Methods and apparatus for delivering electronic identification components over a wireless network

• US 9,877,194 B2
• Filed: 04/14/2016
• Issued: 01/23/2018
• Est. Priority Date: 10/28/2010
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Schell, Stephan V., Mathias, Arun G., Hauck, Jerrold Von, Haggerty, David T., McLaughlin, Kevin, Juang, Ben-Heng, Li, Li
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US15/099,444
• Publication Number:
  US 20160227409A1
• Time in Patent Office: 649 Days
• Field of Search: 713169
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier

Abstract

Methods and apparatus enabling programming of electronic identification information of a wireless apparatus. In one embodiment, a previously purchased or deployed wireless apparatus is activated by a cellular network. The wireless apparatus connects to the cellular network using an access module to download operating system components and/or access control client components. The described methods and apparatus enable updates, additions and replacement of various components including Electronic Subscriber Identity Module (eSIM) data, OS components. One exemplary implementation of the invention utilizes a trusted key exchange between the device and the cellular network to maintain security.

Claims

1. A method for enabling a mobile device to access wireless services, the method comprising:

at the mobile device;

accessing first identification data associated with a secure element included in the mobile device, wherein the secure element stores a pre-loaded at least one partial electronic Subscriber Identity Module (eSIM) having at least one missing component, and the at least one partial eSIM is a virtualization of a physical SIM card;

authenticating with an eSIM server using the first identification data to allow the mobile device to access a package that includes the at least one missing component;

receiving the package from the eSIM server; and

combining the at least one missing component with the at least one partial eSIM to establish a complete eSIM to allow the mobile device to access wireless services provided by a Mobile Network Operator (MNO).

2. The method of claim 1, wherein the steps further include:

receiving second identification data from the eSIM server; and

verifying the second identification data prior to receiving the package.

3. The method of claim 2, wherein the first identification data and the second identification data are based on a cryptographic key protocol.

4. The method of claim 1, wherein the at least one partial eSIM includes components that are common across other eSIMs, and the at least one missing component includes credentials that are associated with a subscriber of the MNO.

5. The method of claim 1, wherein, subsequent to establishing the complete eSIM, the mobile device is permitted to access one or more wireless services using the complete eSIM.

6. The method of claim 5, wherein accessing the one or more wireless services comprises placing or receiving a phone call.

7. The method of claim 5, wherein accessing the one or more wireless services comprises carrying out a wireless data transmission.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a mobile device, cause the mobile device to access wireless services, by carrying out steps that include:

accessing first identification data associated with a secure element included in the mobile device, wherein the secure element stores a pre-loaded at least one partial electronic Subscriber Identity Module (eSIM) having at least one missing component, and the at least one partial eSIM is a virtualization of a physical SIM card;

authenticating with an eSIM server using the first identification data to allow the mobile device to access a package that includes the at least one missing component;

receiving the package from the eSIM server; and

combining the at least one missing component with the at least one partial eSIM to establish a complete eSIM to allow the mobile device to access wireless services provided by a Mobile Network Operator (MNO).

9. The non-transitory computer readable storage medium of claim 8, wherein the steps further include:

receiving second identification data from the eSIM server; and

verifying the second identification data prior to receiving the package.

10. The non-transitory computer readable storage medium of claim 9, wherein the first identification data and the second identification data are based on a cryptographic key protocol.

11. The non-transitory computer readable storage medium of claim 8, wherein authenticating with the eSIM server comprises establishing an authorized data session between the mobile device and the eSIM server and performing a mutual verification.

12. The non-transitory computer readable storage medium of claim 11, wherein the mutual verification comprises a cryptographic key protocol.

13. The non-transitory computer readable storage medium of claim 8, wherein the at least one partial eSIM includes components that are common across other eSIMs, and the at least one missing component includes credentials that are associated with a subscriber of the MNO.

14. A mobile device, comprising:

a secure element with a pre-loaded at least one partial electronic subscriber identity module (eSIM) having at least one missing component, wherein the at least one partial eSIM is a virtualization of a physical SIM card; and

a hardware processor configured to cause the mobile device to carry out steps that include;

accessing first identification data associated with the secure element;

authenticating with an eSIM server using the first identification data to allow the mobile device to access a package that includes the at least one missing component;

receiving the package from the eSIM server; and

combining the at least one missing component with the at least one partial eSIM to establish a complete eSIM to allow the mobile device to access wireless services provided by a Mobile Network Operator (MNO).

15. The mobile device of claim 14, wherein the steps further include:

receiving second identification data from the eSIM server; and

verifying the second identification data prior to receiving the package.

16. The mobile device of claim 15, wherein the first identification data and the second identification data are based on a cryptographic key protocol.

17. The mobile device of claim 14, wherein the at least one partial eSIM includes components that are common across other eSIMs, and the at least one missing component includes credentials that are associated with a subscriber of the MNO.

18. The mobile device of claim 14, wherein, subsequent to establishing the complete eSIM, the mobile device is permitted to access one or more wireless services using the complete eSIM.

19. The mobile device of claim 18, wherein accessing the one or more wireless services comprises placing or receiving a phone call.

20. The mobile device of claim 18, wherein accessing the one or more wireless services comprises carrying out a wireless data transmission.