SYSTEMS AND METHODS FOR REMOTE CREDENTIALS MANAGEMENT

• US 20130305330A1
• Filed: 01/25/2013
• Published: 11/14/2013
• Est. Priority Date: 05/14/2012
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Palanigounder, Anand
• Granted Patent: US 8,875,265 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier

Abstract

The present application relates generally to wireless communication systems and more specifically to systems, methods, and devices for remote credentials management within wireless communication systems. In one aspect, a method of obtaining provisioning information via a service provider network, such as a cellular network, for a device is provided. The method includes transmitting an attach request via the service provider network for provisioning service, the attach request including device vendor information which includes a unique identifier for the device. The method further includes receiving provisioning information from the service provider upon authentication of the device vendor information. In other aspects, systems and methods for providing provisioning information are described.

Claims

1. A method of obtaining provisioning information via a service provider network for a device, the method comprising:

transmitting, via the service provider network, an attach request for provisioning service, the attach request including device vendor information having a unique identifier for the device; and

receiving provisioning information from the service provider network upon authentication of the device vendor information.

2. The method of claim 1, wherein the attach request comprises a provisioning type.

3. The method of claim 2, wherein the provisioning type for the attach request is included in an information element of the attach request.

4. The method of claim 1, further comprising:

receiving a challenge request to authenticate the device vendor information; and

transmitting a challenge response based at least in part on device vendor information.

5. The method of claim 1, further comprising:

receiving a request for subscription authentication; and

transmitting a challenge response based on at least in part on a predetermined credential shared by multiple devices.

6. The method of claim 1, further comprising:

obtaining a session key, the session key based at least in part on the device vendor information; and

securing communications between the device and the service provider network based at least in part on the session key.

7. The method of claim 1, further comprising:

detaching from the service provider network upon receipt of the provisioning information; and

obtaining service based at least in part on the received provisioning information.

8. The method of claim 1, wherein the device vendor information further includes an encryption certificate associated with a vendor of the device.

9. The method of claim 1, wherein the unique identifier for the device comprises at least one of an international mobile equipment identifier and a mobile equipment identifier.

10. The method of claim 1, wherein the service provider network comprises a cellular network.

11. An apparatus for obtaining provisioning information via a service provider network, the apparatus comprising:

an attachment manager configured to transmit, via the service provider network, an attach request for provisioning service, the attach request including device vendor information having a unique identifier for the apparatus; and

a credential manager configured to receive provisioning information from the service provider network upon authentication of the device vendor information.

12. The apparatus of claim 11, wherein the attach request comprises a provisioning type.

13. The apparatus of claim 12, wherein the provisioning type for the attach request is included in an information element of the attach request.

14. The apparatus of claim 11, further comprising:

a challenge request receiver configured to receive a challenge request to authenticate the device vendor information; and

a challenge response transmitter configured to transmit a challenge response based at least in part on device vendor information.

15. The apparatus of claim 11, further comprising:

a challenge request receiver configured to receive a challenge request to authenticate a subscription for the apparatus; and

a challenge response transmitter configured to transmit a challenge response based at least in part on a predetermine credential shared by multiple devices.

16. The apparatus of claim 11, further comprising:

a session key manager configured to obtain a session key based at least in part on the device vendor information; and

a secure communication module configured to securely communicate with the service provider network based at least in part on the session key.

17. The apparatus of claim 11, wherein the attachment processor is further configured to:

detach from the service provider network upon receipt of the provisioning information; and

obtaining service based at least in part on the received provisioning information.

18. The apparatus of claim 11, wherein the device vendor information further includes an encryption certificate associated with a vendor of the apparatus.

19. The apparatus of claim 11, wherein the unique identifier for the apparatus comprises at least one of an international mobile equipment identifier and a mobile equipment identifier.

20. The apparatus of claim 11, wherein the service provider network is a cellular network.

21. An apparatus for obtaining provisioning information via a service provider network, the apparatus comprising:

means for transmitting, via the service provider network, an attach request for provisioning service, the attach request including device vendor information having a unique identifier for the apparatus; and

means for receiving provisioning information from the service provider network upon authentication of the device vendor information.

22. A computer readable storage medium comprising instructions executable by a processor of an apparatus, the instructions causing the apparatus to:

transmit, via a service provider network, an attach request for provisioning service, the attach request including device vendor information having a unique identifier for the apparatus; and

receive provisioning information from the service provider network upon authentication of the device vendor information.

