Communication system for managing safely and independently a plurality of applications by each user card and corresponding user card and management method

• US 6,216,014 B1
• Filed: 11/09/1998
• Issued: 04/10/2001
• Est. Priority Date: 05/17/1996
• Status: Expired due to Term

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemplus (Thales SA)
• Inventors: Laget, Anne, Proust, Philippe, Huet, Cedric
• Primary Examiner(s): LEGREE, TRACY MICHELLE
• Application Number:
  US09/194,086
• Time in Patent Office: 883 Days
• Field of Search: 455/558, 455/550, 455/422, 455/403, 455/410, 455/411, 380/23, 380/25, 380/3, 705/41, 705/65, 705/45, 235/380, 235/382, 235/382.5, 235/492, 707/101, 707/100, 707/9, 713/165, 713/172, 713/193, 711/15
• US Class Current: 455/558
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G07F 7/082 Features insuring the integrity of the data on or in the card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A communication system comprising multiple terminal equipment (1), each consisting of a terminal (4) cooperating with a microprocessor-driven user card (SIM module; 5). Each user card includes data memory (8) comprising a plurality of objects and serving as medium to at least two separate applications, the user card comprising a microprocessor (6) and ROM (7) for executing instructions pertaining to the applications. Each object contained in the user card data memory is associated with a first defined access control policy by a set of first access conditions. Each object is also associated with at least another access control policy defined by a set of at least one alternative access condition. Each alternative access condition is applicable, for the object, to group of at least on instruction pertaining to the application(s) using the other defined access control policy. Each object is also associated with a plurality of access control policy indicators each indicating, for one of the applications, which access control policy to use with the application, the control access policy indicators being stored in the data memory (8).

Claims

1. Communications system of the type having a plurality of terminal devices (MS), each including a terminal (4) cooperating with a microprocessor user card (5),

each user card including data storage means (8) including a plurality of objects, this data storage means (8) serving to support at least two different applications, the user card including means (6, 7) for executing commands belonging to these applications,

each object included in the data storage means of a user card being associated with a first access control policy defined by a set of first access conditions, each of these first access conditions applying, for the object, to a group of at least one command belonging to the application or applications using this first control access policy,

characterized in that each object is also associated with at least one other access control policy, each other control access policy being defined by a set of at least one alternative access conditions, each alternative access condition of another given access control policy applying, for this object, to a group of at least one command belonging to the application or applications using this other given access control policy,

and in that each object is also associated with a plurality of access control policy indicators, each access control policy indicator indicating, for these applications, which access control policy, namely the first or another, is to be used with this application, these access control policy indicators being stored in said data storage means (8).

2. System according to claim 1, characterized in that, for each object, at least one other access control policy is specific to one of the applications, each alternative access condition of this other specific access control policy applying, for said object, to a group of at least one command belonging to the single application using this other specific access control policy.

3. System according to claim 1, characterized in that, for each object, at least one other access control policy is fully common to at least two applications, each alternative access condition of this other fully common access control policy applying, for said object, to a group of at least one command belonging to said at least two applications using this other fully common access control policy.

4. System according to claim 1, characterized in that, for each object, at least one other access control policy is fully common to at least two applications,

whereby some of the alternative access conditions of this other partially common access control policy apply, for said object, to a group of at least one command belonging to said at least two applications using this other common access control policy,

whereby others of the alternative access conditions of this other partially common access control policy apply, for said object, to a group of at least one command belonging solely to one of said at least two applications using this other common access control policy.

5. System according to claim 1, of the type allowing cellular communications, characterized in that said plurality of terminal devices is a plurality of mobile stations (1), said user cards being subscriber identity modules 5).

6. System according to claim 1, including at least one message service center,

said data storage means of a user card serving to support at least one local application and at least one remote application of said user card, the commands being termed “

local”

when they belong to said local application or “

remote”

when they belong to said remote application,

each terminal (4) being able to receive messages of the normal or enhanced type transmitted by said message service center, each user card (5) including means (9) for storing and processing messages received by the terminal with which it cooperates,

whereby the normal messages containing raw data constitute information to be furnished to the subscriber by means of, in particular, a terminal display screen, with the enhanced messages (20) containing remote commands,

characterized in that said data storage means (8) of each user card also store a list of authorized remote applications,

and in that each user card also includes enhanced message discrimination means enabling each enhanced message containing remote commands not belonging to one of said authorized remote applications to be blocked.

7. System according to claim 6, characterized in that said data storage means of each user card also store, for each of said authorized remote applications, a secret reference and an associated message authentication mode,

and in that each user card also includes discriminated enhanced message authentication means enabling a discriminated enhanced message to be authenticated using the secret reference and the message authentication mode associated, in said data storage means, with the authorized remote application to which the commands contained in said discriminated enhanced message belong.

8. System according to claim 7 wherein, said data storage means of each user card having a hierarchical structure with at least three levels and having at least the three following types of files:

master file;

specified file, or subdirectory, placed below said master file;

elementary file, placed below one of said specialized files, known as parent specialized file, or directly below said master file, known as parent master file,

characterized in that said data storage means of each user card include at least one elementary system file, each elementary system file being linked to an authorized remote application and storing a first piece of locator information about the secret reference and the message authentication mode that are associated with this authorized remote application to which it is linked,

and in that each enhanced message includes a second piece of locator information for the elementary system file with which the authorized remote application is linked to which the commands contained in said enhanced message belong,

whereby said authentication means read, in each discriminated enhanced message, said second piece of elementary system file locator information in order to read, into the elementary system file, said first piece of locator information for the secret reference and message authentication mode to be used to authenticate said discriminated enhanced message.

