Method and Apparatus for Protecting SIMLock Information in an Electronic Device

• US 20090007275A1
• Filed: 12/21/2007
• Published: 01/01/2009
• Est. Priority Date: 04/20/2007
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Gehrmann, Christian
• Granted Patent: US 8,209,550 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/48 using secure binding, e.g. securely binding identity modules to devices, services or applications

Abstract

The teachings herein present a method and apparatus for protecting usage restriction data that governs usage of an electronic device. A cryptographic circuit supports secure and non-secure accesses. When non-securely accessed, it is operable only to verify the stored usage restriction data, and, when securely accessed, it is operable to generate a new message authentication code for changed usage restriction data, for subsequent authentication of that data. The usage restriction data may be stored in non-secure memory and may include static and dynamic parts. One or more embodiments include a secure circuit indicating whether the device has been initialized. The cryptographic circuit outputs a message authentication code for the static part using a permanent device key from the secure circuit, only if the device has not been initialized, and outputs a message authentication code for the dynamic part as needed to support authorized changes to the dynamic part.

Claims

1. An electronic device comprising:

a first memory for holding stored usage restriction data and a stored message authentication code for authenticating the stored usage restriction data;

a secure circuit holding a permanent device key; and

a cryptographic circuit connected to the secure circuit and operable, when non-securely accessed, to authenticate the stored usage restriction data using the stored message authentication code and the permanent device key but not operable to output a new message authentication code for the stored usage restriction data, and operable, when securely accessed, to generate a new message authentication code using the permanent key and changed usage restriction data that has been generated via authorized modification of the stored usage restriction data, and to output the new message authentication code for storage in the first memory along with the changed usage restriction data.

2. The electronic device of claim 1, wherein the first memory comprises a non-secure memory.

3. The electronic device of claim 1, further comprising a system processor configured to operate selectively in secure and non-secure modes, and operable to non-securely access the cryptographic circuit for authenticating the stored usage restriction data, and operable in the secure mode to generate the changed usage restriction data responsive to executing secure program instructions and securely access the cryptographic circuit to obtain the new message authentication code for the changed usage restriction data.

4. The electronic device of claim 3, further comprising a secure memory for storing the secure program instructions supporting changing of the stored usage restriction data, said secure memory accessible by the system processor operating in the secure mode.

5. The electronic device of claim 3, wherein the system processor is configured to start in the secure mode responsive to a reset and to periodically serve a secure watchdog timer, at least in part by authenticating the stored usage restriction data and checking it against Subscriber Identity Module (SIM) settings for the electronic device, said secure watchdog timer configured to reset the system processor unless periodically served by the system processor operating in the secure mode.

6. The electronic device of claim 1, wherein the secure circuit includes a one-time programmable element that indicates whether the electronic device has been initialized.

7. The electronic device of claim 6, wherein the one-time programmable element comprises a fuse or anti-fuse that is permanently altered responsive to the application of a programming signal.

8. The electronic device of claim 6, wherein the secure circuit includes a plurality of one-time programmable elements and wherein a subset of the plurality of one-time programmable elements are configured to record the permanent device key as a secret key accessible to the cryptographic circuit.

9. The electronic device of claim 6, wherein the stored usage restriction data comprises a static part and a dynamic part and the stored message authentication code comprises a first stored message authentication code for authenticating the static part and a second stored message authentication code for authenticating the dynamic part, and wherein the cryptographic circuit is operable, when securely accessed, to generate and output a new message authentication code for the static part of the stored usage restriction data for storage in the first memory as the first stored message authentication code only if the one-time programmable element indicates that the electronic device has not been initialized.

10. The electronic device of claim 9, wherein the cryptographic circuit is operable, when securely accessed, to generate and output a new message authentication code for the dynamic part of the stored usage restriction data for storage in the first memory as the second stored message authentication code responsive to secure commands provided to it via secure access by the system processor, thereby enabling later authentication of authorized changes made to the dynamic part of the stored usage restriction data.

11. The electronic device of claim 1, wherein the stored usage restriction data comprises a static part and a dynamic part of Subscriber Identity Module Lock information, and wherein the cryptographic circuit is configured to generate and output a first message authentication code for the static part only as part of securely initializing the electronic device, such that no changes to the static part will ever be authenticated by the cryptographic circuit, and wherein the cryptographic circuit is configured, as part of authorized changing of the dynamic part, to generate and output a new message authentication code for the dynamic part, to allow subsequent authentication of authorized changes to the dynamic part.

