Over-the-air-provisioning of application library

Patent metadata

Field	Value
Publication number	US-10146528-B2
Application number	US-201715666791-A
Country	US
Kind code	B2
Filing date	Aug 2, 2017
Priority date	Dec 29, 2014
Publication date	Dec 4, 2018
Grant date	Dec 4, 2018

Abstract

Techniques for updating an application installed on a communication device may include determining that an update for a private portion of the application is available at a server, sending a request for the update to the server, receiving an updated version of the private portion from the server, and installing the updated version of the private portion on the portable communication device without updating the public portion.

First claim

What is claimed is:

1. A communication device comprising:
a processor; and
a memory coupled to the processor, the memory storing instructions, which when executed by the processor, cause the communication device to perform operations including:
determining that an update for a private portion of an application installed on the communication device is available at a server;
sending a request for the update to the server, wherein the request for the update includes a current private portion identifier associated with a current version of the private portion installed on the communication device, and wherein the current private portion identifier and a current transport key are embedded in the current version of the private portion installed on the communication device;
receiving an updated version of the private portion of the application from the server;
installing the updated version of the private portion of the application; and
subsequent to installing the updated private portion:
sending a request to the server for sensitive data, the request including an updated private portion identifier associated with the updated version of the private portion;
receiving the sensitive data encrypted using an updated transport key embedded in the updated version of the private portion; and
decrypting the sensitive data using the updated transport key by:
generating a decryption key using the updated transport key; and
decrypting the sensitive data with the decryption key.

2. The communication device of claim 1 , wherein the updated version of the private portion received from the server that is encrypted using the current transport key, and the operations further include decrypting the updated version of the private portion using the current transport key embedded in the current version of the private portion installed on the communication device.

3. The communication device of claim 1 , wherein the sensitive data is received in a message that includes a header and a payload containing the sensitive data, and the decryption key is generated by encrypting the header with the updated transport key.

4. The communication device of claim 1 , wherein the decryption key is generated by using the updated transport key and a key derivation seed received from the server.

5. The communication device of claim 1 , wherein the operation of determining that an update for the private portion is available at the server includes contacting the server to determine a most up-to-date version of the application.

6. The communication device of claim 1 , wherein the operation of determining that an update for the private portion is available at the server comprises:
receiving a message notifying that the update for the private portion is available.

7. The communication device of claim 1 , wherein the current version of the private portion is obfuscated using a first obfuscation seed, and the updated version of the private portion is obfuscated using a second obfuscation seed that is different than the first obfuscation seed.

8. The communication device of claim 1 , wherein the application further includes a public portion, and wherein the public portion is written in a first programming language, and the private portion is written in a second programming language that is different than the first programming language.

9. A method for updating an application installed on a communication device, wherein the application includes a public portion and a private portion, the method comprising:
determining that an update for the private portion of the application installed on the communication device is available at a server;
sending a request for the update to the server, wherein the request for the update includes a current private portion identifier associated with a current version of the private portion installed on the communication device, and wherein the current private portion identifier and a current transport key are embedded in the current version of the private portion installed on the communication device;
receiving an updated version of the private portion of the application from the server;
installing the updated version of the private portion of the application; and
subsequent to installing the updated private portion:
sending a request to the server for sensitive data, the request including an updated private portion identifier associated with the updated version of the private portion;
receiving the sensitive data encrypted using an updated transport key embedded in the updated version of the private portion; and
decrypting the sensitive data using the updated transport key by:
generating a decryption key using the updated transport key; and
decrypting the sensitive data with the decryption key.

10. The method of claim 9 , wherein the updated version of the private portion received from the server that is encrypted using the current transport key, and the method further includes decrypting the updated version of the private portion using the current transport key embedded in the current version of the private portion installed on the communication device.

11. The method of claim 9 , wherein the sensitive data is received in a message that includes a header and a payload containing the sensitive data, and the decryption key is generated by encrypting the header with the updated transport key.

12. The method of claim 9 , wherein the decryption key is generated by using the updated transport key and a key derivation seed received from the server.

13. The method of claim 9 , wherein the current version of the private portion is obfuscated using a first obfuscation seed, and the updated version of the private portion is obfuscated using a second obfuscation seed that is different than the first obfuscation seed.

14. The method of claim 9 , wherein the public portion is written in a first programming language, and the private portion is written in a second programming language that is different than the first programming language.

15. A method for providing an update to an application installed on a communication device, wherein the application includes a public portion and a private portion, the method comprising:
receiving, by a server, a request for an update to the private portion of the application from the communication device, wherein the request for the update includes a current private portion identifier associated with a current version of the private portion installed on the communication device, and wherein the current private portion identifier and a current transport key are embedded in the current version of the private portion installed on the communication device;
transmitting, by the server, an updated version of the private portion to the communication device; and
subsequent to the communication device installing the updated version of the private portion:
receiving, by the server, a request from the communication device for sensitive data, the request including an updated private portion identifier associated with the updated version of the private portion;
encrypting, by the server, the sensitive data using an updated transport key embedded in the updated version of the private portion; and
transmitting, by the server, the encrypted sensitive data to the communication device, wherein the encrypted sensitive data is decrypted by the communication device using a decryption key derived from the updated transport key.

16. The method of claim 15 , further comprising:
determining, by the server, the current transport key based on the current private portion identifier in the

Assignees

• Visa Int Service Ass

Inventors

• Hilliar Paul
• Singh Brijendra
• Nosseir Mohamed
• Youdale Robert

Classifications

• G06F8/70

  Software maintenance or management · CPC title

• H04W4/60

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04W4/50

  Service provisioning or reconfiguring · CPC title