Systems and methods for providing security to different functions

• US 9,215,593 B2
• Filed: 05/14/2013
• Issued: 12/15/2015
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Frank, Edward H., Buer, Mark, Karaoguz, Jeyhan
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US13/894,024
• Publication Number:
  US 20130254543A1
• Time in Patent Office: 945 Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Methods and systems are provided that use smartcards, such as subscriber identity module (SIM) cards to provide secure functions for a mobile client. One embodiment of the invention provides a mobile communication network system that includes a mobile network, a mobile terminal, a server coupled to the mobile terminal via the mobile network, and a subscriber identity module (SIM) card coupled to the mobile terminal. The SIM card includes a first key and a second key. The first key is used to authenticate an intended user of the mobile terminal to the mobile network. Upon successful authentication of the intended user to the mobile network, the mobile terminal downloads a function offered from the server through the mobile network. The second key is then used by the mobile terminal to authenticate the intended user to the downloaded function so that the intended user can utilize the function.

Claims

1. A device comprising:

a memory storing;

a first key, a second key and a third key; and

an authentication module coupled to the memory, the authentication module including program code programmed to;

authenticate the device to a mobile network using a copy of the first key to permit downloading, from the mobile network, a function capsule including a first function and a second function;

authenticate the device, using a copy of the second key, to execute the first function of the function capsule; and

authenticate the device, using a copy of the third key, to execute the second function of the function capsule after authenticating the device, using the second key, to execute the first function of the function capsule.

2. The device of claim 1, where the memory further stores a third key;

and

where the authentication module further includes program code programmed to decrypt the function capsule using a copy of the third key.

3. The device of claim 1, where:

the function capsule further comprises a second function; and

the authentication module further includes program code programmed to;

authenticate the device, using a copy of the third key stored in the memory, to use the second function of the function capsule.

4. The device of claim 3, where the second key is incapable of authenticating the device to use the second function of the function capsule.

5. The device of claim 1, where the first key comprises a private key and a public key and where a copy of the public key, but not the private key, is available outside the device to authenticate the device.

6. A smart card comprising:

a memory; and

a communication interface coupled to the memory, the memory comprising;

a server access key accessible from the memory through the communication interface, where the server access key is configured to authenticate access to a server to download a function capsule comprising a first function and a second function, the server access key matching a copy of the server access key stored with the server to enable authentication of the access to the server;

a first function authentication key accessible from the memory through the communication interface, where the first function authentication key matches a copy of the first function authentication key stored remotely from the memory and is configured to authenticate use of the first function of the function capsule; and

a second function authentication key accessible from the memory through the communication interface, where the second function authentication key matches a copy of the second function authentication key stored remotely from the memory and is configured to authenticate use of the second function of the function capsule.

7. The smart card of claim 6 where the first function authentication key of the smart card is configured to be revoked by a different first function capsule authentication key of the server.

8. The smart card of claim 7, where the first function authentication key of the smart card is configured to be remotely revoked by the server via a mobile network.

9. The smart card of claim 6, where any combination of the first function authentication key and the server access key is configured to be revoked by an updated key of the server.

10. The smart card of claim 6, further comprising a function capsule authentication key accessible from the memory through the communication interface, where the function capsule authentication key is configured to authenticate use of the function capsule itself.

11. A method comprising:

through a mobile device comprising a memory;

accessing a server access key from the memory of the mobile device, the server access key matching a key stored with a server remotely from the mobile device;

authenticating the mobile device to access the server using the server access key accessed from the memory and challenge-response communications with the server;

downloading, from the server, a function capsule comprising a first function and a second function;

accessing an additional key from the memory of the mobile device, the additional key matching a copy of the additional key which is stored remotely from the mobile device;

authenticating the mobile device, using the additional key in conjunction with further challenge-response communications, to use the first function of the function capsule;

accessing a second additional key from the memory of the mobile device, the second additional key matching a copy of the second additional key which is stored remotely from the mobile device; and

authenticating the mobile device, using the second additional key in conjunction with further challenge-response communications, to use the second function of the function capsule.

12. The method of claim 11, further comprising:

accessing another additional key from the memory of the mobile device; and

decrypting the function capsule using the other additional key.

13. The method of claim 11, further comprising authenticating the mobile device, using the second additional key, to use the second function of the function capsule after authenticating the mobile device, using the additional key, to use the first function of the function capsule.

14. The method of claim 11, where the additional key is incapable of authenticating the mobile device to use the second function of the function capsule.

15. The method of claim 11, further comprising:

receiving the additional key into the memory of the mobile device via a key writing site.

16. The method of claim 11, further comprising:

receiving the additional key into the memory of the mobile device from a key writing site at a time when downloading the first function of the function capsule from the server.

17. The method of claim 11, further comprising:

accessing a function capsule authentication key from the memory of the mobile device; and

authenticating the mobile device to the function capsule comprising the first function using the function capsule authentication key.

18. The method of claim 11, further comprising:

revoking the server access key from the memory of the mobile device.