Apparatus and method for secure provisioning of a communication device

A method comprising:

• receiving, by a server including a processor, a static key from a remote management server, wherein the remote management server provides the static key to a secure element of a communication device to enable the secure element to generate a first keyset from the static key and to enable the secure element to provide the first keyset to a secure device processor of the communication device;
• generating, by the server, the first keyset from the static key;
• encrypting, by the server, an over-the-air programming message utilizing the first keyset to generate an encrypted over-the-air programming message, wherein the over-the-air programming message includes programming data for use by the communication device;
• and
• providing, by the server, the encrypted over-the-air programming message to the secure device processor of the communication device to enable the secure device processor to decrypt the encrypted over-the-air programming message utilizing the first keyset, wherein the providing of the encrypted over-the-air programming message further enables the secure device processor to provide the programming data to the secure element of the communication device according to a schedule for provisioning of the communication device, wherein the schedule is determined by the secure device processor, and wherein the secure device processor is separate from the secure element and in communication with the secure element, wherein the providing of the programming data to the secure element enables the secure element to further decrypt the programming data utilizing a second keyset, and wherein the secure device processor does not have access to the second keyset.

A communication device comprising:

• a secure element having a secure element memory with first executable instructions, wherein the secure element, responsive to executing the first executable instructions, performs first operations comprising:
• receiving a request for a first keyset, wherein the request is received from a secure device processor of the communication device;
• providing the first keyset to the secure device processor;
• receiving, from the secure device processor, a decrypted over-the-air programming message according to a schedule for providing messages;
• and
• performing an additional decryption of the decrypted over-the-air programming message utilizing a second keyset, wherein the secure device processor does not have access to the second keyset;
• and
• the secure device processor having a secure device processor memory with second executable instructions, wherein the secure device processor, responsive to executing the second executable instructions, performs second operations comprising:
• determining the schedule for provision of the messages to the secure element;
• decrypting an over-the-air programming message utilizing the first keyset to generate the decrypted over-the-air programming message, wherein the over-the-air programming message includes programming data for provisioning the communication device,
• wherein the secure device processor is separate from the secure element and in communication with the secure element;
• and
• a device processor that facilitates wireless communications of the communication device, wherein the device processor is separate from the secure device processor and the secure element.