Source: http://patents.com/us-9686290.html
Timestamp: 2017-10-17 15:27:22
Document Index: 251565046

Matched Legal Cases: ['arty 50', 'arty 50', 'arty 50', 'arty 50', 'arty 50', 'arty 50']

US Patent # 9,686,290. Procedure for the preparation and performing of a post issuance process on a secure element - Patents.com
United States Patent 9,686,290
Vilmos , et al. June 20, 2017
Family ID: 1000002661247
15/080,815
US 20160212149 A1 Jul 21, 2016
13654060 Mar 29, 2016 9298646
Current CPC Class: H04L 63/123 (20130101); G06F 12/1408 (20130101); G06F 12/1416 (20130101); H04L 63/04 (20130101); H04L 63/20 (20130101)
Current International Class: H01L 29/06 (20060101); G06F 12/14 (20060101); H04L 29/06 (20060101)
6591098 July 2003 Shieh
7266371 September 2007 Amin
8549110 October 2013 Jerbi
2004/0117618 June 2004 Kawaguchi
2008/0003980 January 2008 Voss
2006003712 Jan 2006 KR
This application is a continuation of U.S. patent application Ser. No. 13/654,060, filed on Oct. 17, 2012, issued as U.S. Pat. No. 9,298,646, issued on Mar. 29, 2016, which, in turn, is a continuation-in-part of U.S. patent application Ser. No. 12/799,133, filed on Apr. 19, 2010 which, in turn, is a continuation-in-part of PCT/HU2008/000114, filed on Oct. 6, 2008, and claims priority to Hungarian Patent Application No P0700685 filed on Oct. 20, 2007.
1. A method for enabling a post issuance operation on a secure element (SE) controlled by a SE controlling party, the method comprising: performing the following in a communication device comprising a secure element (SE), wherein the SE has at least one security domain, and wherein the SE is already personalized, the SE requiring access parameters to perform at least one post issuance operation on the SE, the method comprising: receiving by the communication device a request to perform the at least one post issuance operation on the SE, the post issuance operation comprising an operation performed on the SE after personalization of the SE; querying the SE by the communication device for first data suitable for the identification of the SE and second data for contacting at least one of an SE controlling party or an agent of the SE controlling party; collecting from the SE by the communication device the first data and the second data; creating by the communication device a post issuance operation request data packet comprising the first data and request information relating to the request to perform the at least one post issuance operation on the SE; and electronically sending by the communication device the post issuance operation request data packet via a remote communication channel according to the second data to the at least one of the SE controlling party or the agent of the SE controlling party.
2. The method according to claim 1, wherein the agent of the SE controlling party is a trusted service manager.
3. The method according to claim 1, wherein the second data comprises a pointer to a remote database containing direct contact details of the SE controlling party.
4. The method according to claim 1, wherein the data packet further comprises information identifying a user of the communication device.
5. The method according to claim 1, wherein the data packet further comprises character series identifying the communication device.
6. The method according to claim 1, wherein the data packet further comprises card production life cycle data for identification of the SE.
7. The method according to claim 1, wherein the second data comprises an information network identifier located in the SE, the information network identifier comprising at least one of a URL or an IP address of the at least one of the SE controlling party or the agent of the SE controlling party.
8. The method according to claim 1, wherein electronically sending the data packet further comprises electronically sending the data packet via a mobile communication network.
9. The method according to claim 1, wherein the SE is a software application as part of an operating system of the communication device.
10. The method according to claim 1 further comprising: receiving by the communication device via the remote communication channel an access data packet comprising the access parameters to perform the post issuance operation on the SE.
11. The method according to claim 10 further comprising: performing by the communication device the post issuance operation on the SE.
12. The method according to claim 1, wherein the post issuance operation comprises at least one of a creating a new security domain on the SE, loading a new application on the SE, installing a new application on the SE, activating a new application on the SE, configuring an application on the SE, personalizing an application on the SE, configuring a security domain on the SE, or personalizing a security domain on the SE.
13. The method according to claim 1, wherein the SE controlling party further comprises a service provider.
14. The method according to claim 1, wherein the post issuance operation is performed using an interface supporting direct data communication between the communication device and the SE controlling party.
15. The method according to claim 1 further comprising: receiving, by the communication device via the remote communication channel, other information related to the at least one post issuance operation prior to creating the post issuance operation request data packet.
16. A communication device comprising: a secure element (SE) having at least one security domain, the SE being previously personalized, the SE requiring access parameters to perform at least one operation on the SE, the SE containing first data suitable for the identification of the SE and second data for contacting at least one of an SE controlling party or an agent of the SE controlling party; the communication device configured to: receive a request to perform a post issuance operation on the SE, the post issuance operation comprising an operation performed on the SE after personalization of the SE; collect from the SE the first data and the second data; and create a post issuance operation request data packet comprising at least the first data; and a transmission hardware device configured to: electronically send the post issuance operation request data packet via a remote communication channel according to the second data to the at least one of the SE controlling party or the agent of the SE controlling party; and electronically receive information relating to the request to perform the post issuance operation on the SE from the at least one of the SE controlling party or the agent of the SE controlling party.
