Apparatuses, methods and systems for configuring a trusted java card virtual machine using biometric information

• US 10,206,097 B2
• Filed: 12/12/2017
• Issued: 02/12/2019
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: GigSky, Inc.
• Original Assignee: Simless, Inc. (GigSky, Inc.)
• Inventors: Wane, Ismaila
• Primary Examiner(s): Chen, Shin-Hon (Eric)
• Application Number:
  US15/838,611
• Publication Number:
  US 20180227748A1
• Time in Patent Office: 427 Days
• Field of Search: None
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/63 based on the content carried by the session initiation protocol [SIP] messages
• CPC Class Codes: H04M 15/7556 by SIM, e.g. smart card account in SCP, SDP or SN
• CPC Class Codes: H04M 15/8038 Roaming or handoff
• CPC Class Codes: H04M 15/8044 Least cost routing
• CPC Class Codes: H04M 15/8055 Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/81 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 17/02 Coin-freed or check-freed systems , e.g. mobile- or card-operated phones, public telephones or booths
• CPC Class Codes: H04M 17/103 using SIMs (USIMs) or calling cards
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/35 : Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/42 : using virtual identity modules
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/183 : Processing at user equipment or user record carrier
• CPC Class Codes: H04W 8/205 : Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Apparatuses, methods, and systems are provided for securely configuring a Java Card virtual machine operating on a cellular device'"'"'s application processor. In one embodiment, a connected device with an integrated cellular modem, a virtual universal integrated circuit chip and an integrated fingerprint scanner are used. In another embodiment, the cellular device'"'"'s built-in camera is used, instead of an integrated fingerprint scanner, to capture the user'"'"'s facial image.

Claims

1. A mobile station comprising:

a modem and

at least one antenna configured to communicate with a plurality of cellular networks; and

one or more memories storing computer-executable instructions that, when executed,

configure a mobile application running on a processor that facilitates communication between the modem and a virtual reprogrammable universal integrated circuit chip (eUICC) that is not physically or electrically connected to the modem, wherein security of the virtual eUICC is maintained using user-provided biometric information; and

configure the mobile station to host the virtual eUICC by causing initialization of a data storage module with the user-provided biometric information as a parameter for security operations;

loading the data storage module upon a device boot-up to perform security operations based on the parameter to generate data that are formatted into data blocks; and

cause storage of the data blocks processed by the security operations in a storage memory, wherein the storage memory maintains the data blocks in a journaling file system.

2. The mobile station of claim 1, further comprising:

a biometric information capturing element,

wherein the user-provided biometric information is captured by the biometric information capturing element.

3. The mobile station of claim 2, wherein the biometric information capturing element comprises a built-in fingerprint scanner or camera device.

4. The mobile station of claim 1, wherein the computer-executable instructions, when executed, further cause configuration of a virtual machine to host the virtual eUICC.

5. The mobile stations of claim 4, wherein the computer-executable instructions, when executed, cause a configuration of the virtual machine by causing the initialization;

the security operations including at least encryption and decryption with one or more signature keys;

the encryption and the decryption of data being associated with the virtual machine using the signature keys as encryption and decryption keys;

digitally signing data associated with the virtual machine using the signature key; and

storage of the digitally signed data in a storage memory.

6. The mobile station of claim 5,

wherein the digitally signed data comprises at least one of a GSM file system, one or more Java Card applications, or one or more network authentication keys, and

wherein the digitally signed data is formatted into data blocks.

7. The mobile station of claim 5, wherein digitally signing the data comprises signing checksums or hashes of the data with the signature key.

8. The mobile station of claim 5, wherein digitally signing the data comprises:

calculating redundancy check values for the data; and

signing the redundancy check values with random keys.

9. A method for communicating in multi-active mode with a plurality of cellular networks, the method comprising:

providing a mobile device having a modem and at least one antenna configured to communicate with a plurality of cellular networks; and

configuring a mobile application running on a processor to facilitate communication between the modem and a virtual reprogrammable universal integrated circuit chip (eUICC) that is not physically or electrically connected to the modem, wherein security of the virtual eUICC is maintained using use r-provided biometric information;

configuring the mobile station to host the virtual eUICC by causing initialization of a data storage module with the user-provided biometric information as a parameter for security operations;

loading the data storage module upon a device boot-up to perform security operations based on the parameter to generate data that are formatted into data blocks; and

causing storage of the data blocks processed by the security operations in a storage memory, wherein the storage memory maintains the data blocks in a journaling file system.

10. The method of claim 9, wherein the mobile device further includes a biometric information capturing element, and wherein the method includes capturing the user-provided biometric information using the biometric information capturing element.

11. The method of claim 9, further comprising:

causing configuration of a virtual machine to host the virtual eUICC, wherein the causing of the configuration of the virtual machine includes causing the initialization;

the security operations including at least encryption and decryption with one or more signature keys;

the encryption and the decryption of data being associated with the virtual machine using the signature keys as encryption and decryption keys;

digitally signing data associated with the virtual machine using the signature key; and

storage of the digitally signed data in a storage memory.

12. The method of claim 11,

wherein the digitally signed data comprises at least one of a GSM file system, one or more Java Card applications, or one or more network authentication keys, and

wherein the digitally signed data is formatted into data blocks.

13. The method of claim 11, wherein digitally signing the data comprises signing checksums or hashes of the data with the signature key.

14. The method of claim 11, wherein digitally signing the data comprises:

calculating redundancy check values for the data; and

signing the redundancy check values with random keys.

15. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a mobile station having a modem and at least one antenna configured to communicate with a plurality of cellular networks, cause the mobile station to:

configure a mobile application running on a processor to facilitate communication between the modem and a virtual reprogrammable universal integrated circuit chip (eUICC) that is not physically or electrically connected to the modem, wherein security of the virtual eUICC is maintained using user-provided biometric information;

configuring the mobile station to host the virtual eUICC by causing initialization of a data storage module with the user-provided biometric information as a parameter for security operations;

loading the data storage module upon a device boot-up to perform security operations based on the parameter to generate data that are formatted into data blocks; and

causing storage of the data blocks processed by the security operations in a storage memory, wherein the storage memory maintains the data blocks in a journaling file system.

16. The one or more non-transitory computer-readable media of claim 15,

wherein the mobile station further includes a biometric information capturing element, and

wherein the user-provided biometric information is captured by the biometric information capturing element.

17. The one or more non-transitory computer-readable media of claim 15, wherein the computer-executable instructions, when executed by the mobile station, further cause the mobile station to cause configuration of a virtual machine to host the virtual eUICC by causing the initialization;

the security operations including at least encryption and decryption with one or more signature keys;

the encryption and the decryption of data being associated with the virtual machine using the signature keys as encryption and decryption keys;

digitally signing data associated with the virtual machine using the signature key; and

storage of the digitally signed data in a storage memory.

18. The one or more non-transitory computer-readable media of claim 17,

wherein the digitally signed data comprises at least one of a GSM file system, one or more Java Card applications, or one or more network authentication keys, and

wherein the digitally signed data is formatted into data blocks.