Telefonaktiebolaget Lm Ericsson (publ)

Fidesmo Ab

Mattias Eld

Petter Arvidsson

Göran Selander

Jakob Saros

Miguel Cardo Rodríguez

Mats Näslund

Vesa Lehtovirta

Bernard Smeets

Frank Hartung

Yi Cheng

Luis Barriga

Michael Liljenstam

Srdjan Krco

Sébastien Pierrel

Krister Sällberg

Miran Mosmondor

Ivica Cubic

Lea Skorin-Kapov

A communication node for delivering secure content in respect of a requested service to a target entity. The communication node has respective interfaces towards: at least one network for communicating with mobile terminals; a service-provider node providing the requested service; and an authorization node for effecting payments. After having completed a set-up phase and in response to a payment, the communication node enables forwarding of secure content, relating to at least one service requested by a user of a first mobile terminal to a target entity associated with the first mobile terminal. The set-up phase involves: identifying the at least one requested service from the first mobile terminal; linking in the service-provider node the at least one requested service to the first mobile terminal; and assigning a reference in the service-provider node to a payment to be made in respect of the at least one requested service.

Linking payment to secure downloading of application data

It is presented a security server arranged to set up communication between a merchant device and a customer payment application. The security server comprises: a receiver arranged to receive a first message comprising a customer identifier, an application identifier and a security token; a determiner arranged to determine whether the merchant device is authorized; a transmitter arranged to send a second message to the merchant device, the second message indicating that the merchant device is authorized to effect payment; and a channel establisher arranged to set up a secure channel between the merchant device and the customer payment application in a secure element being adapted to be comprised in a mobile communication terminal, wherein all communication between the merchant device and the customer payment application is controlled by the security server. Corresponding methods, merchant device, computer programs and computer program products are also presented.

Methods, server, merchant device, computer programs and computer program products for setting up communication

A particular authentication-based service is implemented via a physical authentication device. A service description of the particular authentication-based service is read from the physical authentication device via a user terminal; and based thereon, a service request is generated, which specifies a capability description of the user terminal. A communication node receives the service request and checks this against a database containing information about which node in a set of nodes that stores downloadable software for implementing which authentication-based services on which types of user terminals. If a match is found between at least one node and the particular authentication-based service, a download identification message is sent to the user terminal, which specifies at least one address string uniquely identifying a respective location for the downloadable software stored in the matching node(s). The downloadable software is configured to implement the particular authentication-based service on the particular mobile communication apparatus.

Identifying service providers for integrating a secure element into a short-range wireless communication apparatus

It is disclosed a method and trusted execution environments (TEE) of assigning a selected identifier to an application. A request is received to load or install, within or outside a profile domain, of an application with a selected identifier. It is checked that the selected identifier is not already stored in an application registry entry outside the profile registry. If it is requested to load or install the application in the selected profile domain, the selected identifier is assigned to said application if the selected identifier is not already stored in an application entry of a profile domain registry associated with the selected profile domain. If it is requested to load or install the application outside any profile domain, the selected identifier is assigned to said application if the selected identifier is not already stored in an application entry of any of at least two profile domain registries.

Profile integration management

A method is presented for sending a message to a secure element connected to a mobile equipment, wherein the secure element is coupled to a user of the mobile equipment. The method comprises the steps, performed in an application manager server of: receiving, from an application server, an application message and an identifier of a destination secure element; generating a secure element message from the application message; from a plurality of connectivity providers, selecting a connectivity provider capable of communicating with the destination secure element; and sending the secure element message to the selected connectivity provider for forwarding to the destination secure element. A corresponding application manager server, computer program and computer program product are also presented.

Method, server, computer program and computer program product for communicating with secure element

A network node comprising an input, a processor and an output, the processor being coupled to the input and the output; the input and output both being connected to at least one network; in which the processor is arranged so as to receive from the input an executable application and an associated set of requirements for the application, in which the processor is arranged to determine, on receipt of an application and the associated set of requirements, a set of destination network nodes which are reachable through at least one network, to which the output is connected based upon the requirements and to send the application to the destination nodes through the output. Thus, an application can be distributed through a telecommunications network specifying only the requirements that a destination network must satisfy, rather than the addresses of the destination network nodes. Furthermore, the application can be transferred between network nodes should user equipment move through the network.

Distributing an application via a network node

It presented a method, performed in a secure element, the secure element being arranged to enable user applications of the secure element to verify authenticity of incoming user application commands. The method comprises the steps of: receiving a command from a secure element reader for a user application on the secure element, the command comprising an application identifier of the user application; determining whether there is a matching user application in the secure element; invoking the matching user application; and establishing, when there is an absence of any matching user applications, a communication channel with a remote application manager server and sending an absent user application message to the application manager server indicating that the user application has been requested on the secure element. A corresponding secure element, method for an application manager server and application manager server are also presented.

Methods, secure element, server, computer programs and computer program products for improved application management

It is presented a method for invoking an application service in response to a tag reading by a mobile terminal. The method comprises the steps of: receiving an input message, the input message comprising tag data being associated with a tag read by the mobile terminal using local communication, the input message further comprising a recipient identifier linked to the mobile terminal; determining, using a plurality of parameters associated with the tag reading, a plurality of matching application servers, wherein conditions of a tag reading subscription for each of the matching application servers matches the plurality of parameters; and sending an invocation message to each of the matching application servers to invoke a respective application service of each of the matching application servers, the invocation message comprising the recipient identifier enabling each of the application services to send content to the user equipment and the tag data.

Method, apparatus and computer program product for invoking local communication application services

It is presented a method for invoking an application service in response to a tag reading by a mobile terminal. The method comprises the steps of: receiving an input message, the input message comprising data being associated with a tag read by the mobile terminal using local communication, the input message further comprising a recipient identifier linked to the mobile terminal; determining, using a plurality of parameters associated with the tag reading, a plurality of matching application servers, wherein conditions of a tag reading subscription for each of the matching application servers matches the plurality of parameters; and sending an invocation message to each of the matching application servers to invoke a respective application service of each of the matching application servers, the invocation message comprising the recipient identifier enabling each of the application services to send content to the user equipment and the tag data.

Methods and arrangements for enabling the use of a first device () for controlling transfer of media content from a content provider () to a second device (). The first device has a pre-established security association with the communications network. When the network detects a request made by the first device for delivery of media content to the second device, key information is established which enables determination of one or more media keys for encryption of the media content. The network sends key information to the content provider and to the first device. The content provider then delivers media content encrypted by the media key(s) to the second device. Further, the first device forward the media key(s) over a local communication link to the second device for decryption of media content encrypted by the media key(s) when delivered by the content provider.

Method and arrangement for enabling play-out of media

Methods and systems taught herein allow communication device manufacturers to preconfigure communication devices to use preliminary access credentials to gain temporary network access for downloading subscription credentials, and particularly allow the network operator issuing the subscription credentials to verify that individual devices requesting credentials are trusted. In one or more embodiments, a credentialing server is owned or controlled by the network operator, and is used by the network operator to verify that subscription credentials are issued only to trusted communication devices, even though such devices may be referred to the credentialing server by an external registration server and may be provisioned by an external provisioning server. Particularly, the credentialing server interrogates requesting devices for their device certificates and submits these device certificates to an external authorization server, e.g., an independent OCSP server, for verification. A common Public Key Infrastructure (PKI) may be used for operator and device certificates.

Growing community of inventors

Spånga, Sweden

Mattias Eld