# US 12,120,105 B2 · Method and electronic device for managing digital keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,105 B2 - Document ID: US12120105B2 - Status: Granted - Kind: B2 - Application number: 18/100,251 - Filed: 2023-01-23 - Published: 2023-05-18 - Granted: 2024-10-15 - Earliest claimed: 2019-12-06 - Assignees: Samsung Electronics Co., Ltd. - Applicants: Samsung Electronics Co., Ltd. - Inventors: Sungkyu Cho; Jieun Keum; Sehee Han; Eunyoung Kwon; Daehaeng Cho - Web page: https://patentgrep.com/patent/US12120105B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04W 12/086: using security domains - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/069: using certificates or pre-shared keys - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04W 12/041: Key generation or derivation - H04W 12/40: Security arrangements using identity modules - H04W 12/61: Time-dependent - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Provided is a method, performed by an electronic device, of managing keys for accessing a plurality of services. The method includes transmitting, by a secure domain (SD) in a secure area of the electronic device, a certificate of the SD to a plurality of service providers (SPs); receiving, by an application installed in the electronic device, a certificate of each of the plurality of SPs from the plurality of SPs; receiving, by the application, first signed data from a first SP among the plurality of SPs; authenticating, by the application, the first signed data by using a certificate of the first SP received from the first SP and obtaining an encrypted key of the first SP from the first signed data; decrypting, by the SD, the encrypted key of the first SP by using a private key of the SD; and storing the decrypted key of the first SP in a first instance corresponding to the first SP among a plurality of instances of the SD. ## Claims ### Claim 1 A method, performed by a first electronic device, the method comprising: creating a plurality of instances in a common applet, wherein the plurality of instances corresponds to a plurality of service providers (SPs) and includes one or more keysets of the plurality of SPs, and wherein the common applet is installed in a secure area for digital key management; storing data for a secure channel to a first instance, which is one of the plurality of instances, the first instance being used by a first SP, which is one of the plurality of SPs; and generating an ultra wide band (UWB) session key for a second electronic device based on the stored data; generating a scrambled timestamp sequence (STS) based on the UWB session key; and performing secure ranging using the STS. ### Claim 2 (depends on 1) The method of claim 1, further comprising: transmitting, to the first SP, a certificate of the secure area; receiving, from the first SP, a certificate of the first SP and a first signed data; authenticating the first signed data by using a public key of the first SP included in the certificate of the first SP and obtaining encrypted data from the first signed data; decrypting the encrypted data by using a private key of the secure area; and storing a decrypted key of the first SP in the first instance corresponding to the first SP among the plurality of instances in the secure area. ### Claim 3 (depends on 1) The method of claim 1, further comprising: installing a secure domain (SD) in the secure area, based on information received from a secure area issuer. ### Claim 4 (depends on 2) The method of claim 2, wherein the certificate of the secure area comprises a public key of the secure area. ### Claim 5 (depends on 2) The method of claim 2, wherein the first signed data received from the first SP comprises a key of the first SP encrypted using a public key of the secure area and signed using a private key of the first SP. ### Claim 6 (depends on 1) The method of claim 1, further comprising: setting up the secure channel by using a Bluetooth communication method. ### Claim 7 A first electronic device comprising: a memory storing instructions; and a processor coupled with the memory and configured to execute the instructions to: create a plurality of instances in a common applet, wherein the plurality of instances corresponds to a plurality of service providers (SPs) and includes one or more keysets of the plurality of SPs, and wherein the common applet is installed in a secure area, for digital key management; store data for a secure channel to a first instance, which is one of the plurality of instances, the first instance being used by a first SP, which is one of the plurality of SPs; generate an ultra wide band (UWB) session key for a second electronic device based on the stored data; generate a scrambled timestamp sequence (STS) based on the UWB session key; and perform a secure ranging using the STS. ### Claim 8 (depends on 7) The first electronic device of claim 7, wherein the processor is further configured to execute the instructions to: transmit, to the first SP, a certificate of the secure area; receive, from the first SP, a certificate of the first SP and a first signed data; authenticate the first signed data by using a public key of the first SP included in the certificate of the first SP and obtaining encrypted data from the first signed data; decrypt the encrypted data by using a private key of the secure area; and store a decrypted key of the first SP in the first instance corresponding to the first SP among the plurality of instances in the secure area. ### Claim 9 (depends on 7) The first electronic device of claim 7, wherein the processor is further configured to execute the instructions to: install a secure domain (SD) in the secure area, based on information received from a secure area issuer. ### Claim 10 (depends on 8) The first electronic device of claim 8, wherein the certificate of the secure area comprises a public key of the secure area. ### Claim 11 (depends on 8) The first electronic device of claim 8, wherein the first signed data received from the first SP comprises a key of the first SP encrypted using a public key of the secure area; and signed using a private key of the first SP. ### Claim 12 A non-transitory computer-readable recording medium storing a program, when executed, performs a method, the method comprising: creating a plurality of instances in a common applet, wherein the plurality of instances corresponds to a plurality of service providers (SPs) and includes one or more keysets of the plurality of SPs, and wherein the common applet is installed in a secure area for digital key management; storing data for a secure channel to a first instance, which is one of the plurality of instances, the first instance being used by a first SP, which is one of the plurality of SPs; generating an ultra wide band (UWB) session key for a second electronic device based on the stored data; generating a scrambled timestamp sequence (STS) based on the UWB session key; and performing a secure ranging using the STS.