BOOTSTRAP OF NFC APPLICATION USING GBA

• US 20110029777A1
• Filed: 04/22/2008
• Published: 02/03/2011
• Est. Priority Date: 04/22/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Oda, Toshikane, Murakami, Shingo
• Granted Patent: US 8,646,034 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

The present invention provides a bootstrap system comprising a network system and a mobile handset where the mobile handset can easily receive services of NFC bootstrap application. The handset is effectively authenticated after a bootstrap controller in the network verifies whether a user credential derived in the mobile handset and a user credential separately received from a network server are equal. The application setting is sent to a handset from a bootstrap controller via ad-hoc near field communication (NFC) between the mobile handset and the bootstrap controller. Then the user of the mobile handset can receive various services of the NFC application after the network server delivers the user credential to the service devices with NFC interface.

Claims

1. A method in a communications system for providing services to a mobile handset using near field communication (NFC), the method comprising:

configuring services for the mobile handset at a bootstrap controller that is communicating with a NFC application bootstrap server;

determining a group of NFC application devices that the mobile handset can access at the NFC application bootstrap server and generating a service identity for the services;

sending the service identity from the NFC application bootstrap server to the bootstrap controller;

establishing a NFC link between the mobile handset and the bootstrap controller;

deriving a first user credential at the mobile handset or receiving the first user credential at the mobile handset from the NFC application bootstrap server;

sending the service identity, a second user credential and other service information to the group of NFC application devices;

receiving an application setting for the services at the mobile handset through the bootstrap controller via the NFC link between the mobile handset and the bootstrap controller; and

providing the services to the mobile handset at one of the group of NFC application devices, by a NFC link between the mobile handset and the one of the NFC application devices.

2. The method according to claim 1, wherein the deriving the first user credential is performed in accordance with data including key data and key reference obtained through a bootstrap procedure between the mobile handset and a bootstrap server function with mutual authentication.

3. The method according to claim 2, wherein the data is stored in the mobile handset at the previous bootstrap and is verified to determine whether the key reference is valid or not, and when the key reference is not valid, obtaining another data through another bootstrap procedure between the mobile handset and the bootstrap server function before deriving the first user credential.

4. The method according to claim 1, after establishing the NFC link between the mobile handset and the bootstrap controller, sending a device identity of the bootstrap controller and the service identity from the bootstrap controller to the mobile handset.

5. The method according to claim 1, wherein before receiving the application setting, the method further comprises:

authenticating the mobile handset at the bootstrap controller based on a comparison result that the first user credential is equal to the second user credential, derived in the NFC application bootstrap server.

6. The method according to claim 5, wherein before authenticating the mobile handset at the bootstrap controller, the method further comprises:

sending the key reference included in the data from the mobile handset to the bootstrap controller;

sending a key establishment request for the second user credential from the bootstrap controller to the NFC application bootstrap server;

sending a key material request including the key reference from the NFC application bootstrap server to the bootstrap server function;

sending a key material response including the key material from the bootstrap server function to the NFC application bootstrap server;

deriving the second user credential at the NFC application bootstrap server based on the key material response; and

sending the second user credential and the application setting from the NFC application bootstrap server to the bootstrap controller.

7. The method according to claim 5, wherein the deriving the second user credential is performed in accordance with data including key data and key reference obtained through a bootstrap procedure between the bootstrap controller and a bootstrap server function with mutual authentication.

8. The method according to claim 7, wherein the data is stored in the bootstrap controller by the bootstrap procedure and is verified to determine whether the key reference is valid, and when the key reference is not valid, another data is obtained through another bootstrap procedure before deriving the second user credential.

9. The method according to claim 1, after establishing a NFC link between the mobile handset and the bootstrap controller, the method further comprises:

sending a device identity of the mobile handset from the mobile handset to the bootstrap controller.

10. The method according to claim 1, wherein, before receiving the first user credential at the mobile handset, the method further comprises:

establishing a secure tunnel between the mobile handset and the NFC application bootstrap server based on a device certificate; and

performing authentication based on the device certificate.

