Providing services to an open platform implementing subscriber identity module (SIM) capabilities

• US 20050108534A1
• Filed: 11/19/2003
• Published: 05/19/2005
• Est. Priority Date: 11/19/2003
• Status: Abandoned Application

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Inventors: Silvester, Kelan C., McKeen, Francis X., Bajikar, Sundeep M., Girard, Luke E., Reddy, Ramgopal K.
• Application Number:
  US10/718,369
• Publication Number:
  US 20050108534A1
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

An approach for providing services to an open platform implementing Subscriber Identity Module (SIM) capabilities without the need for a discrete, physical SIM device. For one aspect, a protected communications channel is established with a computing system, the computing system providing SIM Authentication, Authorization and Accounting (AAA) capabilities without the use of a discrete hardware SIM device. SIM secret data is provisioned to the computing system over the protected communications channel.

Claims

1. A method comprising:

establishing a protected communications channel with a computing system, the computing system providing SIM AAA capabilities without the use of a discrete hardware SIM device; and

provisioning SIM secret data to the computing system over the protected communications channel.

2. The method of claim 1 wherein provisioning SIM secret data includes provisioning at least one of identity secrets, key secrets, information to initialize data objects, information to initialize operator-specific cryptography algorithms, and information to install or update applications, parameters, tools or utilities.

3. The method of claim 1 wherein establishing a protected communications channel includes using a protected key exchange mechanism.

4. The method of claim 3 wherein provisioning SIM secret data includes encrypting the SIM secret data.

5. A method comprising:

using SIM capabilities provided by a computing system without a discrete hardware SIM device for user authorization, authentication and accounting in association with a subscription account; and

providing a subscription account for access by the computing system.

6. The method of claim 5 wherein providing the subscription account includes providing a wireless network access account.

7. The method of claim 6 wherein using SIM capabilities provided by a computing system includes using SIM capabilities provided by a laptop computing system.

8. The method of claim 5 wherein providing the subscription account includes providing a wired network access account.

9. The method of claim 5 wherein using SIM capabilities includes using a protected execution environment provided by a laptop computing system.

10. The method of claim 5 wherein providing the subscription account includes providing location-based services.

11. A computer-accessible medium storing information, that when accessed by a computing system causes the computing system to:

establish a protected communications channel with a computing system, the computing system to provide SIM AAA capabilities without the use of a discrete hardware SIM device; and

provision SIM secret data to the computing system over the protected communications channel.

12. The computer-accessible medium of claim 11 wherein provisioning SIM secret data includes provisioning at least one of identity secrets, key secrets, information to initialize data objects, information to initialize operator-specific cryptography algorithms, and information to install or update applications, parameters, tools or utilities.

13. The computer-accessible storage medium of claim 12 wherein provisioning includes encrypting the secret data prior to providing the secret data to the computing system.

14. The computer-accessible storage medium of claim 11 wherein establishing a protected communications channel includes participating in a bilateral key exchange.

15. The computer-accessible storage medium of claim 14 wherein establishing a protected communications channel includes receiving authentication information from the computing system.

16. A method comprising:

authenticating and authorizing a user of a subscription account at least in part by using Subscriber Identity Module (SIM) compliant authentication and authorization capabilities on a computing system that provides the SIM-compliant authentication and authorization capabilities without the use of a discrete SIM hardware device; and

providing user access to the subscription account upon receipt of predetermined credentials.

17. The method of claim 16 wherein providing user access to the subscription account includes providing user access to a wireless network account.

18. The method of claim 17 wherein providing user access to wireless network account includes providing access to one of a GSM/GPRS network, a 3G network and a Personal Handyphone Network.

19. The method of 16 wherein providing user access to the subscription account includes providing user access to a location-based services account.

20. An apparatus comprising:

a server having access to a network; and

a provisioning module stored on the server, the provisioning module, when executed by the provisioning server, to participate in provisioning Subscriber Identity Module (SIM) secret data to a computing system, the computing system to provide SIM-compliant authentication, authorization and accounting capabilities without the use of a discrete hardware SIM device.

21. The apparatus of claim 20 wherein the network is one of a GSM/GPRS, 3G, Personal Handyphone System (PHS) and a CDMA network.

22. The apparatus of claim 20 wherein the network is a wireless network.

23. The apparatus of claim 20 wherein the network is a wired network.

24. The apparatus of claim 20 wherein the provisioning module, when executed by the server, further operates to encrypt the SIM secret data to be provided to the computing system.

25. The apparatus of claim 24 wherein the provisioning module, when executed by the server, further operates to participate in a bilateral key exchange with the computing system over the network.

26. The apparatus of claim 20 wherein the computing system is further to store the SIM secret data in an encrypted format on a mass storage device of the computing system.

27. The apparatus of claim 26 wherein the computing system is further to store an encrypted bulk encryption key to be used to decrypt the encrypted SIM secret data.

28. The apparatus of claim 27 wherein the computing system further includes a hardware token to provide a second key to encrypt the bulk encryption key.

29. The apparatus of claim 20 wherein the server is further to control access by the computing system to a service, the server to provide access to the service by the computing system upon authorization and authentication of the computing system using the SIM-compliant authentication, authorization and accounting capabilities.