Methods for provisioning universal integrated circuit cards

• US 10,834,576 B2
• Filed: 05/01/2020
• Issued: 11/10/2020
• Est. Priority Date: 11/16/2012
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chastain, Walter Cooper, Campbell, Clifton Ashman, Chin, Stephen Emille, Harber, David, Rainer, Brian Keith, Smith, David K., Wang, Shih-Ming
• Primary Examiner(s): Abyaneh, Ali S
• Assistant Examiner(s): Gao, Shu Chun
• Application Number:
  US16/864,395
• Publication Number:
  US 20200260261A1
• Time in Patent Office: 193 Days
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

A system is described that can perform a method for providing a first mobile network operator system with information relating to configuration data. The configuration data enables management of content and memory allocation for security domain containers of a universal integrated circuit card of a communication device. Security management of the universal integrated circuit card is delegated by providing the configuration data to a second mobile network operator system to enable management of the content and the memory allocation for the security domain containers. The memory allocation is adjusted by the second network mobile operator system according to a second group of services provided to the communication device.

Claims

1. A device, comprising:

a processing system including a processor; and

a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, comprising;

providing a first mobile network operator system with information relating to configuration data to enable management, by the first mobile network operator system, of content and memory allocation for a plurality of security domain containers of a universal integrated circuit card of a communication device; and

delegating security management of the universal integrated circuit card of the communication device by providing a second mobile network operator system with the information relating to the configuration data to enable management, by the second mobile network operator system, of the content and the memory allocation for the plurality of security domain containers of the universal integrated circuit card of the communication device, the memory allocation for the plurality of security domain containers being adjusted by the second network mobile operator system according to a second group of services provided to the communication device.

2. The device of claim 1, wherein the operations further comprise instructing an over-the-air system to transmit a first package that comprises configuration data for modifying the universal integrated circuit card.

3. The device of claim 2, wherein the instructing further causes the over-the-air system to encrypt the first package with a transport key to generate a first encrypted package.

4. The device of claim 3, wherein the instructing further causes the over-the-air system to transmit the first encrypted package to the communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card.

5. The device of claim 1, wherein the providing the information to the first mobile network operator system is based on monitoring for configuration changes at the universal integrated circuit card and occurs in response to and after a detection of a particular configuration change at the universal integrated circuit card.

6. The device of claim 5, wherein the particular configuration change is based on the configuration data of a first package, wherein the communication device and the first mobile network operator system are separate devices, wherein the first mobile network operator system is remotely located from the communication device.

7. The device of claim 5, wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers, wherein the plurality of security domain containers comprises an issuer security domain, a supplementary security domain, and a controlling authority security domain, wherein the issuer security domain stores first content that includes card issuer content, wherein the supplementary security domain stores second content that includes application provider content, and wherein the controlling authority security domain stores third content that includes security policy content.

8. A non-transitory, machine-readable storage medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, comprising:

providing a first mobile network operator system with information relating to configuration data to enable management, by the first mobile network operator system, of content and memory allocation for a plurality of security domain containers of a universal integrated circuit card of a communication device; and

delegating security management of the universal integrated circuit card of the communication device, wherein the information relating to the configuration data is provided to a second mobile network operator system to enable management, by the second mobile network operator, of the content and the memory allocation for the plurality of security domain containers of the universal integrated circuit card of the communication device, the memory allocation for the plurality of security domain containers being adjusted by the second mobile network operator according to a second group of services provided to the communication device.

9. The non-transitory, machine-readable storage medium of claim 8, wherein the operations further comprise instructing an over-the-air system to transmit a first package that comprises configuration data for modifying the universal integrated circuit card.

10. The non-transitory, machine-readable storage medium of claim 9, wherein the instructing causes the over-the-air system to encrypt the first package with a transport key to generate a first encrypted package.

11. The non-transitory, machine-readable storage medium of claim 10, wherein the instructing causes the over-the-air system to transmit the first encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card.

12. The non-transitory, machine-readable storage medium of claim 8, wherein the providing the information to the first mobile network operator system is responsive to detecting a particular configuration change based on the configuration data of a first package, wherein the communication device and the first mobile network operator system are separate devices, wherein the first mobile network operator system is remotely located from the communication device.

13. The non-transitory, machine-readable storage medium of claim 8, wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers, wherein the plurality of security domain containers comprises an issuer security domain, a supplementary security domain, and a controlling authority security domain, wherein the issuer security domain stores first content that includes card issuer content, wherein the supplementary security domain stores second content that includes application provider content, and wherein the controlling authority security domain stores third content that includes security policy content.

14. A method, comprising:

initiating, by a secure element issuer processing system including a processor, a transfer of information relating to configuration data to enable management, by a first mobile network operator system, of content and memory allocation for a plurality of security domain containers of a universal integrated circuit card of a communication device; and

delegating, by the secure element issuer processing system, security management of the universal integrated circuit card of the communication device by providing a second mobile network operator system with the information relating to the configuration data to enable management, by the second mobile network operator system, of the content and the memory allocation for the plurality of security domain containers of the universal integrated circuit card of the communication device, the memory allocation for the plurality of security domain containers being adjusted by the second network mobile operator system according to a second group of services provided to the communication device.

15. The method of claim 14, further comprising instructing, by the secure element issuer processing system, an over-the-air system to transmit a first package that comprises the configuration data for modifying the universal integrated circuit card, wherein the first package is encrypted according to a transport key to generate a first encrypted package.

16. The method of claim 15, wherein the instructing causes the over-the-air system to transmit the first encrypted package to the communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card.

17. The method of claim 14, wherein the providing the information to the first mobile network operator system is based on monitoring for configuration changes at the universal integrated circuit card and occurs in response to and after a detection of a particular configuration change at the universal integrated circuit card.

18. The method of claim 17, wherein the particular configuration change is based on configuration data of a first package conveyed via an over-the-air system, wherein the communication device and the first mobile network operator system are separate devices, wherein the first mobile network operator system is remotely located from the communication device.

19. The method of claim 17, wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers, wherein the plurality of security domain containers comprises an issuer security domain, a supplementary security domain, and a controlling authority security domain.

20. The method of claim 19, wherein the issuer security domain stores first content that includes card issuer content, wherein the supplementary security domain stores second content that includes application provider content, and wherein the controlling authority security domain stores third content that includes security policy content.