Abstract:
A system for transferring a profile that is stored at an authentication module includes: a first terminal that includes a first authentication module and that operates based on a user profile that is stored at the first authentication module; a second terminal that includes a second authentication module and that requests the user profile by transmitting a first message including user identification information; and a management server that receives the first terminal and that acquires a profile that is stored at the first terminal based on user identification information and that transmits the acquired profile to the second terminal, wherein the first terminal exports the stored profile, and the second terminal installs a profile, having received from the management server at the second authentication module.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application claims priority to and the benefit of Korean Patent Application No. 10-2012-0064521, 10-2012-0099087, and 10-2013-0065995 filed in the Korean Intellectual Property Office on Jun. 15, 2012, Sep. 7, 2012, and Jun. 10, 2013, the entire contents of which are incorporated herein by reference. 
       BACKGROUND 
       [0002]    (a) Field of the Invention 
         [0003]    The present invention relates to a method and system for transferring a profile of an authentication module. 
         [0004]    (b) Description of the Related Art 
         [0005]    A universal integrated circuit card (UICC) is a smart card that is inserted into a terminal and is a module for user authentication. The UICC can store a profile including a user&#39;s personal information and provider information of a mobile communication provider in which a user subscribes. For example, the UICC may include international mobile subscriber identity (IMSI) for identifying a user. The UICC is called a subscriber identity module (SIM) card in a global system for mobile (GSM) method and a universal subscriber identity module (USIM) card in a wideband code division multiple access (WCDMA) method. 
         [0006]    A terminal performs user authentication using information that is stored at the UICC. Therefore, a user can conveniently communicate, authenticate, and pay using the UICC. Further, when the user replaces a terminal, the user inserts an UICC of an existing terminal into a new terminal. Therefore, by replacing a detachable UICC, the user can transfers the user&#39;s personal information and mobile communication provider information to a new apparatus. 
         [0007]    Nowadays, a communication terminal such as machine to machine (M2M) is produced in a small size. At such a terminal, instead of a detachable UICC, an embedded UICC (eUICC) is mounted. The eUICC cannot be physically removed from a terminal or inserted into a terminal, unlike the detachable UICC. Therefore, it is difficult to transfer a profile that is stored at the UICC to another embedded UICC or another repository. 
       SUMMARY 
       [0008]    The present invention has been made in an effort to provide a method and system having advantages of transferring a profile of an authentication module. 
         [0009]    An exemplary embodiment of the present invention provides a system for transferring a profile that is stored at an authentication module, the system including: a first terminal that includes a first authentication module and that operates based on a user profile that is stored at the first authentication module; a second terminal that includes a second authentication module and that requests the user profile by transmitting a first message including user identification information; and a management server that receives the first terminal and that acquires a profile that is stored at the first terminal based on user identification information and that transmits the acquired profile to the second terminal, wherein the first terminal exports the stored profile, and the second terminal installs a profile, having received from the management server at the second authentication module. 
         [0010]    The system may further include a provider server that is connected to the first terminal based on the profile, wherein the provider server may search for the provider server based on the user identification information and transmit a second message that requests a profile corresponding to the user identification information to the provider server. 
         [0011]    The provider server may receive the second message, search for the first terminal based on the user identification information, transmit a third message that requests a profile to the first terminal, and transmit a profile, having received from the first terminal to the management server. 
         [0012]    The first terminal may encrypt a profile that is stored at the authentication module based on a first credential that shares with the provider server and transmit the encrypted profile to the provider server. 
         [0013]    The provider server may decrypt a received profile based on the first credential. 
         [0014]    The provider server may encrypt the decrypted profile based on a second credential that shares with the management server and transmit the encrypted profile to the management server. 
         [0015]    The management server may encrypt a profile that transmits to the second terminal based on a third credential that shares with the second terminal. 
         [0016]    The second terminal may decrypt a received profile based on the third credential. 
         [0017]    The second terminal may export the stored profile to the first terminal by transmitting a profile that is stored at the second authentication module to the management server and delete the stored profile. 
