Installation of a secure-element-related service application in a secure element in a communication device, system and telecommunications

• US 10,097,553 B2
• Filed: 06/07/2016
• Issued: 10/09/2018
• Est. Priority Date: 06/09/2015
• Status: Active Grant

• Current Assignee: Deutsche Telekom AG
• Original Assignee: Deutsche Telekom AG
• Inventors: Borgards, Frank, Dupre, Michael
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US15/175,088
• Publication Number:
  US 20160366137A1
• Time in Patent Office: 854 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

A method for installation of a secure-element-related service application in a secure element of a user equipment (UE) associated with a subscriber of a telecommunications network includes: transmitting an initial request, transmitting a request to install, receiving token information, transmitting the token information, transmitting an access and/or installation request together with the token information, and establishing a communication link. The secure-element-related service application, when installed within the secure element, is configured to allow the first server entity, together with a UE-related application installed on the user equipment, to provide a service to the subscriber of the telecommunications network.

Claims

1. A method for installation of a secure-element-related service application in a secure element of a user equipment (UE) associated with a subscriber of a telecommunications network, wherein the secure element corresponds to a secure element issuer, the method comprising:

in a first step, transmitting an initial request, via a request message from a UE-related service application of the user equipment towards a first server entity, for installation of the secure-element-related service application in the secure element, wherein the first server entity corresponds to a service provider;

in a second step, subsequent to the first step, transmitting, by the first server entity, a request to install the secure-element-related service application to a second server entity corresponding to the secure element issuer, and receiving, by the first server entity from the second server entity, token information generated by the second server entity and representing combined authorization from the secure element issuer and the service provider to request installation of the secure-element-related service application in the secure element;

in a third step, subsequent to the second step, transmitting, by the first server entity, the token information to the UE-related service application of the user equipment;

in a fourth step, subsequent to the third step, transmitting, by the UE-related service application of the user equipment to a proxy application of the secure element issuer, an access and/or installation request together with the token information, wherein the proxy application is configured to access the secure element and/or to install secure-element-related applications on the secure element, and wherein the proxy application is further configured to interact with the secure element and is installed in the user equipment as a link between the second server entity and the secure element; and

in a fifth step, subsequent to the fourth step, transmitting, by the proxy application to the second server entity via a communication link established between the proxy application and the second server entity, the token information together with Secure Element Identifier (SEID) information of the user equipment for validation by the second server entity;

wherein, during the fifth step, the token information is assigned to the SEID information; and

wherein the secure-element-related service application, when installed within the secure element, is configured to allow the first server entity, together with the UE-related application installed on the user equipment, to provide a service to the subscriber of the telecommunications network.

2. The method according to claim 1, wherein, during the fifth step, installation commands from the second server entity are received by the proxy application for installation of the secure-element-related service application in the secure element.

3. The method according to claim 2, wherein the installation commands received by the proxy application are transmitted in encrypted form.

4. The method according to claim 1, wherein the second server entity is part of the telecommunications network.

5. A system for installation of a secure-element-related service application in a secure element of a user equipment (UE) associated with a subscriber of a telecommunications network, wherein the system comprises:

the telecommunications network;

a first server entity, wherein the first server entity corresponds to a service provider;

a second server entity, wherein the second server entity is related to a secure element issuer related to the secure element; and

the user equipment;

wherein the secure-element-related service application, when installed within the secure element, is configured to allow the first server entity, together with a UE-related application installed on the communication device, to provide a service to the subscriber of the telecommunications network;

wherein the UE-related application of the user equipment is configured to transmit, towards the first server entity via a request message, an initial request for installation of the secure-element-related service application in the secure element;

wherein the first server entity is configured to transmit a request to install the secure-element-related service application to the second server entity;

wherein the second server entity is configured to generate token information and to transmit the token information to the first server entity, the token information representing combined authorization from the secure element issuer and the service provider to request installation of the secure-element-related service application in the secure element;

wherein the first server entity is configured to transmit the token information to the UE-related service application of the user equipment;

wherein the UE-related service application of the user equipment is configured to transmit an access and/or installation request related to the secure-element-related service application, together with the token information, to a proxy application of the secure element issuer, the proxy application being configured to access the secure element and/or to install secure-element-related applications on the secure element, wherein the proxy application is configured to interact with the secure element and is installed in the user equipment as a link between the second server entity and the secure element;

wherein the proxy application is configured to transmit, via a communication link established with the second server entity, the token information, together with Secure Element Identifier (SEID) information of the user equipment, to the second server entity for validation by the second server entity, wherein the token information is assigned to the SEID information upon the establishment of the communication link between the proxy application and the second server entity.

6. The system according to claim 5, wherein the second server entity is configured to transmit installation commands to the proxy application for installation of the secure-element-related service application in the secure element.

7. The system according to claim 6, wherein the second server entity is configured to transmit the installation commands in encrypted form.

8. One or more non-transitory, computer-readable mediums having processor-executable instructions stored thereon for installation of a secure-element-related service application in a secure element of a user equipment (UE) associated with a subscriber of a telecommunications network, wherein the secure element corresponds to a secure element issuer, the processor-executable instructions, when executed, facilitating performance of the following steps:

in a first step, transmitting an initial request, via a request message from a UE-related service application of the user equipment towards a first server entity, for installation of the secure-element-related service application in the secure element, wherein the first server entity corresponds to a service provider;

in a second step, subsequent to the first step, transmitting, by the first server entity, a request to install the secure-element-related service application to a second server entity corresponding to the secure element issuer, and receiving, by the first server entity from the second server entity, token information generated by the second server entity and representing combined authorization from the secure element issuer and the service provider to request installation of the secure-element-related service application in the secure element;

in a third step, subsequent to the second step, transmitting, by the first server entity, the token information to the UE-related service application of the user equipment;

in a fourth step, subsequent to the third step, transmitting, by the UE-related service application of the user equipment to a proxy application of the secure element issuer, an access and/or installation request together with the token information, wherein the proxy application is configured to access the secure element and/or to install secure-element-related applications on the secure element, and wherein the proxy application is further configured to interact with the secure element and is installed in the user equipment as a link between the second server entity and the secure element; and

in a fifth step, subsequent to the fourth step, transmitting, by the proxy application to the second server entity via a communication link established between the proxy application and the second server entity, the token information together with Secure Element Identifier (SEID) information of the user equipment for validation by the second server entity;

wherein, during the fifth step, the token information is assigned to the SEID information; and

wherein the secure-element-related service application, when installed within the secure element, is configured to allow the first server entity, together with the UE-related application installed on the user equipment, to provide a service to the subscriber of the telecommunications network.

9. The non-transitory computer-readable medium according to claim 8, wherein, during the fifth step, installation commands from the second server entity are received by the proxy application for installation of the secure-element-related service application in the secure element.

10. The non-transitory computer-readable medium according to claim 9, wherein the installation commands received by the proxy application are transmitted in encrypted form.

11. The non-transitory computer-readable medium according to claim 8, wherein the second server entity is part of the telecommunications network.