Systems, methods, and computer program products for managing secure elements

Patent metadata

Field	Value
Publication number	US-9323945-B2
Application number	US-201414487433-A
Country	US
Kind code	B2
Filing date	Sep 16, 2014
Priority date	Nov 1, 2011
Publication date	Apr 26, 2016
Grant date	Apr 26, 2016

Abstract

Systems, methods, and computer program products are provided for performing content management operations. At least one memory stores data, and a central security domain manages instructions on behalf of one or more service provider security domains. The instructions are received, over a network, from a trusted service manager. The instructions are processed in at least one of the one or more determined service provider security domains, using the data stored in the at least one memory. The data includes one or more generic applications, each of which can be instantiated for one or more service providers.

First claim

What is claimed is:

1. A system to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a single service provider, comprising:
at least one secure element, each of the at least one secure elements comprising a plurality of memory portions, each of the plurality of memory portions comprising a management portion and a plurality of supplemental portions managed by the management portion; and
a processor communicatively coupled to the plurality of memory portions, wherein the processor executes application code instructions that are stored in the plurality of memory portions to cause the system to:
receive, by a management portion of a particular secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the particular secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the particular secure element and each of the plurality of service providers;
determine, by the management portion of the particular secure element, which one of the plurality of supplemental portions is associated with the first identifier; and
process the first instruction by the determined one of the plurality of supplemental portions of the particular secure element using one or more applications instantiated for two or more of the plurality of service providers.

2. The system of claim 1 , wherein the plurality of supplemental portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

3. The system of claim 1 , wherein the management portion of the particular secure element comprises a master key index, the master key index comprising keys that correspond to each of the supplemental portions.

4. The system of claim 3 , wherein the management portion controls the master key index.

5. The system of claim 3 , wherein a respective key from the keys in the master key index is required to access one of the supplemental portions.

6. The system of claim 1 , wherein the first instruction comprises keys corresponding to the management portion.

7. The system of claim 6 , wherein the keys corresponding to the management portion are used to access the management portion, and wherein the central trusted service manager controls the keys corresponding to the management portion.

8. The system of claim 2 , wherein each of the security domains comprises one or more applets.

9. The system of claim 1 , wherein the first instruction comprises one or more application protocol data units (APDUs).

10. A method to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a service provider, comprising:
receiving, by a management portion of a secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the secure element and each of the plurality of service providers;
determining, by the management portion of the secure element, which one of a plurality of supplemental portions of the secure element is associated with the first identifier; and
processing the first instruction by the determined one of the plurality of supplement portions of the secure element using one or more applications instantiated for two or more of the plurality of service providers.

11. The method of claim 10 , wherein the plurality of supplemental portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

12. The method of claim 10 , wherein the management portion of the secure element comprises a master key index, the master key index comprising keys that correspond to each of the supplemental portions.

13. The method of claim 12 , wherein the management portion controls the master key index.

14. The method of claim 12 , wherein a respective key from the keys in the master key index is required to access one of the supplemental portions.

15. The method of claim 10 , wherein the first instruction further comprises keys corresponding to the management portion.

16. The method of claim 15 , wherein the keys corresponding to the management portion are used to access the management portion, and wherein the central trusted service manager controls the keys corresponding to the management portion.

17. The method of claim 11 , wherein each of the security domains comprises one or more applets.

18. The method of claim 10 , wherein the first instruction comprises one or more application protocol data units (APDUs).

19. A computer program product comprising:
a non-transitory computer-readable medium having computer-readable program instructions embodied therein that when executed by a computer cause the computer to perform content management operations on secure elements using a central trusted service manager (TSM) that interfaces between a plurality of services providers and the secure elements, where a traditional TSM cannot function as a central intermediary TSM to a plurality of service providers because the traditional TSM is associated with a single service provider, the computer-readable program instructions comprising:
computer-readable program instructions to receive, by a management portion of a secure element, a first instruction comprising a first identifier from a central trusted service manager interfacing between the secure element and one of a plurality of service providers, the central trusted service manager configured to interface between the secure element and each of the plurality of service providers;
computer-readable program instructions to determine, by the management portion of the secure element, which one of a plurality of supplemental portions of the secure element is associated with the first identifier; and
computer-readable program instructions to process the first instruction by the determined one of the plurality of supplement portions of the secure element using one or more applications instantiated for two or more of the plurality of service providers.

20. The computer program product of claim 19 , wherein the plurality of supplement portions are security domains and the management portion is a central security domain, and wherein each security domain is associated with one of the plurality of service providers.

21. The computer program product of claim 19 , wherein the management portion of the secure element comprises a master key index, the master key index comprising keys that correspond to each of to the supplemental portions.

22. The computer program product of claim 21 , wherein the management portion controls the master key index.

23. The computer program product of claim 21 , w

Assignees

• Google Inc

Inventors

• Gargiulo Michael J
• Hay Florent

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/32 Primary

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L9/0891 Primary

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title