METHOD FOR INSTALLING AN APPLICATION ON A SIM CARD

• US 20110131421A1
• Filed: 12/02/2009
• Published: 06/02/2011
• Est. Priority Date: 12/02/2009
• Status: Abandoned Application

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Inventors: Robles, Javier Cañís, Yan, Mei, McAvoy, Paul, Jogand-Coulomb, Fabrice
• Application Number:
  US12/629,593
• Publication Number:
  US 20110131421A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method of installing an application on a SIM card is disclosed. A host agent in a host device installs an application on a Subscriber Identity Module card from a non-volatile storage device. The host agent coordinates mutual authentication between the non-volatile storage device and a Subscriber Identity Module card in the host device. If the mutual authentication is successful, the host agent reads an application from the non-volatile storage device and installs the application on the Subscriber Identity Module card, wherein installing the application enables the Subscriber Identity Module card to execute the application. The application may be protected from tampering or unauthorized copying during the host agent transfer by creation of a secure communication channel or transferring encrypted applications. The Subscriber Identity Module card may verify the signature associated with an application before installation to prevent the installation of unauthorized or tampered applications.

Claims

1. A method for installing an application on a Subscriber Identity Module card from a non-volatile storage device, the method comprising:

in a host device that includes a host agent and is operatively connected with a non-volatile storage device and a Subscriber Identity Module card, utilizing the host agent to perform;

coordinating mutual authentication between the non-volatile storage device and the Subscriber Identity Module card; and

if the mutual authentication is successful;

reading an application from the non-volatile storage device; and

installing the application on the Subscriber Identity Module card to enable the Subscriber Identity Module card to execute the application.

2. The method of claim 1, wherein coordinating mutual authentication between the non-volatile storage device and the Subscriber Identity Module card comprises:

utilizing an access control record from a tree in the non-volatile storage device, wherein the tree comprises nodes organized hierarchically therein, each node comprising at least one access control record, wherein the access control record comprises credentials and permissions for authenticating the Subscriber Identity Module card to a set of addressable locations in the non-volatile storage device storing the application, and

authorizing access by the host agent to the application stored in the set of addressable memory locations.

3. The method of claim 1, further comprising:

coordinating establishment of a secure communication channel between the non-volatile storage device and the Subscriber Identity Module card through the host device, wherein reading the application from the non-volatile storage device comprises reading the application from the non-volatile storage device over the secure communication channel, and wherein installing the application on the Subscriber Identity Module card comprises installing the application on the Subscriber Identity Module card over the secure communication channel.

4. The method of claim 3, wherein the application stored in the non-volatile storage device is in an encrypted format, and wherein reading the application from the non-volatile storage device over the secure communication channel comprises reading a decrypted application from the non-volatile storage device, wherein the decrypted application corresponds to the application.

5. The method of claim 1, wherein the application stored in the non-volatile storage device is in an encrypted format, wherein reading the application from the non-volatile storage device comprises reading an encrypted application, and wherein installing the application to the Subscriber Identity Module card comprises installing the encrypted application.

6. The method of claim 1, wherein installing the application on the Subscriber Identity Module card comprises:

reading a signature identification value from the Subscriber Identity Module card;

reading a signature corresponding to the signature identification value from the non-volatile storage device;

combining the application with the signature to form a signed application; and

installing the signed application on the Subscriber Identity Module card.

7. The method of claim 6, wherein the signature is one of a plurality of signatures stored in the non-volatile storage device, and wherein the application is signed by signature keys corresponding to each of the plurality of signatures.

8. The method of claim 1, wherein installing the application on the Subscriber Identity Module card comprises:

transmitting an application identifier associated with the application to a third party;

receiving a signed application identifier from the third party;

combining the application with the signed application identifier to form a signed application; and

installing the signed application on the Subscriber Identity Module card.

9. The method of claim 8, the method further comprising reading the application identifier from the non-volatile storage device before transmitting the application identifier to the third party.

10. The method of claim 8, wherein the application identifier is an application hash.

11. The method of claim 8, wherein the third party is a Mobile Network Operator.

12. The method of claim 1, wherein reading the application from the non-volatile storage device further comprises:

receiving a signature key from a third party;

transmitting the signature key to the non-volatile storage device; and

reading a signed application from the non-volatile storage device, wherein the signed application comprises the application signed with the signature key.

13. The method of claim 12, wherein the third party is a Mobile Network Operator.

14. The method of claim 1, wherein the application comprises an application encrypted with an application key, and wherein the method further comprises:

reading the application key from the non-volatile storage device, wherein the application key is encrypted with a Subscriber Identity Module card key; and

transferring the application key to the Subscriber Identity Module card, wherein transferring the application key to the Subscriber Identity Module card permits the Subscriber Identity Module card to decrypt the application key to yield a decrypted application key and to decrypt the application using the decrypted application key.

15. The method of claim 3, wherein the application comprises an application encrypted with an application key, and wherein the method further comprises:

reading the application key from the non-volatile storage device over the secure communication channel; and

transferring the application key to the Subscriber Identity Module card over the secure communication channel, wherein transferring the application key to the Subscriber Identity Module card permits the Subscriber Identity Module card to decrypt the application using the application key.

16. The method of claim 1, wherein the application comprises an application encrypted with an application key, and wherein transferring the application stored in the non-volatile storage device to the Subscriber Identity Module card comprises:

reading the application from the non-volatile storage device;

reading an application key from the non-volatile storage device;

receiving a Subscriber Identity Module card key from a third party;

encrypting the application key with the Subscriber Identity Module card key to form an encrypted application key; and

transferring the application and the encrypted application key to the Subscriber Identity Module card.

17. The method of claim 16, wherein the third party is a Mobile Network Operator.

18. The method of claim 1, wherein the non-volatile storage device comprises a non-volatile memory card.