Universal subscriber identity module provisioning for machine-to-machine communications

• US 20090191857A1
• Filed: 01/30/2008
• Published: 07/30/2009
• Est. Priority Date: 01/30/2008
• Status: Abandoned Application

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Corporation, Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: De Bie, Luc, Kanerva, Mikko J., Holtmanns, Silke, Horn, Gunther
• Application Number:
  US12/010,889
• Publication Number:
  US 20090191857A1
• Time in Patent Office: Days
• US Class Current: 455/419
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier

Abstract

The present invention relates to remotely provisioning subscriber identification parameters in a device on a wireless network. A secure connection is established with the device, and a token containing the new subscriber identification parameters is forwarded over the secure connection. The device may verify the received token. In one embodiment, the subscriber identification parameters are updated to change network operators. The secure connection can be with the old network operator or the new network operator. The device on the wireless network may be a machine-to-machine device. The provisioned subscriber identification may be part of a universal subscriber identification module.

Claims

1. A method for remotely updating stored subscriber identification parameters over a wireless network, the method comprising:

establishing new parameters from a new operator for updating stored subscriber identification;

checking integrity of the new parameters using data received from an old network operator;

stopping a connection to the network; and

reestablishing the connection using the new parameters.

2. The method of claim 1, wherein the new parameters relate to a new network operator

3. The method of claim 1, wherein the establishing of the new parameters comprises:

storing the new parameters in parallel to the stored parameters; and

prioritizing the new parameters.

4. The method of claim 2, further comprising:

receiving authorization to update the parameters.

5. The method of claim 4, wherein the receiving of the authorization to update the parameters comprises:

accepting a secure connection from the old network operator;

receiving a token from the old network operator, wherein the token comprises the new parameters; and

verifying the token.

6. The method of claim 5, wherein the token comprises an identifier of the new network operator, and wherein the verifying of the token comprises analyzing the identifier.

7. The method of claim 1, wherein the method is performed by a machine-to-machine terminal.

8. The method of claim 1, wherein the method is performed by multiple devices.

9. The method of claim 1, wherein the new parameters comprise changes in a universal subscriber identity module.

10. The method of claim 2, wherein the new parameters result in a change from the old network operator to the new network operator.

11. The method of claim 1, further comprising:

forwarding a first random number;

receiving a second random number;

accepting a secure connection based on the first and second random numbers; and

receiving the new parameters over the secure connection.

12. The method of claim 11, wherein the method is performed by a device, wherein the second random number is produced by a new network operator, and wherein a computer associated with an owner of the device exchanges the both the first and the second random numbers between the device and the new network operator.

13. An apparatus for remotely updating stored subscriber identification parameters over a wireless network, the apparatus comprising:

a storage device configured to store the subscriber identification parameters;

a processor configured to establishing new parameters for updating subscriber identification and to check an integrity of the new parameters using data received from a current network operator; and

a transmitter configured to stop a connection to the network and to reestablish the connection using the new parameters.

14. The apparatus of claim 13, wherein the storage device is further configured to store the new parameters in parallel to the stored parameters to prioritize the new parameters.

15. The apparatus of claim 13, wherein the storage device is further configured to remove the new parameters, and wherein the transmitter is further configured to restore the connection to the network using the stored parameters.

16. The apparatus of claim 13, further comprising:

a receiver configured to receiving authorization to update the parameters.

17. The apparatus of claim 16, wherein the receiver is further configured to accept a secure connection from the current network operator, and to receive a token from the current network operator, wherein the token comprises the new parameters;

and wherein the processor is configured to verify the token.

18. The apparatus of claim 17, wherein the token comprises an identifier of a new network operator, and wherein the processor verifies the token by analyzing the identifier.

19. The apparatus of claim 13, wherein the apparatus comprises a machine-to-machine terminal.

20. The apparatus of claim 19, wherein the apparatus comprises a meter.

21. The apparatus of claim 19, wherein the apparatus comprises a tracking device.

22. The apparatus of claim 13, wherein the new parameters comprise changes in a universal subscriber identity module stored in the apparatus.

23. The apparatus of claim 13, wherein the new parameters result in a change from the current network operator to a new network operator.

24. The apparatus of claim 14,

wherein the processor is configured to produce a first random number and a transmitter is configured to send the first random number to the network;

wherein the receiver configured to receive a second random number, accepts a secure connection based on the first and second random numbers;

receives the new parameters over the secure connection.

25. The apparatus of claim 24, wherein the second random number is produced by a new network operator, and wherein a computer associated with an owner of the apparatus exchanges the both the first and the second random numbers between the apparatus and the new network operator.

26. A method for remotely updating stored subscriber identification parameters over a wireless network, the method comprising:

accepting a secure connection from a new network operator;

establishing new parameters for updating stored subscriber identification, wherein the new parameters are received from the new network operator over the secure connection;

checking integrity of the new parameters;

stopping a connection to the network; and

reestablishing the connection using the new parameters.

27. The method of claim 26, wherein the establishing of the new parameters comprises:

storing the new parameters in parallel to the stored parameters; and

prioritizing the new parameters.

28. The method of claim 26, wherein the accepting of the secure connection comprises:

computing a session key using either a hash or a reverse hash, establishing an authentication and key agreement, or using public key cryptography comprising private and public signing keys.

29. The method of claim 26, wherein the receiving of the authorization to update the parameters comprises:

receiving a token, wherein the token comprises the new parameters; and

verifying the token.

30. The method of claim 29, wherein the token comprises an identifier of the new network operator, and wherein the verifying of the token comprises analyzing the identifier.

31. The method of claim 26, wherein the method is performed by a machine-to-machine terminal.

32. The method of claim 26, wherein the method is performed by multiple devices.

33. The method of claim 26, wherein the new parameters comprise changes in a universal subscriber identity module.

34. The method of claim 26, wherein the new parameters result in a change from an old network operator to the new network operator.

35. An apparatus for remotely updating stored subscriber identification parameters over a wireless network, the apparatus comprising:

a receiver configured to accept a secure connection from new network operator;

a processor configured to establish new parameters for updating stored subscriber identification, wherein the new parameters are received from the new network operator over the secure connection and to check integrity of the new parameters; and

a transmitter configured to stop a connection to the network and to reestablish the connection using the new parameters.

36. The apparatus of claim 35, further comprising:

a storage device configured to store the new parameters in parallel to the stored parameters and to prioritize the new parameters.

37. The apparatus of claim 35, wherein the processor is configured to:

compute a session key using either a hash or a reverse hash;

establish an authentication and key agreement, or

use public key cryptography comprising private and public signing keys.

38. The apparatus of claim 35,

wherein the receiver is configured to receive a token comprising the new parameters over the secure connection;

and

wherein the processor is configured to verify the token.

39. The apparatus of claim 38, wherein the token comprises an identifier of the new network operator, and wherein processor is configured to analyze the identifier.

40. The apparatus of claim 35, wherein the apparatus comprises a machine-to-machine terminal.

41. The apparatus of claim 35, wherein the new parameters comprise changes in a universal subscriber identity module.

42. The apparatus of claim 35, wherein the new parameters result in a change from an old network operator to the new network operator.

43. A computer readable medium for storing instructions to be executed on a process for implementing a method for remotely updating stored subscriber identification parameters over a wireless network, the method comprising:

accepting a secure connection from an old network operator;

receiving a token from the old network operator, wherein the token comprises the new parameters; and

verifying the token.

establishing new parameters from a new operator for updating stored subscriber identification;

checking integrity of the new parameters using data received from an old network operator;

stopping a connection to the network; and

reestablishing the connection using the new parameters.