Apparatus and method for secure delivery of data from a communication device

Patent metadata

Field	Value
Publication number	US-9729526-B2
Application number	US-201715397106-A
Country	US
Kind code	B2
Filing date	Jan 3, 2017
Priority date	Nov 27, 2013
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

A system that incorporates the subject disclosure may perform, for example, providing an upload request to a mobile communication device to cause a secure device processor of the mobile communication device to perform a modification of data according to a data protection key to generate modified data and to perform an encryption of the modified data according to an upload transport key to generate encrypted modified data where the secure device processor is separate from and in communication with a secure element of the mobile communication device, and where the secure element receives master keys from a remote management server and stores the master keys to enable the upload transport key and the data protection key to be generated by the secure element without providing the master keys to the secure device processor. Other embodiments are disclosed.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a processing system including a processor, a master transport key from a remote management server;
generating, by the processing system, a corresponding upload transport key from the master transport key;
receiving, by the processing system, double encrypted data from a communication device, wherein the double encrypted data is generated from data based on a data protection key, wherein the data protection key is used in a first encryption to generate a single encrypted data and a second encryption of the single encrypted data is generated according to an upload transport key;
decrypting, by the processing system, the double encrypted data utilizing the corresponding upload transport key to obtain the single encrypted data;
receiving, by the processing system, a master protection key from the remote management server;
storing, by the processing system, the master protection key;
generating, by the processing system, a corresponding data protection key from the master protection key; and
decrypting, by the processing system, the single encrypted data utilizing the corresponding data protection key to obtain the data,
wherein a Universal Integrated Circuit Card (UICC) of the communication device receives the master transport key and the master protection key over a network from the remote management server, and
wherein the communication device includes a secure device processor separate from and in communication with the UICC, wherein the UICC and the secure device processor are separate components in communication with each other.

2. The method of claim 1 , wherein the remote management server stores the master transport key and the master protection key to enable the upload transport key and the data protection key to be generated.

3. The method of claim 1 , further comprising:
deleting, by the processing system, the corresponding upload transport key after the decrypting of the double encrypted data.

4. The method of claim 1 , further comprising:
storing, by the processing system, the single encrypted data in a memory accessible to the processing system.

5. The method of claim 4 , further comprising:
deleting, by the processing system, the corresponding data protection key after the decrypting of the single encrypted data.

6. The method of claim 3 , wherein the corresponding upload transport key and the upload transport key are a same key.

7. The method of claim 1 , wherein the UICC provides the upload transport key and the data protection key to the secure device processor without providing the master transport key and the master protection key to the secure device processor.

8. The method of claim 1 , wherein the UICC and the secure device processor perform a mutual authentication procedure utilizing a keyset received via the remote management server.

9. A device, comprising:
a processing system including a processor; and
a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations comprising:
receiving a master transport key from a remote management server;
generating a corresponding upload transport key from the master transport key;
receiving double encrypted data from a communication device, wherein the double encrypted data is generated from data based on a data protection key that generates a single encrypted data and a second encryption of the single encrypted data according to an upload transport key;
receiving a master protection key from the remote management server;
storing the master protection key;
generating a corresponding data protection key from the master protection key; and
decrypting the single encrypted data utilizing the corresponding data protection key to obtain the data,
wherein the communication device includes a Universal Integrated Circuit Card (UICC) and a secure device processor separate from and in communication with the UICC, and
wherein the UICC receives the master transport key and the master protection key over a network from the remote management server.

10. The device of claim 9 , wherein the remote management server stores the master transport key and the master protection key to enable the upload transport key and the data protection key to be generated, and wherein the operations further comprise:
decrypting the double encrypted data utilizing the corresponding upload transport key to obtain the single encrypted data; and
storing the single encrypted data in a memory accessible to the processing system.

11. The device of claim 10 , wherein the operations further comprise:
deleting the corresponding upload transport key after the decrypting of the double encrypted data.

12. The device of claim 9 , wherein the corresponding upload transport key and the upload transport key are a same key.

13. The device of claim 9 , wherein the operations further comprise:
deleting the corresponding data protection key after the decrypting of the single encrypted data.

14. The device of claim 9 , wherein the UICC provides the upload transport key and the data protection key to the secure device processor without providing the master transport key and the master protection key to the secure device processor.

15. A machine-readable storage medium comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations comprising:
receiving a master transport key from a remote management server;
generating a corresponding upload transport key from the master transport key; and
receiving double encrypted data from a communication device, wherein the double encrypted data is generated from data based on a data protection key that generates a single encrypted data and a second encryption of the single encrypted data according to an upload transport key;
receiving, by the processing system, a master protection key from the remote management server;
storing, by the processing system, the master protection key;
generating, by the processing system, a corresponding data protection key from the master protection key; and
decrypting, by the processing system, the single encrypted data utilizing the corresponding data protection key to obtain the data,
wherein the communication device includes Universal Integrated Circuit Card (UICC) and a secure device processor separate from and in communication with the UICC, wherein the UICC and the secure device processor perform a mutual authentication procedure utilizing a keyset received via the remote management server, and wherein the UICC receives the master transport key and the master protection key over a network from the remote management server.

16. The machine-readable storage medium of claim 15 , wherein the remote management server stores the master transport key and the master protection key to enable the upload transport key and the data protection key to be generated, and wherein the operations further comprise:
decrypting the double encrypted data utilizing the corresponding upload transport key to obtain the single encrypted data; and
storing the single encrypted data in a memory accessible to the processing system.

17. The machine-readable storage medium of claim 16 , wherein the operations further comprise:
deleting the corresponding upload transport key after the decrypting of the double encrypted data.

18. The machine-readable storage medium of claim 17 , wherein the corresponding upload transport key and the upload transport key are a same

Assignees

• At & T Ip I Lp

Inventors

• Chastain Walter Cooper
• Chin Stephen Emille

Classifications

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0478 Primary

  applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title