Giesecke+Devrient Mobile Security Patente

According to an aspect of the present disclosure, a secure element including at least one application to securely communicate over a mobile communication network is provided. The secure element comprises a secure storage unit, in which a configuration for remote application management and/or file management is stored. The secure element further comprises a secure control unit, which is configured to receive a capability report from a terminal device hosting the secure element. Moreover, the control unit is configured to adapt the configuration based on the received capability report.

A method transferring a profile (P) from a source eUICC (e1) to a target eUICC (e2), characterized in that the profile transfer is effected via an intermediate eUICC (eint), to which the profile (P) is exported from the source eUICC (e1), and from which the profile (P) is exported to the target eUICC (e2).

Method for manufacturing an embedded universal integrated circuit card (eUICC) device, comprising: providing an eUICC device comprising a memory, in which an Operating System (OS) software is stored, wherein said OS software is adapted to exhibit an enabled in-factory-mode and a disabled in-factory-mode and said OS software is incorporated with a particular flag, namely a so-called "in-factory-flag", indicating whether the eUICC device is present in an enabled in-factory-mode or in a disabled in-factory mode.

Device for use in wireless communication, said device comprising an embedded universal integrated circuit card (eUICC) and a communication modem, wherein the eUICC comprises a first part and a second part, wherein the first part of the eUICC denoted as SGP.22 part comprises a first profile denoted as MNO1 profile and a first Issuer Security Domain Root (ISD-R) and the second part of the eUICC denoted as SGP.32 part comprises a second profile denoted as MNO2 profile and a second Issuer Security Domain Root (ISD-R), wherein at least two baseband processors for wireless communication are mounted in the communication modem and the MNO1 profile occupies a first baseband processor and the MNO2 profile occupies a second baseband processor, wherein the first ISD-R is selectable by a Local Profile Assistant (LPA) managing the MNO1 profile, and the second ISD-R is selectable by an IoT Profile Assistant (IPA) managing the MNO2 profile, wherein the device is configured in such a way that at least one of the MNO1 profile and the MNO2 profile is in the enabled state.

A method of establishing, in an eUICC, at least one profile, comprising: a) generate, in the eUICC, at least some of the profile data, referred to as on-board generated profile data (OP); the method characterized by the steps: c) transfer, all or part of, the on-board generated profile data (OP) from the eUICC to a verifier entity (VER); d) at the verifier entity (VER), based on the transferred on-board generated profile data (OP) and verification criteria and verification information, generate a verification result, which represents either successful verification or non-successful verification of the on-board generated profile data (OP), and send the verification result from the verifier entity (VER) to a state manager entity; e) by the state manager entity, provide an operative state of the profile in the eUICC only under a condition that the verification result represents a successful verification of the on-board generated profile data (OP), and under a condition that the verification result represents a non-successful verification of the on-board generated profile data (OP), prevent an operative state of the profile in the eUICC..

A method for updating a software module on a secure element (200, SE) includes the following steps: establishing a communication session between an update service (100) and the SE (200); securing the communication session by quantum-resistant cryptographic measures; transmitting data packages from the update service (100) to the SE (200) via the secured communication session to update the software module; and clearing the communication session when the data packages are successfully transmitted to the SE (200).

A method, as well as a corresponding configuration program (10), an application program dataset (A), a computer-readable data carrier (11, 12, 13), a user device (5), and a server device (3) are provided, wherein for configuring the user device (5), the method comprises the steps of providing security credentials (H), for example, by a trusted entity (T), adapted to allow a secure element (6), such as an eUICC, of the user device (5), to enable access to a secured service, for example, at least one mobile telecommunication network (N); storing the security credentials (H) in the secure element (6); and providing an application program dataset (A) configured to at least partly access and/or alter information provided in the security credentials (H) via an application programming interface, API, (B).

A method in a processing entity, for calculating, in a Security Domain, SD, included in said processing entity, related to an SCPllc Secure Channel between an Off-Card Entity, OCE, and a Security Domain, SD, SCPllc session keys, the calculating made based on:a) an SD static public key PK.SD.ECKA;b) an OCE static secret key SK.OCE.ECKA;c) an OCE ephemeral secret key eSK.OCE.ECKA; andd) key diversification data;the key diversification data being used to effect that more than one SCPllc session keys calculated with the same keys a), b) and c) are different from each other;characterized in thatthe SCPllc session keys are calculated for different Card Group IDs and/or different Hosts, in that the key diversification data comprise the following SCPllc parameters:- HostID (Tag 84); and- Card Group ID (e.g. Subject Identifier (Tag 5F20) from CERT.SD.ECKA certificate).

