Network supporting two-factor authentication for modules with embedded universal integrated circuit cards

• US 10,594,679 B2
• Filed: 02/08/2019
• Issued: 03/17/2020
• Est. Priority Date: 11/19/2013
• Status: Active Grant

• Current Assignee: John A. Nix
• Original Assignee: Network-1 Technologies, Inc.
• Inventors: Nix, John A.
• Primary Examiner(s): Herzog, Madhuri R
• Application Number:
  US16/271,455
• Publication Number:
  US 20190173867A1
• Time in Patent Office: 403 Days
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/40 Security arrangements using identity modules
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Abstract

A network with a set of servers can support authentication from a module, where the module includes an embedded universal integrated circuit card (eUICC). The network can send a first network module identity, a first key K, and an encrypted second key K for an eUICC profile to an eUICC subscription manager. The second key K can be encrypted with a symmetric key. The module can receive and activate the eUICC profile, and the network can authenticate the module using the first network module identity and the first key K. The network can (i) authenticate the user of the module using a second factor, and then (ii) send the symmetric key to the module. The module can decrypt the encrypted second key K using the symmetric key. The network can authenticate the module using the second key K. The module can comprise a mobile phone.

Claims

1. A computer system comprising:

(a) one or more processors; and

(b) one or more non-transitory computer-readable media operatively connected to the one or more processors and having stored thereon instructions that, when executed by the one or more processors, cause the computer system to perform a method of securely distributing a profile from a subscription manager system to an embedded universal integrated circuit card, the method comprising steps of;

(1) recording, by the computer system in memory operatively connected to the subscription manager system, a digital signature algorithm comprising an elliptic curve digital signature algorithm;

(2) recording, by the computer system in the memory operatively connected to the subscription manager system, a profile for the embedded universal integrated circuit card comprising;

(A) a key K; and

(B) a network module identity,

wherein the profile has been encrypted using a first key that is a symmetric key;

(3) recording, by the computer system in the memory operatively connected to the subscription manager system,

(A) a profile ciphering algorithm to cipher the profile into a ciphered profile for the embedded universal integrated circuit card, and

(B) ciphering parameters to be used by the profile ciphering algorithm, wherein the ciphering parameters comprise an Advanced Encryption Standard ciphering algorithm;

(4) authenticating, by the computer system using the subscription manager system, the embedded universal integrated circuit card, by performing steps of;

(A) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card, a first message comprising an eUICC identity associated with the embedded universal integrated circuit card;

(B) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card, a second message comprising a first digital signature generated by the embedded universal integrated circuit card using the same digital signature algorithm as stored in the memory operatively connected to the subscription manager; and

(C) authenticating, by the computer system using the subscription manager system, the embedded universal integrated circuit card by confirming;

(i) the eUICC identity which corresponds to the embedded universal integrated circuit card; and

(ii) the first digital signature which was signed by the embedded universal integrated circuit card using the digital signature algorithm;

(5) authenticating, by the computer system, the subscription manager system with the embedded universal integrated circuit by performing steps of;

(A) generating, by the computer system using the subscription manager system, a third message including a second digital signature, generated by the subscription manager using the digital signature algorithm; and

(B) sending, by the computer system from the subscription manager system to the embedded universal integrated circuit card, the third message;

(6) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card a fourth message comprising;

(A) an eUICC public key corresponding to an eUICC private key stored at the embedded universal integrated circuit card; and

(B) a third digital signature which was generated by the embedded universal integrated circuit card using the same digital signature algorithm as stored in the memory operatively connected to the subscription manager;

(7) confirming, by the computer system using the subscription manager system, that the third digital signature was signed by the embedded universal integrated circuit card using the digital signature algorithm;

(8) generating, by the computer system using the subscription manager system, an eUICC subscription manager public key and a corresponding eUICC subscription manager private key, using elliptic curve cryptography;

(9) generating, by the computer system using the subscription manager system, a second key that is a mutually derived shared key using Elliptical Curve Diffie-Hellman based on at least;

(A) the eUICC public key; and

(B) the eUICC subscription manager private key;

wherein the mutually derived shared key is configured to be derived by the embedded universal integrated circuit card based on at least;

(i) the eUICC private key associated with the eUICC public key; and

(ii) the eUICC subscription manager public key associated with the eUICC subscription manager private key;

(10) generating, by the computer system using the subscription manager system, a third key that is a profile key using the second key that is the mutually derived shared key;

(11) encrypting, by the computer system using the subscription manager system, the profile using;

(A) the profile ciphering algorithm; and

(B) the third key that is the profile key;

(12) authenticating, by the computer system using the subscription manager system, a user associated with the embedded universal integrated circuit card;

(13) sending, by the computer system using the subscription manager system to the embedded universal integrated circuit card, the symmetric key, after the user associated with the embedded universal integrated circuit card is authenticated; and

(14) sending, by the computer system from the subscription manager system to the embedded universal integrated circuit card, the encrypted profile.

2. The computer system of claim 1, wherein the third key that is the profile key is also generated using American National Standards Institute standard X-9.63.

3. The computer system of claim 1, wherein the method further comprises a step of receiving, by the computer system using the subscription manager system, the profile for the embedded universal circuit card prior to the recording step (2).

4. The computer system of claim 1, wherein the first message and second message are received prior to sending the third message.

5. The computer system of claim 1, wherein the first message is received and third message is sent prior to receipt of the second message.

6. The computer system of claim 1, wherein the eUICC subscription manager public key has a length of 283 bits.

7. The computer system of claim 1, wherein the authenticating step (12) occurs before the confirming step (7).

8. The computer system of claim 1, wherein the authenticating step (12) occurs after the confirming step (7).