Apparatuses, methods and systems for implementing a trusted subscription management platform

• US 10,075,841 B2
• Filed: 09/17/2015
• Issued: 09/11/2018
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: GigSky, Inc.
• Original Assignee: Simless, Inc. (GigSky, Inc.)
• Inventors: Wane, Ismaila
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Mastrodonato, Margaret G
• Application Number:
  US14/856,991
• Publication Number:
  US 20160007188A1
• Time in Patent Office: 1,090 Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/63 based on the content carried by the session initiation protocol [SIP] messages
• CPC Class Codes: H04M 15/7556 by SIM, e.g. smart card account in SCP, SDP or SN
• CPC Class Codes: H04M 15/8038 Roaming or handoff
• CPC Class Codes: H04M 15/8044 Least cost routing
• CPC Class Codes: H04M 15/8055 Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/81 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 17/02 Coin-freed or check-freed systems , e.g. mobile- or card-operated phones, public telephones or booths
• CPC Class Codes: H04M 17/103 using SIMs (USIMs) or calling cards
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/35 : Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/42 : using virtual identity modules
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/183 : Processing at user equipment or user record carrier
• CPC Class Codes: H04W 8/205 : Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Apparatuses, methods, and computer readable storage media are provided for implementing a trusted subscription management platform. An example server device is configured to transmit, to a trusted UI client of a mobile station, information regarding a set of virtual SIM cards associated with the mobile station, and receive, from the trusted UI client of the mobile station, a request to provision a particular virtual SIM card. The server device is further configured to initiate, by an SM-SR module and via a trusted baseband client of the mobile device, a secure proxy channel between the server device and a profile manager that hosts the particular virtual SIM card, and transmit, via the secure proxy channel and to the profile manager, an instruction regarding the particular virtual SIM card. Corresponding methods and computer readable storage media are provided.

Claims

1. A system comprising a server device and a mobile device, wherein the server device includes at least one processor and at least one memory storing computer-executable instructions that, when executed by the at least one processor, cause the server device to:

transmit, to a trusted user interface (UI) client of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receive, from the trusted UI client of the mobile station, a request to provision a particular virtual SIM card;

initiate, by a subscription manager—

secure routing (SM-SR) module of the server device and via a trusted baseband client stored in a baseband memory of the mobile device, a secure proxy channel between the server device and a profile manager that hosts the particular virtual SIM card; and

transmit, via the secure proxy channel and to the profile manager, an instruction regarding the particular virtual SIM card, wherein transmitting the instruction via the secure proxy channel includes routing the instruction through the trusted baseband client.

2. The system of claim 1, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server device to:

transmit, to the trusted UI client of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server device,

wherein the request to provision the particular virtual SIM card comprises a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

3. The system of claim 1, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server device to:

create the secure proxy channel between the server device and the profile manager using a mutual authentication procedure.

4. The system of claim 1, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server device to register the mobile station.

5. The system of claim 4, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server device to register the mobile station by causing the server device to assign the mobile station a unique random cryptographic key.

6. The system of claim 4, wherein registration of the mobile station establishes that no additional registrations are required for newly purchased virtual SIM cards.

7. The system of claim 1, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or

delete a virtual SIM card.

8. The system of claim 7, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards is received from the trusted UI client of the mobile station via an internet protocol (IP) channel.

9. A method comprising:

transmitting, by a server device and to a trusted user interface (UI) client of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI client of the mobile station, a request to provision a particular virtual SIM card;

initiating, by a subscription manager-secure routing (SM-SR) module of the server device and via a trusted baseband client stored in a baseband memory of the mobile device, a secure proxy channel between the server device and a profile manager that hosts the particular virtual SIM card; and

transmitting, via the secure proxy channel and to the profile manager, an instruction regarding the particular virtual SIM card, wherein transmitting the instruction via the secure proxy channel includes routing the instruction through the trusted baseband client.

10. The method of claim 9, further comprising:

transmitting, to the trusted UI client of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server device,

wherein the request to provision the particular virtual SIM card comprises a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

11. The method of claim 9, further comprising:

creating the secure proxy channel between the server device and the profile manager using a mutual authentication procedure.

12. The method of claim 9, further comprising:

registering the mobile station.

13. The method of claim 12, wherein registering the mobile station includes:

causing the server device to assign the mobile station a unique random cryptographic key.

14. The method of claim 12, wherein registration of the mobile station establishes that no additional registrations are required for newly purchased virtual SIM cards.

15. The method of claim 9, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or

delete a virtual SIM card.

16. The method of claim 15, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards is received from the trusted UI client of the mobile station via an internet protocol (IP) channel.

17. A system comprising a server device and a mobile device,

wherein the server device includes:

means for transmitting, to a trusted user interface (UI) client of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

means for receiving, from the trusted UI client of the mobile station, a request to provision a particular virtual SIM card;

means for initiating, via a trusted baseband client stored in a baseband memory of the mobile device, a secure proxy channel between the server device and a profile manager that hosts the particular virtual SIM card; and

means for transmitting, via the secure proxy channel and to the profile manager, an instruction regarding the particular virtual SIM card; and

wherein the mobile device includes means for routing the instruction through the trusted baseband client.

18. The system of claim 17, further comprising:

means for transmitting, to the trusted UI client of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server device;

wherein the request to provision the particular virtual SIM card comprises a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

19. The system of claim 17, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or

delete a virtual SIM card.

20. The system of claim 19, wherein the server device further comprises means for receiving the request to provision the particular virtual SIM card of the set of virtual SIM cards from the trusted UI client of the mobile station via an internet protocol (IP) channel.