Systems, methods, and computer program products for interfacing multiple service provider trusted service managers and secure elements

• US 9,104,887 B2
• Filed: 10/16/2012
• Issued: 08/11/2015
• Est. Priority Date: 11/01/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Gargiulo, Michael J.
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US13/653,160
• Publication Number:
  US 20130111599A1
• Time in Patent Office: 1,029 Days
• Field of Search: 726/1, 726/6, 726/7, 726/8, 726/9, 726/26, 726/28, 713/155, 713/156, 713/157, 713/193, 709/217, 709/218, 709/219
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H05K 999/99 dummy group

Abstract

System, methods, and computer program products are provided for interfacing between one of a plurality of service provider (SP) trusted service managers (TSM) and one of a plurality of secure elements (SE). A first request including a mobile subscription identifier (MSI) is received from an SP TSM over a communications network. At least one memory is queried for SE data including an SE identifier corresponding to the MSI. The SE data is transmitted to the SP TSM over the communications network. A second request based on the SE data is received from the SP TSM over the communications network. A third request, based on the second request, is transmitted, over a mobile network, to an SE corresponding to the SE data. The mobile network is selected from multiple mobile networks, and is determined based on the SE data queried from the memory.

Claims

1. A system for interfacing between one of a plurality of service provider (SP) trusted service managers (TSM) and one of a plurality of secure elements, the system comprising:

at least one memory; and

a processor coupled to the at least one memory, the processor being operable to;

receive, from an SP TSM over a communications network, a first request including a mobile subscription identifier;

query the at least one memory for secure element data including a secure element identifier corresponding to the mobile subscription identifier;

transmit the secure element data to the SP TSM over the communications network;

receive, from the SP TSM over the communications network, a second request based on the secure element data; and

transmit, over a mobile network, a third request, based on the second request, to a secure element corresponding to the secure element data,

wherein the mobile network is selected from a plurality of mobile networks, and determined based on the secure element data queried from the at least one memory.

2. The system of claim 1, wherein the second request is a request to perform pre-personalization of the secure element, the pre-personalization including creating, on the secure element, one or more security domains and installing, on the secure element, one or more applications pre-stored on the at least one memory.

3. The system of claim 1, wherein the second request includes at least one of a request to (1) manage a communication, (2) process one or more predetermined scripts, and (3) activate a service.

4. The system of claim 3, wherein the one or more predetermined scripts includes one of a command to (1) personalize an application, and (2) perform key rotation to set a key provided by the SP into a security domain in the secure element.

5. The system of claim 3, wherein the one or more predetermined scripts includes one or more command application protocol data units (ADDU), the one or more command APDUs including commands for the secure element.

6. The system of claim 1, wherein the at least one memory includes a database including a plurality of mobile subscription identifiers and a plurality of corresponding secure element identifiers.

7. The system of claim 1, wherein the processor is further operable to validate the second request using the at least one memory.

8. The system of claim 1, further comprising an enterprise service bus (ESB) operable to process at least one of the first, second and third requests.

9. A method for interfacing between one of a plurality of service provider (SP) trusted service managers (TSM) and one of a plurality of secure elements, the method comprising steps of:

receiving, from an SP TSM over a communications network, a first request including a mobile subscription identifier;

querying at least one memory for secure element data including a secure element identifier corresponding to the mobile subscription identifier;

transmitting the secure element data to the SP TSM over the communications network;

receiving, from the SP TSM over the communications network, a second request based on the secure element data; and

transmitting, over a mobile network, a third request, based on the second request, to a secure element corresponding to the secure element data,

wherein the mobile network is selected from a plurality of mobile networks, and determined based on the secure element data queried from the at least one memory.

10. The method of claim 9, wherein the second request is a request to perform pre-personalization of the secure element, the pre-personalization including creating, on the secure element, one or more security domains and installing, on the secure element, one or more applications pre-stored on the at least one memory.

11. The method of claim 9, wherein the second request includes at least one of a request to (1) manage a communication, (2) process one or more predetermined scripts, and (3) activate a service.

12. The method of claim 11, wherein the one or more predetermined scripts includes one of a command to (1) personalize an application, and (2) perform key rotation to set a key provided by the SP into a security domain in the secure element.

13. The method of claim 11, wherein the one or more predetermined scripts includes one or more command application protocol data units (APDU), the one or more command APDUs including commands for the secure element.

14. The method of claim 9, wherein the at least one memory includes a database including a plurality of mobile subscription identifiers and a plurality of corresponding secure element identifiers.

15. The method of claim 9, further comprising a step of validating the second request using the at least one memory.

16. The method of claim 9, wherein at least one of the first, second, and third requests are processed by an ESB.

17. A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions, which, when executed by a computer system, cause the computer to:

receive, from an SP TSM over a communications network, a first request including a mobile subscription identifier;

query at least one memory for secure element data including a secure element identifier corresponding to the mobile subscription identifier;

transmit the secure element data to the SP TSM over the communications network;

receive, from the SP TSM over the communications network, a second request based on the secure element data; and

transmit, over a mobile network, a third request, based on the second request, to a secure element corresponding to the secure element data,

wherein the mobile network is selected from a plurality of mobile networks, and determined based on the secure element data queried from the at least one memory.

18. The computer-readable medium of claim 17, wherein the second request is a request to perform pre-personalization of the secure element, the pre-personalization including creating, on the secure element, one or more security domains and installing, on the secure element, one or more applications pre-stored on the at least one memory.

19. The computer-readable medium of claim 17, wherein the second request includes at least one of a request to (1) manage a communication, (2) process one or more predetermined scripts, and (3) activate a service.

20. The computer-readable medium of claim 19, wherein the one or more predetermined scripts includes one of a command to (1) personalize an application, and (2) perform key rotation to set a key provided by the SP into a security domain in the secure element.

21. The computer-readable medium of claim 19, wherein the one or more predetermined scripts includes one or more command application protocol data units (ADDU), the one or more command APDUs including commands for the secure element.

22. The computer-readable medium of claim 17, wherein the at least one memory includes a database including a plurality of mobile subscription identifiers and a plurality of corresponding secure element identifiers.

23. The computer-readable medium of claim 17, wherein the sequence of instructions further includes instructions which, when executed by the computer system, cause the computer system to validate the second request using the at least one memory.

24. The computer-readable medium of claim 17, wherein the sequence of instructions further includes instructions which, when executed by the computer system, cause the computer system to process at least one of the first, second, and third requests using an ESB.