23. A method of providing provisioning information via a service provider network to a device, the method comprising:

receiving an attach request from the device via the service provider network for provisioning service, the attach request including device vendor information having a unique identifier for the device;

authenticating the device based at least in part on the device vendor information; and

transmitting provisioning information associated with a subscription upon determining the device is authenticated.

24. The method of claim 23, wherein the attach request comprises a provisioning type.

25. The method of claim 24, wherein the provisioning type for the attach request is included in an information element of the attach request.

26. The method of claim 23, further comprising:

transmitting a challenge request to authenticate the device;

receiving a challenge response; and

determining if the challenge response is associated with a subscription based at least in part on device vendor information.

27. The method of claim 23, further comprising:

transmitting a challenge request to authenticate a subscription for the device;

receiving a challenge response; and

determining if the challenge response is associated with a predetermined credential shared by multiple devices.

28. The method of claim 23, further comprising:

generating a session key, the session key based at least in part on device vendor information; and

securing communications between the device and the service provider network based at least in part on the session key.

29. The method of claim 23, wherein the device vendor information further comprises an encryption certificate associated with a vendor of the device.

30. The method of claim 23, wherein the unique identifier for the device comprises at least one of an international mobile equipment identifier for the device and a mobile equipment identifier for the device.

31. The method of claim 23, wherein the service provider network is a cellular network.

32. The method of claim 23, further comprising, upon determining the device is unauthenticated:

obtaining a subscription offer from a credential provider;

transmitting the subscription offer to the device;

receiving a message indicating acceptance of the subscription offer; and

transmitting provisioning information based on the accepted subscription offer.

33. The method of claim 23, further comprising detaching the device from the service provider network upon transmission of the provisioning information.

34. An apparatus for providing provisioning information via a service provider network for a device, the apparatus comprising:

an attachment manager configured to receive an attach request from the device via the service provider network for provisioning service, the attach request including device vendor information having a unique identifier for the device;

an authenticator configured to authenticate the device based at least in part on the device vendor information; and

a credential manager configured to cause the transmission of provisioning information associated with a subscription upon determining the device is authenticated.

35. The apparatus of claim 34, wherein the attach request comprises a provisioning type.

36. The apparatus of claim 35, wherein the provisioning type for the attach request is included in an information element of the attach request.

37. The apparatus of claim 34, further comprising:

a challenge request circuit configured to cause the transmission of a challenge request to authenticate the device; and

a challenge response circuit configured to receive a challenge response,

wherein the authenticator is further configured to determine if the challenge response is associated with a subscription based at least in part on device vendor information.

38. The apparatus of claim 34, further comprising:

a challenge request circuit configured to cause transmission of a challenge request to authenticate a subscription for the device; and

a challenge response circuit configured to receive a challenge response,

wherein the authenticator is further configured to determine if the challenge response is associated with a subscription based at least in part on a predetermined credential shared by multiple devices.

39. The apparatus of claim 34, further comprising:

a session key generator configured to generate a session key based at least in part on the device vendor information; and

a secure communication module configured to secure communication between the service provider network and the device based at least in part on the session key.

40. The apparatus of claim 34, wherein the device vendor information further includes an encryption certificate associated with a vendor of the device.

41. The apparatus of claim 34, wherein the unique identifier for the device includes at least one of an international mobile equipment identifier for the device and a mobile equipment identifier for the device.

42. The apparatus of claim 34, wherein the service provider network is a cellular network.

43. The apparatus of claim 34, further comprising a subscription offer circuit configured to, upon determining the device is unauthenticated:

obtain a subscription offer from a credential provider;

transmit the subscription offer to the device;

receive a message indicating acceptance of the subscription offer; and

transmit provisioning information based on the accepted subscription offer.

44. The apparatus of claim 34, wherein the attachment manager is further configured to detach the device from the service provider network upon transmission of the provisioning information.

45. An apparatus for providing subscription information via a service provider network to a device, the apparatus comprising:

means for receiving an attach request from the device via the service provider network for provisioning service, the attach request including device vendor information having a unique identifier for the device;

means for authenticating the device based at least in part on device vendor information; and

means for transmitting provisioning information associated with a subscription upon determining the device is authenticated.

46. A computer readable storage medium comprising instructions executable by a processor of an apparatus, the instructions causing the apparatus to:

receive an attach request from a device via the service provider network for provisioning service, the attach request including device vendor information having a unique identifier for the device;

authenticate the device based at least in part on device vendor information; and

transmit provisioning information associated with a subscription upon determining the device is authenticated.