Patent ID: 9210138
Filing Date: 2015-12-08
Classification: H04L,H04W

Abstract:
1. A method for providing end-to-end security for transport of a profile associated with a particular service provider to a target device over at least one communications network that includes a plurality of nodes, the method comprising: encrypting the profile between the target device and an initial node of the network through which the profile is transported, the encryption being an end-to-end inner layer encryption performed prior to hop-to-hop encryption, the encrypting using a device public key of a device public, private key pair, the device private key being derivable from a seed that is unique to a secure element of the target device and securely provisioned in the secure element and a service provider identifier associated with the particular service provider using a key generation function; using the device public key and a service provider private key to perform key agreement to create a profile encryption key that is used to encrypt the profile; and transmitting the encrypted profile over the at least one communications network to the target device, wherein a service provider key pair that includes the service provider private key is unique to a particular population of secure elements respectively located in a population of target devices, wherein a decryption key is calculable by the target device from the device private key and a service provider public key in the service provider key pair.