Service provider activation

• US 8,798,677 B2
• Filed: 04/17/2013
• Issued: 08/05/2014
• Est. Priority Date: 09/01/2007
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: De Atley, Dallas, Bush, Jeffrey, Huang, Ronald Keryuan, Hauck, Jerry, Sathianathan, Brainard
• Primary Examiner(s): Karikari, Kwasi
• Application Number:
  US13/864,990
• Publication Number:
  US 20130260833A1
• Time in Patent Office: 475 Days
• Field of Search: 455/558
• US Class Current: 455/558
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

Systems and methods for activating a mobile device for use with a service provider are described. In one exemplary method, a mobile device having a currently inserted SIM card may be prepared for activation using a signing process in which an activation server generates a signed activation ticket that uniquely corresponds to the combination of the device and SIM card, and that is securely stored on the mobile device. In another exemplary method the mobile device may be activated in an activation process in which the device verifies an activation ticket against information specific to the device and SIM card, and initiates activation when the verification of the activation ticket is successful.

Claims

1. A non-transitory machine readable storage medium storing program instructions which when executed by a device cause the device to perform a method, the method comprising:

issuing from a device having a currently inserted subscriber identification module (SIM) card, an activation request, the activation request comprising a first data that uniquely identifies the device and a second data that uniquely identifies the currently inserted SIM card;

storing in the device a signed activation record comprising the first data and the second data, the activation record having been generated and signed by an activation server responding to the activation request;

verifying the activation record against the currently inserted SIM card; and

initiating registration of the device with a communications network after successfully verifying the activation record.

2. The medium of claim 1, wherein the first data that uniquely identifies the device includes a serial number of the device.

3. The medium of claim 2, wherein the serial number of the device comprises an International Mobile Equipment Identifier (IMEI) encoded in the device.

4. The medium of claim 1, wherein the first data that uniquely identifies the device includes a hardware thumbprint of the device.

5. The medium of claim 4, wherein the hardware thumbprint of the device is derived from at least one of a serial number of a baseband component in the device, a serial number of a memory component of the device, a serial number of the device, in combination with a random number.

6. The medium of claim 1, wherein the second data that uniquely identifies the SIM card includes a serial number of the SIM card.

7. The medium of claim 6, wherein the serial number of the SIM card comprises an Integrated Circuit Card ID (ICCID) encoded on the SIM card.

8. The medium of claim 1, wherein the second data that uniquely identifies the SIM card includes a subscriber identifier associated with SIM card.

9. The medium of claim 8, wherein the subscriber identifier associated with the SIM card comprises an International Mobile Subscriber Identifier (IMSI) that designates the subscriber authorized to use the SIM card.

10. The medium of claim 1, wherein the activation record stored in the device further comprises an activation public key, the activation record having been signed by the activation server using an activation private key corresponding to the activation public key.

11. The medium of claim 1, wherein verifying the activation record stored in the device further comprises decrypting a content of the activation record using a device obfuscation key that is derived from a hardware thumbprint of the device and a shared obfuscation key.

12. The medium of claim 1, wherein verifying the activation record stored in the device further comprises validating an activation public key contained in the activation record.

13. The medium of claim 12, wherein verifying the activation record stored in the device further comprises validating a signature of the activation record stored in the device using the validated activation public key.

14. The medium of claim 1, wherein verifying the activation record stored in the device further comprises verifying that a maximum retry counter has not reached a maximum count.

15. The medium of claim 1, the method further comprising incrementing a maximum retry counter when the activation record is not successfully verified.

16. A non-transitory machine readable storage medium storing program instructions which when executed by a device cause the device to perform a method of operating a wireless communications apparatus comprising a subscriber identification security module, the method comprising:

issuing an activation request comprising a first data configured to uniquely identify the communications apparatus, and a second data configured to uniquely identify the security module;

storing, in the wireless communications apparatus, a signed activation record comprising at least a representation of the first data and the second data, the signed activation record having been generated by an entity of a communications network, based at least in part on the activation request; and

providing a first information configured to enable verification of the activation record against a second information associated with the security module, the first information comprising at least a portion of the signed activation record; and

wherein the wireless communications apparatus is configured to be registered with the communications network based at least in part on a successful verification of the signed activation record.

17. A method of providing service in a wireless communications network, the method comprising:

receiving an activation request comprising a first data and a second data, the activation request being received from a wireless communications apparatus which has the first data, the second data, and a subscriber identification security module associated therewith;

creating a signed activation record comprising at least a representation of the first data and the second data, the activation record being created by an entity of a communications network, and being created based at least in part on the activation request;

causing registration of the wireless communications apparatus with the network, based at least in part on a successful verification of the signed activation record;

wherein the first data is configured to uniquely identify the wireless communications apparatus, and the second data is configured to uniquely identify the security module.

18. The method of claim 17, wherein the registration of the wireless communications apparatus with the network is configured to enable a subscriber associated with the wireless communications apparatus to communicate over the wireless network with at least one other wireless communication apparatus associated with the network.

19. A non-transitory machine readable storage medium storing program instructions which when executed by a device cause the device to perform a method of providing service in a wireless communications network, the method comprising:

receiving an activation request comprising a first data and a second data, the activation request being received from a wireless communications apparatus which has the first data, the second data, and a subscriber identification security module associated therewith;

creating a signed activation record comprising at least a representation of the first data and the second data, the activation record being created by an entity of a communications network, and being created based at least in part on the activation request;

causing registration of the wireless communications apparatus with the network, based at least in part on a successful verification of the signed activation record;

wherein the first data is configured to uniquely identify the wireless communications apparatus, and the second data is configured to uniquely identify the security module.

20. The medium of claim 19, wherein the registration of the wireless communications apparatus with the network is configured to enable a subscriber associated with the wireless communications apparatus to communicate over the wireless network with at least one other wireless communication apparatus associated with the network.