Dynamic adaption of a secure element execution environment to profiles

Patent metadata

Field	Value
Publication number	US-12254083-B2
Application number	US-202017597664-A
Country	US
Kind code	B2
Filing date	Jul 23, 2020
Priority date	Jul 26, 2019
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

An eUICC card comprising an initial runtime environment, subscriber profiles, associated adapters, and an adaptive routine configured to apply these adapters. An adapter enables the initial runtime environment to be adapted to the specificities of the corresponding profile when the latter is enabled. To enable dynamic adaptation of the runtime environment to the profiles used, the eUICC card further comprises inverse adapters associated with the profiles. The inverse adapter of the active profile makes it possible to restore the initial runtime environment upon disabling or deleting this profile. The adaptation can consist of modifying a Java class of the Java Card runtime environment of the eUICC, to the specificities of a profile.

First claim

The invention claimed is:

1. A secure element comprising:
a processor;
a storage;
a communication interface;
a plurality of service profiles;
an initial runtime environment comprising resources stored in the storage, the initial runtime environment comprising an operating system of the secure element or a virtual machine executed by the operating system of the secure element;
adaptive data for a selected one of the service profiles to adapt the resources of the initial runtime environment to obtain an adapted runtime environment adapted to the selected one of the service profiles;
an adaptive routine configured to apply the adaptive data of the selected service profile to the resources of the initial runtime environment; and
inverse adaptive data to restore the resources of the initial runtime environment from the adapted runtime environment, the adaptive routine being configured to apply the inverse adaptive data after using the selected service profile.

2. The secure element according to claim 1 , wherein the adaptive routine is configured to apply the adaptive data and the inverse adaptive data based on the life cycle of the selected service profile.

3. The secure element according to claim 2 , wherein the adaptive routine is configured to apply the adaptive data to the resources of the initial runtime environment upon enabling the selected service profile and to apply the inverse adaptive data to the resources of the adapted runtime environment upon disabling or deleting of the selected service profile.

4. The secure element according to claim 1 , wherein the adaptive data and the inverse adaptive data are stored as lists of directives able to be interpreted by the adaptive routine.

5. The secure element according to claim 1 , wherein the processor is configured to receive the adaptive data and the inverse adaptive data within an installation package of the selected service profile transmitted by an external equipment.

6. The secure element according to claim 1 , wherein the processor is configured to generate the inverse adaptive data from the adaptive data received from a remote network equipment.

7. The secure element according to claim 1 , further comprising another service profile of the services profiles selected from:
a service profile able to be used in the initial runtime environment, and
a service profile able to be used in a modified runtime environment obtained by applying other adaptive data different from said adaptive data to the resources of the initial runtime environment, the service profile able to be used in the modified runtime environment including the other adaptive data and other inverse adaptive data to restore the resources of the initial runtime environment from the modified runtime environment.

8. The secure element according to claim 1 , further comprising a garbage collector collecting unreferenced profile resources stored in memory, the garbage collector being configured to collect only among specific profile resources linked to one or more specific service profiles of the plurality of service profiles.

9. The secure element according to claim 1 , wherein the adaptive data are configured to adapt an initial Java class of the initial runtime environment to a format of an object instantiating the initial Java class in the first service profile, and the inverse adaptive data are configured to restore the initial Java class from the adapted Java class.

10. The secure element according to claim 1 , wherein the adaptive data includes an application applicable to the plurality of service profiles and dedicated components applicable to the selected service profile.

11. The secure element according to claim 1 , wherein the secure element receives a profile activation command to activate the selected service profile.

12. A method of execution in a secure element including an initial runtime environment and a plurality of service profiles, the method comprising:
applying, by an adaptive routine, adaptive data for a selected one of the service profiles of resources of the initial runtime environment to obtain an adapted runtime environment adapted to the selected service profile;
using the selected service profile in the adapted runtime environment; and
then applying, by the adaptive routine, inverse adaptive data to the resources of runtime environment adapted to restore the initial runtime environment.

13. The method according to claim 12 , wherein the adaptive data and the inverse adaptive data are applied based on a life cycle of the selected service profile.

14. The method according to claim 12 , wherein the adaptive data are applied to the resources of the initial runtime environment upon enabling the selected service profile and the inverse adaptive data are applied to the resources of the adapted runtime environment when disabling or deleting the selected service profile.

15. The method according to claim 12 , wherein the adaptive data and the inverse adaptive data are stored as lists of directives that are able to be interpreted by the adaptive routine.

16. The method according to claim 12 , wherein the secure element further comprises another service profile of the service profiles selected from:
a service profile able to be used in the initial runtime environment, and
a service profile able to be used in the modified runtime environment obtained by applying other adaptive data different from said adaptive data to the resources of the initial runtime environment, the service profile able to be used in the modified runtime environment including the other adaptive data and other inverse adaptive data to restore the resources of the initial runtime environment from the modified runtime environment.

17. The method according to claim 12 , wherein the secure element further comprises a garbage collector collecting unused profile resources stored in memory, the garbage collector being configured to carry out collecting only among specific profile resources linked to a specific service profile of the service profiles.

18. A non-transitory computer-readable storage medium storing instructions of a computer program configured to implement a method comprising:
applying, by an adaptive routine, adaptive data of resources of an initial runtime environment 4 a secure element to obtain an adapted runtime environment adapted to a selected service profile of the secure element from a plurality of service profiles of the secure element, the initial runtime environment comprising an operating system of the secure element or a virtual machine executed by the operating system of the secure element;
using the selected service profile in the adapted runtime environment; and
then applying, by the adaptive routine, inverse adaptive data to the resources of the runtime environment adapted to restore the initial runtime environment.

Assignees

• Idemia Identity & Security
• Idemia Identity & Security France

Inventors

• Del Giudice Lauren
• Cricco Rémy
• Courquin Yannick

Classifications

• H04W8/183 Primary

  Processing at user equipment or user record carrier · CPC title

• H04W8/205

  Transfer to or from user equipment or user record carrier · CPC title

• G06F2221/03

  Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms · CPC title

• H04W4/60

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title