Service provider activation

• US 8,428,570 B2
• Filed: 04/15/2011
• Issued: 04/23/2013
• Est. Priority Date: 09/01/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: De Atley, Dallas, Bush, Jeffrey, Hauck, Jerry, Huang, Ronald Keryuan, Sathianathan, Brainerd
• Primary Examiner(s): Karikari, Kwasi
• Application Number:
  US13/088,184
• Publication Number:
  US 20110195751A1
• Time in Patent Office: 739 Days
• Field of Search: 455/418, 455/410, 455/411, 455/412, 380/245, 380/250, 380/248, 380/270, 380/249, 713/161, 713/156, 713/171, 713/183, 379/161
• US Class Current: 455/418
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

Systems and methods for activating a mobile device for use with a service provider are described. In one exemplary method, a mobile device having a currently inserted SIM card may be prepared for activation using a signing process in which an activation server generates a signed activation ticket that uniquely corresponds to the combination of the device and SIM card, and that is securely stored on the mobile device. In another exemplary method the mobile device may be activated in an activation process in which the device verifies an activation ticket against information specific to the device and SIM card, and initiates activation when the verification of the activation ticket is successful.

Claims

1. A machine implemented method of activating a mobile device, the method comprising:

issuing, from a device having a currently inserted subscriber identification module (SIM) card, an activation request, the activation request comprising a first data that uniquely identifies the device and a second data that uniquely identifies the currently inserted SIM card;

storing in the mobile device a signed activation record comprising the first data and the second data, the activation record having been generated and signed by an activation server responding to the activation request;

verifying the activation record against the currently inserted SIM card; and

registering the device with a communications network after successfully verifying the activation record.

2. The method of claim 1, wherein the first data that uniquely identifies the device includes a serial number of the device.

3. The method of claim 2, wherein the serial number of the device comprises an International Mobile Equipment Identifier (IMEI) encoded in the device.

4. The method of claim 1, wherein the first data that uniquely identifies the device includes a hardware thumbprint of the device.

5. The method of claim 4, wherein the hardware thumbprint of the device is derived from at least one of a serial number of a baseband component in the device, a serial number of a memory component of the device, a serial number of the device, in combination with a random number.

6. The method of claim 1, wherein the second data that uniquely identifies the SIM card includes a serial number of the SIM card.

7. The method of claim 6, wherein the serial number of the SIM card comprises an Integrated Circuit Card ID (ICCID) encoded on the SIM card.

8. The method of claim 1, wherein the second data that uniquely identifies the SIM card includes a subscriber identifier associated with SIM card.

9. The method of claim 8, wherein the subscriber identifier associated with the SIM card comprises an International Mobile Subscriber Identifier (IMSI) that designates the subscriber authorized to use the SIM card.

10. The method of claim 1, wherein the activation record stored in the device further comprises an activation public key, the activation record having been signed by the activation server using an activation private key corresponding to the activation public key.

11. The method of claim 1, wherein verifying the activation record stored in the device further comprises decrypting a content of the activation record using a device obfuscation key that is derived from a hardware thumbprint of the device and a shared obfuscation key.

12. The method of claim 1, wherein verifying the activation record stored in the device further comprises validating an activation public key contained in the activation record.

13. The method of claim 12, wherein verifying the activation record stored in the device further comprises validating a signature of the activation record stored in the device using the validated activation public key.

14. The method of claim 1, wherein verifying the activation record stored in the device further comprises verifying that a maximum retry counter has not reached a maximum count.

15. The method of claim 1, further comprising incrementing a maximum retry counter when the activation record is not successfully verified.

16. A machine implemented method of registering a user device in a wireless communications network, the user device comprising a security module, the method comprising:

issuing, from the user device, an activation request comprising a first data configured to uniquely identify the user device, and a second data configured to uniquely identify the security module;

storing in the user device a signed activation record comprising at least the second data and the first data, the signed activation record having been generated and signed by a network entity based at least in part on the activation request;

verifying the activation record against the security module; and

upon a successful verification of the activation record against the security module, providing verification data to the network, the verification data configured to cause registration of the user device with the network.

17. The method of claim 16, wherein the network entity comprises an activation server in communication with the network.

18. The method of claim 17, wherein the activation record further comprises a public activation key, the activation record having been signed by the network entity using a private activation key corresponding to the public activation key.

