Method of personalizing a NFC Chipset

• US 20090103732A1
• Filed: 12/07/2007
• Published: 04/23/2009
• Est. Priority Date: 10/23/2007
• Status: Active Grant

• Current Assignee: Verimatrix Incorporated (Verimatrix SA)
• Original Assignee: INSIDE Contactless
• Inventors: Benteo, Bruno, Nerot, Sebastien, Feix, Benoit
• Granted Patent: US 8,861,733 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules

Abstract

The invention relates to a method for personalizing a secure processor in a NFC system to execute a secure application, comprising steps of obtaining by a server identification data of a user memorized in a secure storage medium, personalization data corresponding to the user identification data, and identification data of a NFC system of the user, comprising an encryption key of the secure processor, encrypting by the server personalization data using the encryption key, transmitting to the NFC system encrypted personalization data, receiving by the secure processor encrypted personalization data, deciphering personalization data, and memorizing in a secured way personalization data by the secure processor.

Claims

1. A method for personalizing a secure processor in a NFC system to execute a secure application comprising steps of:

establishing communication between a storage medium memorizing in a secured way identification data of a user, and a process unit,

transmitting identification data stored in the storage medium to the process unit,

the process unit obtaining personalization data corresponding to the user identification data,

the process unit obtaining identification data of a NFC system of the user comprising a secure processor, the identification data of the NFC system comprising an encryption key of the secure processor,

the process unit encrypting the personalization data using the encryption key, and transmitting to the NFC system the encrypted personalization data,

the secure processor receiving the encrypted personalization data, and deciphering the personalization data, and

memorizing in a secured way the personalization data by the secured processor.

2. The method according to claim 1, wherein the user identification data are transmitted to the process unit by putting in communication the storing medium and a terminal connected to the process unit.

3. The method according to claim 1, wherein the identification data of the NFC system are at least partially supplied by the user to a terminal connected to the process unit.

4. The method according to claim 1, wherein the identification data of the NFC system are at least partially supplied by a contactless link established between the secure processor and a terminal connected to the process unit.

5. The method according to claim 1, wherein the identification data of the NFC system comprise an identifier of a NFC processor and/or a host processor coupled to the NFC processor.

6. The method according to claim 1, comprising steps of generating a common secret piece of data shared by the process unit and a terminal connected to the process unit and to which the user has access, and the terminal supplying the secret piece of data to the user, then the user supplying it to the NFC system.

7. The method according to claim 6, wherein the NFC system calculates a condensed value by applying a deterministic encryption function to the identification data of the NFC system and the secret piece of data and transmits the calculated condensed value with the identification data of the NFC system to the process unit, and the process unit checks the condensed value by applying the encryption function to the identification data of the NFC system and the secret piece of data it has generated, and stops the personalization process if the received condensed value is different of the calculated condensed value.

8. The method according to claim 1, wherein the NFC system is integrated into a mobile telecommunication terminal and the encrypted personalization data are transmitted by the process unit to the NFC system through a mobile telecommunication network.

9. The method according to claim 1, wherein the encrypted personalization data are transmitted by the process unit to the NFC system by a contactless link established between a terminal connected to the process unit and comprising a NFC interface in communication with the NFC system.

10. The method according to claim 1, wherein the encrypted personalization data are transmitted to the NFC system through a memory card given to the user and susceptible of being put in communication through a contactless link with the NFC system.

11. The method according to claim 10, wherein the memory card comprises a NFC interface to establish a contactless link with the NFC system.

12. The method according to claim 10, wherein the memory card transmits the encrypted personalization data to the NFC system through a contactless link established with a terminal connected to the memory card and comprising a NFC interface.

13. The method according to claim 1, wherein the encrypted personalization data are transmitted with a condensed value obtained by applying a deterministic encryption function to the encrypted personalization data and the identification data of the NFC system, the NFC system checking the received condensed value by applying the encryption function to the encrypted personalization data received from the process unit and the identification data of the NFC system, and stops the personalization process if the condensed value received is different of the condensed value calculated.

14. The method according to claim 1, wherein the encryption key of the secure processor comprises a public key and a corresponding secret key which are locally generated by the secure processor.

15. The method according to claim 1, wherein the encryption key of the secure processor comprises a public key and a secret key which are inserted into the secure processor with a certificate emitted by a certification authority.

16. A system for personalizing a secure processor in a NFC system to execute a secure application,

comprising:

a NFC system of a user, comprising a secure processor,

a process unit configured to;

obtain identification data of the user memorized in a secured way in a storage medium, and obtain personalization data corresponding to the user identification data,

obtain identification data of a NFC system, the identification data comprising an encryption key of the secure processor, and

encrypt the personalization data using the encryption key of the secure processor, and transmit to the NFC system the encrypted personalization data,

the secure processor being configured to receive the encrypted personalization data, decipher the personalization data, and memorize in a secured way the personalization data.

