Enabling users to select between secure service providers using a key escrow service

• US 8,255,687 B1
• Filed: 09/26/2011
• Issued: 08/28/2012
• Est. Priority Date: 09/15/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Pelly, Nicholas Julian, Hamilton, Jeffrey William
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Su, Sarah
• Application Number:
  US13/244,876
• Time in Patent Office: 337 Days
• Field of Search: 713/155, 713/156, 713/158, 713/164, 726/2, 726/3, 380/278
• US Class Current: 713/164
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Systems and methods are described herein for enabling users to select from available secure service providers (each having a Trusted Service Manager (“TSM”)) for provisioning applications and services on a secure element installed on a device of the user. The device includes a service provider selector (“SPS”) module that provides a user interface for selecting the secure service provider. In one embodiment, the SPS communicates with a key escrow service that maintains cryptographic keys for the secure element and distributes the keys to the user selected secure service provider. The key escrow service also revokes the keys from deselected secure service providers. In another embodiment, the SPS communicates with a central TSM that provisions applications and service on behalf of the user selected secure service provider. The central TSM serves as a proxy between the secure service providers and the secure element.

Claims

1. A computer-implemented method for providing a secure service to a network device comprising a secure element, the method comprising:

maintaining, by a computer, at least one cryptographic key for the secure element, the at least one cryptographic key operable to provide secure access to the secure element via a secure communication channel;

receiving, by the computer, from the network device, a request to change trusted service managers (“

TSMs”

) from a first TSM to a second TSM;

causing, by the computer, the first TSM to lose access to the secure element by revoking the at least one cryptographic key from the first TSM in response to receiving the request to change TSMs; and

transmitting, by the computer, the at least one cryptographic key to the second TSM in response to receiving the request to change TSMs.

2. The computer-implemented method of claim 1, wherein the revoking the at least one cryptographic key comprises transmitting a message to the first TSM requesting that the first TSM discard the at least one cryptographic key.

3. The computer-implemented method of claim 1, wherein the revoking the at least one cryptographic key comprises sending a message to the secure element requesting the secure element to block the first TSM from accessing the secure element, and wherein the secure element is operable to block the first TSM from accessing the secure element in response to receiving the message.

4. The computer-implemented method of claim 3, wherein the secure element is further operable to identify TSMs attempting to access the secure element and to prevent access to blocked TSMs.

5. The computer-implemented method of claim 1, wherein the secure element comprises at least one cryptographic key for each of a plurality of TSMs, and wherein the revoking the at least one cryptographic key comprises transmitting a message to the secure element requesting the secure element to deactivate the at least one cryptographic key for the first TSM.

6. The computer-implemented method of claim 1, further comprising removing information related to the first TSM from the secure element in response to receiving the request to change TSMs.

7. The computer-implemented method of claim 1, further comprising sending a message to the secure element requesting the secure element to remove information related to the first TSM from the secure element in response to the request to change TSMs.

8. The computer-implemented method of claim 1, wherein the request comprises a selection of the second TSM, and wherein the method further comprises performing an off-path confirmation of the selection of the second TSM prior to transmitting the at least one cryptographic key to the second TSM.

9. The computer-implemented method of claim 1, wherein the network device comprises a near field communication (“

NFC”

) module and wherein the secure service comprises a secure contactless service via the NFC module.

10. The computer-implemented method of claim 1, wherein the at least one cryptographic key enables the second TSM to install and provision at least one software application onto the secure element.

11. A computer program product, comprising:

a non-transitory computer-readable medium having computer-readable program code embodied therein for providing a secure service to a communication device comprising a secure element, the computer-readable medium comprising;

computer-readable program code for maintaining at least one cryptographic key for the secure element, the at least one cryptographic key operable to provide secure access to the secure element via a secure communication channel;

computer-readable program code for receiving a request to change trusted service managers (“

TSMs”

) from a first TSM to a second TSM;

computer-readable program code for causing the first TSM to lose access to the secure element by revoking the at least one cryptographic key from the first TSM in response to receiving the request to change TSMs; and

computer-readable program code for transmitting the at least one cryptographic key to the second TSM in response to receiving the request to change TSMs.

