SYSTEM AND METHOD FOR PROVISIONING OVER THE AIR OF CONFIDENTIAL INFORMATION ON MOBILE COMMUNICATIVE DEVICES WITH NON-UICC SECURE ELEMENTS

• US 20120172089A1
• Filed: 12/02/2011
• Published: 07/05/2012
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: Mozido Corfire-Korea Limited
• Original Assignee: SK C&C Company Limited (SK Inc.)
• Inventors: CHEONG, Kido, BAE, Sungwoo, KIM, Donghyun, LIM, Jaemin, KWON, Daeman, YOU, Youngjin
• Granted Patent: US 9,161,218 B2
• Time in Patent Office: Days
• US Class Current: 455/558
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/354 Card activation or deactivation
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A method for over-the-air (OTA) provisioning a non-Universal Integrated Circuit Card (UICC) type secure element (SE) of a mobile device, including receiving a request to initialize an OTA proxy of a mobile device; initializing the OTA proxy; receiving provisioning data through the OTA proxy; and provisioning the received data into the SE, in which the SE is a non-UICC type SE. A mobile device to provision secure data OTA in a non-UICC type SE including an OTA proxy to connect to a Trusted Service Manager (TSM) system, and to receive provisioning data from the TSM system; a near-field-communication (NFC) enabled chip to conduct a contactless transaction; and a SE to store information provisioned through OTA proxy, in which the SE is a non-UICC type SE.

Claims

1. A method for over-the-air (OTA) provisioning a non-Universal Integrated Circuit Card (UICC) type secure element (SE) of a mobile device, comprising:

receiving a request to initialize an OTA proxy of a mobile device;

initializing the OTA proxy;

receiving provisioning data through the OTA proxy; and

provisioning the received data into the SE, wherein the SE is a non-UICC type SE.

2. The method of claim 1, further comprising:

requesting the OTA proxy from a Trusted Service Manager (TSM) system;

receiving OTA proxy installation information; and

installing the OTA proxy in the mobile device.

3. The method of claim 1, wherein initializing the OTA proxy comprises:

waking the OTA proxy from its dormant state;

gathering mobile device information;

communicating, by the mobile device, with a TSM system through the OTA proxy; and

transmitting the mobile device information to the TSM system.

4. The method of claim 1, wherein receiving provisioning data through the OTA proxy comprises:

receiving the provisioning data as Application Protocol Data Unit (APDU) commands through the OTA proxy, wherein the TSM system converts the provisioning data into APDU commands.

5. The method of claim 4, wherein provisioning the received data into the non-UICC type SE comprises provisioning the APDU commands, wherein the non-UICC type SE comprises a Micro SD, an Embedded SE, or a SE that does not support either a Short Message Service Point to Point (SMS-PP) protocol or a Bearer Independent Protocol (BIP).

6. The method of claim 1, wherein the request to initialize the OTA proxy is received through a push server.

7. The method of claim 1, further comprising preparing the SE for provisioning, wherein preparing the SE for provisioning comprises:

retrieving mobile device information and SE information, wherein the SE information comprises an SE status and an SE type;

receiving a key from the TSM system for accessing the SE; and

securing the SE based on the SE status.

8. The method of claim 7, wherein the mobile device information comprises at least one of International Mobile Equipment Identity (IMEI), Mobile Equipment Identifier (MEID), and Mobile Subscriber Integrated Services Digital Network Number (MSISDN).

9. The method of claim 7, wherein the key comprises at least one of an initial issuer master key and a final issuer master key.

10. The method of claim 9, wherein securing the SE comprises providing the initial issuer master key and the final issuer master key to the SE in response to a determination that the SE status is Operating System (OS) native.

11. The method of claim 9, wherein securing the SE comprises providing the final issuer master key to the SE in response to a determination that SE status is initialized.

12. The method of claim 7, wherein preparing the SE for provisioning further comprises processing a protocol to enable the SE to be provisioned, the SE type being a Micro SD type.

13. The method of claim 3, wherein communicating, by the mobile device, with the TSM system through the OTA proxy comprises reattempting to communicate with the TSM system in response to a failure to communicate with the TSM system by the mobile device.

14. The method of claim 1, wherein receiving provisioning data comprises reconnecting to the TSM system and requesting to receive the provisioning data in response to receipt of unusable data or in response to a session disconnection during an attempted receiving of the provisioning data.

15. A method for over-the-air (OTA) provisioning a non-Universal Integrated Circuit Card (UICC) type secure element (SE), comprising:

receiving a request to initialize an OTA proxy of a mobile device from a Trusted Service Manager (TSM) system;

initializing the OTA proxy;

communicating, by the mobile device, with the TSM system through the OTA proxy;

retrieving mobile device information and SE information, wherein the SE information comprises an SE status and an SE type;

receiving a key from the TSM system for accessing the SE, wherein the key comprises at least one of an initial issuer master key and a final issuer master key;

securing the SE by providing the corresponding key to the SE based on its status;

receiving provisioning data; and

provisioning the received data into the SE, wherein the SE is a non-UICC type SE.

16. The method of claim 15, further comprising processing a protocol for enabling the SE to receive provisioning data.

17. The method of claim 15, wherein the request to initialize the OTA proxy is received at the mobile device through a push server.

18. The method of claim 15, wherein the non-UICC type SE comprises a Micro SD, an Embedded SE, or a SE that does not support either a Short Message Service Point to Point (SMS-PP) protocol or a Bearer Independent Protocol (BIP).

19. A mobile device to provision secure data over-the-air (OTA) in a non-Universal Integrated Circuit Card (UICC) type secure element (SE), comprising:

an OTA proxy to connect to a Trusted Service Manager (TSM) system, and to receive provisioning data from the TSM system;

a near-field-communication (NFC) enabled device to conduct a contactless transaction; and

a SE to store information provisioned through OTA proxy, wherein the SE is a non-UICC type SE.

20. The mobile device of claim 19, wherein the OTA proxy is configured to transmit mobile device information and SE information to the TSM system, wherein the SE information comprises an SE status and an SE type.

21. The mobile device of claim 20, wherein the mobile device information comprises at least one of International Mobile Equipment Identity (IMEI), Mobile Equipment Identifier (MEID), and Mobile Subscriber Integrated Services Digital Network Number (MSISDN).

22. The mobile device of claim 20, wherein the OTA proxy is configured to receive a key from the TSM system to access the SE based on the SE information sent to the TSM system, wherein the key comprises at least one of an initial issuer master key and a final issuer master key.

23. The mobile device of claim 20, wherein the OTA proxy is further configured to receive a protocol to prepare the SE to be provisioned, the SE type being a Micro SD type.

24. The mobile device of claim 19, wherein the mobile device further comprises a mobile wallet application comprising a widget corresponding to the information stored in the SE.

25. The mobile device of claim 19, wherein the OTA proxy is to be installed OTA.

26. The mobile device of claim 24, wherein the information stored in the SE comprises:

a Payment Procedure Secure Elements (PPSE) to store a contactless card applet; and

a wallet management applet (WMA) corresponding to the contactless card applet.