A method, as well as a corresponding configuration program (10), an application program dataset (A), a computer-readable data carrier (11, 12, 13), a user device (5), and a server device (3) are provided, wherein for configuring the user device (5), the method comprises the steps of providing at least one user profile dataset (P) for a user (U) to operate a secure element (6), such as an eUICC, of the user device (5), to access at least one mobile telecommunication network (M); performing a network scan with the user device (5) to identify available mobile telecommunication networks (N, M); and switching the secure element (6) to access at least one further mobile telecommunication network (N) identified by the network scan.

A secure element (100) includes a processor (110) and a memory (120). The memory stores data and instructions for being executed by the processor (110). The memory (120) is divided into a first memory section (121) for code and non-volatile data and a second memory section (122) for volatile data. The processor (110) executes an operating system (115). The operating system (115) implements a memory manager (130) with a map tree (140). The memory manager (130) dynamically allocates a physical address (129) of the first memory section (121) of the memory (120) to a virtual address (128) in the map tree (140).

Provided is a method of generating a subscriber profile configuration, preferably for a mobile communication network, in a data processing system. The method comprises: receiving configuration input data from at least one computer system external to the data processing system; processing the configuration input data by the artificial intelligence system, wherein the artificial intelligence system has been trained based on training data comprising an initialization structure, a plurality of personalization specifications and existing subscriber profile configurations generated based on the initialization structure and the plurality of personalization specifications; and generating the subscriber profile configuration based on the artificial intelligence system, wherein an output of the artificial intelligence system comprises the generated subscriber profile configuration.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

The disclosure relates to a communication system (100, 200), comprising: an User Equipment, UE (110), comprising a subscriber identity module, SIM (111), storing an identity of an UE owner (105), UE ID, in particular an International Mobile Subscriber Identity, IMSI, and an authentication key, Ki, a first communication network (101), in particular a cellular network, comprising a first authentication server (103) configured to authenticate (112) the UE owner (105) on the first communication network (101) based on the UE ID and the authentication key, Ki; a second communication network (102), in particular a cellular or mobile network, comprising a second authentication server (104); and a network interface between the first authentication server (103) and the second authentication server (104), wherein the first authentication server (103) acts as master and is configured to propagate (113) an authentication status (106) of the UE owner (105) in the first communication network (101) to the second authentication server (104), wherein the second authentication server (104) is configured to grant the UE owner (105) rights (114) in the second communication network (102) depending on the authentication status (106) of the UE owner (105) in the first communication network (101).

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Die Erfindung betrifft ein Verfahren zum Bestimmen der Qualität einer elektrischen Verbindung zwischen einem integrierten Chip (5) und einer Antenne einer kontaktlos arbeitenden Chipkarte (1). Das erfindungsgemäße Verfahren umfasst in einem Schritt a) das Einbringen einer zu untersuchenden Chipkarte (1) in eine Schwefelwasserstoff-Umgebung, wobei der Schwefelwasserstoff an Oberflächen aus leitfähigem Material eine chemische Reaktion hervorruft, aus der eine Einfärbung resultiert. In einem Schritt b) erfolgt das Auftrennen der elektrischen Verbindung zwischen dem Chip (5) und der Antenne der zu untersuchenden Chipkarte (1). Schließlich wird in einem Schritt c) eine optische Analyse der aufgetrennten Bereiche durchgeführt, bei der eine Auswertung der eine Einfärbung aufweisenden Flächenbereiche mit den keine Einfärbung aufweisenden Flächenbereichen jeweiliger aufgetrennter Bereiche durchgeführt wird.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

The present invention relates to methods, interfaces and devices for delegated management of profiles of an embedded Universal Integrated Circuit Card, eUICC, included in a mobile device. Delegated management is provided to a profile selected from a list of profiles available at the eUICC by registering the eUICC with a server and joining with the selected profile an existing subscription group of profiles on the server or by creating a new subscription group on the server based on the selected profile.

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …

Zusammenfassung wird geladen …