System and methods for UICC-based secure communication

• US 9,036,820 B2
• Filed: 09/11/2013
• Issued: 05/19/2015
• Est. Priority Date: 09/11/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chastain, Walter Cooper, Chin, Stephen Emille
• Primary Examiner(s): SCOTT, RANDY A
• Application Number:
  US14/023,932
• Publication Number:
  US 20150071437A1
• Time in Patent Office: 615 Days
• Field of Search: 713/153, 713/155, 713/177, 713/178, 380/40, 380/44, 380/277, 380/278
• US Class Current: 380/249
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A system that incorporates the subject disclosure may include, for example, instructions which when executed cause a device processor to perform operations comprising sending a service request to a remote management server; receiving from the management server an authentication management function and an encryption key generator for execution by a secure element and an encryption engine for execution by a secure device processor, sending a request to establish a communication session with a remote device; and communicating with the remote device via a channel established using an application server. The secure element and the secure device processor authenticate each other using a mutual authentication keyset. The secure element, the secure device processor and the device processor each have a security level associated therewith; the security level associated with the secure device processor is intermediate between that of the secure element and that of the device processor. Other embodiments are disclosed.

Claims

1. A device comprising:

a secure element;

a secure device processor separate from the secure element;

a memory to store executable instructions; and

a device processor separate from the secure device processor and coupled to the memory, the secure element and the secure device processor, wherein the device processor, responsive to executing the instructions, performs operations comprising;

sending a first request for service to a management server remote from the device;

receiving from the management server an authentication management function and an encryption key generator for execution by the secure element and an encryption engine for execution by the secure device processor, to cause the secure element and the secure device processor to authenticate each other using a mutual authentication keyset;

authenticating a user of the device using a user interface keyset, wherein user credentials are verified by the authentication management function;

sending a second request for a secure signaling session to a secure application server remote from the device, wherein the second request is initiated by the secure device processor;

receiving from the secure application server a first authentication signal, wherein the secure application server is authenticated by the authentication management function using a signaling authentication keyset;

communicating with the secure application server via a first encrypted channel using a first signaling encryption keyset, wherein encryption and decryption of communications over the first encrypted channel is performed by the encryption engine and the first signaling encryption keyset is generated by the encryption key generator;

sending a third request to the secure application server to establish a communication session with a second device; and

receiving from the second device a second authentication signal, wherein the second device is authenticated by the authentication management function using a bearer path authentication keyset,

wherein the mutual authentication keyset, the user interface keyset, the signaling authentication keyset, the first signaling encryption keyset, and the bearer path authentication keyset are distinct keysets.

2. The device of claim 1, wherein the operations further comprise:

sending a fourth request to the second device to establish an encrypted communication session with bi-directional encryption, wherein the secure device processor receives a bearer path encryption keyset from the encryption key generator, and wherein encryption and decryption of communications in the encrypted communication session are performed by the encryption engine using the bearer path encryption keyset; and

sending a notification message directed to the user indicating that the encrypted communication session with bi-directional encryption has been established.

3. The device of claim 2, wherein the secure element is a universal integrated circuit card, wherein the secure element and the secure device processor form a secure service platform separate from the device processor, wherein the mutual authentication keyset is provided to the secure service platform by the management server, and wherein the management server transmits information to the secure service platform using a remote management keyset.

4. The device of claim 3, wherein the secure element and the management server authenticate each other using the remote management keyset, and wherein the authentication management function performs authentication of the management server by the secure element.

5. The device of claim 3, wherein the secure device processor and the management server authenticate each other using the remote management keyset, and wherein the authentication management function performs authentication of the management server by the secure device processor.

6. The device of claim 1, wherein the device is coupled to a communications network, and wherein the authentication management function comprises a network authentication service for mutual authentication between the device and equipment of the network.

7. The device of claim 6, wherein the network is a cellular communications network, a WiFi network or a wireline network, and wherein the second device and the secure application server are coupled to the network.

8. The device of claim 1, wherein the secure application server communicates with the second device via a second encrypted channel using a second signaling encryption keyset, wherein the second encrypted channel is separate from the first encrypted channel and wherein the second signaling encryption keyset is distinct from the first signaling encryption keyset.

9. The device of claim 1,

wherein the secure element is a first secure element comprising a universal integrated circuit card and the secure device processor further comprises a second secure element, and

wherein the encryption engine is loaded on the second secure element.

