Methods for provisioning universal integrated circuit cards

• US 8,898,769 B2
• Filed: 11/16/2012
• Issued: 11/25/2014
• Est. Priority Date: 11/16/2012
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Chastain, Walter Cooper, Campbell, Clifton, Chin, Stephen, Harber, David, Rainer, Brian Keith, Smith, David K., Wang, Shih-Ming
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): An, Wayne
• Application Number:
  US13/679,479
• Publication Number:
  US 20140140509A1
• Time in Patent Office: 739 Days
• Field of Search: None
• US Class Current: 726/17
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

A system is described that can perform a method for receiving a request to modify a universal integrated circuit card, generating a package comprising configuration data for modifying the universal integrated circuit card, instructing an over-the-air system to transmit the package encrypting the package with a transport key to generate an encrypted package, and transmitting the encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card. The system can also perform a method of providing a mobile network operator trusted service manager system information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation of the universal integrated circuit card.

Claims

1. A method, comprising:

receiving, by a secure element issuer system, a request to modify a universal integrated circuit card;

generating, by the secure element issuer system, a first package comprising configuration data for modifying the universal integrated circuit card;

instructing, by the secure element issuer system, an over-the-air system to transmit the first package;

encrypting, by the over-the-air system, the first package with a transport key to generate a first encrypted package;

transmitting, by the over-the-air system, the first encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card; and

providing, by the secure element issuer system, a mobile network operator trusted service manager system first information relating to the configuration data to enable the mobile network operator trusted service manager system to manage content and memory allocation for a plurality of security domain containers of the universal integrated circuit card of the communication device, wherein the communication device and the mobile network operator trusted service manager system are separate devices, wherein the mobile network operator trusted service manager system is remotely located from the communication device, wherein a first security domain container of the plurality of security domain containers is limited to use by a card issuer entity, wherein a second security domain container of the plurality of security domain containers is limited to use by an application provider entity, wherein a third security domain container of the plurality of security domain containers is limited to use by a controlling authority entity, and wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers.

2. The method of claim 1, wherein the configuration data comprises one of an authentication key, a network access parameter, a service operator application, or combinations thereof.

3. The method of claim 2, wherein the service operator application comprises a network-based application comprising one of a subscriber identity module application, a universal subscriber identity module application, or an internet protocol multimedia services identity module application.

4. The method of claim 2, wherein the service operator application configures the communication device to comply with network operational requirements of a communication system from which the communication device receives communication services.

5. The method of claim 1, wherein the communication device is a portable communication device, and wherein the universal integrated circuit card is an embedded universal integrated circuit card affixed to the communication device.

6. The method of claim 1, wherein the plurality of security domain containers enable key handling, encryption, decryption, digital signature generation and verification for applications associated with the card issuer entity, the application provider entity and the controlling authority entity, and wherein the management of the content and the memory allocation for the plurality of security domain containers includes deleting a selected security domain container of the plurality of security domain containers from the universal integrated circuit card.

7. The method of claim 1, wherein the first encrypted package is transmitted to the communication device as a short messaging service message.

8. The method of claim 1, comprising:

generating, by a trusted execution environment management system, a second package comprising a trusted application;

encrypting, by the trusted execution environment management system, the second package with a trusted execution environment key to generate a second encrypted package;

instructing, by the trusted execution environment management system, the over-the-air system to transmit the second encrypted package;

encrypting, by the over-the-air system, the second encrypted package with transport data with a transport key to generate a third encrypted package;

transmitting, by the over-the-air system, the third encrypted package to the communication device to provision a trusted execution environment function of the communication device; and

providing, by the trusted execution environment management system, the mobile network operator trusted service manager system second information relating to the trusted application to enable the mobile network operator trusted service manager system to continue to manage the content and memory allocation of the plurality of security domain containers of the universal integrated circuit card.

9. The method of claim 8, wherein the trusted execution environment management system and the mobile network operator trusted service manager system operate as combined system.