         [0018]    Another embodiment of the present invention provides a method in which a terminal transfers a profile that is stored at an authentication module, the method including: receiving a profile request message from a server; encrypting a first profile that is stored at the authentication module based on credentials; transmitting the encrypted first profile to the first server; and disabling the first profile that is stored at the authentication module. 
         [0019]    The credential may be a key in which the terminal uses for loading, installing, or managing a profile. 
         [0020]    The method may further include: receiving an encrypted second profile from the server; decrypting the received second profile based on the credentials; and installing information of the decrypted second profile at the authentication module. 
         [0021]    Yet another embodiment of the present invention provides a method in which a terminal transfers a profile that is stored at an authentication module, the method including: transmitting a profile request message including user identification information to a server; receiving an encrypted profile from the server; decrypting the profile based on credentials sharing with the server; and installing the decrypted profile at an authentication module. 
         [0022]    The credentials may be a value in which the terminal and the server share. 
         [0023]    The method may further include: encrypting a profile that is stored at the authentication module based on the credentials; transmitting a profile restoration message including the encrypted profile to the server; and deleting a profile that is stored at the authentication module. 
         [0024]    According to an exemplary embodiment of the present invention, even if a user cannot physically detach an embedded authentication module, the user can freely transfer a profile between the embedded authentication modules. According to an exemplary embodiment of the present invention, because the user can import a profile to a desired terminal, the user can use a plurality of terminals in the same environment. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0025]      FIG. 1  is a diagram illustrating a communication system according to an exemplary embodiment of the present invention. 
           [0026]      FIGS. 2A ,  2 B, and  3  are flowcharts illustrating a method of acquiring a profile according to an exemplary embodiment of the present invention. 
           [0027]      FIGS. 4A ,  4 B, and  5  are flowcharts illustrating a method of restoring a profile according to another exemplary embodiment of the present invention. 
           [0028]      FIGS. 6 and 7  illustrate an application screen for acquiring a profile according to an exemplary embodiment of the present invention. 
           [0029]      FIGS. 8 and 9  illustrate an application screen for restoring a profile according to an exemplary embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0030]    In the following detailed description, only certain exemplary embodiments of the present invention have been shown and described, simply by way of illustration. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. Accordingly, the drawings and description are to be regarded as illustrative in nature and not restrictive. Like reference numerals designate like elements throughout the specification. 
         [0031]    Throughout the specification, unless explicitly described to the contrary, the word “comprise” and variations such as “comprises” or “comprising”, will be understood to imply the inclusion of stated elements but not the exclusion of any other elements. 
         [0032]      FIG. 1  is a diagram illustrating a communication system according to an exemplary embodiment of the present invention. 
         [0033]    Referring to  FIG. 1 , a communication system  1  includes a first terminal  100 , a second terminal  200 , a management server  300 , and at least one provider server  400 . The management server  300  performs management for safely transferring a profile. The management server  300  may be a subscriber management server (SMS). The provider server  400  may be a server of a mobile network operator (MNO). The management server  300  and the provider server  400  may be integrated. 
         [0034]    The first terminal  100  and the second terminal  200  include authentication modules  110  and  210 , respectively. The authentication module may be replaced with various terms such as an authorization module, a certification module, a subscriber identification module, a subscriber identification module card, and a universal subscriber identification module. The authentication module  110 / 210  may be an embedded authentication module that is embedded in the terminal  100 / 200 . The embedded authentication module  110 / 210  cannot be removed by being separated from the terminal  100 / 200 . The embedded authentication module that is mounted in the terminal cannot be replaced with another embedded authentication module. Here, the embedded authentication module may be embedded universal integrated circuit card (eUICC). 
         [0035]    The authentication module  110 / 210  stores profiles. The profile includes various information related to terminal operation such as user authentication information. The profile may include a user&#39;s personal information and provider information of a communication provider in which a user subscribes. The terminal performs user authentication or terminal authentication using profiles. 
