METHOD FOR GENERATING PERSONALIZED PROFILE PACKAGE DATA FOR INTEGRATED CIRCUIT CARDS

• US 20200137030A1
• Filed: 10/18/2019
• Published: 04/30/2020
• Est. Priority Date: 10/30/2018
• Status: Active Grant

• Current Assignee: STMicroelectronics SRL (STMicroelectronics NV)
• Original Assignee: STMicroelectronics SRL (STMicroelectronics NV)
• Inventors: Alfarano, Marco, Massascusa, Sofia
• Granted Patent: US 11,792,166 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/9035 Filtering based on additional data, e.g. user or group profiles
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/42 using virtual identity modules
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/20 Transfer of user or subscriber data
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

A method can be used for generating personalized profile package data for integrated circuit cards. The method includes encrypting data records corresponding to profile data with a respective data protection key thereby obtaining encrypted data records. Each record includes a number of personalization fields to store different types of personalization values. The method also includes encrypting a file for a profile package with a master encryption key thereby obtaining an encrypted file for the profile package. The file includes fields to be personalized corresponding to one or more of the personalization fields to store different types of personalization values. The encrypted file for the profile package and encrypted data records are transmitted to a data preparation entity where the encrypted data records and the encrypted file can be decrypted and combined to obtain personalized profile packages.

Claims

1. A method of generating personalized profile package data for integrated circuit cards, comprising:

encrypting data records corresponding to a plurality of profile data with a respective data protection key thereby obtaining encrypted data records, each record comprising a plurality of personalization fields to store different types of personalization values;

encrypting a file for a profile package with a master encryption key thereby obtaining an encrypted file for the profile package, the file comprising fields to be personalized corresponding to one or more of the personalization fields to store different types of personalization values; and

transmitting the encrypted file for the profile package and encrypted data records to a data preparation entity where the encrypted data records and the encrypted file can be decrypted and combined to obtain personalized profile packages at the data preparation entity.

2. The method of claim 1, wherein the respective data protection key is obtained based on the encrypted file for the profile package.

3. The method of claim 2, wherein the respective data protection key is obtained based on a hash of the encrypted file for the profile package.

4. The method of claim 1, wherein the personalized profile packages are composed in a single output file or batch at the data preparation entity.

5. The method of claim 1, wherein the file for the master profile is converted in DER format at a profile making entity.

6. The method of claim 1, wherein the master encryption key is associated with a product identifier identifying the file for the master profile.

7. The method of claim 1, further comprising decrypting the encrypted data records and the encrypted file at the data preparation entity and combining the data records and the file to obtain the personalized profile packages.

8. The method of claim 7, further comprising transmitting the personalized profile packages from the data preparation entity to respective integrated circuit cards.

9. The method of claim 1, wherein the integrated circuit cards are eUICC cards.

10. A computer-program product that can be loaded into a non-transitory memory of at least one processor and comprises software code for implementing the method of claim 1.

11. A method of generating personalized profile package data in integrated circuit cards, the method comprising:

providing a table comprising a plurality of data records corresponding to a plurality of profile data, each record comprising a plurality of personalization fields to store different types of personalization values;

providing a file for the profile package, the file comprising fields to be personalized corresponding to one or more of the personalization fields to store different types of personalization values;

protecting the file for the profile package by performing an encryption with a master encryption key thereby obtaining an encrypted file for the profile package;

protecting data records in the plurality of data records by performing an encryption with a respective data protection key thereby obtaining encrypted data records;

transmitting the encrypted file for the profile package and encrypted data records to a data preparation entity;

decrypting the encrypted file for a master profile and the encrypted data records at the data preparation entity to obtain unencrypted data records and the file for the master profile;

combining data records comprised in the table with the file for the profile package by inserting the personalization values in fields to be personalized to obtain respective personalized profile packages; and

transmitting the personalized profile packages from the data preparation entity to respective integrated circuit cards.

12. The method of claim 11, wherein the respective data protection key is obtained based on the encrypted file for the profile package.

13. The method of claim 12, wherein the respective data protection key is obtained based on a hash of the encrypted file for the profile package.

14. The method of claim 11, wherein the personalized profile packages are composed in a single output file or batch at the data preparation entity.

15. The method of claim 11, wherein the file for the master profile is converted in DER format at a profile making entity.

16. The method of claim 11, wherein the master encryption key is associated with a product identifier identifying the file for the master profile.

17. The method of claim 11, wherein the integrated circuit cards are eUICC cards.

18. A system for the personalization of integrated circuit cards comprising a profile making entity, a mobile network operator and a data preparation entity, the system configured to generate a personalized profile packages bundle using a method comprising:

encrypting, at the profile making entity, data records corresponding to a plurality of profile data with a respective data protection key thereby obtaining encrypted data records, each record comprising a plurality of personalization fields to store different types of personalization values;

encrypting, at the profile making entity, a file for a profile package with a master encryption key thereby obtaining an encrypted file for the profile package, the file comprising fields to be personalized corresponding to one or more of the personalization fields to store different types of personalization values; and

transmitting the encrypted file for the profile package and encrypted data records from the profile making entity to the data preparation entity.

19. The system of claim 18, wherein the system is further configured to decrypt the encrypted data records and the encrypted file at the data preparation entity and to combine, at the data preparation entity, the data records and the file to obtain the personalized profile packages.

20. The method of claim 19, wherein the system is further configured to transmit the personalized profile packages from the data preparation entity to respective integrated circuit cards.