10. A method, comprising:

receiving, by a mobile wallet trusted service manager system, a request to modify content in a mobile wallet security domain container of a universal integrated circuit card;

verifying, by the mobile wallet trusted service manager system, that resources of the universal integrated circuit card and a communication device communicatively coupled to the universal integrated circuit card are capable of satisfying the request;

generating, by the mobile wallet trusted service manager system, a script according to the request;

encrypting, by the mobile wallet trusted service manager system, the script according to an application key to generate an encrypted script;

instructing, by the mobile wallet trusted service manager system, an over-the-air system to transmit the encrypted script;

generating, by the over-the-air system, a package comprising the encrypted script and transport data;

encrypting, by the over-the-air system, the package with a transport key to generate an encrypted package;

transmitting, by the over-the-air system, the encrypted package to the communication device communicatively coupled to the universal integrated circuit card to provision the content of the mobile wallet security domain container of the universal integrated circuit card; and

providing, by the mobile wallet trusted service manager system, a mobile network operator trusted service manager system information relating to the provisioning of the mobile wallet security domain to manage content and memory allocation for a plurality of security domain containers of the universal integrated circuit card, wherein the communication device and the mobile network operator trusted service manager system are separate devices, wherein the mobile network operator trusted service manager system is remotely located from the communication device, wherein a first security domain container of the plurality of security domain containers is limited to use by a card issuer entity, wherein a second security domain container of the plurality of security domain containers is limited to use by an application provider entity, and wherein a third security domain container of the plurality of security domain containers is limited to use by a controlling authority entity.

11. The method of claim 10, wherein the communication device is a portable communication device, and wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers.

12. The method of claim 10, wherein the universal integrated circuit card is an embedded universal integrated circuit card affixed to the communication device, wherein the plurality of security domain containers enable key handling, encryption, decryption, digital signature generation and verification for applications associated with the card issuer entity, the application provider entity and the controlling authority entity.

13. The method of claim 10, wherein the management of the content and the memory allocation for the plurality of security domain containers includes deleting a selected security domain container of the plurality of security domain containers from the universal integrated circuit card.

14. The method of claim 13, comprising modifying, by the mobile network operator trusted service manager system, a security domain container of the plurality of security domain containers.

15. The method of claim 14, wherein the modifying comprises one of updating the security domain container, deleting the security domain container, or adding the security domain container to the plurality of security domain containers.

16. The method of claim 13, wherein the managing comprises one of increasing or decreasing memory allocated to each of the plurality of security domain containers of the universal integrated circuit card.

17. The method of claim 10, wherein the encrypted package is transmitted to the communication device over a data channel conforming to a hypertext transport protocol.

18. A method, comprising:

receiving, by a subscription management secure routing system of a first service provider, a first encrypted package, wherein the first encrypted package is encrypted by a subscription management data preparation system with an application key responsive to a subscription management data profile system receiving a request from a second service provider to modify a universal integrated circuit card with configuration data;

sending, by the subscription management secure routing system of the first service provider, to an over-the-air system of the first service provider a second package comprising the first encrypted package and transport data;

encrypting, by the over-the-air system of the first service provider, the second package with a transport key to generate a second encrypted package;

transmitting, by the over-the-air system of the first service provider, the second encrypted package to a communication device communicatively coupled to the universal integrated circuit card to provision the universal integrated circuit card with the configuration data; and

providing, by the subscription management secure routing system of the first service provider, a mobile network operator system of the first service provider information relating to the configuration data to enable the mobile network operator system of the first operator to manage content and memory allocation for a plurality of security domain containers of the universal integrated circuit card, wherein the communication device and the mobile network operator system are separate devices, wherein the mobile network operator system is remotely located from the communication device, wherein a first security domain container of the plurality of security domain containers is limited to use by a card issuer entity, wherein a second security domain container of the plurality of security domain containers is limited to use by an application provider entity, and wherein a third security domain container of the plurality of security domain containers is limited to use by a controlling authority entity.

19. The method of claim 18, wherein the subscription management secure routing system of the first service provider and the mobile network operator system of the first operator operate as combined system of the first service provider, wherein the plurality of security domain containers enable key handling, encryption, decryption, digital signature generation and verification for applications associated with the card issuer entity, the application provider entity and the controlling authority entity, and wherein the management of the content and the memory allocation for the plurality of security domain containers includes deleting a selected security domain container of the plurality of security domain containers from the universal integrated circuit card.

20. The method of claim 18, comprising transferring, by the mobile network operator system of the first service provider, management of the memory allocation for the plurality of security domain containers of the universal integrated circuit card to a mobile network operator system of the second service provider, wherein the first service provider and the second service provider are independently managed entities, and wherein management of the content and the memory allocation for the plurality of security domain containers includes changing an amount of memory resource allocated to a particular security domain container of the plurality of security domain containers.