12. A method of protecting usage restriction data that governs usage of an electronic device comprising:

storing the usage restriction data as stored usage restriction data in a first memory of the electronic device, along with a stored message authentication code for authenticating the stored usage restriction data;

storing a permanent device key in a secure circuit;

if in a non-secure mode of operation, authenticating the stored usage restriction data using the stored message authentication code and the permanent device key but not generating any new message authentication codes for the stored usage restriction data; and

if in a secure mode of operation, selectively generating a new message authentication code using the permanent key and changed usage restriction data that has been generated via authorized modification of the stored usage restriction data, and outputting the new message authentication code for storage in the first memory along with the changed usage restriction data.

13. The method of claim 12, wherein said storing of the usage restriction data and the message authentication code in the first memory comprises storing the usage restriction data and the message authentication code in a non-secure memory.

14. The method of claim 12, further comprising operating in the secure mode and in the non-secure mode based on a system processor of the electronic device dynamically changing between the secure and the non-secure modes of operation, and making the authorized modification of the stored usage restriction data via execution by the system processor of secure program instructions.

15. The method of claim 14, further comprising storing the secure program instructions in a secure memory, said secure memory accessible by the system processor operating in the secure mode.

16. The method of claim 14, wherein the system processor is configured to start in the secure mode responsive to a reset and to periodically serve a secure watchdog timer, at least in part by authenticating the stored usage restriction data and checking it against Subscriber Identity Module (SIM) settings for the electronic device, and further comprising configuring a secure watchdog timer to reset the system processor unless periodically served by the system processor operating in the secure mode.

17. The method of claim 12, further comprising indicating whether the electronic device has been initialized via a one-time programmable element included within the secure circuit.

18. The method of claim 17, further comprising storing the permanent device key within the secure circuit via a plurality of additional one-time programmable elements.

19. The method of claim 17, wherein the stored usage restriction data comprises a static part and a dynamic part and the stored message authentication code comprises a first stored message authentication code for authenticating the static part and a second stored message authentication code for authenticating the dynamic part, and wherein said authenticating of the stored usage restriction data in the non-secure mode of operation comprises using the permanent device key and the first and second stored message authentication codes as retrieved from the first memory to authenticate, respectively, the static and dynamic parts of the stored usage restriction information as retrieved from the first memory.

20. The method of claim 19, wherein said generating of the new message authentication code in the secure mode of operation comprises using the permanent device key and the changed usage restriction data to generate a new second message authentication code, and outputting the new second message authentication code for storage as the second stored message authentication code in the first memory, along with storage of the changed usage restriction data as the dynamic part of the stored usage restriction data in the first memory.

21. A method of protecting usage restriction data that governs usage of an electronic device comprising configuring a cryptographic circuit of the electronic device to perform only authentication of stored usage restriction data retrieved from a memory of the electronic device if the cryptographic circuit is non-securely accessed, and to perform generation of a new message authentication code for subsequent authentication of changed usage restriction data if the cryptographic circuit is securely accessed and commanded to perform said generation of the new message authentication code.

22. The method of claim 21, further comprising storing a permanent device key securely in a secure circuit and connecting the secure circuit to the cryptographic circuit, and wherein said configuring the cryptographic circuit of the electronic device to perform only authentication of the stored usage restriction data if the cryptographic circuit is non-securely accessed comprises configuring the cryptographic circuit to, for non-secure accesses, read in the stored usage restriction data and a corresponding stored message authentication code, read in the permanent device key, calculate a message authentication code from the stored usage restriction data using the permanent device key, and compare the calculated message authentication code to the stored message authentication code, while disallowing any outputting of the calculated message authentication code.

23. The method of claim 22, wherein said configuring the cryptographic circuit of the electronic device to perform generation of the new message authentication code if the cryptographic circuit is securely accessed and commanded to perform said generation of the new message authentication code comprises configuring the cryptographic circuit to be responsive to one or more generation commands if securely accessed, wherein the cryptographic circuit responds by reading in the permanent device key, calculating the new message authentication code from the changed usage restriction data using the permanent device key, and outputting the new message authentication code for storing in conjunction with the changed usage restriction data.