19. The method of claim 16, wherein the first data comprises a serial number of the user device.

20. The method of claim 19, wherein the serial number of the user device comprises an International Mobile Equipment Identifier (IMEI) associated with the user device.

21. The method of claim 16, wherein the first data comprises a hardware thumbprint of the user device.

22. The method of claim 21, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the user device, (ii) a serial number of a memory component of the user device, (iii) a serial number of the user device, and/or (iv) a random number.

23. The method of claim 16, wherein the second data comprises a serial number of the security module.

24. The method of claim 16, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

25. The method of claim 16, wherein verifying the activation record further comprises decrypting a content of the activation record based at least in part on:

(i) a private obfuscation key obtained using a hardware thumbprint of the user device, and

(ii) a shared obfuscation key.

26. The method of claim 16, wherein:

the activation record comprises a public activation key; and

verifying the activation record further comprises validating the public activation key.

27. The method of claim 26, wherein verifying the activation record further comprises validating a signature of the activation record based at least in part on the validated public activation key.

28. The method of claim 16, wherein verifying the activation record further comprises verifying that an activation retry counter has not reached a maximum count associated with the network.

29. The method of claim 28, further comprising incrementing the activation retry counter when the activation record is not successfully verified.

30. The method of claim 16, wherein the registration of the user device with the network comprises registration with the network entity.

31. The method of claim 16, wherein the security module comprises a card-like form factor that is insertable and removable from the user device.

32. A method of operating a wireless communications apparatus comprising a subscriber identification security module, the method comprising:

issuing an activation request comprising a first data configured to uniquely identify the communications apparatus, and a second data configured to uniquely identify the security module;

storing, in the communications apparatus, a signed activation record comprising at least the first data and the second data, the signed activation record having been generated by an entity of a communications network, based at least in part on the activation request; and

providing a first information configured to enable verification of the activation record against a second information associated with the security module, the first information comprising at least a portion of the signed activation record; and

wherein the wireless communications apparatus is configured to be registered with the communications network based at least in part on a successful verification of the signed activation record.

56. The method of claim 32, wherein the entity of the communications network comprises an activation server in communication with the communications network.

57. The method of claim 32, wherein the activation record further comprises a public activation key, the activation record having been signed by the entity of the communications network using a private activation key corresponding to the public activation key.

58. The method of claim 32, wherein the first data comprises a serial number of the wireless communications apparatus.

59. The method of claim 58, wherein the serial number of the wireless communications apparatus comprises an International Mobile Equipment Identifier (IMEI) associated with the wireless communications apparatus.

60. The method of claim 32, wherein the first data comprises a hardware thumbprint of the wireless communications apparatus.

61. The method of claim 60, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the wireless communications apparatus, (ii) a serial number of a memory component of the wireless communications apparatus, (iii) a serial number of the wireless communications apparatus, and/or (iv) a random number.

62. The method of claim 32, wherein the second data comprises a serial number of the security module.

63. The method of claim 32, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

64. The method of claim 32, wherein verification of the activation record further comprises verifying that an activation retry counter has not reached a maximum count associated with the communications network.

65. The method of claim 64, further comprising incrementing the activation retry counter when the activation record is not successfully verified.

66. The method of claim 32, wherein the registration of the wireless communications apparatus with the communications network comprises registration with the entity of the communications network.

67. The method of claim 32, wherein the security module comprises a card-like form factor that is insertable and removable from the wireless communications apparatus.

33. A machine implemented method of registering a user device in a wireless communications network, the user device comprising a subscriber identification means, the method comprising:

a step for issuing from the user device an activation request comprising a first data for uniquely identifying the device, and a second data for uniquely identifying the subscriber identification means;

a step for obtaining a signed activation record comprising at least the first and second data, the signed activation record having been generated by a network entity based at least in part on the activation request;

a step for verifying the activation record against the subscriber identification means; and

a step for, upon a successful verification of the activation record against the subscriber identification means, providing a verification data to the network, the verification data configured to cause registration of the user device with the network.

68. The machine implemented method of claim 33, wherein the network entity comprises an activation server in communication with the network.

69. The machine implemented method of claim 33, wherein the activation record further comprises a public activation key, the activation record having been signed by the network entity using a private activation key corresponding to the public activation key.