17. The communication device according to claim 16, wherein the second data comprises an information network identifier located in the SE, the information network identifier comprising at least one of a URL or an IP address of the at least one of the SE controlling party or the agent of the SE controlling party.
18. The communication device according to claim 16, wherein the transmission hardware device is further configured to electronically receive via the remote communication channel an access data packet comprising the access parameters to perform the post issuance operation on the SE.
19. The communication device according to claim 18, wherein the communication device is further configured to perform the post issuance operation on the SE.
20. The communication device according to claim 16, wherein the post issuance operation comprises at least one of a creating a new security domain on the SE, loading a new application on the SE, installing a new application on the SE, activating a new application on the SE, configuring an application on the SE, personalizing an application on the SE, configuring a security domain on the SE, or personalizing a security domain on the SE.
21. A secure element (SE) comprising: a security domain requiring access parameters to perform at least one operation on the security domain; and a determined data group including first data suitable for the identification of the SE and second data for contacting at least one of an SE controlling party or an agent of the SE controlling party, the SE controlling party controlling the SE; the SE configured to: provide the first data and the second data to a communication device to enable a post issuance operation on the SE after the SE is personalized; provide the first data and the second data, the first data to be sent in a request data packet by the communication device to the at least one of the SE controlling party or the agent of the SE controlling party according to the second data; and enable performance of a post issuance operation on the SE as instructed by the at least one of the SE controlling party or the agent of the SE controlling party, the post issuance operation comprising at least one of creating a new security domain on the SE, loading a new application on the SE, installing a new application on the SE, activating a new application on the SE configuring an application on the SE, personalizing an application on the SE, configuring a security domain on the SE, or personalizing a security domain on the SE.
22. The SE according to claim 21, wherein the second data comprises an information network identifier located in the SE, the information network identifier comprising at least one of a URL or an IP address of the at least one of the SE controlling party or the agent of the SE controlling party.
23. The SE according to claim 21, wherein the request data packet also includes information relating to the post issuance operation.
FIG. 2 shows the block diagram of the participating parties of an exemplary embodiment of the procedure according to the invention n.
The individual communication devices 10 may be connected to external parties, which are in the present example a service provider 30 and/or its agent 30 a (see FIG. 2), as well as being connected to a SE controlling party 50 by an information forwarding network 70 (such as the Internet or a mobile communication network). In the context of the present invention the external party is the party for whom a new security domain is created, or whose application or data is loaded, or installed on the SE, or on the behalf of whom other management functions, such as personalization and activation of applications loaded on the secure element is performed.
A plurality of other entities may also be involved in the interactions of the communication device 10 of the user 8, the service provider 30 and the SE controlling party 50 as illustrated in FIG. 2, such as one or more OTA providers 100 providing OTA (over the air) services, or one or more trusted service managers (TSM) 110, i.e. a trusted third party, who can provide the technology and service support necessary for realizing certain new types of services, for which service providers 30 and/or users 8 may not be technically ready. For example the service provider's agent 30 a can be a TSM 110 that may perform the remote application management for the service provider 30 while the user's TSM 110 may provide certain types of customer support functions for the user. Both the user 8 and the service provider 30 may employ a separate TSM 110 or the same TSM 110 may be acting for the different parties. It is also possible that the secure element issuer's 50a agent 50b is a TSM (being the actual SE controlling party 50) is the same entity which provides technical support for the service provider 30 as well as for the users 8.
In Step 134 the post issuance operation request data packet 60 was sent to the SE controlling party 50 (the SE issuer 50 a or its agent 50b) where it was processed in Step 135 in order to identify the necessary data for carrying out the post issuance process. The secure element 20 on which the security domain 22 had to be made as well as the communication device 10 containing it was identified from the position request data 60 and more specifically from the identification data 61. Following this, in Step 136 the required security domain 22 was created by the SE controlling party 50 remotely using OTA technology. This involved sending a group of instructions, according to Global Platform life-cycle management specifications. (See: Global Platform Card Specifications) to the communication device 10 containing the secure element 20 with which the security domain 22 was created.
As illustrated in FIG. 4, in Step 141 a data packet 60 relating to a post issuance operation request is created at the communication device 10 (possibly with the help of the data collecting application). In the present example the data packet 60 the supplementary data 42 preferably also comprises data relating to the size and optionally other technical requirements of the security domain 22 to be created in the secure element 20, as well as data identifying an external party (typically the service provider 30) destined to have access to the security domain 22. In step 142 this data packet 60 is sent directly to the SE controlling party 50, where it is processed in Step 143 in a similar manner as described in the above examples in connection with the post issuance operation request data packet 60 of the service provider 30.
Previous Patent US 9,686,289 | Next Patent US 9,686,291