11. The method according to claim 10, wherein before receiving the application setting for the services, the method further comprises:

verifying by comparison at the bootstrap controller that the first user credential is equal to a second user credential, derived in the NFC application bootstrap server, thereby indirectly authenticating the mobile handset.

12. The method according to claim 11, wherein the verifying by comparison at the bootstrap controller comprises:

sending a key reference included in the data from the bootstrap controller to the mobile handset;

sending a key establishment request for the first user credential from the mobile handset to the NFC application bootstrap server;

sending a key material request including the key reference from the NFC application bootstrap server to the bootstrap server function;

sending a key material response including the key material from the bootstrap server function to the NFC application bootstrap server;

deriving the first user credential at the NFC application bootstrap server based on the key material;

sending the first user credential from the NFC application bootstrap server to the mobile handset; and

sending the application setting for the services from the NFC application bootstrap server to the bootstrap controller.

13. A bootstrap controller comprising:

a network interface to a near field communication (NFC) application bootstrap server;

a NFC interface to a mobile handset; and

circuitry configured for sending service information through the network interface to configure services and a group of NFC application devices that the mobile handset can access, for sending a key establishment request through the network interface to derive a user credential, for receiving through the network interface a NFC application setting and the user credential derived in the NFC application bootstrap server, for sending through the NFC interface the NFC application setting for the services and for receiving through the NFC interface a user credential response from the mobile handset, and for authenticating the mobile handset when the user credential response from the mobile handset is equal to the user credential derived in the NFC application bootstrap server.

14. The bootstrap controller according to claim 13, wherein:

the circuitry is further configured to use the network interface to the NFC application bootstrap server to receive a service identity for the configured services and group of NFC application devices from the NFC application bootstrap server, and to receive a NFC application setting for the services, and is configured to use the NFC interface to the mobile handset to send the service identity to the mobile handset.

15. A bootstrap controller, comprising:

a network interface to a NFC application bootstrap server;

a NFC interface to a mobile handset; and

circuitry configured for sending through the network interface service information to configure services and a group of NFC application devices that a mobile handset can access,

for identifying the group of NFC application devices, that the mobile handset can access,

for receiving through the network interface a NFC application setting,

for sending through the NFC interface the NFC application setting for the services, and

for verifying the mobile handset when a user credential in the mobile handset is equal to a user credential derived in the bootstrap controller.

16. The bootstrap controller according to claim 15, wherein,

the circuitry if further configured to use the network interface to the NFC application bootstrap server to receive a service identity for the configured services and group of the NFC application devices, and is configured to use the NFC interface to the mobile handset to send the service identity to the mobile handset.

17. A NFC application bootstrap server, comprising:

a first network interface to a bootstrap controller;

a second network interface to a bootstrap server function;

a third network interface to a group of NFC application devices; and

circuitry configured for receiving service information from the bootstrap controller through the first network interface,

for providing a user credential and application setting through the first network interface,

for deriving the user credential using key material received through the second network interface,

for sending the user credential, a service identity and other service information through the third network interface, and

for configuring services and the group of NFC application devices by using the service information and generating a service identity for the services that the mobile handset can access.

18. The NFC application bootstrap server according to claim 17, wherein the circuitry is further configured for distributing the service identity, the user credential and other service information to the group of NFC application devices.

19. A NFC application bootstrap server, comprising:

a first network interface to a bootstrap controller;

a second network interface to a mobile handset;

a third network interface to a bootstrap server function;

a fourth network interface to the group of NFC application devices; and

circuitry configured for receiving service information from the bootstrap controller through the first network interface,

for providing application setting for a mobile handset through the first network interface,

for receiving through the second network interface a key establishment request to derive a user credential and for providing the user credential,

for receiving through the third network interface key material,

for configuring services and a group of NFC application devices by using the service information and generating a service identity for the services that the mobile handset can access,

for sending the user credential, the service identity and other service information through the third network interface, and

for deriving a user credential using the key material.

20. The NFC application bootstrap server according to claim 19, wherein the circuitry is further configured for distributing the service identity and the user credential to the group of NFC application devices.