System and methods for UICC-based secure communication

• US 10,091,655 B2
• Filed: 09/08/2016
• Issued: 10/02/2018
• Est. Priority Date: 09/11/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chastain, Walter Cooper, Chin, Stephen Emille
• Primary Examiner(s): SCOTT, RANDY A
• Application Number:
  US15/259,821
• Publication Number:
  US 20160381555A1
• Time in Patent Office: 754 Days
• Field of Search: 713153, 713155, 713156, 713172, 713190, 726 3, 726 10, 726 22, 726 25
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A system that incorporates the subject disclosure may include, for example, instructions which when executed cause a device processor to perform operations comprising sending a service request to a remote management server; receiving from the management server an authentication management function and an encryption key generator for execution by a secure element and an encryption engine for execution by a secure device processor, sending a request to establish a communication session with a remote device; and communicating with the remote device via a channel established using an application server. The secure element and the secure device processor authenticate each other using a mutual authentication keyset. The secure element, the secure device processor and the device processor each have a security level associated therewith; the security level associated with the secure device processor is intermediate between that of the secure element and that of the device processor. Other embodiments are disclosed.

Claims

1. A method comprising:

receiving, over a wireless network by a processing system including a processor, a first request from a first wireless communication device;

responsive to the first request, wirelessly providing, by the processing system via a remote server, provisioning information to the first wireless communication device to be stored in a universal integrated circuit card of the first wireless communication device, the provisioning information including authentication information that enables authentication of the first wireless communication device with the wireless network, wherein the wirelessly providing of the provisioning information utilizes a secure transmission key to provide a secure transmitting of the provisioning information;

responsive to the wirelessly providing of the provisioning information, authenticating the universal integrated circuit card of the first wireless communication device, by the processing system, according to an authentication key and utilizing the authentication information;

enabling, by the processing system, communication services for the first wireless communication device responsive to a successful authentication of the universal integrated circuit card of the first wireless communication device, wherein the secure transmission key and the authentication key are distinct keys;

receiving, by the processing system over the wireless network from the first wireless communication device, a second request to establish a communication session between the first wireless communication device and a second wireless communication device; and

communicating by the processing system with the second wireless communication device via an encrypted channel, wherein the enabling communication services and the communicating with the second wireless communication device enables establishing the communication session between the first wireless communication device and the second wireless communication device.

2. The method of claim 1, wherein the first wireless communication device is a machine-to-machine device, and wherein the authenticating of the universal integrated circuit card of the first wireless communication device includes a mutual authentication of the wireless network.

3. A method comprising:

receiving, by a system over a network from a first end user device, a first request for a secure signaling session, wherein the first request is initiated by a secure device processor of the first end user device, wherein the secure device processor of the first end user device executes an encryption engine, wherein a secure element of the first end user device executes an authentication management function and an encryption key generator, wherein the secure element and the secure device processor authenticate each other using a mutual authentication keyset, and wherein the secure element and the secure device processor are separate from each other;

providing, by the system over the network to the first end user device, a first authentication signal, wherein a secure application server associated with the system is authenticated by the authentication management function using a signaling authentication keyset;

communicating by the system with the first end user device via a first encrypted channel using a first signaling encryption keyset, wherein encryption and decryption of communications over the first encrypted channel is performed by the encryption engine and the first signaling encryption keyset is generated by the encryption key generator;

receiving, by the system over the network from the first end user device, a second request to establish a communication session with a second end user device; and

communicating by the system with the second end user device via a second encrypted channel using a second signaling encryption keyset, wherein the communicating by the system with the first and second end user devices enables establishing the communication session between the first and second end user devices, and wherein the mutual authentication keyset, the signaling authentication keyset, and the first and second signaling encryption keysets are distinct keysets.

4. The method of claim 3, wherein the first end user device receives a second authentication signal from the second end user device, wherein the second end user device is authenticated by the authentication management function using a bearer path authentication keyset, and wherein the bearer path authentication keyset is a distinct keyset from the mutual authentication keyset, the signaling authentication keyset, and the first and second signaling encryption keysets.

5. The method of claim 3, wherein the communication session between the first and second end user devices comprises an encrypted communication session with bi-directional encryption.

