EP3202174A1

EP3202174A1 - Method and system for personalizing a security element of a terminal

Info

Publication number: EP3202174A1
Application number: EP15750252.7A
Authority: EP
Inventors: Ulrich WIMBÖCK
Original assignee: Giesecke and Devrient GmbH
Current assignee: Giesecke and Devrient Mobile Security GmbH
Priority date: 2014-09-30
Filing date: 2015-08-07
Publication date: 2017-08-09
Also published as: DE102014014561A1; KR101879348B1; US20170230830A1; WO2016050333A1; US10397781B2; CN107079291B; CN107079291A; KR20170060100A

Abstract

The invention relates to a method for personalizing a security element (14) for a mobile terminal (10) for communicating via a mobile communications network (20) and to a corresponding system. The method has the following steps: providing initialization data (17) to the security element (14) from an initialization entity (30), said initialization data (17) comprising a personalization token (17a); providing the personalization token (17a) to a personalization entity (40) from the security element (14); checking the validity of the personalization token (17a) using the personalization entity (40); and providing personalization data (18) to the security element (14) from the personalization entity (40) after successfully checking the validity of the personalization token (17a), wherein authorization data (18a) for authenticating the security element (14) is already part of the initialization data in an encrypted form, and the personalization data comprises a key for decrypting the authorization data (18a).

Description

Method and system for personalizing a security element of a terminal Field of the invention

The invention relates to communication via mobile radio networks in general and in particular to methods and systems for personalizing a security element of a mobile terminal for communication via a mobile radio network.

Background of the invention

Communicating by means of a mobile terminal, for example by means of a mobile telephone, via a mobile radio network (also referred to as PLMN [Public Land Mobile Network]) operated by a network operator (also referred to as MNO [Mobile Network Operator]) usually requires in that the mobile terminal is equipped with a security element, for example in the form of a SIM card, for the secure acceptance of subscription authorization data ("subscription credentials"), which uniquely identify and authenticate the user of the mobile terminal in relation to the mobile radio network. Such security element-specific subscription authorization data, for example an IMSI (International Mobile Subscriber Identity) and an authentication key Ki, are generally stored on a security element as part of a so-called "personalization" in the secure environment of the security element manufacturer.

While in the past the vast majority of SIM card security devices could be easily exchanged in a mobile device, for some time now more and more security devices have been installed in a mobile device. Such a permanently installed in a mobile terminal security element is the expert in particular the term "embedded SIM" or "embedded UICC (eUICC)" known.

As mentioned above, so far the personalization was usually in a secure environment at the manufacturer of the security element. In the future, this will often no longer be possible since the personalization must already take place at the manufacturer of the processor of the security element or later in the production line of the manufacturer of the mobile terminal with the security element embedded therein. In this case, however, it must be ensured that the processor manufacturer or the manufacturer of the mobile terminal has no or, at best, only limited access to the security element-specific personalization data to be applied to the security element, in particular the subscription authorization data contained therein.

Thus, there is a need for improved methods and apparatus for personalizing a security element that is preferably fixedly mounted in a terminal. Summary of the invention

The above object is solved according to the present invention by the respective subject matter of the independent claims. Preferred embodiments of the invention are defined in the dependent claims.

According to a first aspect of the invention, a method for personalizing a security element for a terminal for communication over a mobile radio network is provided. The method comprises the following steps: the provision of initialization data from an initialization sierungsinstanz to the security element, wherein the initialization data include a personalization token; providing the personalization token from the security element to a personalization entity; checking the validity of the personalization token by the personalization authority; and upon successful verification of the validity of the personalization token, providing personalization data from the personalization entity to the security element, wherein the authorization data for authenticating the security element in encrypted form is already part of the initialization data and the personalization data comprises a key for decrypting the authorization data. The terminal may be a mobile (or a stationary) terminal.

According to the invention, initialization data with a personalization token are thus loaded onto the security element in a first phase by an initialization entity. The initialization instance can be, for example, a server of the manufacturer of the processor of the security element or of the manufacturer of the mobile terminal with a security element embedded therein. The initialization data are essentially the same for a batch of security elements to be personalized. In addition to these initialization data, the security element is provided with a security element-individual valid personalization token. The initialization data may be, for example, parts of an operating system of the security element. In a second phase, according to the invention, the security element, by means of its valid personalization token towards a personalization entity, has its authorization to be able to download security personalization-individual personalization data from the personalization entity in addition to the initialization data. With subscription authorization Subscription Credentials, such as an IMSI (International Mobile Subscriber Identity) and / or an authentication key Ki, can authenticate the security element to a mobile radio network. Authorization data may alternatively or additionally include an encryption key. In the present case, (subscription

) Authorization data in encrypted form already part of the initialization data. The personalization data includes a key for decrypting the authorization data already present on the security element. The personalization data may include further security element-specific data.