         [0036]    A profile  10  may be installed at the authentication module  110  of the first terminal  100 , and the authentication module  210  of the second terminal  200  may be empty. In this case, the second terminal  200  imports a profile from the first terminal  100  through the management server  300  and the provider server  400 , and the first terminal  100  exports a profile to the second terminal  200  through the management server  300  and the provider server  400 . That is, when the user replaces a terminal, an authentication module is not replaced, a profile that is stored at the authentication module is transferred. 
         [0037]    The first terminal  100  transmits the profile  10  to the second terminal  200  through the management server  300  and the provider server  400 . The first terminal  100 , having transmitted the profile  10  disables the profile  10 . The second terminal  200 , having received the profile  10  installs the profile  10  at the authentication module  210  and enables the profile  10 . That is, the profile is activated only in one terminal. 
         [0038]    The second terminal  200  transmits the profile  10  to the first terminal  100 , which is an original position. The second terminal  200 , having transmitted the profile  10  deletes the profile  10 . The first terminal  100 , having received the profile  10  activates the profile  10 . 
         [0039]    The management server  300  and the provider server  400  are positioned between the second terminal  200  and the first terminal  100  and transfer the profile. For this purpose, the second terminal  200  and the management server  300 , the management server  300  and the provider server  400 , and the provider server  400  and the first terminal  100  communicate. In this case, transmission information in which communication subjects give and receive is encrypted based on credentials that are shared between the communication subjects. That is, the profile is encrypted, and transmitted at the outside of an authentication module. 
         [0040]      FIGS. 2 and 3  are flowcharts illustrating a method of acquiring a profile according to an exemplary embodiment of the present invention. 
         [0041]    Referring to  FIG. 2A , the second terminal  200  requests a user profile to the management server  300  (S 110 ). The second terminal  200  transmits user identification information to authenticate a user that is related to a profile request. The second terminal  200  has initial information for connecting a management server. User identification information may be subscriber identification information. User identification information may be, for example, user credentials or terminal intrinsic information. User credentials may be, for example, identification (ID), a password, and an access token. Terminal intrinsic information may be, for example, international mobile subscriber identity (IMSI). 
         [0042]    When requesting a profile, the management server  300  determines the provider server  400  in which a user subscribes based on transmitted user identification information (S 120 ). For example, the management server  300  may use intrinsic identification information of a provider server such as ID/PW or IMSI information of a user. 
         [0043]    The management server  300  requests a user profile to the provider server  400  (S 122 ). 
         [0044]    The provider server  400  identifies a registered terminal, i.e., the first terminal  100  at which a user profile is stored (S 130 ). The first terminal  100  is connected to a communication provider network in which the user subscribes based on a user profile. Therefore, the provider server  400  that can identify a user of the terminal can know that a requested user profile is installed at the first terminal  100 . That is, the provider server  400  searches for the first terminal  100  corresponding with user identification information of the second terminal  200  among terminals, having connected to a network thereof. 
         [0045]    The provider server  400  requests a profile to the first terminal  100  (S 132 ). 
         [0046]    The first terminal  100  encrypts a profile that is stored at the authentication module  110  based on a first credential that is shared with the provider server  400  (S 140 ). The first credential in which the first terminal  100  and the provider server  400  share may be a key that uses when the first terminal  100  loads, installs, or manages a profile. The first credential may exist at an embedded authentication module. 
         [0047]    The first terminal  100  transmits the encrypted profile to the provider server  400  (S 142 ). 
         [0048]    The first terminal  100  disables the profile (S 144 ). 
         [0049]    The provider server  400  decrypts a profile based on the first credential that is shared with the first terminal  100  (S 150 ). 
         [0050]    The provider server  400  encrypts a profile based on a second credential that is shared with the management server  300  (S 152 ). 
         [0051]    Referring to  FIG. 2B , the provider server  400  transmits the encrypted profile to the management server  300  (S 154 ). 
         [0052]    The management server  300  decrypts a profile based on the second credential that is shared with the provider server  400  (S 160 ). 
