Giesecke+Devrient Mobile Security

Die Erfindung betrifft ein Sicherheitspapier (10) für die Herstellung von Sicherheitsdokumenten, wie Banknoten, Ausweisdokumenten oder dergleichen, mit zwei gegenüberliegenden Hauptflächen (10V, 10R) und mit in das Volumen des Sicherheitspapiers eingebrachten ersten Melierfasern (22). Erfindungsgemäß ist dabei vorgesehen, dass das Sicherheitspapier (10) auf einer ersten Hauptfläche (10V) vollflächig mit zweiten Melierfasern (24) versehen ist, deren Eigenschaften sich von den Eigenschaften der ersten Melierfasern (22) unterscheiden, und die im Wesentlichen nur bei Betrachtung des Sicherheitspapiers von der Seite der ersten Hauptfläche (10V) her erkennbar sind.

A method, as well as a corresponding configuration program (10), an administration program dataset (C), a computer-readable data carrier (11, 12, 13), a user device (5), and a server device (3) are provided, wherein for configuring a user device (5), in particular a mobile device or an IoT device, comprising a secure element (6), such as an eUICC, configurable for identifying a user (U) with at least one associated user profile dataset (P) to allow participation in mobile telecommunication networks (N), the method comprises the steps of providing a secure element (6) of the user device (5), such as an eUICC, with an operating system dataset (O); and providing an administration program dataset (C) configured to be installed on the secure element (6) and to open a communication channel (M) to remotely interact with the operating system dataset (O).

A method, as well as a corresponding configuration program (10), a server program dataset (B), a computer-readable data carrier (11, 12, 13), a user device (5), and a server device (3) are provided, wherein for configuring a server device (3), in particular a security server providing a secure location for handling user profile datasets (P) adapted to be stored on a secure element (6), such as an eUICC, of a user device (5) associated to a user (U) and configured to identify the respective user (U) to allow participation in mobile telecommunication networks (N), the method comprises the steps of providing a database (D) containing an administered set (M) of user profile datasets (P); defining at least one connectivity parameter (C) relating to each user device (5) associated to a user profile (P) contained in the administered set (M); and predicting an outcome of a profile operation (Q) to be remotely carried out with the user pro-file datasets (P) contained in the administered set (M) based on the at least one connectivity parameter (C).

Process for migration of an Internet of Things (IoT) device, namely an eUICC device, from a first eSIM IoT Remote Manager (eIM1) to a second eSIM IoT Remote Manager (eIM2), said process comprising: a) the step of providing an eUICC device, in which the configuration data of a first eSIM IoT Remote Manager (eIM1) are added; and providing an IoT Profile Assistant (IPA); b) the step of providing the eUICC device with a specific key, said key being usable for carrying out a protected operation with the capability to delete the configuration data of the first eSIM IoT Remote Manager (eIM1) within the eUICC by an eligible entity; c) the step of triggering the IoT Profile Assistant (IPA) to perform a protected eUICC Memory Reset operation, thereby deleting the configuration data of the first eSIM IoT Remote Manager (eIM1) within the eUICC and optionally creating a new, second eSIM IoT Remote Manager (eIM2) within the eUICC.

Proposed is a method of configuring a secure element (10) with an operational profile (B) using a provisioning unit (22). The provisioning unit (22) is provided with profile data (D) of an operational profile (B). I a memory (16) of the secure element (10) a generic installation key (I), a temporal network contact credentials (T) and a unique identifier of the secure element (E) re installed. A base profile is installed (A) in the secure element (10) using the generic installation key (I). A confirmation information (T) confirming installation of the base profile (A) including the unique identifier (E) is received. A temporal connection between secure element (10) and profile provisioning unit (22) using the temporal contact credentials (T) is established. Profile data (D) corresponding to the unique identifier (E) are provided to the secure element using (10) the temporal connection. The profile data (D) are integrated into the base profile (A) to create an operational profile (B).

