EUICC secure timing and certificate revocation

A wireless device comprising:

• a processor;
• and
• a memory, wherein the memory stores instructions that when executed by the processor cause the wireless device to perform operations comprising:
• obtaining a first time value from a time source included in the wireless device, the first time value indicating a time when the wireless device initiated a certificate revocation list (CRL) update,
• holding a power assertion to an embedded Universal Integrated Circuit Card (eUICC) included in the wireless device,
• sending, to the eUICC, a first message initiating the CRL update, the first message comprising i) a first payload that includes the first time value and ii) a first signature over the first payload,
• receiving from the eUICC a second message comprising a second payload, wherein the second payload comprises:
• i) a received first time value, ii) a received nonce, iii) a TServer time value indicating a most up-to-date time value extracted from a CRL by the eUICC, iv) a TDevice time value indicating a most up-to-date time value received by the eUICC from the wireless device, and wherein the second message further comprises a second signature signed over the second payload by the eUICC using a private key of the eUICC,
• determining whether the second signature is valid,
• when the second signature is valid:
• storing the second payload,
• requesting a CRL from a server hosting a CRL database,
• receiving the CRL from the server,
• obtaining, from the time source, a second time value indicating a time when the wireless device received the CRL from the server hosting the CRL database
• reading a thisUpdate value from the CRL,
• reading a nextUpdate value from the CRL,
• when the second time value obtained from the time source falls in a window between the thisUpdate value and the nextUpdate value:
• i) forming a third payload based on the received nonce, the CRL, and the second time value,
• ii) signing the third payload to form a third signature, and
• iii) sending a third message to the eUICC wherein the third message comprises the third payload.

A method of updating timestamp memories by a secure element (SE), wherein the timestamp memories comprise a TServer memory location, and a TDevice memory location, the method comprising:

• sending, by the SE to a wireless device, a first message comprising a nonce generated by the SE;
• receiving, by the SE from the wireless device, a second message comprising a certificate revocation list (CRL), a received nonce, and a wireless device timestamp;
• determining that the CRL has been securely received when the received nonce equals the nonce;
• storing a first timestamp extracted from the CRL by the SE in the TServer memory location, the first timestamp indicating a most up-to-date time value received by the SE from a CRL database server;
• and
• storing the wireless device timestamp in the TDevice memory location, the wireless device timestamp indicating a most up-to-date verified time value received by the SE from the wireless device.