         [0053]    The management server  300  encrypts a profile based on a third credential that is shared with the second terminal  200  (S 162 ). The third credential in which the management server  300  and the second terminal  200  share may be a key using when the second terminal  200  loads, installs, or manages a profile. The third credential may exist at an embedded authentication module. 
         [0054]    The management server  300  transmits the encrypted profile to the second terminal  200  (S 164 ). 
         [0055]    The second terminal  200  decrypts a profile based on the third credential that is shared with the management server  300  (S 170 ). 
         [0056]    The second terminal  200  installs the profile at the authentication module  210  (S 180 ). 
         [0057]    The second terminal  200  executes the profile (S 190 ). 
         [0058]    Referring to  FIG. 3 , the first terminal  100  receives a profile request of a user from the provider server  400 . 
         [0059]    The first terminal  100  encrypts the profile  10  based on a first credential  20  that is shared with the provider server  400  (S 210 ). 
         [0060]    The first terminal  100  transmits the encrypted profile  10  to the provider server  400  (S 212 ). The first terminal  100  disables the profile  10  (S 214 ). 
         [0061]    The provider server  400  decrypts the profile  10  based on the first credential  20  that is shared with the first terminal  100  (S 220 ). 
         [0062]    The provider server  400  encrypts the profile  10  based on the second credential  30  that is shared with the management server  300  (S 222 ). 
         [0063]    The provider server  400  transmits the encrypted profile  10  to the management server  300  (S 224 ). 
         [0064]    The management server  300  decrypts the profile  10  based on the second credential  30  that is shared with the provider server  400  (S 230 ). 
         [0065]    The management server  300  encrypts the profile  10  based on a third credential  40  that is shared with the second terminal  200  (S 232 ). 
         [0066]    The management server  300  transmits the encrypted profile  10  to the second terminal  200  (S 234 ). 
         [0067]    The second terminal  200  decrypts the profile  10  based on the third credential  40  that is shared with the management server  300  (S 240 ). 
         [0068]    The second terminal  200  executes the profile (S 242 ). 
         [0069]    In this way, the user imports the profile of the first terminal  100  to the second terminal  200 . The user can safely import the user&#39;s personal information that is stored at the first terminal  100  and provider information of a communication provider in which the user subscribes to the second terminal  200  without replacement of an authentication module. 
         [0070]      FIGS. 4 and 5  are flowcharts illustrating a method of restoring a profile according to another exemplary embodiment of the present invention. 
         [0071]    Referring to  FIG. 4A , the user may temporarily use the second terminal  200  that imports the profile and again use the first terminal  100 . 
         [0072]    The second terminal  200  transmits the stored profile to the first terminal  100  and deletes the stored profile. The first terminal  100  executes the received profile  10 . Here, a profile in which the second terminal  200  transmits to the first terminal  100  may be a profile in which partial information such as personal information is updated in a profile in which the second terminal  200  receives from the first terminal  100 . 
         [0073]    The second terminal  200  encrypts the profile  10  based on a third credential that is shared with the management server  300  (S 310 ). 
         [0074]    The second terminal  200  requests restoration of a profile to the management server  300  (S 312 ). The second terminal  200  transmits the encrypted profile  10  and user identification information to the management server  300 . 
         [0075]    The second terminal  200  deletes the profile  10  (S 314 ). 
         [0076]    The management server  300  decrypts the profile  10  based on a third credential that is shared with the second terminal  200  (S 320 ). 
         [0077]    The management server  300  determines the provider server  400  in which the user subscribes based on user identification information that is related to profile restoration (S 322 ). 
         [0078]    The management server  300  encrypts the profile  10  based on a second credential that is shared with the provider server  400  (S 324 ). 
         [0079]    The management server  300  requests restoration of a user profile to the provider server  400  (S 326 ). The management server  300  transmits the encrypted profile to the provider server  400 . 
         [0080]    Referring to  FIG. 4B , the provider server  400  decrypts a profile based on the second credential that is shared with the management server  300  (S 330 ). 