70. The machine implemented method of claim 33, wherein the first data comprises a serial number of the user device.

71. The machine implemented method of claim 70, wherein the serial number of the user device comprises an International Mobile Equipment Identifier (IMEI) associated with the user device.

72. The machine implemented method of claim 33, wherein the first data comprises a hardware thumbprint of the user device.

73. The machine implemented method of claim 72, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the user device, (ii) a serial number of a memory component of the user device, (iii) a serial number of the user device, and/or (iv) a random number.

74. The machine implemented method of claim 33, wherein the second data comprises a serial number of the subscriber identification means.

75. The machine implemented method of claim 33, wherein the second data comprises an identifier associated with subscriber identification means, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the subscriber identification means.

34. A user mobile device capable of operating in a wireless communications network, the mobile device configured according to a process, comprising:

providing a security module within the mobile device;

causing issuance of an activation request comprising a first data configured to uniquely identify the mobile device, and a second data configured to uniquely identify the security module;

causing receipt of a signed activation record comprising at least the first data and the second data, the activation record having been generated by an entity of the wireless communications network based at least in part on the activation request;

causing provision of a first information configured to enable verification of the activation record against a second information associated with the security module, the first information associated with the security module comprising at least a portion of the activation record; and

causing registration of the mobile device with the network based at least in part on a successful verification of the activation record.

76. The user mobile device of claim 34, wherein the entity of the communications network comprises an activation server.

77. The user mobile device of claim 76, wherein the activation record further comprises a public activation key, the activation record having been signed by the entity of the communications network using a private activation key corresponding to the public activation key.

78. The user mobile device of claim 34, wherein the first data comprises a serial number of the user mobile device.

79. The user mobile device of claim 78, wherein the serial number of the user mobile device comprises an International Mobile Equipment Identifier (IMEI) associated with the user mobile device.

80. The user mobile device of claim 34, wherein the first data comprises a hardware thumbprint of the user mobile device.

81. The user mobile device of claim 80, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the user mobile device, (ii) a serial number of a memory component of the user mobile device, (iii) a serial number of the user mobile device, and/or (iv) a random number.

82. The user mobile device of claim 34, wherein the second data comprises a serial number of the security module.

83. The user mobile device of claim 34, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

84. The user mobile device of claim 34, wherein verification of the activation record further comprises decryption of a content of the activation record based at least in part on:

(i) a private obfuscation key obtained using a hardware thumbprint of the mobile device, and

(ii) a shared obfuscation key.

85. The user mobile device of claim 34, wherein:

the activation record comprises a public activation key; and

verification of the activation record further comprises validation of the public activation key.

86. The user mobile device of claim 85, wherein verification of the activation record further comprises validation of a signature of the activation record based at least in part on the validated public activation key.

35. A device adapted for operation in a wireless communications network, the device having a first data and a second data, and a subscriber identification security module associated therewith, the device operable according to the method comprising:

causing issuance of an activation request comprising the first data and the second data;

causing provision of a first information configured to enable verification of a signed activation record against a second information associated with the security module, the first information associated with the security module comprising at least a portion of the activation record; and

causing registration of the device with the network based at least in part on a successful verification of the activation record;

wherein;

the activation record having been generated by an entity of the wireless communications network based at least in part on the activation request; and

the first data enables unique identification of the device, and the second data enables unique identification of the security module.

36. The wireless user communications device of claim 35, wherein the signed activation record comprises at least the first data and the second data.

87. The device of claim 35, wherein the entity of the wireless communications network comprises an activation server.

88. The device of claim 36, wherein the activation record further comprises a public activation key, the activation record having been signed by the network entity using a private activation key corresponding to the public activation key.

89. The device of claim 35, wherein the first data comprises a serial number of the device.

90. The device of claim 89, wherein the serial number of the device comprises an International Mobile Equipment Identifier (IMEI) associated with the device.

91. The device of claim 36, wherein the first data comprises a hardware thumbprint of the device.

92. The device of claim 91, wherein the hardware thumbprint is derived from at least one of (i) a serial number of a baseband component in the device, (ii) a serial number of a memory component of the device, (iii) a serial number of the device, and/or (iv) a random number.

