium of claim 7, further comprising computer-readable program instructions to receive a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to create the security domain on the secure element that corresponds to the service provider.

11. The computer-readable medium of claim 7, further comprising computer-readable program instructions to receive a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to determine whether the secure element comprises the application associated with the service.

12. The computer-readable medium of claim 7, wherein the request to install the instance of the application comprises instructions for creating the instance of the application based on the service identifier.

13. A system to interface between one of a plurality of service provider computing systems and one of a plurality of secure elements, comprising:

a trusted service manager comprising at least one memory and a processor communicatively coupled to the at least one memory, wherein the processor executes application code instructions that are stored in the at least one memory to cause the system to;

receive, from a service provider computing system, a request to activate a service;

transmit, to a management portion of a secure element, a request to create a security domain on the secure element that corresponds to the service provider, the management portion of the secure element storing one or more uninstantiated applications available to be extradited to two or more security domains the secure element and instantiated for two or more service providers in the two or more security domains of the secure element;

transmit, to the management portion of the secure element, a request to extradite an instance of an uninstantiated application associated with the service to the security domain on the secure element associated with the service provider computing system; and

transmit, to the service provider computing system, a response comprising an indication whether the request to activate the service was successfully processed.

14. The system of claim 13, wherein the request to activate the service comprises a service qualifier associated with the service.

15. The system of claim 14, wherein the processor is further configured to execute computer-executable instructions stored in the storage device to cause the system to determine a secure element that corresponds to the service qualifier associated with the service.

16. The system of claim 13, wherein the processor is further configured to execute computer-executable instructions stored in the storage device to cause the system to receive a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to create the security domain on the secure element that corresponds to the service provider.

17. The system of claim 13, wherein the processor is further configured to execute computer-executable instructions stored in the storage device to cause the system to receive a pre-personalization request from the service provider computing system, the pre-personalization request comprising a request to determine whether the secure element comprises the application associated with the service.

18. The system of claim 13, wherein the request to install the instance of the application comprises instructions for creating the instance of the application based on the service identifier.