# US 11,910,198 B2 · Methods for certificate issuance in remote provisioning architectures for embedded UICCS

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,910,198 B2
- Document ID: US11910198B2
- Status: Granted
- Kind: B2
- Application number: 18/070,325
- Filed: 2022-11-28
- Published: 2023-04-13
- Granted: 2024-02-20
- Earliest claimed: 2018-05-07
- Assignees: Tata Communications (America) Inc.
- Applicants: Tata Communications (America) Inc.
- Inventors: Ron Grippo; Luke Kiernan; William Buchanan; Brian Peebles
- Web page: https://patentgrep.com/patent/US11910198B2

## CPC

- H04W 4/50: Service provisioning or reconfiguring
- H04W 12/72: Subscriber identity
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04W 4/60: Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
- H04W 8/183: {Processing at user equipment or user record carrier}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/041: Key generation or derivation
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications
- H04W 12/40: Security arrangements using identity modules
- H04W 60/00: Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method includes mobile device, a SIM associated with mobile device, an MNO computer, a computer associated with an owner of the mobile device, a first set of keys stored in the SIM for securely communicating with the MNO computer, and a second set of keys for securely communicating with the computer associated with the owner of the mobile device, to exchange application information. The SIM can be configured to determine when updated information related to the second set of keys is required, securely send a request to the MNO computer for updated information related to the second set of keys using the first set of keys, and responsively receive the updated information related to the second set of keys from the MNO computer, the updated information being provisioned by the computer associated with the owner of the mobile device. The mobile device is configured to utilize the updated information related to the second set of keys to establish data communication between an application running on the mobile device and the computer associated with the owner of the mobile device.

## Claims

### Claim 1

A system comprising:
a mobile device having a Subscriber Identity Module (SIM);
a Mobile Network Operator (MNO) computer;
a computer associated with an owner of the mobile device;
wherein the SIM is configured, in response to a first use of the mobile device, to securely transmit to the MNO computer information associating the SIM with the mobile device to form an association therebetween;
wherein the MNO computer is configured to record the information associating the SIM with the mobile device with the computer associated with the owner of the mobile device;
wherein the computer associated with the owner of the mobile device is configured to verify the association between the SIM and the mobile device before permitting certain attempted communications purportedly from the mobile device to the computer associated with the owner of the mobile device;
wherein the SIM is further configured to securely transmit the information associating the SIM with the mobile device using a first set of keys provided with the SIM; and
wherein the computer associated with the owner of the mobile device is further configured to send a second set of keys in response to receiving the information associating the SIM with the mobile device, the second set of keys enabling data communication between an application running on the mobile device and the computer associated with the owner of the mobile device.

### Claim 2 (depends on 1)

The system of claim 1, wherein the information associating the SIM with the mobile device includes an identification number for the SIM and an identification number for the mobile device.

### Claim 3 (depends on 1)

The system of claim 1, wherein the SIM comprises a Universal Integrated Circuit Card (UICC).

### Claim 4 (depends on 3)

The system of claim 3, wherein the UICC is embedded in circuitry of the mobile device.

### Claim 5 (depends on 1)

The system of claim 1, wherein the SIM comprises a Universal SIM.

### Claim 6 (depends on 1)

The system of claim 1, wherein the owner of the mobile device is an Enterprise.

### Claim 7

A method for enabling an owner of a mobile device to remotely provision a Subscriber Identity Module (SIM) of the mobile device, the method comprising:
a) sending, with the SIM using a first set of security keys, a first message to a Mobile Network Operator (MNO) computer, the message containing an identification number for the SIM and an identification number for the mobile device;
b) reporting, with the MNO computer, the identification number for the SIM and the identification number of the mobile device to a computer associated with an owner of the mobile device;
c) in response to receiving the identification number for the SIM and the identification number of the mobile device to a computer associated with an owner of the mobile device, provisioning, with the computer associated with the owner of the mobile device, a second set of security keys specific for an application running on the mobile device;
d) sending, with the computer associated with the owner of the mobile device, a second message to the MNO computer, the second message containing the second set of security keys specific for an application running on the mobile device;
e) sending, with the MNO computer using the first set of security keys, the second message with the second set of security keys specific for the application running on the mobile device; and
f) establishing, with the application running on the mobile device, a secure communication line with the computer associated with the owner of the mobile device using the second set of keys.

### Claim 8 (depends on 7)

The method of claim 7, wherein the owner of the mobile device is an Enterprise.

### Claim 9 (depends on 7)

The method of claim 7, wherein the SIM comprises a Universal Integrated Circuit Card (UICC).

### Claim 10 (depends on 9)

The method of claim 9, wherein the UICC is embedded in circuitry of the mobile device.

### Claim 11 (depends on 7)

The method of claim 7, wherein the SIM comprises a Universal SIM.

### Claim 12 (depends on 7)

The method of claim 7, wherein prior to performing step a, activating the mobile device for a first time.

### Claim 13 (depends on 7)

The method of claim 7, wherein steps a-e are repeated each time another set of security keys for establishing a secure communication line between the mobile device and the computer associated with the owner of the mobile device are required and wherein the first, the second, or another set of security keys can be used to securely send the message in step a containing the identification number for the SIM and the identification number for the mobile device.