A method, as well as a corresponding configuration program (10), a security program dataset (10c), a computer-readable data carrier (11, 12, 13), a hardware security module (4), and a server device (3) are provided, wherein for transforming data objects (D) for configuring secure elements (6), such as eUICCs, of user devices (5) intended to be issued to users and allowing secure accesses involving a trusted entity (T), in particular for accessing telecommunication networks, the method comprising the steps of providing a hardware security module (4) for a server device (3) configured to transform a data input of data elements (F) to a data output of data objects (D) configured to operate the secure elements (6); and providing a sequence key (Φ) configured to allow execution of a transformation sequence (W) in the hardware security module (4), wherein the transformation sequence (W) comprises at least two transformation operations (V) performed on the data elements (F) in the course of generating the data objects (D).

Wertdokument, umfassend ein Substrat (10) mit einer ersten Substratoberfläche und einer, der ersten Substratoberfläche gegenüberliegenden zweiten Substratoberfläche; ein erstes Sicherheitselement (20) mit einem ersten Sicherheitsmerkmal (22 = Prägestruktur 60 + Metallisierung 62) auf einer Vorderseite des Sicherheitselements und einem zweiten Sicherheitsmerkmal (32 = Reflexionsschicht 70 + Dielektrikumsschicht 72 + Absorberschicht 74) auf einer Rückseite des Sicherheitselements, wobei das erste Sicherheitsmerkmal einen optisch variablen Effekt umfasst, der auf der ersten Substratoberfläche visuell erkennbar ist, und wobei das zweite Sicherheitsmerkmal einen Farbkippeffekt umfasst, der auf der zweiten Substratoberfläche visuell erkennbar ist; ein zweites Sicherheitselement (40, wie 20) mit einem dritten Sicherheitsmerkmal, wobei das dritte Sicherheitsmerkmal einen Farbkippeffekt umfasst, der auf der ersten oder der zweiten Substratoberfläche visuell erkennbar ist; wobei ein Farbeindruck des Farbkippeffekts des zweiten Sicherheitsmerkmals und ein Farbeindruck des Farbkippeffekts des dritten Sicherheitsmerkmals derart zueinander korrelieren, dass die jeweiligen unter einem Betrachtungswinkel erkennbaren Farbeindrücke des zweiten und des dritten Sicherheitsmerkmals gleich oder zueinander komplementär sind.

A method, as well as a corresponding configuration program (10), a security program dataset (10c), a computer-readable data carrier (11, 12, 13), a hardware security module (4), and a server device (4) are provided, wherein providing user profile datasets (P) for configuring secure elements (6), such as eUICCs, of user devices (5) intended to be issued to users (U) and allowing secure accesses involving a trusted entity (T), in particular for accessing telecommunication networks, the method comprising the steps of providing a set of secure elements (6) each having an element identifier (D), configuring a profile identifier database (D) containing potential profile identifiers (I) each identifying a user profile dataset (P) to be associated with a user; and fetching an element identifier (X) of a secure element (6) for configuration, and selecting a profile identifier (I) from the profile identifier database (D) to be associated with the element identifier (X) based on at least one selection instruction taken from the profile identifier database (D).

A method, as well as a corresponding configuration program (10), a security program dataset (10c), a computer-readable data carrier (11, 12, 13), a hardware security module (4), and a server device (3) are provided, wherein for transforming data objects (D) for configuring secure elements (6), such as eUICCs, of user devices (5) intended to be issued to users (U) and allowing secure accesses involving a trusted entity (T), in particular for accessing telecommunication networks, the method comprising the steps of providing a hardware security module (4) for a server device (3) configured to transform a data input of data elements (E) to a data output of data objects (D) configured to operate the secure elements (6); and providing a trust chain dataset (U) for managing a data batch (M) of the data elements (E), the data objects (D) and/or transformation operations (V) performed on the data elements (E) in the course of generating the data objects (D).

System comprising an accessed device and a key device, wherein said accessed device is a computer device comprising a Trusted Platform Module (TPM) and said key device is an em-bedded universal integrated circuit card (eUICC) device comprising a secure element (SE), wherein said system further comprises a communication means for enabling said accessed device to communicate with said key device by exchanging an encrypted code in response to an access request during a power-up sequence, wherein said encrypted code is generated by encrypting executable code on the basis of a secret key.