Thales Dis France Sas

Thales Dis France Sa

Thales

Michel Anslot

Marc Lamberton

Jean-Yves Fine

Alain Rhelimi

Xavier Berard

Vania Conan

Eric Saliba

Milas Fokle Kokou

Philippe Bouckaert

Francis D'Souza

Franck Scholler

Jean-Marc Montenot

Mathieu Bouet

Filippo Rebecchi

The invention is a method for updating a first secret data in a credential container including a subscriber identity module. The credential container comprises a set of secret parameters customized for a network operator and is configured to execute a symmetric mutual authentication algorithm using said set. The credential container receives from a remote server a second secret data enciphered using a second algorithm different from said symmetric mutual authentication algorithm and a subset of said secret parameters, the credential container deciphers the enciphered second secret data by using both the subset and a third algorithm and replaces the first secret data with the second secret data.

Method for updating a secret data in a credential container

A method for transmitting a subscription profile that includes transmitting from a POS of the MNO the unique identifier of the secure element to a SM-DP; creating or reserving the subscription profile at the SM-DP; provisioning in a D-HSS server having the first MCC/MNC the unique identifier and a temporary IMSI including a second MCC, a second MNC; provisioning in the HSS of the MNO the temporary IMSI and an ephemeral Ki; at the first attempt of the secure element to connect to the D-HSS server with its temporary profile, exchanging data in signaling messages between the secure element and the D-HSS for provisioning the secure element with the temporary IMSI; at the next attempt of the secure element to connect to the MNO network with the temporary IMSI, open an APN and send from the SM-DP to the secure element the subscription profile.

Method for transmitting an existing subscription profile from a MNO to a secure element, corresponding servers and secure element

A method for authenticating by a network server a communication apparatus, the communication apparatus contains a tamper resistant area adapted to memorize a first secret, by receiving from the communication apparatus a request message including a subscriber identifier; providing, by consulting a database accessible by the network server, a device identifier associated to the received subscriber identifier allowing to identify the communication apparatus; identifying in a secure distributed ledger a record published by a manufacturer of at least a portion of the communication apparatus, the record including a second secret attributed to the identified communication apparatus; generating a challenge message including a random number and sending it to the communication apparatus for it to generate a first result; receiving from the communication apparatus a response message including the first result, the communication apparatus being authenticated by the network server if the first result is equal to a second result.

Method and network server for authenticating a communication apparatus

A method for personalizing a UICC includes: i—sending from the UICC to a D-HSS an attach request message comprising an IMSI with a given MCC/MNC; ii—sending from the D-HSS to the UICC a command and first cryptographic data; iii—computing at the UICC a secret key by using the first cryptographic data; iv—sending from the UICC to the D-HSS a command and second cryptographic data; v—repeating steps ii to iv until the UICC holds the entire first cryptographic data and the D-HSS holds the entire second cryptographic data; vi—computing at the D-HSS the secret key by using the second entire cryptographic data; vii—allocating by the D-HSS a free IMSI belonging to an operator and transferring from the D-HSS to the UICC the free IMSI and other personalization data; viii—personalizing the UICC with the free IMSI, personalization data and the secret key.

Method for personalizing an improved UICC cooperating with a terminal

Provided is a method for establishing a bidirectional communication channel between a server and a secure element cooperating with a terminal in a cellular telecommunication network for exchanging data and commands. Provided also is an improved SM-DS+ comprising comprising a SM-OS server that provisions the HSS of a MNO with a temporary IMSI transmitted to said secure element, along with an ephemeral key contained also in said secure element. Other embodiments disclosed.

Method for establishing a bidirectional communication channel between a server and a secure element, corresponding servers and secure element

A method for transmitting a subscription profile from an MNO to a secure element pre-provisioned with a temporary profile comprising a unique identifier, MCC and MNC, includes: &#x2014;Transmitting from the MNO the unique identifier to a SM-DP; &#x2014;Creating the subscription profile at the SM-DP; &#x2014;Provisioning in a D-HSS server having the first MCC/MNC the unique identifier and a temporary IMSI comprising a second MCC, a second MNC; &#x2014;Provisioning in the MNO the temporary IMSI and an ephemeral key; &#x2014;At the first attempt of the secure element to connect to the D-HSS server, exchanging data in signaling messages for provisioning the secure element with the temporary IMSI; &#x2014;At the next attempt of the secure element to connect to the MNO network with the temporary IMSI, open an APN and send from the SM-DP to the secure element the subscription profile.

