Systems, methods, and computer program products for managing secure elements

• US 9,323,945 B2
• Filed: 09/16/2014
• Issued: 04/26/2016
• Est. Priority Date: 11/01/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Gargiulo, Michael J., Hay, Florent
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/487,433
• Publication Number:
  US 20150007345A1
• Time in Patent Office: 588 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H05K 999/99 dummy group

Abstract

Systems, methods, and computer program products are provided for performing content management operations. At least one memory stores data, and a central security domain manages instructions on behalf of one or more service provider security domains. The instructions are received, over a network, from a trusted service manager. The instructions are processed in at least one of the one or more determined service provider security domains, using the data stored in the at least one memory. The data includes one or more generic applications, each of which can be instantiated for one or more service providers.

Claims

1. A system to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a single service provider, comprising:

at least one secure element, each of the at least one secure elements comprising a plurality of memory portions, each of the plurality of memory portions comprising a management portion and a plurality of supplemental portions managed by the management portion; and

a processor communicatively coupled to the plurality of memory portions, wherein the processor executes application code instructions that are stored in the plurality of memory portions to cause the system to;

receive, by a management portion of a particular secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the particular secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the particular secure element and each of the plurality of service providers;

determine, by the management portion of the particular secure element, which one of the plurality of supplemental portions is associated with the first identifier; and

process the first instruction by the determined one of the plurality of supplemental portions of the particular secure element using one or more applications instantiated for two or more of the plurality of service providers.

2. The system of claim 1, wherein the plurality of supplemental portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

3. The system of claim 1, wherein the management portion of the particular secure element comprises a master key index, the master key index comprising keys that correspond to each of the supplemental portions.

4. The system of claim 3, wherein the management portion controls the master key index.

5. The system of claim 3, wherein a respective key from the keys in the master key index is required to access one of the supplemental portions.

6. The system of claim 1, wherein the first instruction comprises keys corresponding to the management portion.

7. The system of claim 6, wherein the keys corresponding to the management portion are used to access the management portion, and wherein the central trusted service manager controls the keys corresponding to the management portion.

8. The system of claim 2, wherein each of the security domains comprises one or more applets.

9. The system of claim 1, wherein the first instruction comprises one or more application protocol data units (APDUs).

10. A method to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a service provider, comprising:

receiving, by a management portion of a secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the secure element and each of the plurality of service providers;

determining, by the management portion of the secure element, which one of a plurality of supplemental portions of the secure element is associated with the first identifier; and

processing the first instruction by the determined one of the plurality of supplement portions of the secure element using one or more applications instantiated for two or more of the plurality of service providers.

11. The method of claim 10, wherein the plurality of supplemental portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

12. The method of claim 10, wherein the management portion of the secure element comprises a master key index, the master key index comprising keys that correspond to each of the supplemental portions.

13. The method of claim 12, wherein the management portion controls the master key index.

14. The method of claim 12, wherein a respective key from the keys in the master key index is required to access one of the supplemental portions.

15. The method of claim 10, wherein the first instruction further comprises keys corresponding to the management portion.

16. The method of claim 15, wherein the keys corresponding to the management portion are used to access the management portion, and wherein the central trusted service manager controls the keys corresponding to the management portion.

17. The method of claim 11, wherein each of the security domains comprises one or more applets.

18. The method of claim 10, wherein the first instruction comprises one or more application protocol data units (APDUs).

19. A computer program product comprising:

a non-transitory computer-readable medium having computer-readable program instructions embodied therein that when executed by a computer cause the computer to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a single service provider, the computer-readable program instructions comprising;

computer-readable program instructions to receive, by a management portion of a secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the secure element and each of the plurality of service providers;

computer-readable program instructions to determine, by the management portion of the secure element, which one of a plurality of supplemental portions of the secure element is associated with the first identifier; and

computer-readable program instructions to process the first instruction by the determined one of the plurality of supplement portions of the secure element using one or more applications instantiated for two or more of the plurality of service providers.

20. The computer program product of claim 19, wherein the plurality of supplement portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

21. The computer program product of claim 19, wherein the management portion of the secure element comprises a master key index, the master key index comprising keys that correspond to each of to the supplemental portions.

22. The computer program product of claim 21, wherein the management portion controls the master key index.

23. The computer program product of claim 21, wherein a respective key from the keys in the master key index is required to access one of the supplemental portions.

24. The computer program product of claim 19, wherein the first instruction further comprises keys corresponding to the management portion.

25. The computer program product of claim 24, wherein the keys corresponding to the management portion are used to access the management portion, and wherein the central trusted service manager controls the keys corresponding to the management portion.

26. The computer program product of claim 20, wherein each of the security domains comprises one or more applets.

27. The computer program product of claim 19, wherein the first instruction comprises one or more application protocol data units (APDUs).