Preferably, prior to the step of providing the initialization data from the initialization entity to the security element, the method comprises the further step of providing the initialization data and a batch of valid personalization tokens from the personalization entity to the initialization entity. In this case, the valid personalization tokens are preferably digitally signed by the personalization entity, so that it can be checked whether a personalization token originates from the personalization entity.

According to preferred embodiments of the invention, the provision of personalization data from the personalization entity to the security element occurs via a secure communication channel between the personalization entity and the security entity.

Preferably, to establish a secure communication channel between the personalization entity and the security element, a security element-specific key between the personalization entity and the security element used to secure the personalization data.

According to preferred embodiments of the invention, the secure channel between the personalization entity and the security element is based on a public key infrastructure. In these preferred embodiments, the initialization data that is transmitted to the security element preferably includes a certificate of the personalization entity with a public key of the personalization entity. Preferably, a TLS (Transport Layer Security) communication channel can be formed between the personalization entity and the security element in this way, whereby the personalization entity authenticates itself to the security element. The authentication of the security element with respect to the personalization instance preferably takes place via the personalization token.

In the step of providing the personalization token to the personalization entity, the security element preferably transmits an identifier of the security element, for example a chip ID or elD, to the personalization instance in addition to the personalization token.

According to preferred embodiments of the invention, more than one personalization token may be provided on the security element during initialization. The provision of further personalization tokens is advantageous in the event that a first personalization token is not accepted by the personalization entity.

Preferably, after the step of successfully checking the validity of the personalization token, the method comprises the further one Step Mark the personalization token on the personalization instance as invalid or already in use.

According to preferred embodiments of the invention, the personalization authority can be configured to check the validity of the personalization token by means of further mechanisms in order to recognize and possibly reject the misuse of personalization tokens.

According to a second aspect of the invention, a system is provided for personalizing a security element for a terminal for communication via a mobile radio network. The system includes an initialization instance configured to provide initialization data to the security element, wherein the initialization data comprises a personalization token, and a personalization entity configured to receive the personalization token from the security element, check the validity of the personalization token, and after successful verification of the validity of the personalization token provide personalization data to the security element, wherein the personalization data subscription authorization data to authenticate to a mobile network or the subscription authorization data for authentication of the security element to the mobile network in encrypted form already part of the initialization data and the personalization data a key to Decrypt the subscription authorization data. The terminal may be a mobile (or a stationary) terminal.

As those skilled in the art will appreciate, the preferred embodiments described above can be both within the scope of the first aspect of the invention, ie in the context of the method for personalizing a security Selements, as well as in the context of the second aspect of the invention, ie in the context of a system for personalizing a security element, implement advantageous. Other features, advantages and objects of the invention will be apparent from the following detailed description of several embodiments and alternative embodiments. Referring to the drawings, FIG. 1 is a schematic illustration of a system for personalizing a security element in the form of an eUICC as part of a mobile telephone for communication over a cellular network, illustrating different aspects of the present invention, and FIG Schematic representation of a preferred process when personalizing the security element of Figure 1.

Figure 1 shows a schematic representation of the components of a system for personalizing a security element of a mobile terminal, as well as some of the communication links between these components, which illustrate different aspects of the present invention. Although in the following detailed description reference will be made to a "mobile" terminal, those skilled in the art will appreciate that the present invention may be advantageously implemented in conjunction with any type of terminal configured to communicate over a mobile or cellular communication network So also with terminals whose location practically does not change. In other words, the attribute "mobile" used here refers to the ability of the terminal to communicate over a mobile or cellular communications network.

An exemplary mobile terminal 10 is shown in FIG. 1, which includes a secure element 14 for securely storing and processing data that uniquely identifies, for example, the mobile terminal 10 and / or its user. As indicated in FIG. 1, the mobile terminal 10 is preferably a mobile phone, a smartphone or a similar device having a display 12. However, those skilled in the art will recognize that the mobile terminal 10 according to the present invention is also in the form of can be implemented by other devices that are configured to communicate over a cellular network, such as a tablet computer, a notebook, a TV system, a set-top box, a vending machine, a motor vehicle, a security camera , a sensor device and the like.