93. The device of claim 36, wherein the second data comprises a serial number of the security module.

94. The device of claim 36, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

37. A method of registering a wireless communications apparatus with a wireless network, the wireless communications apparatus having a first data, a second data, and a subscriber identification security module associated therewith, the method comprising:

providing for issuance of an activation request comprising the first data and the second data;

causing provision of a first information configured to enable verification of a signed activation record against a second information associated with the security module, the first information configured to enable verification of the activation record comprising at least a portion of the activation record; and

providing for registration of the wireless communications apparatus with the network based at least in part on a successful verification of the activation record;

wherein;

the signed activation record having been generated by an entity of the wireless network based at least in part on the activation request;

the first data is configured to uniquely identify the wireless communications apparatus, and the second data is configured to uniquely identify the security module.

38. The method of claim 37, wherein the signed activation record comprises at least the first data and the second data.

39. The method of claim 38, wherein the issuance of the activation request is based at least in part on an input from a user associated with the wireless communications apparatus.

40. The method of claim 39, wherein the registration of the wireless communications apparatus with the network enables the user to communicate over the wireless network.

95. The method of claim 37, wherein the entity of the wireless network comprises an activation server.

96. The method of claim 95, wherein the activation record further comprises a public activation key, the activation record having been signed by the entity of the wireless network using a private activation key corresponding to the public activation key.

97. The method of claim 38, wherein the first data comprises a serial number of the wireless communications apparatus.

98. The method of claim 97, wherein the serial number of the wireless communications apparatus comprises an International Mobile Equipment Identifier (IMEI) associated with the wireless communications apparatus.

99. The method of claim 38, wherein the first data comprises a hardware thumbprint of the wireless communications apparatus.

100. The method of claim 99, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the wireless communications apparatus, (ii) a serial number of a memory component of the wireless communications apparatus, (iii) a serial number of the user wireless communications apparatus, and/or (iv) a random number.

101. The method of claim 38, wherein the second data comprises a serial number of the security module.

102. The method of claim 38, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

103. The method of claim 37, wherein verification of the activation record further comprises decryption of a content of the activation record based at least in part on:

(i) a private obfuscation key obtained using a hardware thumbprint of the wireless communications apparatus, and

(ii) a shared obfuscation key.

104. The method of claim 38, wherein:

the activation record comprises a public activation key; and

verification of the activation record further comprises validation of the public activation key.

105. The method of claim 104, wherein verification of the activation record further comprises validation of a signature of the activation record based at least in part on the validated public activation key.

106. The method of claim 37, wherein verification the activation record further comprises verification that an activation retry counter has not reached a maximum count associated with the wireless communications network.

107. The method of claim 106, further comprising adding an increment of the activation retry counter when the activation record is not successfully verified.

108. The method of claim 37, wherein the registration of the wireless communications apparatus with the wireless network comprises registration with the entity of the wireless network.

109. The method of claim 37, wherein the security module comprises a card-like form factor that is insertable and removable from the wireless communications apparatus.

41. A method of providing service in a wireless communications network, the method comprising:

providing a wireless communications apparatus to a user, the wireless communications apparatus having a first data, a second data, and a subscriber identification security module associated therewith;

causing issuance of an activation request comprising the first data and the second data;

causing receipt of a signed activation record comprising at least the first data and the second data, the activation record having been generated by an entity of a communications network, the generation based at least in part on the activation request;

causing provision of a first information configured to enable verification of the activation record against a second information associated with the security module, the first information comprising at least a portion of the activation record; and

causing registration of the wireless communications apparatus with the network, based at least in part on a successful verification of the activation record;

wherein the first data is configured to uniquely identify the wireless communications apparatus, and the second data is configured to uniquely identify the security module.

42. The method of claim 41, wherein the registration of the wireless communications apparatus with the network is configured to enable a subscriber associated with the wireless communications apparatus to communicate over the wireless network with at least one other wireless communication apparatus associated with the network.

110. The method of claim 41, wherein the activation record further comprises a public activation key, the activation record having been signed by the entity of the wireless network using a private activation key corresponding to the public activation key.

111. The method of claim 41, wherein the first data comprises a serial number of the wireless communications apparatus.

112. The method of claim 111, wherein the serial number of the wireless communications apparatus comprises an International Mobile Equipment Identifier (IMEI) associated with the wireless communications apparatus.

