Method for provisioning an applet with credentials of a terminal application provided by an application server and corresponding OTA platform

A method for provisioning an applet in a security element with credentials of a terminal application provided by an application server comprises: Sending a request to provision the applet with credentials from the terminal application to the applet; Sending an SMS message containing an identifier of the applet from the applet to an OTA platform; Adding the MSISDN of the security element by an SMSC located in front of the OTA platform in the header of the SMS; Requesting the credentials from the OTA platform to the application server; Sending from the application server to the OTA platform the credentials to be associated with the MSISDN; Sending from the OTA platform to the applet the credentials associated with the MSISDN; and Sending from the applet to the terminal application a message that it has been provisioned with credentials of the terminal application.

The present invention enters in the scope of telecommunications and in particular in the provisioning of credentials for an application present in a telecommunication terminal.

More precisely, the present invention concerns among others a method for verifying seamlessly the MSISDN (Mobile Station International Subscriber Directory Number) of an end-user when he wants to subscribe to a service identifying the subscriber identity based on his MSISDN. The MSISDN is the telephone number that is assigned to a mobile user.

There are a large number of handset applications (or terminal applications in general) that, are identifying the end-user with his MSISDN, for example WiFi Offload applications, VoLTE, VoWiFi, VoIP, etc . . . .

FIG. 1represents a system in which an application server10containing applications or services11,12can interact with a terminal13. Application server10acts as a service provider.

The terminal13is typically a handset a smartphone or a PDA and contains a security element14, typically a SIM card, a UICC or an embedded UICC also called eUICC (UICC not extractible from the terminal13). Terminal13can communicate with the network of a MNO (Mobile Network Operator) and especially with an OTA platform15. This OTA platform15can communicate with the application server10and constitutes a bridge between the terminal13and the application server10.

When the user of the terminal13wishes to download a service11,12from the application server10, it connects to the OTA platform15and downloads this service after having entered a login and a password. The service is then stored in the terminal13in a so called terminal application16.

The application server10is for example a server belonging to Google™ or Apple™.

In order to activate the terminal application16in his terminal13(for instating it), the user has generally to enter his MSISDN for ensuring the application server10that the terminal13on which the application18has been downloaded is the one that is entitled to use it. This is called the “OTP solution”. For this purpose, the application server10sends (via SMS) a OTP (One Time Password) to the terminal13. The user has then to type in the OTP in the user interface of the handset application. The issue with solution is that it obliges the end-user to go “out” on the handset application, enter the SMS application, open the received SMS containing the OTP, read and remember the OTP, reopen the handset application and type in the OTP.

This is not a user friendly solution at all and it requires an additional authentication server (for generating and verifying the OTP).

Another known solution is called “GGSN solution”. The gateway GPRS support node (GGSN) is a main component of the GPRS network. The GGSN is responsible for the internet working between the GPRS network and external packet switched networks, like the Internet and X.25 networks.

In this solution, the terminal application16sends a http request to the application server10through the GGSN, the GGSN intercepts the request and adds the MSISDN as a header. The application server10can then automatically know the MSISDN of the end-user. The issue here is that not all the MNOs are able and/or willing to change their GGSN behaviour in order to add the MSISDN in the request.

Another solution is called “mobile ID solution”: The terminal application18asks the end-user to type his MSISDN and sends a http request to the server10with the MSISDN. The server sends a formatted SMS to a Mobile ID applet based on OTP. The applet prompts the end-user to confirm the request and sends back the response to the application server10. The issue with this solution is that it requires a specific authentication server and a large applet (25 Kbytes) not easy to deploy (especially to SIMs already deployed) and requires large free memory space.

The problem solved by the present invention is to avoid impersonation and to ensure that the MSISDN belongs effectively to the end-user, in a user friendly manner.

More precisely, one of the purposes of the invention is to propose a solution that can be easily pre-deployed or even deployed during provisioning process.

Another purpose is to propose a solution that is user friendly with no end-user interaction (no manual entry of the MSISDN).

These purposes, among others are reached thanks to a method for provisioning an applet with credentials of a terminal application provided by an application server, the applet being comprised in a security element of a terminal, the method consisting in:Sending a request to provision the applet with credentials from the terminal application to the applet;Sending a SWS message containing an identifier of the applet, from the applet to an OTA platform;Adding the MSISDN of the security element by a SMSC located in front of the OTA platform in the header of the SMS;Requesting the credentials from the OTA platform to the application server;Sending from the application server to the OTA platform the credentials to be associated with the MSISDN;Sending from the OTA platform to the applet the credentials associated with the MSISDN;Sending from the applet to the terminal application a message informing the terminal application that it has been provisioned with credentials of the terminal application.

The invention also concerns a computer program product implemented in an applet composed in a security element, the computer program product being configured to be operable to:Send a SMS message containing ah identifier of the applet to an OTA platform, at the request of a terminal application to be provisioned with credentials;Receive from the OTA platform the credentials of the terminal application and the MSISDN of the security element;Send to the terminal application a message Informing the terminal application that it has been provisioned with credentials of the terminal application.

Finally, the invention concerns an OTA platform comprising means for:Receiving from an applet comprised in a security element of a terminal a SMS message containing an identifier of the applet, the SMS message containing the MSISDN of the security element and a request for getting credentials for a terminal application present in the terminal;Sending the request to an application server with the MSISDN;Receiving from the application server the credentials to be associated with the MSISDN;Sending to the applet the credentials associated with the MSISDN.

