US 2017/0373845 A1 · Key Derivation for a Module Using an Embedded Universal Integrated Circuit Card

Abstract

A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.

Claims20

Dependent claims

A method for an embedded universal integrated circuit card (eUICC) to receive an eUICC profile, the method comprising the eUICC:

storing a network public key, an eUICC identity, and eUICC private key, wherein the eUICC uses the network public key to authenticate an eUICC subscription manager;
receiving a server public key from the authenticated eUICC subscription manager;
deriving a derived private key and a derived public key, wherein the eUICC (i) signs the derived public key with the eUICC private key and (ii) sends the derived public key to the eUICC subscription manager;
deriving a first shared secret key using a key derivation function and a set of cryptographic parameters, wherein the key derivation function uses as input at least (i) the received server public key, (ii) derived private key, and (iii) the set of cryptographic parameters;
deriving a second shared secret key using (i) a shared secret algorithm and (ii) the derived first shared secret key as an algorithm token for the shared secret algorithm, wherein the shared secret algorithm uses a secure hash algorithm;
and,
receiving the profile, wherein the eUICC uses the derived second shared secret key and a symmetric ciphering algorithm to decrypt the profile.

4 more elements

A method for a module using an embedded integrated circuit card (eUICC) to support authentication, the method comprising the module:

reading a module identity from a protected memory and sending the module identity to an eUICC subscription manager;
receiving a first profile for the eUICC, wherein the first profile includes a first network module identity and a first key K;
using the eUICC, the first network module identity, and the first key K to authenticate;
receiving from an eUICC subscription manager a server public key after authenticating with the first key K;
deriving a shared secret key using (i) the received server public key, (ii) an eUICC private key, and (iii) a shared secret algorithm, wherein the shared secret algorithm includes a secure hash algorithm;
receiving a second profile for the eUICC, wherein the module decrypts the second profile using the derived shared secret key, wherein the decrypted second profile includes a second network module identity and a second key K;
and,
authenticating using the second network module identity and the second key K.

5 more elements

Dependencies are inferred from the claim text.

Key Derivation for a Module Using an Embedded Universal Integrated Circuit Card

Life of this patent

Key Derivation for a Module Using an Embedded Universal Integrated Circuit Card

Life of this patent

Abstract

Claims20