113. The method of claim 41, wherein the second data comprises a serial number of the security module.

114. The method of claim 41, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

43. A subscriber identification security module adapted to enable registration of a wireless communications apparatus with a wireless network, the apparatus having a first data and a second data associated therewith, the module configured to be made operable according to the method comprising:

enabling issuance of an activation request comprising the first data and the second data configured;

enabling provision of a first information configured to enable verification of the signed activation record against a second information associated with the security module, the first information configured to enable verification of the activation record comprising at least a portion of the activation record; and

wherein;

the signed activation record having been generated by an entity of the wireless network based at least in part on the activation request;

the first data is configured to uniquely identify the wireless communication apparatus, and the second data is configured to uniquely identify the security module; and

successful verification of the activation record is configured to enable registration of the wireless communication apparatus with the wireless network.

44. The subscriber identification security module of claim 43, wherein the signed activation record comprises at least the first data and the second data.

115. The subscriber identification security module of claim 43, wherein the entity of the wireless network comprises an activation server.

116. The subscriber identification security module of claim 115, wherein the activation record further comprises a public activation key, the activation record having been signed by the network entity using a private activation key corresponding to the public activation key.

117. The subscriber identification security module of claim 116, wherein the first data comprises a serial number of the wireless communications apparatus.

118. The subscriber identification security module of claim 117, wherein the serial number of the wireless communications apparatus comprises an International Mobile Equipment Identifier (IMEI) associated with the wireless communications apparatus.

119. The subscriber identification security module of claim 43, wherein the first data comprises a hardware thumbprint of the wireless communications apparatus.

120. The subscriber identification security module of claim 119, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the wireless communications apparatus, (ii) a serial number of a memory component of the wireless communications apparatus, (iii) a serial number of the wireless communications apparatus, and/or (iv) a random number.

121. The subscriber identification security module of claim 43, wherein the second data comprises a serial number of the security module.

122. The subscriber identification security module of claim 43, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.

45. A subscriber identification security module adapted to enable registration of a wireless communications apparatus with a wireless network, the apparatus having a first data and a second data associated therewith, the security module configured to be made operable according to the method comprising:

enabling issuance of an activation request comprising the first data and the second data configured;

enabling provision of a first information configured to enable verification of a signed activation record against a second information associated with the security module, the first information configured to enable verification of the activation record comprising at least a portion of the activation record; and

enabling registration of the wireless communication apparatus with the network based at least in part on a successful verification of the activation record;

wherein;

the activation record having been generated by an entity of the wireless network based at least in part on the activation request; and

the first data is configured to uniquely identify the wireless communication apparatus, and the second data is configured to uniquely identify the security module.

46. The subscriber identification security module of claim 45, wherein the signed activation record comprises at least the first data and the second data.

47. The subscriber identification security module of claim 45, wherein the issuance of the activation request is based at least in part on an input from a user associated with the wireless communication apparatus.

48. The subscriber identification security module of claim 45, wherein the entity of the wireless network comprises an activation server in communication with the wireless network.

49. The subscriber identification security module of claim 45, wherein the activation record further comprises a public activation key, the activation record having been signed by the entity of the wireless network using a private activation key corresponding to the public activation key.

50. The subscriber identification security module of claim 45, wherein the first data comprises a serial number of the wireless communications apparatus.

51. The subscriber identification security module of claim 50, wherein the serial number of the wireless communications apparatus comprises an International Mobile Equipment Identifier (IMEI) associated with the wireless communications apparatus.

52. The subscriber identification security module of claim 45, wherein the first data comprises a hardware thumbprint of the wireless communications apparatus.

53. The subscriber identification security module of claim 52, wherein the hardware thumbprint is derived from at least one of:

(i) a serial number of a baseband component in the wireless communications apparatus, (ii) a serial number of a memory component of the wireless communications apparatus, (iii) a serial number of the wireless communications apparatus, and/or (iv) a random number.

54. The subscriber identification security module of claim 45, wherein the second data comprises a serial number of the security module.

55. The subscriber identification security module of claim 45, wherein the second data comprises an identifier associated with security module, the identifier comprising an International Mobile Subscriber Identifier (IMSI) associated with a subscriber authorized to use the security module.