System and Method for Providing Diverse Secure Data Communication Permissions to Trusted Applications on a Portable Communication Device

• US 20120124659A1
• Filed: 10/21/2011
• Published: 05/17/2012
• Est. Priority Date: 11/17/2010
• Status: Abandoned Application

• Current Assignee: TIS Incorporated (It Holdings Corporation)
• Original Assignee: TIS Incorporated (It Holdings Corporation)
• Inventors: Craft, Michael, Brudnicki, David, Reisgies, Hans, Weinstein, Andrew
• Application Number:
  US13/279,200
• Publication Number:
  US 20120124659A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3567 Software being in the reader
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system for providing first and second trusted applications diverse permission to communicate via a secure element. The system comprising first digital identifier and digital token operably associated with the first trusted application; a second digital identifier and digital token operably associated with the second trusted application. The system further includes a card services module that provides an application programming interface to the secure element supported by a secure data table including first and second sets of permissions. The card services module issues one or more commands to the secure element based on a first action requested by the first trusted application in conjunction with the presentation of the first digital token only if the one or more commands will not violate the first set of permissions. A method is also disclosed.

Claims

1. A system for providing first and second trusted applications diverse permission to communicate via a secure element associated with a portable communication device, the system comprising:

a first digital identifier and a first digital token operably associated with the first trusted application;

a second digital identifier and a second digital token operably associated with the second trusted application;

a card services module disposed on the portable communication device and operably associated with the secure element to provide an application programming interface to the secure element; and

a secure data table electronically associated with the card service module, the secure data table including a first entry pairing the first digital identifier with the first digital token and a second entry pairing the second digital identifier with the second digital token, the first entry further including a first set of permissions and the second entry further including a second set of permissions,

wherein the card services module issues one or more commands to the secure element based on a first action requested by the first trusted application in conjunction with the presentation of the first digital token only if the one or more commands will not violate the first set of permissions and the card services module issues one or more commands to the secure element based on a second action requested by the second trusted application in conjunction with the presentation of the second digital token only if the one more commands will not violate the second set of permissions.

2. The system according to claim 1 wherein the first and second sets of permissions are different.

3. The system according to claim 2 wherein the first and second sets of permissions govern reading, writing, activating/deactivating and downloading credentials.

4. The system according to claim 3 wherein the first and second set of permissions apply independently to three categories:

all credentials, own credentials and extended issuer credentials.

5. The system according to claim 1 wherein the first and second sets of permissions govern reading, writing, activating/deactivating and downloading credentials.

6. The system according to claim 5 wherein the first and second set of permissions apply independently to three categories:

all credentials, own credentials and extended issuer credentials.

7. A method for providing first and second trusted applications diverse permission to communicate via a secure element associated with a portable communication device, the method comprising:

assigning a first set of permissions to the first trusted application;

assigning a second set of permissions to the second trusted application;

requesting from the first trusted application that a card services module operably associated with the secure element implement a first action; and

issuing one or more commands to the secure element based on the first action requested by the first trusted application only if the one or more commands will not violate the first set of permissions.

8. The method of claim 7 further comprising:

requesting from the second trusted application that a card services module operably associated with the secure element implement a second action; and

issuing one or more commands to the secure element based on the second action requested by the second trusted application only if the one or more commands will not violate the second set of permissions.

9. The method according to claim 8 wherein the first and second sets of permissions are different.

10. The method according to claim 9 wherein the first and second sets of permissions govern reading, writing, activating/deactivating and downloading credentials.

11. The method according to claim 10 wherein the first and second set of permissions apply independently to three categories:

all credentials, own credentials and extended issuer credentials.

12. The method according to claim 7 wherein the first and second sets of permissions govern reading, writing, activating/deactivating and downloading credentials.

13. The system according to claim 12 wherein the first and second set of permissions apply independently to three categories:

all credentials, own credentials and extended issuer credentials.