Method and apparatus for discussing digital certificate by ESIM terminal and server

Patent metadata

Field	Value
Publication number	US-11184769-B2
Application number	US-201816622009-A
Country	US
Kind code	B2
Filing date	Jun 26, 2018
Priority date	Jul 4, 2017
Publication date	Nov 23, 2021
Grant date	Nov 23, 2021

Abstract

The present disclosure relates to a communication technique for convergence of IoT technology and a 5G communication system for supporting a higher data transfer rate beyond a 4G system, and a system therefor. The present disclosure can be applied to intelligent services (e.g., smart homes, smart buildings, smart cities, smart or connected cars, health care, digital education, retail business, and services associated with security and safety) on the basis of 5G communication technology and IoT-related technology. Disclosed are a method and an apparatus for securely providing a profile to a terminal in a communication system.

First claim

The invention claimed is:

1. A method performed by a terminal including a universal integrated circuit card (UICC) in a wireless communication system, the method comprising:
obtaining a first certificate issuer (CI) public key identifier;
obtaining, from the UICC, UICC information including a list of public key identifiers supported by the UICC;
comparing the first CI public key identifier with the list included in the UICC information;
modifying the list by removing at least one public key identifier not matched with the first CI public key identifier from the list of the public key identifiers supported by the UICC; and
transmitting, to a server, a first message for initiating an authentication, the first message including the modified list,
wherein the terminal is configured to obtain the first CI public key identifier by any one of: receiving a user input with respect to the terminal, retrieving information stored in the UICC, receiving an activation code, or receiving a command code.

2. The method of claim 1 ,
wherein a public key identifier used in the authentication procedure is restricted to by excluding a public key identifier not included in the first CI public key identifier.

3. The method of claim 1 , further comprising receiving, from the server, a second message in response to the first message, wherein the second message includes a second CI public key identifier to be used by the UICC, a server certificate, and a server signature, wherein the second CI public key identifier is determined based on the first message, and wherein a validity of the server for the authentication is verified based on the server certificate and the server signature.

4. The method of claim 1 , wherein the authentication procedure is terminated, in case that there is no public key identifier matched with the first CI public key identifier in the list.

5. A terminal in a wireless communication system, the terminal comprising: a transceiver configured to transmit and receive a signal; a universal integrated circuit card (UICC); and a controller coupled with the transceiver and configured to:
obtain a first certificate issuer (CI) public key identifier, obtain, from the UICC, UICC information including a list of public key identifiers supported by the UICC, compare the first CI public key identifier with the list included in the UICC information,
modify the list by removing at least one public key identifier not matched with the first CI public key identifier from the list of the public key identifiers supported by the UICC, and
transmit, to a server, a first message for initiating an authentication, the first message including the modified list,
wherein the terminal is configured to obtain first CI public key identifier by any one of: receiving a user input with respect to the terminal, retrieving information stored in the UICC, receiving an activation code, or receiving a command code.

6. The terminal of claim 5 , wherein a public key identifier used in the authentication procedure is restricted to the first CI public key identifier.

7. The terminal of claim 5 , wherein the controller is configured to receive, from the server, a second message in response to the first message, wherein the second message includes a second CI public key identifier to be used by the UICC, a server certificate, and a server signature, wherein the second CI public key identifier is determined based on the first message, and wherein a validity of the server for the authentication is verified based on the server certificate and the server.

8. The terminal of claim 5 , wherein the authentication procedure is terminated, in case that there is no public key identifier matched with the first CI public key identifier in the list.

9. A method performed by a server in a wireless communication system, the method comprising:
receiving, from a terminal, a first message for initiating an authentication of the terminal, the first message including a modified list of public key identifiers matched with a first certificate issuer (CI) public key identifier; and
transmitting, to the terminal, a second message in response to the first message, the second message including a second CI public key identifier to be used by a universal integrated circuit card (UICC) of the terminal,
wherein the first CI public key identifier is pre-obtained by the terminal,
wherein the modified list is modified by the terminal by comparing the first CI public key identifier with a list of public key identifiers supported by the UICC of the terminal included in UICC information cached in the terminal, and by removing at least one public key identifier not matched with the first CI public key identifier from the list of the public key identifiers supported by the UICC, and wherein the terminal is configured to obtain the first CI public key identifier by any one of: receiving a user input with respect to the terminal, retrieving information stored in the UICC, receiving an activation code, or receiving a command code.

10. The method of claim 9 , wherein a public key identifier used in the authentication procedure is restricted to the first CI public key identifier.

11. The method of claim 9 , wherein the second message further includes a server certificate and a server signature, wherein the second CI public key identifier is determined based on the first message, and wherein a validity of the server for the authentication is verified based on the server certificate and the server signature.

12. A server in a wireless communication system, the server comprising:
a transceiver configured to transmit and receive a signal; and
a controller coupled with the transceiver and configured to:
receive, from a terminal, a first message for initiating an authentication of the terminal, the first message including a modified list of public key identifiers matched with a first certificate issuer (CI) public key identifier, and transmit, to the terminal, a second message in response to the first message, the second message including a second CI public key identifier to be used by a universal integrated circuit card (UICC) of the terminal,
wherein the first CI public key identifier is pre-obtained by the terminal,
wherein the modified list is modified by the terminal by comparing the first CI public key identifier with a list of public key identifiers supported by the UICC of the terminal included in UICC information cached in the terminal, and by removing at least one public key not matched with the first CI public key identifier from the list of the public key identifiers supported by the UICC, and
wherein the terminal is configured to obtain the first CI public key identifier by any one of: receiving a user input with respect to the terminal, retrieving information stored in the UICC, receiving an activation code, or receiving a command code.

13. The server of claim 12 , wherein a public key identifier used in the authentication procedure is restricted to the first CI public key identifier.

14. The server of claim 12 , wherein the second message further includes a server certificate and a server signature, wherein the second CI public key identifier is determined based on the first message, and wherein a validity of the server for the authentication is verified based on the server certificate and the server signature.

Assignees

• Samsung Electronics Co Ltd

Inventors

• Lee Hyewon
• Lee Duckey
• Kang Sujung
• Ryu Youngsun
• Park Jonghan
• Yoon Kangjin

Classifications

• H04W12/069 Primary

  using certificates or pre-shared keys · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04W12/043

  using a trusted network node as an anchor · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title