METHOD FOR ACCESSING A SECURE STORAGE, SECURE STORAGE AND SYSTEM COMPRISING THE SECURE STORAGE

• US 20130145455A1
• Filed: 11/27/2012
• Published: 06/06/2013
• Est. Priority Date: 12/02/2011
• Status: Abandoned Application

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: Vijayshankar, Roshan, De Jong, Hans, Meyn, Hauke
• Application Number:
  US13/686,829
• Publication Number:
  US 20130145455A1
• Time in Patent Office: Days
• US Class Current: 726/16
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories

Abstract

It is described a method for accessing a secure storage of a mobile device, the method comprising: providing a generic interface for accessing the secure storage; accessing the secure storage using the generic interface by a first application of the mobile device; accessing the secure storage using the generic interface by a second application of the mobile device. Further, a corresponding secure electronic storage and a system is described.

Claims

1. Method for accessing a secure storage of a mobile device, the method comprising:

providing a generic interface for accessing the secure storage;

accessing the secure storage using the generic interface by a first application of the mobile device;

accessing the secure storage using the generic interface by a second application of the mobile device.

2. Method according to claim 1, wherein the generic interface is implemented as a generic software module, in particular an applet, stored within the secure storage.

3. Method according to claim 2, wherein the generic software module is stored in a read-only portion of the secure storage.

4. Method according to claim 1, wherein the first application is not stored in the secure storage, wherein the second application is not stored in the secure storage.

5. Method according to claim 2, wherein the generic interface provides access functions comprising first access functions and second access functions for communicating with the secure storage,

wherein the second access functions are invockable, by the first application, only after successfully invoking, by the first application, at least one of the first access functions,

wherein the second access functions are invockable, by the second application, only after successfully invoking, by the second application, at least one of the first access functions.

6. Method according to claim 5, wherein the first access functions comprise at least one of:

a registration function for generically registering the first application and the second application; and

an authentication function for authenticating the first application and the second application.

7. Method according to claim 6,

wherein the register function comprises a register initiation function and a register completion function,

wherein generic software module is associated with a private key and a public key, stored in the secure storage, of the generic software module, wherein the public key is being used for signing a certificate of the generic software module,

wherein during registration via the register initiation function the first application requests the certificate of the generic software module and sends it to a service provider associated with the first application who verifies the certificate using the public key of the generic software module.

8. Method according to claim 7, wherein upon successful verification of the certificate the first application stores first application data in the secure storage, the first application data being encrypted with the public key of the generic software module, the first application data comprising first service keys and/or first parameters.

9. Method according to claim 8, wherein the generic software module returns, via the register completion function, a first reference handle to the first application based on which the first application is enabled to invoke the access functions and to access the first application data.

10. Method according to claim 8, wherein at least one portion of the first application data is associated with information indicating a life span of the portion of the first application data, wherein the portion is removed from the secure storage if the life span has expired.

11. Method according to claim 5, wherein the second access functions comprise at least one of:

a data retrieval function for retrieving, by the first application, first application data from the secure storage and for retrieving, by the second application, second application data from the secure storage, wherein retrieval of the second application data by the first application is prohibited, wherein retrieval of the first application data by the second application is prohibited; and

a data storage function for storing, in the secure storage, first application data by the first application and for storing, in the secure storage, second application data by the second application.

12. Method according to claim 11, wherein the first application data comprise at least one of:

first identification data for identifying the first application; and

first data and first keys resulting from functions performed by the generic interface; and

first service parameters for the first application; and

first macros for the first application.

13. Method according to claim 5, wherein the second access functions comprise at least one of:

a data encryption function for encrypting data, in particular for encrypting data associated with the first application using a first application key comprised in the first application data, in particular for encrypting data associated with the second application using a second application key comprised in the second application data; and

a data decryption function for decrypting data, in particular at least one of the first application data and the second application data.

14. Method according to claim 5, wherein the second access functions comprise at least one of:

a data deletion function for deleting, by the first application, at least a portion of the first application data, and for deleting, by the second application, at least a portion of the second application data, wherein deletion of the second application data by the first application is prohibited, wherein deletion of the first application data by the second application is prohibited; and

a key update function for updating a first public key of the first application and for updating a second public key of the second application; and

a verify function; and

a signing function.

15. Method according to claim 1, wherein the generic interface utilizes a wireless or wire based communication procedure between the secure storage and the first application and the second application.

16. Method according to claim 1, wherein the generic interface is adapted to support secure transaction applications comprising at least one of a payment application, an access key application for accessing a physical facility, and a key handling function for handling a VPN key.

17. A secure electronic storage in which a generic software module implementing a method according to claim 1 is stored.

18. The Secure storage according to claim 1 which is comprised in at least one of a SIM-card, a general storage of the mobile device, and a SD-card.

19. System comprising a mobile device capable to communicate with a secure storage according to claim 17.