FIG. 2represents the provisioning steps of an applet with credentials of an application server according to the present invention.

The provisioning steps of this figure have the purpose to enrol the terminal application16with the application server10. A terminal application16is one of the terminal applications11or12represented inFIG. 1. The enrolment has the purpose to store credentials of the application server10in the security element14without requiring from the end-user to enter his MSISDN in his terminal13. The security element14contains, according to the invention, an applet20which function will now be described. Prior to this enrolment, the terminal application18has been downloaded in the terminal13.

Seven main steps are represented inFIG. 2.

The first step (1) of the enrolment consists in sending from the terminal application16to the applet20a request to provision the applet20with credentials. These credentials are typically at the level of the application server10from which the terminal application18has been downloaded. The credentials of a terminal application18can for example consist in a security key. This request also consists in requiring to the applet20to check the MSISDN of the security element14, here constituted by a UICC. In the scope of the invention, the terminal application18has access to the security element14.

The second step (2) consists in sending from the applet20to an OTA platform15a SMS message containing an identifier of the applet20(for example its AID-AID standing for Application Identifier). An AID defined in ISO 7816-5 and is a sequence of bytes between 5 and 16 bytes in length. This SMS contains information requesting the provisioning of the applet20with credentials relative to the terminal application18. The wireless network between the terminal13and the OTA platform15supports the sending of SMS (2G, 3G, or VoLTE for example).

The third step (3) consists in adding the MSISDN of the security element14by a SMSC not represented (Short Message Service Center) located in front of the OTA platform15in the header of the SMS (i.e. between the terminal13and the OTA platform15). The SMSC has a table of correspondence between the received IMSI (or TMSI) transmitted by the terminal13when communication is established with the OTA platform and the MSISDN. When receiving this SMS, the OTA platform15extracts the applet identifier and understands that there is a request to provision the applet20with credentials of the terminal application16.

The OTA platform15also retrieves from the header of the received SMS the MSISDN that has been added by the SMSC.

The fourth step (4) consists in requesting from the OTA platform15to the application server10credentials for the terminal application16. In this request, at least the MSISDN of the security element14is transmitted to the application server10.

The fifth step (5) consists in sending from the application server10to the OTA platform15the requested credentials to be associated with the received MSISDN. The credentials are unique for each MSISDN in order that if credentials are hacked, the hacker will not have access to the service provided to each end-user.

The OTA platform15then (at step6) sends back to the applet20the requested credentials associated with the MSISDN. At this step, the applet20is provisioned with credentials (a key for example) and the MSISDN of the security element14.

The seventh step (7) consists in sending from the applet20to the terminal application16a message informing the terminal application16that the applet20has been provisioned with credentials of the terminal application16. Optionally, the applet20also transmits the received MSISDN to the terminal application16.

FIG. 3represents the access to a service of a terminal application provisioned according toFIG. 2. The access to a service does not require the presence of an OTA platform.

In a first step (1), the terminal application16requests access to a service provided by the application server10. This request includes the sending of the MSISDN of the security element14. If the MSISDN has net been transmitted optionally during step7ofFIG. 2to the terminal application16, the terminal application16requests this MSISDN in a precedent step to the applet20. The important point is that the terminal application must have the MSISDN in order to be able to transmit it to the application server10.

In a second step (2), the application server10sends a challenge (a random value) to the terminal application16that towards this challenge (in a third step (3)) to the applet20. The applet20then computes (step4) the response to the challenge by using the credentials received at provisioning stage (step6ofFIG. 2). The computation can be expressed by the following function F:
Response=F(credentials, challenge)

The applet then sends this response to the terminal application16(step5).

In a sixth step (6), the terminal application16forwards this response to the application server10and in a final step (7), the application server10verifies the response (by using the sent challenge and the credentials assigned during the enrolment procedure to the MSISDN of the security element14). If the response computed by the applet20is identical to the result of the same function computed at the level of the application server10, the MSISDN is correct (the credentials assigned to the applet20correspond to the MSISDN used for getting these credentials during the enrolment phase ofFIG. 2) and access to the service is allowed. Otherwise, access to the service is denied.

This process for accessing to a service occurs at each request of the end-user for accessing to the specifies service.

The present invention also concerns a computer program product implemented in the applet20comprised in the security element14. According to the invention, the computer program product is configured to be operable to:Send a SMS message containing an identifier of the applet20to the OTA platform15, at the request of the terminal application16to be provisioned with credentials;Receive from the OTA platform15the credentials of the terminal application16and the MSISDN of the security element14;Send to the terminal application16a message informing the terminal application16that it has been provisioned with credentials of the terminal application16.

The present invention also concerns an OTA platform15comprising means for:Receiving from the applet20comprised in the security element14of the terminal13a SMS message containing an Identifier of the applet20, the SMS message containing the MSISDN of the security element14(added by the SMSC) and a request for getting credentials for the terminal application present in the terminal13;Sending the request to the application server10with the MSISDN;Receiving from the application server10the credentials to be associated with the MSISDN;Sending to the applet20the credentials associated with this MSISDN.

The advantages of the inventions are:The size of the applet20is very limited (around 1 KB);The enrolling method is very secured since it is based on a security element like a Sim, a UICC or a eUICC;It does not require any change in the operator's network neither additional server.