Secure remote subscription module access

• US 20040176071A1
• Filed: 05/03/2004
• Published: 09/09/2004
• Est. Priority Date: 05/08/2001
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Smeets, Bernard, Gehrmann, Christian
• Granted Patent: US 8,295,808 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 8/20 Transfer of user or subscriber data
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Disclosed is a method of granting a client communications terminal access to a subscription module of a server communications terminal, the method comprising the steps of establishing a communications link between the client communications terminal and the server communications terminal; communicating data related to the subscription module between the server communications terminal and the client communications terminal via the communications link; authenticating the client communications terminal by the subscription module using a key-based authentication procedure; and initiating the step of communicating data related to the subscription module conditioned on a result of the step of authenticating the client communications device. The present invention further relates to an arrangement for granting access to a subscription module in a communications system. The present invention also relates to a server communications terminal comprising a subscription module, a client communications terminal and a subscription module.

Claims

1. A method of granting a client communications terminal (106) access to a subscription module (102;

302) of a server communications terminal (101), the method comprising the steps of

establishing (501;

601) a communications link (115) between the client communications terminal and the server communications terminal; and

communicating (506) data related to the subscription module between the server communications terminal and the client communications terminal via the communications link;

characterised in that the method further comprises the steps of

authenticating (504;

604) the client communications terminal by the subscription module using a key-based authentication procedure; and

initiating the step of communicating data related to the subscription module conditioned on a result of the step of authenticating the client communications device.

2. A method according to claim 1, characterised in that the method further comprises the step of authenticating the subscription module by the client communications terminal using the key-based authentication procedure.

3. A method according to claim 1 or 2, characterised in that the key-based authentication procedure is a symmetric authentication procedure based on a first secret key stored in both the client communications terminal and the subscription module.

4. A method according to claim 3, characterised in that the step of communicating data related to the subscription module further comprises the step of encrypting the data using an encryption key derived from the first secret key.

5. A method according to claim 4, characterised in that the method further comprises the step of deriving (505) an encryption key from the first secret key.

6. A method according to any one of the claims 3 through 5, characterised in that the step of communicating data related to the subscription module further comprises the step of integrity protecting the data using a key derived from the first secret key.

7. A method according to claim 1 or 2, characterised in that the key-based authentication procedure is a public key-based authentication procedure wherein the subscription module has access to a public key related to the client communications terminal.

8. A method according to claim 7, characterised in that the method further comprises the step of authenticating the subscription module by the client communications terminal using the public key-based authentication procedure wherein the client communications terminal has access to a public key related to the subscription module.

9. A method according to claim 7 or 8, characterised in that the step of authenticating the client communications terminal further comprises the step of exchanging (605) between the client communications terminal and the subscription module a second secret key for use during cryptographic protection of the data related to the subscription module communicated between the server communications terminal and the client communications terminal via the communications link.

10. A method according to claim 9, characterised in that the step of communicating data related to the subscription module further comprises the step of encrypting the data using an encryption key derived from the second secret key.

11. A method according to claim 9 or 10, characterised in that the step of communicating data related to the subscription module further comprises the step of integrity protecting the data using a key derived from the second secret key.

12. A method according to any one of the claims 1 through 11, characterised in that the step of authenticating the client communications terminal further comprises the step of inquiring an input from a user of the server communications terminal indicative of an approval of the authentication.

13. A method according to any one of the claims 1 through 12, characterised in that the step of initiating communicating data related to the subscription module further comprises the step of performing a user authorisation based on a PIN code stored on the subscription module.

14. An arrangement for granting access to a subscription module (102;

302) in a communications system, the arrangement comprising a client communications terminal (106) and a server communications terminal (101) including the subscription module, the client and server communications terminals each comprising respective communications means (110,104;

305) for establishing a communications link (115) between the client communications terminal and the server communications terminal, and for communicating data related to the subscription module between the server communications terminal and the client communications terminal via the communications link;

characterised in that the subscription module further comprises processing means (103,103a) adapted to authenticate the client communications terminal using a key-based authentication procedure, and to grant access to the subscription module conditioned on a result of the authentication procedure.

16. An arrangement according to claim 14 or 16, characterised in that the server communications terminal, the communications means of the server communications terminal, and the subscription module are physically included in a single unit.

17. An arrangement according to any one of the claims 14 through 16, characterised in that at least one of the server communications terminal and the client communications terminal is a mobile telephone.

18. An arrangement according to any one of the claims 14 through 17, wherein the respective communications means are Bluetooth transceivers.

15. An arrangement according to claim 15, characterised in that the communications link is a wireless communications link.

19. A server communications terminal (101) comprising a subscription module (102;

302) and communications means (104;

305) for establishing a communications link (115) with a client communications terminal (106) and for communicating data related to the subscription module with the client communications terminal via the communications link;

characterised in that the subscription module comprises processing means (103,103a) adapted to authenticate the client communications terminal using a key-based authentication procedure, and to grant access to the subscription module conditioned on a result of the authentication procedure.

20. A client communications terminal (106) comprising communications means (110) for establishing a communications link (115) with a server communications terminal (101) including a subscription module (102), and for communicating data related to the subscription module with the server communications terminal via the communications link;

characterised in that the client communications terminal comprises processing means (109) adapted to perform a key-based authentication procedure cooperatively with the subscription module allowing the subscription module to authenticate the client communications terminal and to grant access to the subscription module conditioned on a result of the authentication procedure.

21. A subscription module (102;

302) for use with a server communications terminal (101), the server communications terminal including communications means (104;

305) for establishing a communications link (115) with a client communications terminal (106) and for communicating data related to the subscription module with the client communications terminal via the communications link;

characterised in that the subscription module comprises processing means (103,103a) adapted to, when the subscription module is in connection with the server communications terminal, authenticate the client communications terminal using a key-based authentication procedure, and to grant access to the subscription module conditioned on a result of the authentication procedure.

22. A subscription module according to claim 21, characterised in that the subscription module is a smart card.

23. A subscription module according to claim 22, characterised in that the smart card comprises an integrated radio transceiver.

24. A subscription module according to claim 21, characterised in that the subscription module is a security module comprising a removably insertable smart card.