According to preferred embodiments of the invention, the security element 14 is designed as an eUICC (embedded universal integrated circuit card) with a SIM application implemented thereon, ie as a security element that is an integral part of the mobile terminal 10 and in a mobile network for the unique and secure Identification of the user or subscriber and used for the provision of different functions and value-added services. Alternatively, the security element 14 may be configured as a UICC (Universal Integrated Circuit Card) or Subscriber Identity Module (SIM) card, which is known to those skilled in the art as one of the most commonly used forms of security element. However, those skilled in the art will recognize that other types of security elements, depending on the generation and type of underlying mobile radio standards USIM, R-UIM, ISIM and the like are also included in the present invention. According to further preferred embodiments of the invention, the security element 14 can be embodied as a combination of hardware and software components in a trustworthy part of an operating system of a central processor unit of the mobile terminal 10, which is also known to the person skilled in the art as a trusted execution environment ("trusted execution environment"; TEE) is known. The security element 14 can then be embodied, for example, within such a secure runtime environment of the mobile terminal 10 in the form of programs running therein, so-called Trustlets®. The mobile terminal 10 is configured to communicate over the air interface with a cellular network 20 (also referred to as "mobile network" for short, or "Public Land Mobile Network" [PLMN]). For this purpose, the mobile terminal 10 usually has an antenna (not shown in Figure 1) for transmitting and receiving radio waves.

Hereinafter, preferred embodiments of the invention will be described in the context of a cellular network 20 in accordance with the GSM (Global Standard for Mobile Communications) standard specified in a variety of ETSI specifications. However, those skilled in the art will recognize that the present invention may also be used to advantage in connection with other mobile networks. Such networks include third-generation (3GPP) cellular networks such as UMTS (Universal Mobile Telecommunications System), mobile networks of the fourth generation. Generation (4G), such as LTE (Long Term Evolution), as well as other mobile networks, such as CDMA and the like.

As is known to the person skilled in the art, a mobile radio network or PLMN constructed according to the GSM standard generally comprises a BSS (Base Station Subsystem), which consists of a multiplicity of BTSs ("Base Transceiver Station"), the respective radio cells of the PLMN and are connected to a BSC ("Base Station Controller"). Typically, the BSC is one of a plurality of BSCs that communicate with a common MSC ("Mobile Switching Center"). Often, a local database called the Visitor Location Register (VLR) is part of the MSC to hold information about the mobile subscribers currently located in the radio cells served by an MSC (ie, the one covered by an MSC Area). The MSC provides essentially the same functionality as a public-switched telephone network (PSTN) and is in communication with a HLR ("Home Location Register"), which is the primary database of the PLMN in which information for the registration or authentication of mobile subscribers is stored. For this purpose, the HLR usually has access to an AUC ("Authentication Center"). As is known to those skilled in the art, the communication links between the components of a PLMN described above may be based on proprietary and / or open standards. The protocols used may be, for example, SS7 or IP based. How the network components are formed as separate or combined units and how the interfaces are formed between these components is a matter for the MNO, so that the above description is to be understood merely as an example. It will be appreciated by those skilled in the art that although the functional units of a conventional mobile network according to the GSM standard may have different names in other or future cellular standards, the underlying principles are substantially the same and are therefore also encompassed by the invention. For the sake of clarity, of the components of a mobile radio network described above, only the following are shown in the schematic representation of FIG. 1: an exemplary BTS 22 and an HLR 24 for the mobile radio network 20.

As can be seen from the enlarged view of the security element 14 in FIG. 1, the security element 14 preferably comprises a central processing unit or central processor (CPU) 15. Preferably, the processor 15 is equipped such that Applications may be executed on the processor 15, such as a Personalisierungsapplikation 15a (referred to in Figure 1 as "applet"), which preferably at least some of the features for personalizing the security element 14 provides, as described in detail below in connection with Figure 2.

