Systems and Methods For Providing Security to Different Functions

• US 20100088516A1
• Filed: 12/07/2009
• Published: 04/08/2010
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Karaoguz, Jeyhan, Buer, Mark, Frank, Edward H.
• Granted Patent: US 7,937,585 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Methods and systems are provided that use smartcards, such as subscriber identity module (SIM) cards to provide secure functions for a mobile client. One embodiment of the invention provides a mobile communication network system that includes a mobile network, a mobile terminal, a server coupled to the mobile terminal via the mobile network, and a subscriber identity module (SIM) card coupled to the mobile terminal. The SIM card includes a first key and a second key. The first key is used to authenticate an intended user of the mobile terminal to the mobile network. Upon successful authentication of the intended user to the mobile network, the mobile terminal downloads a function offered from the server through the mobile network. The second key is then used by the mobile terminal to authenticate the intended user to the downloaded function so that the intended user can utilize the function.

Claims

1-29. -29. (canceled)

30. A mobile terminal adapted for wireless communication with a mobile network, the mobile terminal comprising:

a Subscriber Identity Module (SIM) card removably coupled to the mobile terminal, the SIM card having a first key and a second key;

wherein the mobile terminal is adapted to download a function capsule including a first function from the mobile network, wherein the first key is used to authenticate an intended user of the mobile terminal to the mobile network and to download the function capsule from the mobile network to the mobile terminal; and

wherein the second key is used to authenticate the intended user to the function capsule on the mobile terminal.

31. The mobile terminal of claim 30, wherein the function capsule includes a copy of the second key to authenticate the intended user to the function capsule.

32. The mobile terminal of claim 30, wherein the downloaded function capsule from the mobile network is encrypted and wherein the SIM card includes a third key for decrypting the downloaded function capsule.

33. The mobile terminal of claim 30, wherein the first function provides a call waiting service to the mobile terminal.

34. The mobile terminal of claim 30, wherein the first function provides an e-mailing service to the mobile terminal.

35. The mobile terminal of claim 30, wherein the first function provides a financial data service to the mobile terminal.

36. The mobile terminal of claim 30, wherein the SIM card includes a third key and wherein the third key authenticates the intended user to utilize the first function of the function capsule after the second key has authenticated the intended user to the function capsule.

37. The mobile terminal of claim 36, wherein the SIM card includes a fourth key, wherein the function capsule comprises a second function, and wherein the fourth key authenticates the intended user to utilize the second function of the function capsule.

38. The mobile terminal of claim 37, wherein the fourth key authenticates the intended user to utilize the second function of the function capsule after the third key has authenticated the intended user to utilize the first function of the function capsule.

39. The mobile terminal of claim 38, wherein the first function provides an e-mailing service to the mobile terminal and wherein the second function provides a financial data e-mailing service to the mobile terminal.

40. The mobile terminal of claim 37, wherein the third key does not authenticate the intended user to utilize the second function of the function capsule.

41. The mobile terminal of claim 36, wherein the function capsule comprises an authentication module and wherein the authentication module includes a copy of the second key to authenticate the intended user to the function capsule and a copy of the third key to authenticate the intended user to utilize the first function of the function capsule.

42. The mobile terminal of claim 30, wherein at least one of the first and second keys comprises a private key and a public key and wherein only a copy of the public key is available outside the SIM card to authenticate the intended user.

43. The mobile terminal of claim 30, further comprising a stateless module coupled to the SIM card and for securely receiving and using keys.

44. The mobile terminal of claim 43, wherein the stateless module provides a secure usage environment for receiving and using keys that is remotely separated from and cryptographically secured to the SIM card.

45. A server system adapted to be coupled to a mobile terminal via a mobile network, the mobile terminal including a SIM card coupled to the mobile terminal, the SIM card having a first key and a second key, the server comprising

at least one server adapted to download a function capsule including a first function over the mobile network to the mobile terminal;

and

wherein the first key is used to authenticate an intended user of the mobile terminal to the mobile network and to download the function capsule from the mobile network to the mobile terminal; and

wherein the second key is used to authenticate the intended user to the function capsule on the mobile terminal.

