Apparatus and method for secure delivery of data from a communication device

Patent metadata

Field	Value
Publication number	US-9560025-B2
Application number	US-201615205402-A
Country	US
Kind code	B2
Filing date	Jul 8, 2016
Priority date	Nov 27, 2013
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A system that incorporates the subject disclosure may perform, for example, providing an upload request to a mobile communication device to cause a secure device processor of the mobile communication device to perform a modification of data according to a data protection key to generate modified data and to perform an encryption of the modified data according to an upload transport key to generate encrypted modified data where the secure device processor is separate from and in communication with a secure element of the mobile communication device, and where the secure element receives master keys from a remote management server and stores the master keys to enable the upload transport key and the data protection key to be generated by the secure element without providing the master keys to the secure device processor. Other embodiments are disclosed.

First claim

What is claimed is:

1. A computer-readable storage device comprising executable instructions which, responsive to being executed by a secure device processor of a mobile communication device, cause the secure device processor to perform operations comprising:
receiving a user credential via a user interface;
providing the user credential to a secure element of the mobile communication device;
receiving a user authentication from the secure element based on the user credential;
responsive to the receiving of the user authentication, receiving an upload transport key and a data protection key from the secure element without receiving master keys, wherein the secure element stores master keys from which the upload transport key and the data protection key are generated by the secure element, wherein the secure element receives the master keys over a network from a remote management server;
responsive to an upload request, obtaining data for transmission to a recipient device;
encrypting the data using the data protection key to generate a single encrypted data; and
encrypting the single encrypted data using the upload transport key to generate a double encrypted data,
wherein the mobile communication device comprises a mobile processor device that facilitates wireless communications by the secure device processor and by the secure element, and
wherein the mobile processor device, the secure element and the secure device processor are physically separated components that are housed in the mobile communication device and are in communication with each other,
wherein the secure device processor and the secure element perform a mutual authentication with each other utilizing a keyset received via the remote management server.

2. The computer-readable storage device of claim 1 , wherein the upload request is received from a user input received at the mobile communication device.

3. The computer-readable storage device of claim 1 , wherein the upload request is received from the recipient device, another communication device, an application being executed by the mobile communication device, or a user input received at the mobile communication device.

4. The computer-readable storage device of claim 1 , wherein the secure element comprises a universal integrated circuit card, and wherein the operations further comprise:
facilitating establishing a communication channel with the recipient device; and
providing the double encrypted data over the communication channel to the recipient device to enable the recipient device to perform a first decryption of the double encrypted data utilizing a corresponding upload transport key.

5. The computer-readable storage device of claim 4 , wherein the recipient device is one of an end user device or an application server, and
wherein the recipient device receives, from the remote management server, the corresponding upload transport key or a master transport key for deriving the corresponding upload transport key.

6. The computer-readable storage device of claim 1 , wherein the recipient device is a removable memory device having a connection port to enable a physical coupling with the mobile communication device, and wherein the operations further comprise:
providing the double encrypted data to the removable memory device via the connection port to enable the recipient device to be removed from the mobile communication device and subsequently coupled with an end user device for transmission of the double encrypted data to the end user device to enable the end user device to perform a first decryption of the double encrypted data utilizing a corresponding upload transport key.

7. A communication device, comprising:
a mobile processing device comprising a control element to control a transceiver of the communications device;
a secure element having a secure element memory that stores first executable instructions that, when executed by the secure element, facilitate performance of first operations, comprising:
receiving master keys over a network from a remote management server;
storing the master keys in the secure element memory; and
generating an upload transport key and a data protection key from the master keys;

a secure device processor comprising a secure device processor memory that stores second executable instructions that, when executed by the secure device processor, facilitate performance of second operations, comprising:
receiving the upload transport key and the data protection key from the secure element without receiving the master keys;
responsive to an upload request, obtaining data for transmission to a recipient device;
modifying the data using the data protection key to generate a modified data;
encrypting the modified data using the upload transport key to generate an encrypted modified data; and
deleting the upload transport key and the data protection key after the modifying the data and the encrypting the modified data,

wherein the secure device processor, the secure element and the mobile processing device are separate components in communication with each other and are housed in the communication device, and wherein the secure device processor and the secure element perform a mutual authentication with each other utilizing a keyset received via the remote management server.

8. The communication device of claim 7 , wherein the first operations further comprise:
receiving a request from the secure device processor for the upload transport key and the data protection key, wherein the generating of the upload transport key and the data protection key is in response to the request from the secure device processor; and
wherein the second operations further comprise:
providing the upload transport key, the data protection key, and the encrypted modified data to the recipient device.

9. The communication device of claim 7 , further comprising a device processor that is separate from the secure device processor and in communication with the secure device processor, wherein the device processor facilitates wireless communications between the communication device and the recipient device, wherein the secure element comprises a universal integrated circuit card, and wherein the modifying of the data to generate the modified data comprises adding additional information to the data and applying another encryption.

10. The communication device of claim 9 , wherein the first executable instructions are provisioned to the secure element memory and the second executable instructions are provisioned to the secure device processor memory from the remote management server utilizing a remote management keyset, and wherein the additional information includes permissions, authentication data or a combination thereof.

11. The communication device of claim 7 , further comprising a user interface, wherein the second operations further comprise:
receiving a user credential via the user interface;
providing the user credential to the secure element;
receiving a user authentication from the secure element; and
requesting the upload transport key and the data protection key from the secure element in response to the receiving of the user authentication.

12. The communication device of claim 7 , wherein the upload request is received from the recipient device, another communication device, an application being executed by the communication device, or a user input received at the communication device,
wherein the secure element comprises a universal integrated circuit card, and wherein the second operations further comprise:
providing the encrypted modified data over a communication channel to the recipient dev

Assignees

• At & T Ip I Lp
• At & T Ip I Lp

Inventors

• Chastain Walter Cooper
• Chin Stephen Emille

Classifications

• H04L63/062 Primary

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0478 Primary

  applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title