12. The computer program product of claim 11, wherein the computer-readable program code for revoking the at least one cryptographic key comprises computer-readable program code for sending a message to the secure element requesting the secure element to block the first TSM from accessing the secure element, and wherein the secure element is operable to block the first TSM from accessing the secure element in response to receiving the message.

13. The computer program product of claim 12, wherein the secure element is further operable to identify TSMs attempting to access the secure element and to prevent access to blocked TSMs.

14. The computer program product of claim 11, wherein the secure element comprises at least one cryptographic key for each of a plurality of TSMs, and wherein the computer-readable program code for revoking the at least one cryptographic key comprises computer-readable program code for transmitting a message to the secure element requesting the secure element to deactivate the at least one cryptographic key for the first TSM.

15. The computer program product of claim 11, wherein the computer-readable program code for revoking the at least one cryptographic key comprises computer-readable program code for transmitting a message to the first TSM requesting that the first TSM discard the at least one cryptographic key.

16. The computer program product of claim 11, further comprising computer-readable program code for removing information related to the first TSM from the secure element in response to receiving the request to change TSMs.

17. The computer program product of claim 11, further comprising computer-readable program code for sending a message to the secure element requesting the secure element to remove information related to the first TSM from the secure element in response to the request to change TSMs.

18. The computer program product of claim 11, wherein the request comprises a selection of the second TSM, and wherein the computer program product further comprises computer-readable program code for performing an off-path confirmation of the selection of the second TSM prior to transmitting the at least one cryptographic key to the second TSM.

19. The computer program product of claim 11, wherein the network device comprises a near field communication (“

NFC”

) module, and wherein the secure service comprises a secure contactless service via the NFC module.

20. The computer program product of claim 11, wherein the at least one cryptographic key enables the second TSM to install and provision at least one software application onto the secure element.

21. A system for providing a secure service to a network device comprising a secure element, the system comprising:

a first network communication module that receives, from the network device, a request to change trusted service managers (“

TSMs”

) from a first TSM to a second TSM;

a key escrow service that;

maintains at least one cryptographic key for the secure element, the at least one cryptographic key operable to provide secure access to the secure element via a secure communication channel; and

causes the first TSM to lose access to the secure element in response to receiving the request to change TSMs by revoking the at least one cryptographic key from the first TSM in response to receiving the request to change TSMs; and

a second network communication module that transmits the at least one cryptographic key to the second TSM in response to receiving the request to change TSMs,

wherein the key escrow service is communicably coupled to the first network communication module and to the second network communication module.

22. The system of claim 21, wherein the key escrow service revokes the at least one cryptographic key by sending, via the second network communication module, a message to the secure element requesting the secure element to block the first TSM from accessing the secure element, and wherein the secure element is operable to block the first TSM from accessing the secure element in response to receiving the message.

23. The system of claim 22, wherein the secure element is further operable to identify TSMs attempting to access the secure element and to prevent access to blocked TSMs.

24. The system of claim 21, wherein the secure element comprises at least one cryptographic key for each of a plurality of TSMs, and wherein the key escrow service revokes the at least one cryptographic key by transmitting, via the second network communication module, a message to the secure element requesting the secure element to deactivate the at least one cryptographic key for the first TSM.

25. The system of claim 21, wherein the key escrow service sends, via the second network communication module, a message to the secure element requesting the secure element to remove information related to the first TSM from the secure element in response to the request to change TSMs.

26. The system of claim 21, wherein the key escrow service revokes the at least one cryptographic key by transmitting a message to the first TSM requesting that the first TSM discard the at least one cryptographic key.

27. The system of claim 21, wherein the key escrow service sends a message to the secure element requesting the secure element to remove information related to the first TSM from the secure element in response to the request to change TSMs.

28. The system of claim 21, wherein the request comprises a selection of the second TSM, and wherein the key escrow service performs an off-path confirmation of the selection of the second TSM prior to transmitting the at least one cryptographic key to the second TSM.

29. The system of claim 21, wherein the network device comprises a near field communication (“

NFC”

) module, and wherein the secure service comprises a secure contactless service via the NFC module.

30. The system of claim 21, wherein the at least one cryptographic key enables the second TSM to install and provision at least one software application onto the secure element.