6. The method of claim 3, wherein the receiving of the first request and the providing of the authentication management function, the encryption key generator, and the encryption engine is from a management server of the system.

7. The method of claim 6, wherein the management server is authenticated by the authentication management function using a remote management keyset, to provide mutual authentication of the secure element and the management server and to provide mutual authentication of the secure device processor and the management server.

8. The method of claim 3, wherein the receiving of the second request, the providing of the first authentication signal, the communicating via the first encrypted channel, and the communicating via the second encrypted channel is by the secure application server.

9. The method of claim 3, wherein the secure element, the secure device processor and a device processor of the first end user device each have a security level associated therewith, and wherein the security level associated with the secure device processor is intermediate between that of the secure element and that of the device processor.

10. The method of claim 3, wherein a user of the first end user device is authenticated using a user interface keyset, and wherein user credentials are verified by the authentication management function.

11. The method of claim 3, wherein the secure element is a universal integrated circuit card, wherein the secure element and the secure device processor form a secure service platform separate from a device processor of the first end user device, wherein the mutual authentication keyset is provided to the secure service platform by a management server of the system, and wherein the management server transmits information to the secure service platform using a remote management keyset.

12. An end user device comprising:

a secure element;

a secure device processor separate from the secure element;

a memory that stores executable instructions; and

a device processor separate from the secure device processor and coupled to the memory, the secure element and the secure device processor, wherein the device processor, responsive to executing the executable instructions, performs operations, the operations comprising;

authenticating a user of the end user device using a user interface keyset, wherein user credentials are verified by an authentication management function executed by the secure element;

sending a first request for a secure signaling session to a secure application server remote from the end user device, wherein the first request is initiated by the secure device processor;

receiving from the secure application server a first authentication signal, wherein the secure application server is authenticated by the authentication management function using a signaling authentication keyset;

communicating with the secure application server via a first encrypted channel using a first signaling encryption keyset, wherein encryption and decryption of communications over the first encrypted channel is performed by an encryption engine executed by the secure device processor, wherein the first signaling encryption keyset is generated by an encryption key generator executed by the secure element, and wherein the secure element and the secure device processor authenticate each other using a mutual authentication keyset; and

sending a second request to the secure application server to establish an encrypted communication session with another device, wherein the encrypted communication session provides bi-directional encryption, wherein the mutual authentication keyset, the user interface keyset, the signaling authentication keyset, and the first signaling encryption keyset are distinct keysets.

13. The end user device of claim 12, wherein the operations further comprise:

receiving, from the another device, a second authentication signal, wherein the another device is authenticated by the authentication management function using a bearer path authentication keyset,

wherein the bearer path authentication keyset is a distinct keyset from the mutual authentication keyset, the user interface keyset, the signaling authentication keyset, and the first signaling encryption keyset.

14. The end user device of claim 12, wherein the operations further comprise:

sending a notification message indicating that the encrypted communication session with bi-directional encryption has been established.

15. The end user device of claim 12, wherein the secure element is a universal integrated circuit card, wherein the secure element and the secure device processor form a secure service platform separate from the device processor, wherein the mutual authentication keyset is provided to the secure service platform by a management server, and wherein the management server transmits information to the secure service platform using a remote management keyset.

16. The end user device of claim 15, wherein the secure element and the management server authenticate each other using the remote management keyset, and wherein the authentication management function performs authentication of the management server by the secure element.

17. The end user device of claim 15, wherein the secure device processor and the management server authenticate each other using the remote management keyset, and wherein the authentication management function performs authentication of the management server by the secure device processor.

18. The end user device of claim 12, wherein the authentication management function comprises a network authentication service for mutual authentication between the end user device and equipment of the network, and wherein the device processor comprises a plurality of processors operating in a distributed processing environment.

19. The end user device of claim 18, wherein the network is a cellular communications network, and wherein the another device and the secure application server are coupled to the network.

20. The end user device of claim 12, wherein the secure application server communicates with the another device via a second encrypted channel using a second signaling encryption keyset, wherein the second encrypted channel is separate from the first encrypted channel and wherein the second signaling encryption keyset is distinct from the first signaling encryption keyset.