Secure element for processing and authenticating digital key and operation method therefor

Patent metadata

Field	Value
Publication number	US-11609979-B2
Application number	US-201917259843-A
Country	US
Kind code	B2
Filing date	Jul 18, 2019
Priority date	Jul 24, 2018
Publication date	Mar 21, 2023
Grant date	Mar 21, 2023

Abstract

A secure element (SE) for processing a digital key includes a communication interface for communicating with a host, a memory for storing programs and data for processing the digital key, and a processor for executing the programs stored in the memory to receive a digital key processing request from a target device, determine whether a service is providable to the target device, by using a service-provider-specific service performance manager, process the digital key by using a digital key manager based on digital key processing information stored in the memory, upon determining that a service is providable to the target device, issue a digital key processing certificate by using the service-provider-specific service performance manager based on authentication information stored in the memory, and transmit the digital key processing certificate to at least one of a service provider and the target device.

First claim

The invention claimed is:

1. A secure element (SE) for running a digital key application to process a digital key, the SE comprising:
a memory for storing programs and a plurality of instance certificate authorities (CAs) corresponding to the digital key application, wherein each of the plurality of instance CAs includes a key pair for a service provider and is used for a different service provider; and
at least one processor for executing the programs stored in the memory, wherein the at least one processor is configured to:
receive a digital key processing request related to an external entity from a service framework, wherein the external entity is a target device or a server related to the service provider,
determine whether a digital key service is providable to the external entity,
process the digital key based on digital key processing information, upon determining that the digital key service is providable to the external entity,
generate a digital key processing certificate based on authentication information, and
provide the digital key processing certificate to the service framework.

2. The SE of claim 1 , wherein processing the digital key comprises at least one of generating or managing the digital key.

3. The SE of claim 1 , wherein the at least one processor is further configured to determine whether the digital key service is providable to the external entity, based on at least one of:
whether an instance CA corresponding to the service provider for the external entity is stored in the SE, whether a key pair for a certificate including a public key and a private key of the service provider is stored in the SE, whether identification information of the digital key is stored in the SE, whether identification information of the target device is stored in the SE, whether certification information of the service provider is valid, or whether the target device is a valid target device.

4. The SE of claim 1 , wherein the digital key processing information includes at least one of identification information of the target device, a valid time, or identification information of the digital key, and
wherein an instance CA corresponding to the service provider comprises a key pair for a certificate including a public key and a private key of the service provider.

5. The SE of claim 1 , wherein the service framework is configured to provide the digital key processing certificate to at least one of the external entity or an entity other than the external entity.

6. The SE of claim 1 , wherein, when a request to integrally process digital keys of the service provider stored in the memory is received, the at least one processor is further configured to:
determine whether integral processing is enabled,
integrally process the digital keys of the service provider stored in the memory upon determining that integral processing is enabled,
issue an integral processing certificate, and
transmit the integral processing certificate to the service provider.

7. The SE of claim 1 , wherein the at least one processor is further configured to:
receive a digital key authentication request from the target device,
determine whether a registered digital key is present in the target device, and
perform an authentication procedure based on an authentication request type upon determining that the registered digital key is present in the target device.

8. The SE of claim 7 , wherein, in case that the digital key authentication request received from the target device is a one-way authentication request, the at least one processor is further configured to:
determine whether one-way authentication is performable, and
perform one-way authentication upon determining that one-way authentication is performable.

9. The SE of claim 7 , wherein the authentication request type includes at least one of a type for standard transaction, or a type for fast transaction.

10. The SE of claim 7 , wherein the at least one processor is further configured to:
determine whether user authentication is performed, and
in case that the user authentication is not performed, terminate the authentication procedure.

11. A method, performed by a secure element (SE), for running a digital key application to process a digital key, the method comprising:
receiving a digital key processing request related to an external entity from a service framework, wherein the external entity is a target device or a server related to a service provider;
determining whether a digital key service is providable to the external entity, wherein the SE includes a plurality of instance certificate authorities (CAs) corresponding to the digital key application, and wherein each of the plurality of instance CAs includes a key pair for the service provider and is used for a different service provider;
processing the digital key based on digital key processing information, upon determining that the digital key service is providable to the external entity;
generating a digital key processing certificate based on authentication information; and
providing the digital key processing certificate to the service framework.

12. The method of claim 11 , wherein processing the digital key comprises at least one of generating or managing the digital key.

13. The method of claim 11 , wherein determining whether the digital key service is providable to the external entity comprises:
determining at least one of whether an instance CA corresponding to the service provider for the external entity is stored in the SE, whether a key pair for a certificate including a public key and a private key of the service provider is stored in the SE, whether identification information of the digital key is stored in the SE, whether identification information of the target device is stored in the SE, whether certification information of the service provider is valid, or whether the target device is a valid target device.

14. The method of claim 11 , wherein the digital key processing information includes at least one of identification information of the target device, a valid time, or identification information of the digital key, and
wherein an instance CA corresponding to the service provider comprises a key pair for a certificate including a public key and a private key of the service provider.

15. The method of claim 11 , wherein the service framework is configured to provide the digital key processing certificate to at least one of the external entity or an entity other than the external entity.

16. The method of claim 11 , wherein, when a request to integrally process digital keys of the service provider stored in a memory of the SE is received, the method further comprises:
determining whether integral processing is enabled;
integrally processing the digital keys of the service provider upon determining that integral processing is enabled;
issuing an integral processing certificate; and
transmitting the integral processing certificate to the service provider.

17. The method of claim 11 , further comprising:
receiving a digital key authentication request from the target device,
determining whether a registered digital key is present in the target device, and
performing an authentication procedure based on an authentication request type upon determining that the registered digital key is present in the target device.

18. The method of claim 17 , wherein the authentication request type includes at least one of a type for standard transaction, or a type for fast transaction.

19. The method of

Assignees

• Samsung Electronics Co Ltd

Inventors

• Jung Sooyeon
• Shin Inyoung
• LEE Jonghyo

Classifications

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• G07C9/27

  with central registration · CPC title

• G07C2009/00825

  remotely by lines or wireless communication · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/3247

  involving digital signatures · CPC title