Method for transmitting an existing subscription profile from a mobile network operator to a secure element, corresponding servers and secure element

This invention relates to a method for updating a one-time secret key Kn maintained in a subscription module implemented in a communication apparatus, a wireless communication network maintaining an identical version of said one-time secret key Kn and configured to determine a result XRES expected from the communication apparatus when an authentication function is applied by the subscription module using a random challenge and said one-time secret key Kn as an input, the method comprising the following steps: receiving from the communication network an authentication request message containing at least a random challenge RANDn; determining by the subscription module a result RES by applying the authentication function using the random number RANDn and the one-time secret key Kn as inputs; transmitting said result RES to the communication network for it to be compared with the expected result XRES determined by the communication network using the random number RANDn and the corresponding version of the one-time secret key Kn, the subscriber being authenticated if said first and second results are matching; updating the one-time secret key Kn by replacing its current version with a new version obtained by applying a first key derivation function using the random challenge RANDn as an input, the updated version of the one-time secret key Kn being used by the subscription module for processing a subsequent authentication request, the same update being carried out by a server accessible or part of the wireless communication network in order to maintain an identical version of the one-time secret key Kn.

Method for updating a one-time secret key

A user equipment for wireless communication, configured to operate in a cellular network, includes a credential container. The user equipment sends a set of payload items to a central server communicatively coupled to the cellular network, wherein the user equipment is configured to send an attach request message to the cellular network comprising a preconfigured qualifier for at least one of the user equipment and the credential container. The user equipment is further configured&#x2014;to retrieve an authentication request message from the cellular network comprising a random value and an authentication code, &#x2014;to determine a response token comprising a preconfigured identifier stored in at least one of the user equipment and the credential container and at least one out of the set of payload items, and&#x2014;to submit said response token with an authentication failure message to the cellular network for forwarding to the central server.

Method for operating a user equipment in a cellular network

The invention is a method for communication between a server and a user equipment through a set of command/response pairs. The user equipment uses an IMSI field of an Attach Request frame as defined by ETSI TS 124.008 to convey a command to the server. The server uses an Authentication parameter RAND field or an Authentication parameter AUTN field of an Authentication Request frame as defined by ETSI TS 124.008 to convey a response corresponding to the received command. The server sends the Authentication Request frame in response to the Attach Request frame.

Method for managing communication between a server and a user equipment

The invention concerns a method for establishing a bidirectional communication channel between a server and a secure element cooperating with a terminal in a cellular telecommunication network for exchanging data and commands, the method comprising:

A method for transmitting a subscription profile from an MNO to a secure element pre-provisioned with a temporary profile comprising a unique identifier, MCC and MNC, includes:&#x2014;Transmitting from the MNO the unique identifier to a SM-DP;&#x2014;Creating the subscription profile at the SM-DP;&#x2014;Provisioning in a D-HSS server having the first MCC/MNC the unique identifier and a temporary IMSI comprising a second MCC, a second MNC;&#x2014;Provisioning in the MNO the temporary IMSI and an ephemeral key;&#x2014;At the first attempt of the secure element to connect to the D-HSS server, exchanging data in signaling messages for provisioning the secure element with the temporary IMSI;&#x2014;At the next attempt of the secure element to connect to the MNO network with the temporary IMSI, open an APN and send from the SM-DP to the secure element the subscription profile.

A method for an eUICC embedded into a machine type communication device to trigger the download of a subscription profile from a first network operator, the eUICC being provisioned with an eUICC identifier and a pre-loaded data set memorizing a range of International Mobile Subscription Identifiers associated to a second network operator by selecting randomly by the eUICC an IMSI number in the range memorized in the pre-loaded data set, sending an attachment request comprising the randomly selected IMSI, receiving in an authentication request message the request for getting the eUICC identifier, as a response, sending to the discovery server a authentication failure message, receiving in an authentication request message a temporary IMSI from the discovery server so that the machine type communication device is able to attach to the first network operator and download the pending subscription profile.

Method for an eUICC embedded into a machine type communication device to trigger the download of a subscription profile

A method for a credential container embedded into a wireless communication device to obtain a temporary wireless connectivity through a first wireless network, the credential container being provisioned with an identifier ID identifying the wireless communication device or the credential container and a pre-loaded subscription profile comprising a range of International Mobile Subscription Identifiers associated to a second network operator.

Growing community of inventors

Meudon, France

Michel Anslot