46. The server system of claim 45, wherein the server includes a third key to revoke the second key of the SIM card.

47. The server system of claim 46, wherein the second key of the SIM card is remotely revoked by the server via the mobile network.

48. The server system of claim 45, wherein the SIM card includes a third key to authenticate the intended user to access the server.

49. The communication system of claim 48, wherein the server includes a fourth key to revoke one or both of the second and third keys of the SIM card.

50. A communication system for providing secure mobile terminal functions, the system comprising:

a mobile terminal adapted to be coupled to a mobile network;

a function capsule including a first function; and

a SIM card coupled to the mobile terminal, the SIM card having a function capsule authentication key;

wherein the function capsule is downloaded from the mobile network to the mobile terminal; and

wherein the function capsule authentication key is used to authenticate the intended user to the function capsule on the mobile terminal.

51. The communication system of claim 50, wherein the function capsule includes a copy of the function capsule authentication key to authenticate the intended user to the function capsule.

52. The communication system of claim 50, wherein the downloaded function capsule from the mobile network is encrypted and wherein the SIM card includes an additional key for decrypting the downloaded function capsule.

53. The communication system of claim 50, wherein the first function provides a call waiting service to the mobile terminal.

54. The communications system of claim 50, wherein the first function provides an e-mailing service to the mobile terminal.

55. The communication system of claim 50, wherein the first function provides a financial data service to the mobile terminal.

56. The communication system of claim 50, wherein the SIM card includes an additional key and wherein the additional key authenticates the intended user to utilize the first function of the function capsule after the function capsule authentication key has authenticated the intended user to the function capsule.

57. The communication system of claim 56, wherein the SIM card includes a second additional key, wherein the function capsule comprises a second function, and wherein the second additional key authenticates the intended user to utilize the second function of the function capsule.

58. The communication system of claim 57, wherein the second additional key authenticates the intended user to utilize the second function of the function capsule after the additional key has authenticated the intended user to utilize the first function of the function capsule.

59. The communication system of claim 57, wherein the additional key does not authenticate the intended user to utilize the second function of the function capsule.

60. The communication system of claim 56, wherein the function capsule comprises an authentication module and wherein the authentication module includes a copy of the function capsule authentication key to authenticate the intended user to the function capsule and a copy of the additional key to authenticate the intended user to utilize the first function of the function capsule.

61. The communication system of claim 50, further comprising a second network, an authentication server, and a key writing site coupled to the authentication server via the second network, wherein the key writing site is used to write the function authentication capsule key into the SIM card at a time when the intended user desires to utilize the first function of the function capsule and wherein the function authentication capsule key is provided from the authentication server to the key writing site.

64. The communication system of claim 50, further comprising a server coupled to the mobile terminal via the mobile network, wherein the function capsule is downloaded over the mobile network from the server.

65. The communication system of claim 64, wherein the server includes an additional key to revoke the function capsule authentication key of the SIM card.

66. The communication system of claim 65, wherein the function capsule authentication key of the SIM card is remotely revoked by the server via the mobile network.

67. The communication system of claim 50, further comprising a key writing site, wherein the key writing site is used to write the function capsule authentication key into the SIM card at a time when the intended user has purchased the first function of the function capsule.

68. The communication system of claim 50, further comprising a server coupled to the mobile terminal via the mobile network, wherein the function capsule is downloaded over the mobile network from the server and wherein the SIM card includes an additional key to authenticate the intended user to access the server.

69. The communication system of claim 68, wherein the server includes a second additional key to revoke one or both of the function capsule authentication key and additional key of the SIM card.

62. The communication system of claim 62, wherein the authentication server includes an additional key to revoke the function authentication capsule key written into the SIM card of the intended user.

63. The communication system of claim 63, wherein the function authentication capsule key is wirelessly revoked by the authentication server via the mobile network.