Systems for provisioning universal integrated circuit cards

• US 8,959,331 B2
• Filed: 11/19/2012
• Issued: 02/17/2015
• Est. Priority Date: 11/19/2012
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Chastain, Walter Cooper, Campbell, Clifton, Chin, Stephen, Harber, David, Rainer, Brian Keith, Smith, David K., Wang, Shih-Ming
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/680,680
• Publication Number:
  US 20140143534A1
• Time in Patent Office: 820 Days
• Field of Search: 713150-153, 713164-168, 713/172, 713/189, 713/193
• US Class Current: 713/150
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier

Abstract

A system that incorporates the subject disclosure may include, for example, a system for receiving a request to modify a universal integrated circuit card, generating a package comprising configuration data for modifying the universal integrated circuit card, encrypting the package with a transport key to generate an encrypted package, transmitting the encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card, and providing a mobile network operator trusted service manager system information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation of the universal integrated circuit card. Other embodiments are disclosed.

Claims

1. A system, comprising:

a memory device to store instructions; and

a controller device coupled to the memory device, wherein responsive to executing the instructions the controller device performs operations, comprising;

receiving a request to modify a universal integrated circuit card;

generating a package comprising configuration data for modifying the universal integrated circuit card;

encrypting the package with a transport key to generate an encrypted package;

transmitting the encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card; and

providing a mobile network operator trusted service manager system information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation of the universal integrated circuit card,

wherein the management of the content and the memory allocation of the universal integrated circuit card by the mobile network operator trusted service manager system comprises adding an additional security domain container to a plurality of security domain containers of the universal integrated circuit card and adjusting an amount of memory allocated to a security domain container of the plurality of security domain containers.

2. The system of claim 1, wherein the controller device comprises:

a secure element issuer system comprising a first processor that performs the receiving of the request and the generating of the package;

an over-the-air system comprising a second processor that performs the generating of the encrypted package and the transmitting of the encrypted package to the communication device; and

the mobile network operator trusted service manager system comprising a third processor that performs the managing of the content and the memory allocation of the universal integrated circuit card.

3. The system of claim 2, wherein the controller device further comprises:

a trusted execution environment management system comprising a fourth processor that performs operations comprising;

generating a second package comprising a trusted application;

encrypting the second package with a trusted execution environment key to generated a second encrypted package;

instructing the over-the-air system to transmit the second encrypted package; and

providing the mobile network operator trusted service manager system second information relating to the trusted application to enable the mobile network operator trusted service manager system to continue to manage the content and the memory allocation of the universal integrated circuit card;

wherein the trusted execution environment management system and the mobile network operator trusted service manager system operate as combined system.

4. The system of claim 1, wherein the configuration data comprises one of an authentication key, a network access parameter, a service operator application, or combinations thereof.

5. The system of claim 4, wherein the service operator application comprises a network-based application comprising one of a subscriber identity module application, a universal subscriber identity module application, or an internet protocol multimedia services identity module application.

6. The system of claim 4, wherein the service operator application configures the communication device to comply with network operational requirements of a communication system from which the communication device receives communication services.

7. The system of claim 1, wherein the communication device is a portable communication device, and wherein the universal integrated circuit card is an embedded universal integrated circuit card affixed to the communication device, and wherein the providing of the information to the mobile network operator trusted service manager system is over a network to enable remote management of the content and the memory allocation of the universal integrated circuit card.

8. The system of claim 1, wherein the mobile network operator trusted service manager system is managed by a first service provider, and wherein management of the content and the memory allocation of the universal integrated circuit card is transferred to another mobile network operator trusted service manager system of a second service provider, wherein the first service provider and the second service provider are independently managed entities.

9. The system of claim 1, wherein the encrypted package is transmitted to the communication device as a short messaging service message.