The security element 14 preferably also comprises a memory unit 16, which is preferably implemented as a non-volatile, rewritable memory unit, eg in the form of a flash memory. According to the invention, in a first step initialization data 17 with a personalization token 17a is stored by an initialization entity 16 on this memory unit 16, and in a second step by a personalization entity 40 personalization data 18 with (subscription) authorization data ("Subscription Credentials"). 18a deposited, as will be described in detail below in connection with Figure 2. Preferably The personalization data 18 and in particular the subscription authorization data enable the security element 14 and the mobile terminal 10 to log into the mobile radio network 20 and to communicate via the latter.

FIG. 2 shows a preferred sequence according to the invention in the personalization of the security element 14 of FIG. 1. In a first step S 1 of FIG. 2, initialization data 17 and a batch of signed personalization tokens 17 a are provided to an initialization entity 30 by a personalization entity 40. The initialization data 17 may be, for example, parts of an operating system to be implemented on the security element 14, wherein the initialization data 17 may be the same for all security elements to be initialized. The initialization entity 30 may be, for example, a server of the manufacturer of the processor of the security element or of the manufacturer of the mobile terminal with the security element embedded therein. The batch of signed personalization tokens can be a list of individual random numbers and the digital signatures of those random numbers.

In step S 2 of FIG. 2, in a first phase of the method according to the invention for personalizing the security element 14, the initialization data 17 together with a signed personalization token 17 a are provided by the initialization entity 30 to the security element 14. It is conceivable according to the invention that the security element 14 is present as a single chip, a chip module, a SIM or the like. In step S3 of FIG. 2, the initialization data 17 received from the initialization entity 30, including the persona Lisierungsstokens 17a stored on the security element 14, preferably on the memory 16 shown in Figure 1 thereof.

In a second phase of the inventive method for personalizing the security element 14, in step S4 of FIG. 2 the security element 14 preferably sends the personalization token 17a together with an identifier ID of the security element 14, e.g. a chip ID, to the personalization entity 40. In step S5 of Figure 2, the personalization entity 40 checks the validity of the personalization token 17a received from the security element 14. According to preferred embodiments of the invention, such a check can take place by checking by means of a database of the personalization instance 40 whether the personalization token 17a received by the security element 14 has been output by the personalization entity 40 (for example in step S1 of FIG. 2) and if so Personalization token 17a has not already been used for downloading personalization data 18, ie whether the personalization token 17a is still valid.

If the check in step S5 of FIG. 2 is successful, ie if the personalization entity 40 determines that the personalization token 17a received by the security element 14 is valid, in step S6 of FIG. 2 security-personalization data 18 is sent to the personalization entity via a secure communication channel 40 are provided to the security element 14 where they are stored in step S7 of Figure 2. The personalization data 18 provided to the security element 14 by the personalization entity 40 could be security element individual subscription authorization data (Subscription Credentials) 18a, such as an IMSI (International Mobile Subscriber Identity) and / or an authentication key Ki, with which the security element 14 in step S8 in the mobile network 20 and can communicate over this.

In the present case, the subscription authorization data 18a is already part of the initialization data 17 in encrypted form. In this case, the personalization data 18 basically comprises only one key for decrypting the subscription authorization data 18a already present on the security element 14.

According to preferred embodiments of the invention, after the successful verification of the personalization token 17a received by the security element 14, it can be marked as invalid or already used in a database of the personalization entity 40. In conjunction with the personalization token 17a received by the security element 14, the identifier ID of the security element 14 can furthermore be stored in the database of the personalization entity 40 so that the personalization entity 40 has information about which security elements have already been provided with personalization data.

According to preferred embodiments of the invention, the personalization data 18 is provided or transmitted by the personalization entity 40 to the security element 14 via a secure communication channel between the personalization entity 40 and the security entity 14. Physically, such a channel may exist between the personalization entity 40 and the security entity 14 For example, at least partially be formed via a WiFi network, for example, in a shop in which a customer acquires the mobile device 10. As in FIG. 1 is indicated by the arrows, it is also conceivable according to the invention that the personalization entity 40 via the initialization entity 30 with the security element 14 / mobile end device 10 communicates. Preferably, to establish a secure communication channel between the personalization entity 40 and the security element 14, a security element-individual key is agreed between the personalization entity 40 and the security entity 14 with which the personalization data 18 is secured. According to preferred embodiments of the invention, the secure channel between the personalization entity 40 and the security element 14 is based on a public-key infrastructure. In these preferred embodiments, the initialization data 17 transmitted to the security element 14 preferably includes a certificate of the personalization entity 40 with a public key of the personalization entity 40. Preferably, in this way, a TLS (Transport Layer Security) communication channel may exist between the personalization entity 40 and the security element 14, whereby the personalization entity 40 authenticates itself to the security element 14. In this case, a session key is agreed between the security element 14 and the personalization instance, which can not be recalculated by the initialization entity 30. The authentication of the security element 14 with respect to the personalization entity 40 preferably takes place via the personalization key 17a.