         [0081]    The provider server  400  identifies a terminal, i.e., the first terminal  100  to restore a profile (S 332 ). 
         [0082]    The provider server  400  encrypts a profile based on the first credential that is shared with the first terminal  100  (S 334 ). 
         [0083]    The provider server  400  requests restoration of a profile to the first terminal  100  (S 336 ). The provider server  400  transmits the encrypted profile to the first terminal  100 . 
         [0084]    The first terminal  100  decrypts a profile based on the first credential that is shared with the provider server  400  (S 340 ). 
         [0085]    The first terminal  100  installs the profile  10  at the authentication module  110  (S 350 ). 
         [0086]    The first terminal  100  executes the profile  10  (S 360 ). 
         [0087]    Referring to  FIG. 5 , the second terminal  200  encrypts the profile  10  based on the third credential  40  sharing with the management server  300  (S 410 ). 
         [0088]    The second terminal  200  requests restoration of a profile to the management server  300  (S 412 ). In this case, the second terminal  200  transmits the encrypted profile  10  to the management server  300  based on the third credential  40 . 
         [0089]    The second terminal  200  deletes the profile  10  (S 414 ). 
         [0090]    The management server  300  decrypts the profile  10  based on the third credential  40  that is shared with the second terminal  200  (S 420 ). 
         [0091]    The management server  300  encrypts the profile  10  based on the second credential  30  that is shared with the provider server  400  (S 422 ). 
         [0092]    The management server  300  requests restoration of a user profile to the provider server  400  (S 424 ). The management server  300  transmits the encrypted profile  10  to the provider server  400 . 
         [0093]    The provider server  400  decrypts the profile  10  based on the second credential  30  that is shared with the provider server  400  (S 430 ). 
         [0094]    The provider server  400  encrypts the profile  10  based on the first credential  20  that is shared with the first terminal  100  (S 432 ). 
         [0095]    The provider server  400  transmits the encrypted profile  10  to the first terminal  100  (S 434 ). 
         [0096]    The first terminal  100  decrypts the profile  10  based on the first credential  20  that is shared with the provider server  400  (S 440 ). 
         [0097]    The first terminal  100  executes the profile (S 442 ). 
         [0098]      FIGS. 6 and 7  illustrate an application screen for acquiring a profile according to an exemplary embodiment of the present invention. 
         [0099]    Referring to  FIG. 6 , the second terminal  200  provides an application for transferring a profile. When the second terminal  200  executes an application, the application displays a get profile icon  510  and a backup profile icon  520  at a display  500  of the second terminal  200 . The application has information for connecting the management server  300 . 
         [0100]    When the user presses the get profile icon  510 , the second terminal  200  requests a profile that is stored at another terminal to the management server  300 . 
         [0101]    The second terminal  200  decrypts and executes the profile, having received from the management server  300 . Therefore, as shown in  FIG. 7 , the application may display a guide window  530  representing that a profile is imported and the second terminal  200  operates at the display  500 . 
         [0102]      FIGS. 8 and 9  illustrate an application screen for restoring a profile according to an exemplary embodiment of the present invention. 
         [0103]    Referring to  FIG. 8 , when the user presses a profile restoration icon  520 , the second terminal  200  requests profile restoration of the first terminal  100  to the management server  300 . 
         [0104]    The second terminal  200  deletes a stored profile. Therefore, as shown in  FIG. 9 , the application may display a guide window  540  representing that a profile is exported and the second terminal  200  does not operate at the display  500 . 
         [0105]    In this way, according to an exemplary embodiment of the present invention, even if an embedded authentication module cannot be physically detached, the profile can be freely transferred between the embedded authentication modules. According to an exemplary embodiment of the present invention, because a user can import a profile to a desired terminal, a plurality of terminals can be used in the same environment. 
         [0106]    An exemplary embodiment of the present invention may be not only embodied through an apparatus and method but also embodied through a program that executes a function corresponding to a configuration of the exemplary embodiment of the present invention or through a recording medium on which the program is recorded. 
         [0107]    While this invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.