# US 10,122,534 B2 · Apparatus and method for managing use of secure tokens

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,534 B2
- Document ID: US10122534B2
- Status: Granted
- Kind: B2
- Application number: 15/206,975
- Filed: 2016-07-11
- Published: 2016-11-03
- Granted: 2018-11-06
- Earliest claimed: 2013-10-04
- Assignees: AT&T Intellectual Property I, L.P.; AT&T Mobility II LLC
- Applicants: At&T Intellectual Property I, LP; At&T Mobility II LLC
- Inventors: Walter Cooper Chastain; Stephen Emille Chin; Samuel King; Michael Suozzo; Nicholas Vondrak; Ismaila Wane
- Web page: https://patentgrep.com/patent/US10122534B2

## CPC

- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04W 12/069: using certificates or pre-shared keys
- H04L 2463/121: Timestamp
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system that incorporates the subject disclosure may perform, for example, operations including receiving an encrypted secure token from a secure token application function that is remote from the communication device, storing the encrypted secure token in a secure element memory of the secure element, accessing user input requesting the encrypted secure token where the secure device processor is separate from the secure element and is in communication with the secure element, generating a modified secure token by adding identification information to the encrypted secure token and by performing a second encryption of the encrypted secure token with the identification information, receiving the modified secure token from the secure element, and providing the modified secure token to a receiving device. Other embodiments are disclosed.

## Claims

### Claim 1

A communication device comprising:
a secure element having a secure element memory with first executable instructions, wherein the secure element, responsive to executing the first executable instructions, facilitates performance of first operations, the first operations comprising:
storing a secure token in the secure element memory;
modifying the secure token utilizing identification information resulting in a modified secure token; and
receiving token adjustment instructions over a network from a secure token application function of a server, wherein the token adjustment instructions are received via a remote management server;
a secure device processing system including a processor and having a secure device processing system memory with second executable instructions, wherein the secure device processing system is in communication with the secure element, wherein the secure device processing system, responsive to executing the second executable instructions, facilitates performance of second operations, the second operations comprising:
receiving the modified secure token from the secure element, wherein the secure device processing system does not have access to the secure token stored in the secure element memory; and
providing the modified secure token over the network to a receiving device to enable the receiving device to provide the modified secure token to the secure token application function of the server for decrypting the modified secure token to analyze the identification information and to obtain token information for use by the receiving device, wherein the server, the communication device and the receiving device are remote from each other; and
a device processing system including processor that is separate from the secure device processing system and in communication with the secure device processing system, wherein the device processing system facilitates wireless communications between the communication device and the receiving device, and wherein the secure device processing system is separate from the secure element.

### Claim 2 (depends on 1)

The communication device of claim 1, wherein the token adjustment instructions include a command to delete the secure token from the secure element memory.

### Claim 3 (depends on 1)

The communication device of claim 1, wherein the token adjustment instructions include a command to replace the secure token in the secure element memory with another secure token.

### Claim 4 (depends on 1)

The communication device of claim 1, wherein the token adjustment instructions include a command to change encryption keys associated with the secure token stored in the secure element memory.

### Claim 5 (depends on 1)

The communication device of claim 1, wherein the identification information comprises a digital signature, a time stamp or a combination thereof.

### Claim 6 (depends on 5)

The communication device of claim 5, wherein the secure element comprises a universal integrated circuit card, wherein keysets are utilized for mutual authentication of the secure element and the secure device processing system with the remote management server, and wherein the first operations of the secure element further comprise receiving an encrypted secure token from the secure token application function that is remote from the communication device.

### Claim 7 (depends on 1)

The communication device of claim 1, wherein the modifying the secure token is via a hash function.

### Claim 8 (depends on 1)

The communication device of claim 1, wherein the second operations of the secure device processing system further comprise accessing user input requesting the secure token, wherein the receiving of the modified secure token from the secure element is responsive to the accessing of the user input.

### Claim 9 (depends on 8)

The communication device of claim 8, wherein the secure token comprises a two dimensional bar code, and wherein the receiving device comprises a two dimensional bar code reader.

### Claim 10 (depends on 9)

The communication device of claim 9, wherein the second operations of the secure device processing system further comprise:
receiving, by the secure device processing system, a secure token descriptor associated with the secure token from the secure token application function; and
storing the secure token descriptor in the secure device processing system memory, wherein the user input is a selection based on the secure token descriptor.

### Claim 11 (depends on 1)

The communication device of claim 1, wherein the identification information comprises a digital signature.

### Claim 12

A method comprising:
modifying, by a communication device comprising a processing system including a processor, a secure token based on identification information resulting in a modified secure token;
providing, by the communication device, the modified secure token over a network to a receiving device to enable the receiving device to provide the modified secure token over the network to a secure token application function of a server for decrypting the modified secure token to analyze the identification information and to obtain token information for use by the receiving device, wherein the server, the communication device and the receiving device are remote from each other; and
receiving, by the communication device, token adjustment instructions over the network from the secure token application function, wherein the token adjustment instructions are received via a remote management server, and wherein keysets are utilized for authentication with the remote management server.

### Claim 13 (depends on 12)

The method of claim 12, wherein the identification information comprises a digital signature, a time stamp or a combination thereof and further comprising:
receiving, by the communication device, a secure token descriptor associated with the secure token from the secure token application function, wherein a request for the secure token is based on a selection according to the secure token descriptor.

### Claim 14 (depends on 13)

The method of claim 13, wherein the request is generated by an application being executed on the communication device and further comprising providing wireless communications between the communication device and the receiving device utilizing a device processor of the communication device.

### Claim 15 (depends on 13)

The method of claim 13, wherein the request is generated by a remote source.

### Claim 16 (depends on 12)

The method of claim 12, wherein the identification information is added to the secure token using a hash function.

### Claim 17 (depends on 12)

The method of claim 12, wherein the token adjustment instructions include one of a command to delete the secure token, a command to replace the secure token with another secure token, or a command to change encryption keys associated with the secure token.

### Claim 18

A non-transitory, machine-readable storage medium, comprising executable instructions that, when executed by a processing system including a processor executing a secure token application function, facilitate performance of operations, comprising:
receiving over a network a modified secure token from a receiving device that obtained the modified secure token over the network from a communication device according to user input associated with a token descriptor, wherein the processing system, the receiving device and the communication device are remote from each other;
decrypting the modified secure token to obtain an encrypted secure token and to obtain identification information;
verifying the identification information;
decrypting the encrypted secure token to obtain a secure token;
analyzing the secure token to obtain token information;
providing a notification over the network to the receiving device indicating a result of the analyzing of the token information; and
providing token adjustment instructions over the network to the communication device, wherein the token adjustment instructions are provided via a remote management server,
wherein the encrypted secure token is provided over the network to the communication device via the remote management server.

### Claim 19 (depends on 18)

The non-transitory, machine-readable storage medium of claim 18, wherein the token adjustment instructions include one of a command to delete the encrypted secure token, a command to replace the encrypted secure token with another encrypted secure token, or a command to change encryption keys associate with the encrypted secure token.

### Claim 20 (depends on 18)

The non-transitory, machine-readable storage medium of claim 18, wherein the operations further comprise comparing the secure token obtained from the decrypting to another secure token that was generated and stored by the secure token application function, wherein the decrypting of the encrypted secure token to obtain the secure token utilizes a transport key, and wherein keysets are utilized for mutual authentication of a secure element and a secure device processor of the communication device with the remote management server.