APPARATUS AND METHODS FOR STORING ELECTRONIC ACCESS CLIENTS

• US 20120260090A1
• Filed: 04/25/2011
• Published: 10/11/2012
• Est. Priority Date: 04/05/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Hauck, Jerrold Von, Haggerty, David T., McLaughlin, Kevin
• Granted Patent: US 9,009,475 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/43 using shared identity modules, e.g. SIM sharing

Abstract

Apparatus and methods for storing and controlling access control clients. In one embodiment, transmitting and receiving devices ensure that only one copy of an eSIM is active at any time. Specifically, each transferred eSIM is encrypted for the destination device; the eSIM from the source device is deleted, deactivated, or otherwise rendered unusable. Various aspects of network infrastructure are also described, including electronic Universal Integrated Circuit Card (eUICC) appliances, and mobile devices. Various scenarios for transfer of eSIMs are also disclosed.

Claims

1. Apparatus for storing one or more access data elements, comprising:

a secure element adapted to store a plurality of user access data elements, each user access data element encrypted for the secure element;

a processor; and

a storage device in data communication with the processor, the storage device comprising computer-executable instructions that are configured to, when executed by the processor;

process a request for one or more access data elements from a peer device in order to verify the peer device;

decrypt the one or more requested access data elements;

re-encrypt the decrypted one or more access data elements for the peer device; and

transfer the re-encrypted one or more data elements to the verified peer device, the transfer causing removal of the one or more access data elements from the secure element.

2. The apparatus of claim 1, wherein each of the plurality of user access data elements is associated with a corresponding different network.

3. The apparatus of claim 1, wherein each of the plurality of user access data elements is associated with a corresponding different user.

4. The apparatus of claim 1, wherein each of the plurality of user access data elements is associated with a corresponding different use case for a same user.

5. The apparatus of claim 1, wherein the user access data element comprises an electronic Subscriber Identity Module (eSIM).

6. The apparatus of claim 1, wherein the verification comprises checking a certificate associated with the peer device, and generating a challenge response.

7. The apparatus of claim 1, wherein the computer-executable instructions additionally comprise instructions that are configured to, when executed by the processor, negotiate a transfer protocol.

8. The apparatus of claim 7, wherein the re-encryption of the decrypted one or more access data elements is based at least in part on the transfer protocol.

9. The apparatus of claim 7, wherein the transfer protocol comprises one or more elements of handshaking.

10. The apparatus of claim 7, wherein the negotiated transfer protocol comprises identification of a transfer protocol supported by the apparatus and the peer device.

11. The apparatus of claim 1, wherein the apparatus comprises a Hardware Security Module (HSM).

12. The apparatus of claim 1, wherein the apparatus is embodied within a mobile phone.

13. The apparatus of claim 1, wherein the apparatus is embodied within a physical card form factor.

14. Apparatus for storing one or more access data elements, comprising:

a secure element adapted to store a plurality of user access data elements, each user access data element encrypted for the secure element;

a processor; and

a storage device in data communication with the processor, the storage device comprising computer-executable instructions that are configured to, when executed by the processor;

request one or more access data elements from a verified peer device;

receive the one or more requested access data elements from the verified peer device;

verify the one or more requested access data elements are encrypted for the secure element;

store the one or more encrypted access data elements within the secure element; and

decrypt the one or more encrypted access data elements during an authentication protocol.

15. The apparatus of claim 14, wherein the user access data element comprises an electronic Subscriber Identity Module (eSIM).

16. The apparatus of claim 14, wherein the apparatus is embodied within a mobile phone.

17. The apparatus of claim 16, wherein the apparatus comprises a physical card form factor configured for use within the mobile phone.

18. The apparatus of claim 14, wherein the verification comprises checking a digital certificate issued by a trusted certification authority.

19. The apparatus of claim 14, wherein the verification comprises completion of a challenge and response cryptographic exchange.

20. The apparatus of claim 14, wherein the peer device comprises one of (i) a SIM Provisioning Service (SPS), (ii) a eUICC appliance, or (iii) a mobile device.

21. The apparatus of claim 14, wherein the peer device comprises desktop computer in operative communication with a mobile applications store.

22. A method for transferring one or more access data elements, the one or more access data elements having a unique identifier associated therewith, comprising:

agreeing to a transfer protocol between a device and a peer device;

receiving the one or more access data elements from the secure peer device;

verifying the transferred one or more access data elements, the one or more access data elements and unique identifier being encrypted for the device; and

storing the transferred one or more access data elements.

23. The method of claim 22, wherein the user access data element comprises an electronic Subscriber Identity Module (eSIM).

24. The method of claim 22, wherein the unique identifier of the transferred one or more access data elements is determined by the device.

25. The method of claim 22, wherein the unique identifier of the transferred one or more access data elements is provided to the peer device.

26. The method of claim 22, additionally comprising notifying the peer device of successful receipt of the one or more access data elements.