# US 2019/0173867 A1 · Network supporting two-factor authentication for modules with embedded universal integrated circuit cards

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173867 A1
- Document ID: US20190173867A1
- Status: Published application
- Kind: A1
- Application number: 16/271,455
- Filed: 2019-02-08
- Published: 2019-06-06
- Earliest claimed: 2016-05-23
- Assignees: Network-1 Technologies, Inc.
- Applicants: Network-1 Technologies, Inc.
- Inventors: John A. Nix
- Web page: https://patentgrep.com/patent/US20190173867A1

## CPC

- H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning}
- H04B 1/3816: Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/3271: {using challenge-response}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/101: {Access control lists [ACL]}
- H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC]
- H04W 12/03: Protecting confidentiality, e.g. by encryption
- H04W 12/06: Authentication
- H04W 12/40: Security arrangements using identity modules
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 2209/80: Wireless
- H04W 8/18: Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04B: TRANSMISSION
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A network with a set of servers can support authentication from a module, where the module includes an embedded universal integrated circuit card (eUICC). The network can send a first network module identity, a first key K, and an encrypted second key K for an eUICC profile to an eUICC subscription manager. The second key K can be encrypted with a symmetric key. The module can receive and activate the eUICC profile, and the network can authenticate the module using the first network module identity and the first key K. The network can (i) authenticate the user of the module using a second factor, and then (ii) send the symmetric key to the module. The module can decrypt the encrypted second key K using the symmetric key. The network can authenticate the module using the second key K. The module can comprise a mobile phone.

## Claims

### Claim 1

A computer system comprising:
(a) one or more processors; and
(b) one or more computer-readable media operatively connected to the one or more processors and having stored thereon instructions that, when executed by the one or more processors, cause the computer system to perform a method of securely distributing a profile from a subscription manager system to an embedded universal integrated circuit card, the method comprising steps of:
(1) recording, by the computer system in memory operatively connected to the subscription manager system, a digital signature algorithm comprising an elliptic curve digital signature algorithm;
(2) recording, by the computer system in the memory operatively connected to the subscription manager system, a profile for the embedded universal integrated circuit card comprising:
(A) a key K; and
(B) a network module identity,
wherein the profile has been encrypted using a first key that is a symmetric key;
(3) recording, by the computer system in the memory operatively connected to the subscription manager system,
(A) a profile ciphering algorithm to cipher the profile into a ciphered profile for the embedded universal integrated circuit card, and
(B) ciphering parameters to be used by the profile ciphering algorithm, wherein the ciphering parameters comprise an Advanced Encryption Standard ciphering algorithm;
(4) authenticating, by the computer system using the subscription manager system, the embedded universal integrated circuit card, by performing steps of:
(A) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card, a first message comprising an eUICC identity associated with the embedded universal integrated circuit card;
(B) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card, a second message comprising a first digital signature generated by the embedded universal integrated circuit card using the same digital signature algorithm as stored in the memory operatively connected to the subscription manager; and
(C) authenticating, by the computer system using the subscription manager system, the embedded universal integrated circuit card by confirming:
(i) the eUICC identity which corresponds to the embedded universal integrated circuit card; and
(ii) the first digital signature which was signed by the embedded universal integrated circuit card using the digital signature algorithm;
(5) authenticating, by the computer system, the subscription manager system with the embedded universal integrated circuit by performing steps of:
(A) generating, by the computer system using the subscription manager system, a third message including a second digital signature, generated by the subscription manager using the digital signature algorithm; and
(B) sending, by the computer system from the subscription manager system to the embedded universal integrated circuit card, the third message;
(6) receiving, by the computer system using the subscription manager system from the embedded universal integrated circuit card a fourth message comprising:
(A) an eUICC public key corresponding to an eUICC private key stored at the embedded universal integrated circuit card; and
(B) a third digital signature which was generated by the embedded universal integrated circuit card using the same digital signature algorithm as stored in the memory operatively connected to the subscription manager;
(7) confirming, by the computer system using the subscription manager system, that the third digital signature was signed by the embedded universal integrated circuit card using the digital signature algorithm;
(8) generating, by the computer system using the subscription manager system, an eUICC subscription manager public key and a corresponding eUICC subscription manager private key, using elliptic curve cryptography;
(9) generating, by the computer system using the subscription manager system, a second key that is a mutually derived shared key using Elliptical Curve Diffie-Hellman based on at least:
(A) the eUICC public key; and
(B) the eUICC subscription manager private key;
wherein the mutually derived shared key is configured to be derived by the embedded universal integrated circuit card based on at least:
(i) the eUICC private key associated with the eUICC public key; and
(ii) the eUICC subscription manager public key associated with the eUICC subscription manager private key;
(10) generating, by the computer system using the subscription manager system, a third key that is a profile key using the second key that is the mutually derived shared key;
(11) encrypting, by the computer system using the subscription manager system, the profile using:
(A) the profile ciphering algorithm; and
(B) the third key that is the profile key;
(12) authenticating, by the computer system using the subscription manager system, a user associated with the embedded universal integrated circuit card;
(13) sending, by the computer system using the subscription manager system to the embedded universal integrated circuit card, the symmetric key, after the user associated with the embedded universal integrated circuit card is authenticated;
(14) sending, by the computer system from the subscription manager system to the embedded universal integrated circuit card, the encrypted profile.

### Claim 2 (depends on 1)

The computer system of claim 1, wherein the third key that is the profile key is also generated using American National Standards Institute standard X-9.63.

### Claim 3 (depends on 1)

The computer system of claim 1, wherein the method further comprises a step of receiving, by the computer system using the subscription manager system, the profile for the embedded universal circuit card prior to the recording step (2).

### Claim 4 (depends on 1)

The computer system of claim 1, wherein the first message and second message are received prior to sending the third message.

### Claim 5 (depends on 1)

The computer system of claim 1, wherein the first message is received and third message is sent prior to receipt of the second message.

### Claim 6 (depends on 1)

The computer system of claim 1, wherein the eUICC subscription manager public key and corresponding eUICC subscription manager public key have a length of 283 bits.

### Claim 7 (depends on 1)

The computer system of claim 1, wherein the authenticating step (12) occurs before the confirming step (7).

### Claim 8 (depends on 1)

The computer system of claim 1, wherein the authenticating step (12) occurs after the confirming step (7).