Systems and methods for providing security to different functions

• US 7,937,585 B2
• Filed: 12/07/2009
• Issued: 05/03/2011
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Edward H., Karaoguz, Jeyhan, Buer, Mark
• Primary Examiner(s): Dinh; Minh
• Assistant Examiner(s): HO, VIRGINIA T
• Application Number:
  US12/632,354
• Publication Number:
  US 20100088516A1
• Time in Patent Office: 512 Days
• Field of Search: 726/9, 380/247, 713/167
• US Class Current: 713/167
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Methods and systems are provided that use smartcards, such as subscriber identity module (SIM) cards to provide secure functions for a mobile client. One embodiment of the invention provides a mobile communication network system that includes a mobile network, a mobile terminal, a server coupled to the mobile terminal via the mobile network, and a subscriber identity module (SIM) card coupled to the mobile terminal. The SIM card includes a first key and a second key. The first key is used to authenticate an intended user of the mobile terminal to the mobile network. Upon successful authentication of the intended user to the mobile network, the mobile terminal downloads a function offered from the server through the mobile network. The second key is then used by the mobile terminal to authenticate the intended user to the downloaded function so that the intended user can utilize the function.

Claims

1. A mobile terminal adapted for wireless communication with a mobile network, the mobile terminal comprising:

a Subscriber Identity Module (SIM) card removably coupled to the mobile terminal, the SIM card having a first key and a second key;

wherein the mobile terminal is adapted to download a function capsule including a first function from the mobile network, wherein the first key is used to authenticate an intended user of the mobile terminal to the mobile network and to download the function capsule from the mobile network to the mobile terminal; and

wherein the second key is used to authenticate the intended user to the function capsule on the mobile terminal.

2. The mobile terminal of claim 1, wherein the function capsule includes a copy of the second key to authenticate the intended user to the function capsule.

3. The mobile terminal of claim 1, wherein the downloaded function capsule from the mobile network is encrypted and wherein the SIM card includes a third key for decrypting the downloaded function capsule.

4. The mobile terminal of claim 1, wherein the first function provides a call waiting service to the mobile terminal.

5. The mobile terminal of claim 1, wherein the first function provides an e-mailing service to the mobile terminal.

6. The mobile terminal of claim 1, wherein the first function provides a financial data service to the mobile terminal.

7. The mobile terminal of claim 1, wherein the SIM card includes a third key and wherein the third key authenticates the intended user to utilize the first function of the function capsule after the second key has authenticated the intended user to the function capsule.

8. The mobile terminal of claim 7, wherein the SIM card includes a fourth key, wherein the function capsule comprises a second function, and wherein the fourth key authenticates the intended user to utilize the second function of the function capsule.

9. The mobile terminal of claim 8, wherein the fourth key authenticates the intended user to utilize the second function of the function capsule after the third key has authenticated the intended user to utilize the first function of the function capsule.

10. The mobile terminal of claim 9, wherein the first function provides an e-mailing service to the mobile terminal and wherein the second function provides a financial data e-mailing service to the mobile terminal.

11. The mobile terminal of claim 8, wherein the third key does not authenticate the intended user to utilize the second function of the function capsule.

12. The mobile terminal of claim 7, wherein the function capsule comprises an authentication module and wherein the authentication module includes a copy of the second key to authenticate the intended user to the function capsule and a copy of the third key to authenticate the intended user to utilize the first function of the function capsule.

13. The mobile terminal of claim 1, wherein at least one of the first and second keys comprises a private key and a public key and wherein only a copy of the public key is available outside the SIM card to authenticate the intended user.

14. The mobile terminal of claim 1, further comprising a stateless module coupled to the SIM card and for securely receiving and using keys.

15. The mobile terminal of claim 14, wherein the stateless module provides a secure usage environment for receiving and using keys that is remotely separated from and cryptographically secured to the SIM card.