According to preferred embodiments of the invention, the personalization entity 40 is configured to check the validity of the personalization token 17a by means of further mechanisms in order to recognize and possibly reject the misuse of personalization tokens. In this It is conceivable that the initialization entity 30 (preferably the manufacturer of the security element 14) of the personalization entity 40 must provide information about which personalization token has been loaded on which security element 14 identified by its identifier. Furthermore, mechanisms for tracking personalization tokens may be provided. In this case, the path of the mobile terminal in which the security element 14 is installed can be tracked. It can be provided that the use of a personalization token is only possible within a certain time window from the provision of a personalization token.

Claims

Patent claims

A method of personalizing a security element (14) for a terminal (10) for communication over a cellular network (20), the method comprising the steps of:

- providing initialization data (17) from an initialization entity (30) to the security element (14), the initialization data (17) comprising a personalization token (17a);

- providing the personalization token (17a) from the security element (14) to a personalization entity (40);

- checking the validity of the personalization token (17a) by the personalization entity (40); and

after successfully checking the validity of the personalization token (17a), providing personalization data (18) from the personalization entity (40) to the security element (14);

wherein authorization data (18a) for the authentication of the security element (14) in encrypted form is already part of the initialization data and the personalization data comprises a key for decrypting the authorization data (18a).

2. The method of claim 1, wherein prior to the step of providing the initialization data (17) from the initialization entity (30) to the security element (14) the method includes the further step of providing the initialization data (17) and a batch of personalization tokens (17a). from the personalization entity (40) to the initialization entity (30).

The method of claim 2, wherein the personalization tokens (17a) are digitally signed by the personalization entity (40).

4. The method according to any one of the preceding claims, wherein providing the personalization data (18) from the personalization entity (40) to the security element (14) via a secure communication channel between the personalization entity (40) and the security element (14).

5. The method of claim 4, wherein for establishing a secure communication channel between the personalization entity (40) and the security element (14) a security element individual key between the personalization entity (40) and the security element (14) is agreed, with the personalization data ( 18) are secured.

6. The method according to claim 4 or 5, wherein the secure communication channel between the personalization entity (40) and the security element (14) is based on a public key infrastructure and the initialization data (17) transmitted to the security element (14) will include a certificate of the personalization entity (40) with a public key of the personalization entity (40).

7. The method of claim 6, wherein between the personalization entity (40) and the security element (14) a TLS communication channel is formed.

8. The method according to any one of the preceding claims, wherein the

Security element (14) in the step of providing the personalization token (17a) to the personalization entity (40) next to the personalization token (17a) an identifier of the security element (14) to the personalization entity (40) transmits.

A method according to any one of the preceding claims, wherein more than one personalization token (17a) is provided on the security element (14).

The method of any one of the preceding claims, wherein after the step of successfully checking the validity of the personalization token (17a), the method comprises the further step of marking the personalization token (17a) on the personalization entity (40) as invalid.

11. The method according to any one of the preceding claims, wherein the personalization entity (40) is configured to check by means of further mechanisms, the validity of the Personalisierungstokens (17a).

A system for personalizing a security element (14) for a terminal (10) for communication over a cellular network (20), comprising:

an initialization entity (30) configured to provide initialization data (17) to the security element (14), the initialization data (17) including a personalization token (17a); and a personalization entity (40) adapted to receive the personalization token (17a) from the security element (14), to check the validity of the personalization token (17a), and to have personalization data (17a) after successfully checking the validity of the personalization token (17a) 18) to the security element (14), wherein the personalization data (18) authorization data (18a) for authentication of the security element (14) in encrypted form already part of the initialization data and the personalization data include a key for decrypting the authorization data (18a).

13. System according to claim 12, wherein the authorization data (18a) are provided as subscription authorization data for authentication of the security element (14) with respect to the mobile radio network.

14. Security element (14), wherein the security element (14) has been personalized by the method according to one of claims 1 to 11.

15. Terminal (10) with a security element (14) according to claim 14.