Apparatuses, methods and systems for implementing a trusted subscription management platform

• US 10,516,990 B2
• Filed: 09/06/2018
• Issued: 12/24/2019
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: GigSky, Inc.
• Original Assignee: Simless, Inc. (GigSky, Inc.)
• Inventors: Wane, Ismaila
• Primary Examiner(s): Mastrodonato, Margaret G
• Application Number:
  US16/124,136
• Publication Number:
  US 20190007826A1
• Time in Patent Office: 474 Days
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/63 based on the content carried by the session initiation protocol [SIP] messages
• CPC Class Codes: H04M 15/7556 by SIM, e.g. smart card account in SCP, SDP or SN
• CPC Class Codes: H04M 15/8038 Roaming or handoff
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/183 : Processing at user equipment or user record carrier
• CPC Class Codes: H04W 8/205 : Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Apparatuses, methods, and computer readable storage media are provided for implementing a trusted subscription management platform. An example server device is configured to transmit, to a trusted UI client of a mobile station, information regarding a set of virtual SIM cards associated with the mobile station, and receive, from the trusted UI client of the mobile station, a request to provision a particular virtual SIM card. The server device is further configured to initiate, by an SM-SR module and via a trusted baseband client of the mobile device, a secure proxy channel between the server device and a profile manager that hosts the particular virtual SIM card, and transmit, via the secure proxy channel and to the profile manager, an instruction regarding the particular virtual SIM card. Corresponding methods and computer readable storage media are provided.

Claims

1. A server system that includes at least one processor and at least one memory storing computer-executable instructions that, when executed by the at least one processor, cause the server system to implement a method comprising:

transmitting, by the server system, to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, at the server, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card, the communications being associated with a trusted baseband module of the mobile device that participates in establishing the secure proxy channel; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission is configured, such that the instruction is transmitted, via the trusted baseband module.

2. The server system of claim 1, wherein the method further comprises

transmitting, to the trusted UI of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server system,

wherein the request to provision the particular virtual SIM card includes at least a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

3. The server system of claim 1, wherein

the sending or receiving of the communications, by the server system, related to the initiating of the secure proxy channel includes at least the server system participating in a mutual authentication procedure with the mobile station.

4. The server system of claim 1, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to register the mobile station.

5. The server system of claim 4, wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to register the mobile station by causing the server system to assign the mobile station a unique random cryptographic key.

6. The server system of claim 4, wherein registration of the mobile station establishes that no additional registrations are required for newly purchased virtual SIM cards.

7. The server system of claim 1, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or

delete a virtual SIM card.

8. The server system of claim 7, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards is received from the trusted UI of the mobile station via an internet protocol (IP) channel.

9. A method comprising:

transmitting, by a server system and to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager—

secure routing (SM-SR) module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card, the communications also being associated with a trusted baseband module of the mobile device that participates in establishing the secure proxy channel; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission is configured, such that the instruction is transmitted, via the trusted baseband module.

10. The method of claim 9, further comprising:

transmitting, to the trusted UI of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server system,

wherein the request to provision the particular virtual SIM card includes at least a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

11. The method of claim 9, further comprising:

the sending or receiving communications, by the server system, related to the initiating of the secure proxy channel including at least a mutual authentication procedure.

12. The method of claim 9, further comprising:

registering the mobile station.

13. The method of claim 12, wherein registering the mobile station includes at least causing the server system to assign the mobile station a unique random cryptographic key.

14. The method of claim 12, wherein registration of the mobile station establishes that no additional registrations are required for newly purchased virtual SIM cards.

15. The method of claim 9, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or

delete a virtual SIM card.

16. The method of claim 15, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards is received from the trusted UI of the mobile station via an interne protocol (IP) channel.

17. A non-transitory computer readable storage medium storing computer executable instructions that, when executed, cause a server system to implement a method comprising:

transmitting, by a server system and to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager—

secure routing (SM-SR) module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card, the communications also being associated a trusted baseband module of the mobile device that participates in establishing the secure proxy channel; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission being configured, such that the instruction is transmitted, via the trusted baseband module.

18. The non transitory computer readable storage medium system of claim 17, the method further comprising:

further comprising;

transmitting, to the trusted UI of the mobile station, information regarding a set of virtual SIM cards offered by a trusted virtual store associated with the server system,

wherein the request to provision the particular virtual SIM card includes at least a request to purchase a virtual SIM card selected from the set of virtual SIM cards offered by the trusted virtual store.

19. The non transitory computer readable storage medium system of claim 17, wherein the request to provision the particular virtual SIM card of the set of virtual SIM cards comprises a request to:

purchase a virtual SIM card;

activate a virtual SIM card;

deactivate a virtual SIM card;

or delete a virtual SIM card.

20. The non transitory computer readable storage medium system of claim 19, wherein the computer executable instructions, when executed, further cause the server system to receive the request to provision the particular virtual SIM card of the set of virtual SIM cards from the trusted UI of the mobile station, via an internet protocol (IP) channel.

21. A server system that includes at least one processor and at least one memory storing computer-executable instructions that, when executed by the at least one processor, cause the server system to implement a method comprising:

transmitting, by the server system, to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, at the server, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card, the communications also being associated with a trusted module of the mobile device that is configured for handling real time communications and that participates in establishing the secure proxy channel; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission being configured, such that the instruction is transmitted, via the trusted module of the mobile station, which is configured for handling real time communications.

22. A method comprising:

transmitting, by a server system and to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager—

secure routing (SM-SR) module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission being configured, such that the instruction is transmitted, via a trusted module of the mobile station that is configured for handling real time communications.

23. The method of claim 22, further comprising:

determining at the server, a best particular virtual SIM card available to a mobile virtual network operator (MVNO) from a mobile network operator (MNO), the determining based on data of a MVNO'"'"'s customer received by the server from the trusted UI, the data including at least one of user supplied preferences, location, the server'"'"'s network performance, network availability, and pricing; and

transmitting, via a proxy channel from the server to an Issuer Security Domain—

Register (ISD-R) of the profile manager, information representing the best particular virtual SIM card.

24. The method of claim 22, wherein the instruction is an instruction from a mobile virtual network operator (MVNO) to an Issuer Security Domain-Register (ISD-R) of the profile manager to make a transition from using a particular virtual SIM card of a mobile network operator (MNO) profile to using a particular virtual SIM card of another MNO profile or from using a particular virtual SIM card of an MNO sub-profile to using a particular virtual SIM card of another MNO sub-profile;

and

the transmitting the transmission of an instruction is conducted silently, without instructions for displaying information in the trusted UI to a consumer that the transition has been made.

25. A non-transitory computer readable storage medium storing computer executable instructions that, when executed, cause a server system to implement a method comprising:

transmitting, by a server system and to a trusted user interface (UI) of a mobile station, information regarding a set of virtual subscriber identity module (SIM) cards associated with the mobile station;

receiving, from the trusted UI of the mobile station, a request to provision a particular virtual SIM card;

sending or receiving communications, by the server system, associated with a subscription manager—

secure routing (SM-SR) module of the server system related to initiating a secure proxy channel between the server system and a profile manager that hosts the particular virtual SIM card; and

transmitting, via the secure proxy channel and to the profile manager, a transmission of an instruction regarding the particular virtual SIM card, wherein the transmission being configured, such that the instruction is transmitted, via a trusted module of the mobile station that is configured for handling real time communications.