17. The system according to claim 16, comprising a terminal connected to the process unit and the storage medium, the terminal being configured to extract from the storage medium the user identification data and to transmit them to the process unit.

18. The system according to claim 16, comprising a terminal connected to the process unit, the terminal being configured to receive from the user at least partially, the identification data of the NFC system.

19. The system according to claim 16, comprising a terminal connected to the process unit and comprising a contactless interface configured to establish a contactless link with the secure processor, the secure processor and the terminal being configured so that the identification data are at least partially transmitted through the contactless link of the NFC system from the secure processor to the terminal.

20. The system according to claim 16, wherein the identification data of the NFC system comprise an identifier of a NFC processor and/or a secure host processor coupled to the NFC processor.

21. The system according to claim 16, comprising a terminal connected to the process unit and to which the user has access, the terminal and the process unit being configured to generate a common secret piece of data shared by the process unit and the terminal, the terminal being configured to supply the secret piece of data to the user, the NFC system being configured to receive the secret piece of data of the user.

22. The system according to claim 21, wherein the NFC system is configured to calculate a condensed value by applying a deterministic encryption function to the identification data of the NFC system and the secret piece of data, and to transmit the calculated condensed value with the identification data of the NFC system to the process unit, the process unit being configured to receive and check the condensed value by applying the encryption function to the identification data of the NFC system and the secret piece of data it has generated, and to stop the personalization process if the received condensed value is different of the calculated condensed value.

23. The system according to claim 16, wherein the NFC system is integrated into a mobile telecommunication terminal, the process unit being configured to transmit the encrypted personalization data to the NFC system through a mobile telecommunication network.

24. The system according to claim 16, comprising a terminal connected to the process unit and comprising a NFC interface in communication through a contactless link with the NFC system, the process unit, the terminal and the NFC system being configured so that the encrypted personalization data are transmitted from the process unit to the NFC system through the contactless link via the terminal.

25. The system according to claim 16, comprising a memory card given to the user and susceptible of being put in communication through a contactless link with the NFC system, the memory card being configured to memorize the encrypted personalization data and transmit them to the NFC system.

26. The system according to claim 16, comprising a memory card given to the user and a terminal susceptible of being connected to the memory card and comprising a NFC interface in communication through a contactless link with the NFC system, the memory card being configured to memorize the encrypted personalization data, the memory card, the terminal and the NFC system being configured so that the encrypted personalization data are transmitted from the memory card to the NFC system via the terminal.

27. The system according to claim 16, wherein the process unit is configured to transmit the encrypted personalization data with a condensed value obtained by applying a deterministic encryption function to the encrypted personalization data and the identification data of the NFC system, the NFC system being configured to check the received condensed value by applying the encryption function to the encrypted personalization data received from the process unit and the identification data of the NFC system, and to stop the personalization process if the received condensed value is different of the calculated condensed value.

28. The system according to claim 16, wherein the secure processor is configured to generate the public key and the corresponding secret key.

29. The system according to claim 16, wherein the secure processor is configured to receive the public key and the corresponding secret key with a certificate emitted by a certification authority.

30. Process A process unit for personalizing a secure processor of a NFC system in order to execute a secure application,

configured to:

obtain identification data of a user stored in a secured way in a storage medium, and personalization data corresponding to the user identification data,

obtain identification data of a NFC system, the identification data comprising an encryption key of the secure processor, and

encrypt the personalization data using the encryption key, and transmit to the NFC system the encrypted personalization data.

31. The process unit according to claim 30, wherein the identification data of the NFC system comprise an identifier of a NFC processor and/or a host processor coupled to the NFC processor.

32. The process unit according to claim 30, configured to generate a secret piece of data in common with a terminal connected to the process unit, the secret piece of data being shared by the process unit and the terminal.

33. The process unit according to claim 32, configured to receive and check a condensed value obtained by applying an encryption function to the identification data of the NFC system and the secret piece of data it has generated, and to stop the personalization process if the received condensed value is different of the calculated condensed value.

34. The process unit according to claim 30, configured to transmit the encrypted personalization data to the NFC system via a mobile telecommunication network.

35. The process unit according to claim 30, configured to transmit the encrypted personalization data to the NFC system via a terminal connected to the process unit via a network and to the NFC system via a contactless link.

36. The process unit according to claim 30, configured to transmit the encrypted personalization data with a condensed value obtained by applying a deterministic encryption function to the encrypted personalization data and the identification data of the NFC system.