Method of controlling applications installed on a security module associated with a mobile terminal, and an associated security module, mobile terminal, and server

Patent metadata

Field	Value
Publication number	US-9113338-B2
Application number	US-74594608-A
Country	US
Kind code	B2
Filing date	Dec 3, 2008
Priority date	Dec 7, 2007
Publication date	Aug 18, 2015
Grant date	Aug 18, 2015

Abstract

The invention relates to a method of controlling applications installed in a security module associated with a mobile terminal and adapted to increment at least one transaction value during a transaction effected by an application and, if that transaction value reaches an associated predetermined value, sending at least one connection command to a management server and blocking at least one application if the command fails. The invention also relates to a method of managing such applications adapted to receive a connection command, verify the user rights and update at least one transaction value and/or block at least one application as a function of the verification result. The invention further relates to a management server, a mobile terminal and a security module that can be used with a mobile terminal.

First claim

The invention claimed is:

1. A method of controlling applications installed in a security module of a mobile terminal and configured to conduct with an equipment transactions linked to the applications, the method comprising the following steps:
incrementing by the mobile terminal at least one transaction value in a memory of the security module during a transaction conducted by one of the applications;
comparing by the mobile terminal the at least one transaction value with a predetermined value;
if the at least one transaction value reaches the predetermined value, sending at least one connection command from the security module to a management server of the application via the mobile terminal;
blocking at least one of the applications in the event of failure of said at least one connection command;
if a connection responsive to the connection command succeeds and a user has rights concerning the application, receiving by the mobile terminal from the management server an instruction to reinitialize the at least one transaction value, and reinitializing the at least one transaction value; and
where writing or reading a memory area of the security module requires using cryptographic keys shared by the security module and the management server.

2. The method according to claim 1 , wherein an incrementing step increments a transaction value common to all the applications present in the security module during a transaction carried out by any of the applications.

3. The method according to claim 1 , wherein an incrementing step increments a transaction value linked to an application present in the security module during a transaction conducted by that application.

4. The method according to claim 1 , wherein the blocking step comprises a step of stopping the transaction in progress.

5. The method according to claim 1 , wherein the blocking step comprises a step of sending the at least one application an instruction preventing future selection of said at least one application.

6. The method according to claim 1 , wherein the blocking step is conducted after sending a plurality of connection commands.

7. The method according to claim 1 , further comprising, if the connection command succeeds, receiving from the management server an update to the rights concerning at least one of the applications that has updatable rights as a function of the result of a verification of the user rights concerning said at least one application that has updatable rights.

8. The method according to claim 7 , further comprising a step of updating at least one transaction value.

9. The method according to claim 7 further comprising a step of receiving an instruction preventing future selection of said at least one application.

10. The method according to claim 1 , further comprising:
receiving by the management server the connection command sent from the security module by the mobile terminal; and
verifying by the management server user rights for at least one of the applications installed in the security module.

11. A security module containing one or more applications configured to conduct at least one transaction with an equipment, the security module comprising:
a hardware processor and memory that comprises program elements, the program elements comprising:
an incrementing program element that increments at least one transaction value;
a comparing program element that compares the at least one transaction value with a predetermined value;
a transmitting program element that sends at least one connection command to an application management server if the value of a counter reaches the predetermined value;
a blocking program element that blocks at least one application of the one or more applications if said at least one connection command fails;
a receiving program element that receives from the management server, if the connection succeeds and a user has rights concerning the at least one application, an instruction to reinitialize the at least one transaction value; and
a reinitializing program element that when the instruction to reinitialize is received, reinitializes the at least one transaction value;
where writing or reading a memory area of the security module requires using cryptographic keys shared by the security module and the management server.

12. A mobile terminal comprising a security module containing one or more applications configured to conduct at least one transaction with an equipment, the security module comprising:
a hardware processor and memory that comprises program elements, the program elements comprising:
an incrementing program element that increments at least one transaction value;
a comparing program element that compares the at least one transaction value with a predetermined value;
a transmitting program element that sends at least one connection command to an application management server if the value of a counter reaches the predetermined value;
a blocking program element that blocks at least one application of the one or more applications if said at least one connection command fails;
a receiving program element that receives from the management server, if the connection succeeds and a user has rights concerning the at least one application, an instruction to reinitialize the at least one transaction value; and
an reinitializing program element that when the instruction to reinitialize is received, reinitializes the at least one transaction value;
where writing or reading a memory area of the security module requires using cryptographic keys shared by the security module and the management server.

13. The mobile terminal according to claim 12 , in combination with said application management server, the management server comprising:
a hardware processor and memory that comprises program elements, the program elements comprising:
a receiver program element that receives the connection command sent by the mobile terminal;
a verifier program element that verifies user rights for at least one application stored in the security module to which the connection command relates;
a transmitting program element that sends at least one of a command to reinitialize the at least one transaction value and a command to block at least one application of the one or more applications; and
cryptographic keys that are shared with the security module and utilized for writing or reading a memory area of the security module.

14. A computer program product embodied on a non-transitory medium, comprising instructions for executing the following steps when it is loaded into and executed by a processor of a security module of a mobile terminal:
incrementing at least one transaction value in a memory of the security module during a transaction conducted by an application of one or more applications installed in the security module with an equipment;
comparing the at least one transaction value with a predetermined value;
if the at least one transaction value reaches the predetermined value, sending at least one connection command from the security module to a management server of the application via the mobile terminal;
blocking at least one application of said one or more applications in the event of failure of said at least one connection command;
if a connection responsive to the connection command succeeds and a user has rights concerning the application, receiving from the management server an instruction to reinitialize the at least one transaction value and reinitializing the at least one transaction value;
when writing or reading a memory area of the security module, using cryptographic keys shared by th

Assignees

• Raffard Rémi
• Fourreau Laurent
• Orange

Inventors

• Raffard Rémi
• Fourreau Laurent

Classifications

• H04W12/12 Primary

  Detection or prevention of fraud · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04W12/126

  Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning · CPC title