Systems and methods for providing security to different functions

• US 8,464,052 B2
• Filed: 04/29/2011
• Issued: 06/11/2013
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Edward H., Buer, Mark, Karaoguz, Jeyhan
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Ho, Virginia T
• Application Number:
  US13/097,400
• Publication Number:
  US 20110271111A1
• Time in Patent Office: 774 Days
• Field of Search: None
• US Class Current: 713/167
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Methods and systems are provided that use smartcards, such as subscriber identity module (SIM) cards to provide secure functions for a mobile client. One embodiment of the invention provides a mobile communication network system that includes a mobile network, a mobile terminal, a server coupled to the mobile terminal via the mobile network, and a subscriber identity module (SIM) card coupled to the mobile terminal. The SIM card includes a first key and a second key. The first key is used to authenticate an intended user of the mobile terminal to the mobile network. Upon successful authentication of the intended user to the mobile network, the mobile terminal downloads a function offered from the server through the mobile network. The second key is then used by the mobile terminal to authenticate the intended user to the downloaded function so that the intended user can utilize the function.

Claims

1. A device comprising:

a Subscriber Identity Module (SIM) comprising;

a first key, a second key, and a third key; and

system logic adapted to;

use the first key to authenticate an intended user to a mobile network to download a function capsule including a first function from the mobile network;

use the second key to authenticate the intended user to the function capsule; and

use the third key to authenticate the intended user to utilize the first function of the function capsule.

2. The device of claim 1, wherein the SIM further comprises a fourth key;

and where the system logic is further adapted to use the fourth key to decrypt function capsule.

3. The device of claim 1, wherein the SIM further comprises a fourth key, wherein the function capsule further comprises a second function, and wherein the system logic is further adapted to:

use the fourth key to authenticate the intended user to utilize the second function of the function capsule.

4. The device of claim 3, wherein the system logic is adapted to use the fourth key to authenticate the intended user to utilize the second function of the function capsule after using the third key to authenticate the intended user to utilize the first function of the function capsule.

5. The device of claim 3, wherein the third key does not authenticate the intended user to utilize the second function of the function capsule.

6. The device of claim 1, wherein at least one of the first and second keys comprises a private key and a public key and wherein only a copy of the public key is available outside the SIM to authenticate the intended user.

7. A Subscriber Identity Module (SIM) card comprising:

a memory; and

a host communication interface connected to the memory, the memory comprising;

a function capsule authentication key accessible from the memory through the host communication interface, where the function capsule authentication key is configured to authenticate a user to a function capsule comprising a first function; and

a first function authentication key accessible from the memory through the host communication interface, where the first function authentication key is configured to authenticate the user as permitted to use the first function of the function capsule.

8. The SIM card of claim 7, wherein the function capsule authentication key of the SIM card is configured to be revoked by a different function capsule authentication key of a server.

9. The SIM card of claim 8, wherein the function capsule authentication key of the SIM card is configured to be remotely revoked by the server via a mobile network.

10. The SIM card of claim 7, wherein the memory further comprises a server access key accessible from the memory through the host communication interface, where the server access key is configured to authenticate the user to access the server.

11. The SIM card of claim 10, wherein any combination of the function capsule authentication key, first function authentication key, and server access key is configured to be revoked by an updated key of the server.

12. A device comprising:

a Subscriber Identity Module (SIM) card comprising;

a function capsule authentication key; and

an additional key; and

system logic in communication with the SIM card, the system logic adapted to;

use the function capsule authentication key to authenticate an intended user to a function capsule including a first function; and

use the additional key to authenticate the intended user to utilize the first function of the function capsule after authenticating the intended user to the function capsule.

13. The device of claim 12, wherein the SIM card further comprises a second additional key;

and

where the system logic is further adapted to use the second additional key for decrypting the function capsule.

14. The device of claim 12, wherein the SIM card further comprises a second additional key;

and

where the system logic is further adapted to use the second additional key to authenticate the intended user to utilize a second function of the function capsule.

15. The device of claim 14, wherein the system logic is adapted to use the second additional key to authenticate the intended user to utilize the second function of the function capsule after using the additional key to authenticate the intended user to utilize the first function of the function capsule.

16. The device of claim 14, wherein the additional key does not authenticate the intended user to utilize the second function of the function capsule.

17. The device of claim 12, wherein the function capsule authentication key is written into the SIM card via a key writing site at a time when the intended user desires to utilize the first function of the function capsule.

18. The device of claim 12, wherein the system logic is further adapted to:

receive the function capsule authentication key from a key writing site at a time when the intended user has purchased the first function of the function capsule.

19. The device of claim 12, wherein the SIM card further comprises a second additional key;

and

where the system logic is adapted to use the second additional key to authenticate the intended user to access a server to download the function capsule.