9. System according to claim 8, characterized in that each elementary system file is placed under a specialized file or directly under the master file, whereby a maximum of one elementary system file can be placed under each specialized file, and a maximum of one elementary system file can be placed directly under the master file.

10. System according to claim 9, characterized in that, if no elementary system file exists under a specialized file or under the master file, then each elementary file placed under said specialized file, whatever the value of the remote access conditions associated with this elementary file, is not accessible by any remote command, and in that, if no elementary system file exists directly under the master file then each elementary file placed directly under the master file, whatever the value of the remote access conditions associated with this elementary rile, is not accessible by any remote command.

11. System according to claim 10, characterized in that said second piece of information for locating the elementary system file is an identifier of a specialized file or a waster file to which said elementary system file relates according to a predetermined search strategy in the data storage means.

12. System according to claim 11, characterized in that said predetermined search strategy in the data storage means is a backtracking search mechanism which looks to see whether an elementary system file exists under specialized file or master file indicated by said identifier and, if not, and if the identifier does not indicate the master file, looking to see whether an elementary system file exists directly under the master file.

13. System according to claim 8, characterized in that, in the case of a file one of whose remote access conditions has the “

private access”

value, said predetermined unique remote application whose remote commands can access said file is, provided it is successfully authenticated, the parent authorized remote application of said file, namely the authorized remote application linked to the same elementary system file as that to which the parent specialized file or parent master file of said file relates,

and in that, in the case of a file whose remote access condition has the “

shared access”

value, said at least two predetermined remote applications whose remote commands are able to access said file are, provided they are successfully authenticated, all the authorized remote applications, whatever the elementary system file to which each of them is linked.

14. System according to any one of claim 8, characterized in that each elementary system file comprises a separate set of access control policy indicators, whereby each access control policy indicator, for one of said applications, indicates what access control policy, namely the first or another, is to be used with this application,

said separate set of access control policy indicators being associated with all the files whose parent specialized file or parent master file relates to said elementary system file.

15. A secured, independent method for managing at least two remote applications by a microprocessor user card of the type designed to cooperate with a terminal (4) in order to constitute a terminal device (1) of a communications system according to claim 6,

characterized in that, for each enhanced message received, said user card carries out in particular the following step:

for each remote command contained in said enhanced message, verification of accessibility of this remote command to the object concerned, said accessibility verification being based on a first or remote access control policy, to be used for said object concerned with said current remote application.

16. Method according to claim 15, characterized in that, for each enhanced message received, said user card also carries out a prior discrimination stage (54) of said enhanced message in order not to continue with its processing unless the remote application, known as current remote application, to which the remote commands that it contains belong, is an authorized remote application.

17. Method according to claim 15, characterized in that, for each enhanced message received, said user card also carries out a prior step (57) in which it authenticates said enhanced message, using a secret reference and a message authentication mode that are associated with said current remote application.

18. Method according to claim 15, characterized in that at least some of the elements belonging to the following group can be created and/or updated and/or deleted by remote commands:

the access condition values, particularly the first or remote access condition values, of the access control policies associated with each object;

the access control policy indicator, particularly the first or remote access control policy indicator, to be used with each application for each object;

the list of authorized remote applications,

for each of the authorized remote applications in said list, the associated secret reference and message authentication mode;

the elementary system file or files each linked to a separate authorized remote application,

the elementary, specialized, and master files.

19. System according to claim 1, characterized in that, for said object, the or at least one of the other access control policies, known as second access control policy, is defined by a set of at least one special alternative access conditions, each special alternative access condition being able to assume in particular the following values:

“

no access”

;

if said object is not accessible by any command in said group of at least one command to which said special alternative access condition applies;

“

private access”

;

if said object is accessible only by the commands belonging to a single predetermined application, among said group of at least one command to which said special alternative access condition applies;

“

shared access”

;

if said object is accessible by the commands belonging to at least two predetermined applications, within said group of at least one command to which said special alternative access condition applies.

20. System according to claim 19, characterized in that, for each object, at least one other access control policy, known as remote access control policy, is defined by a set of at least one remote access conditions, each remote access condition applying, for said object, to a group of at least one remote command belonging to the remote application or applications using said remote access control policy,

and in that, for each object, only the access control policy Indicators each associated with one of the remote applications is able to indicate said remote access control policy.

21. System according to claim 20, characterized in that, for each object, each remote access condition can assume the same values NEVER, PRIVATE, SHARED as said special alternative access conditions.

22. Microprocessor user card of the type designed to cooperate with a terminal in order to constitute a terminal device of a communications system according to claim 1, characterized in that each object of the data storage means of said user card is also associated with at least one other access control policy, each other access control policy being defined by a set of at least one alternative access condition, each alternative access condition of another given access control policy applying, for said object, to a group of at least one command belonging to the application or applications using said other given access control policy,

and in that each object is also associated with a plurality of access control policy indicators, whereby each access control policy indicator indicates, for one of said applications, which access control policy, namely the first or another, is to be used with this application, said access control policy indicators being stored in the data storage means (8) of said user card.