10. A method comprising:

sending, by a device comprising a device processor, a secure element and a secure device processor separate from the device processor, a first request for service to a management server remote from the device;

receiving, by the device, from the management server an authentication management function and an encryption key generator for execution by the secure element and an encryption engine for execution by the secure device processor, to cause the secure element and the secure device processor to authenticate each other using a mutual authentication keyset, wherein the secure element and the secure device processor are separate from each other;

sending, by the device, a second request for a secure signaling session to a secure application server remote from the device, wherein the second request is initiated by the secure device processor;

receiving, by the device, from the secure application server a first authentication signal, wherein the secure application server is authenticated by the authentication management function using a signaling authentication keyset;

communicating, by the device, with the secure application server via a first encrypted channel using a first signaling encryption keyset, wherein encryption and decryption of communications over the first encrypted channel is performed by the encryption engine and the first signaling encryption keyset is generated by the encryption key generator;

sending, by the device, a third request to the secure application server to establish a communication session with a second device; and

receiving, by the device, from the second device a second authentication signal, wherein the second device is authenticated by the authentication management function using a bearer path authentication keyset,

wherein the mutual authentication keyset, the signaling authentication keyset, the first signaling encryption keyset, and the bearer path authentication keyset are distinct keysets.

11. The method of claim 10, further comprising authenticating, by the device, a user of the device using a user interface keyset, wherein user credentials are verified by the authentication management function.

12. The method of claim 11, wherein the secure element is a universal integrated circuit card, wherein the secure element and the secure device processor form a secure service platform separate from the device processor, wherein the mutual authentication keyset is provided to the secure service platform by the management server, and wherein the management server transmits information to the secure service platform using a remote management keyset.

13. The method of claim 11, further comprising:

sending, by the device, a fourth request to the second device to establish an encrypted communication session with bi-directional encryption, wherein the secure device processor receives a bearer path encryption keyset from the encryption key generator, and wherein encryption and decryption of communications in the encrypted communication session are performed by the encryption engine using the bearer path encryption keyset; and

sending, by the device, a notification message directed to the user indicating that the encrypted communication session with bi-directional encryption has been established.

14. The method of claim 12, wherein the secure element, the secure device processor and the device processor each have a security level associated therewith, and wherein the security level associated with the secure device processor is intermediate between that of the secure element and that of the device processor.

15. The method of claim 12, further comprising authenticating the management server by the authentication management function using the remote management keyset, to provide mutual authentication of the secure element and the management server and to provide mutual authentication of the secure device processor and the management server.

16. A tangible computer-readable storage device comprising instructions, which when executed by a device processor cause the device processor to perform operations comprising:

sending a first request for service to a management server remote from the device;

receiving from the management server an authentication management function and an encryption key generator for execution by a secure element and an encryption engine for execution by a secure device processor, to cause the secure element and the secure device processor to authenticate each other using a mutual authentication keyset, wherein the secure element and the secure device processor are separate from each other and coupled to the device processor;

authenticating a user using a user interface keyset, wherein user credentials are verified by the authentication management function;

sending a second request to establish a communication session with a remote second device, wherein the second request is initiated by the secure device processor;

communicating with the second device via a communication channel established using an application server;

sending a third request to the secure application server to establish the communication session with the second device; and

receiving from the second device a second authentication signal, wherein the second device is authenticated by the authentication management function using a bearer path authentication keyset,

wherein the secure element, the secure device processor and the device processor each have a security level associated therewith, and wherein the security level associated with the secure device processor is intermediate between that of the secure element and that of the device processor,

wherein the secure element is a universal integrated circuit card, wherein the secure element and the secure device processor form a secure service platform separate from the device processor, wherein the mutual authentication keyset is provided to the secure service platform by the management server, and wherein the management server transmits information to the secure service platform using a remote management keyset, and

wherein the mutual authentication keyset, the user interface keyset, the bearer path authentication keyset and the remote management keyset are distinct keysets.

17. The tangible computer-readable storage device of claim 16, wherein the application server is a secure application server, and wherein the operations further comprise:

receiving a first authentication signal, wherein the secure application server is authenticated by the authentication management function using a signaling authentication keyset; and

communicating with the secure application server via a first encrypted channel using a first signaling encryption keyset, wherein encryption and decryption of communications over the first encrypted channel is performed by the encryption engine and the first signaling encryption keyset is generated by the encryption key generator,

wherein the mutual authentication keyset, the user interface keyset, the remote management keyset, the signaling authentication keyset, the first signaling encryption keyset, and the bearer path authentication keyset are distinct keysets.

18. The tangible computer-readable storage device of claim 17, wherein the secure application server communicates with the second device via a second encrypted channel using a second signaling encryption keyset, wherein the second encrypted channel is separate from the first encrypted channel and wherein the second signaling encryption keyset is distinct from the first signaling encryption keyset.

19. The tangible computer-readable storage device of claim 16, wherein the device is coupled to a communications network, and wherein the authentication management function comprises a network authentication service for authenticating the device to equipment of the network.

20. The tangible computer-readable storage device of claim 19, wherein the network is a cellular communications network, a WiFi network or a wireline network, and wherein the second device and the application server are coupled to the network.