16. A server system adapted to be coupled to a mobile terminal via a mobile network, the mobile terminal including a Subscriber Identity Module (SIM) card coupled to the mobile terminal, the SIM card having a first key and a second key, the server system comprising:

at least one server adapted to download a function capsule including a first function over the mobile network to the mobile terminal; and

wherein the first key is used to authenticate an intended user of the mobile terminal to the mobile network and to download the function capsule from the mobile network to the mobile terminal; and

wherein the second key is used to authenticate the intended user to the function capsule on the mobile terminal.

17. The server system of claim 16, wherein the server includes a third key to revoke the second key of the SIM card.

18. The server system of claim 17, wherein the second key of the SIM card is remotely revoked by the server via the mobile network.

19. The server system of claim 16, wherein the SIM card includes a third key to authenticate the intended user to access the server.

20. The communication system of claim 19, wherein the server includes a fourth key to revoke one or both of the second and third keys of the SIM card.

21. A communication system for providing secure mobile terminal functions, the system comprising:

a mobile terminal adapted to be coupled to a mobile network;

a function capsule including a first function; and

a Subscriber Identity Module (SIM) card coupled to the mobile terminal, the SIM card having a function capsule authentication key;

wherein the function capsule is downloaded from the mobile network to the mobile terminal;

wherein the function capsule authentication key is used to authenticate the intended user to the function capsule on the mobile terminal; and

wherein the SIM card includes an additional key and wherein the additional key authenticates the intended user to utilize the first function of the function capsule after the function capsule authentication key has authenticated the intended user to the function capsule.

22. The communication system of claim 21, wherein the function capsule includes a copy of the function capsule authentication key to authenticate the intended user to the function capsule.

23. The communication system of claim 21, wherein the downloaded function capsule from the mobile network is encrypted and wherein the SIM card includes a second additional key for decrypting the downloaded function capsule.

24. The communication system of claim 21, wherein the first function provides a call waiting service to the mobile terminal.

25. The communications system of claim 21, wherein the first function provides an e-mailing service to the mobile terminal.

26. The communication system of claim 21, wherein the first function provides a financial data service to the mobile terminal.

27. The communication system of claim 21, wherein the SIM card includes a second additional key, wherein the function capsule comprises a second function, and wherein the second additional key authenticates the intended user to utilize the second function of the function capsule.

28. The communication system of claim 27, wherein the second additional key authenticates the intended user to utilize the second function of the function capsule after the additional key has authenticated the intended user to utilize the first function of the function capsule.

29. The communication system of claim 27, wherein the additional key does not authenticate the intended user to utilize the second function of the function capsule.

30. The communication system of claim 21, wherein the function capsule comprises an authentication module and wherein the authentication module includes a copy of the function capsule authentication key to authenticate the intended user to the function capsule and a copy of the additional key to authenticate the intended user to utilize the first function of the function capsule.

31. The communication system of claim 21, further comprising a second network, an authentication server, and a key writing site coupled to the authentication server via the second network, wherein the key writing site is used to write the function capsule authentication key into the SIM card at a time when the intended user desires to utilize the first function of the function capsule and wherein the function capsule authentication key is provided from the authentication server to the key writing site.

32. The communication system of claim 31, wherein the authentication server includes a second additional key to revoke the function capsule authentication key written into the SIM card of the intended user.

33. The communication system of claim 32, wherein the function capsule authentication key is wirelessly revoked by the authentication server via the mobile network.

34. The communication system of claim 21, further comprising a server coupled to the mobile terminal via the mobile network, wherein the function capsule is downloaded over the mobile network from the server.

35. The communication system of claim 34, wherein the server includes a second additional key to revoke the function capsule authentication key of the SIM card.

36. The communication system of claim 35, wherein the function capsule authentication key of the SIM card is remotely revoked by the server via the mobile network.

37. The communication system of claim 21, further comprising a key writing site, wherein the key writing site is used to write the function capsule authentication key into the SIM card at a time when the intended user has purchased the first function of the function capsule.

38. The communication system of claim 21, further comprising a server coupled to the mobile terminal via the mobile network, wherein the function capsule is downloaded over the mobile network from the server and wherein the SIM card includes a second additional key to authenticate the intended user to access the server.

39. The communication system of 38, wherein the server includes a third additional key to revoke one or both of the function capsule authentication key and second additional key of the SIM card.