Orange

Said Gharout

Laurent Coureau

Dominique Barthel

Jacques Traore

Todor Gamishev

Nicolas Ducrot

Amira Barki

Julien Sicart

Jean Luc Grimault

Suman Bala

A method for obtaining a profile for access to a communication network by a secondary terminal via a main terminal. The main terminal includes a security element having an authentication key, the authentication key being used by the network and by the main terminal to generate at least one session master key specific to the main terminal. The secondary terminal: provides its identifier to the main terminal; receives from the main terminal a temporary key specific to the secondary terminal, a temporary identifier of the secondary terminal, and an identifier of the network for access to the network. The temporary key is based on the temporary identifier of the secondary terminal and the session master key of the main terminal. The temporary key, the temporary identifier, the identifier of the secondary terminal, and the identifier of the access network are included in an profile for access to the network.

Method for obtaining a profile for access to a communication network by a secondary terminal via a main terminal

A method for obtaining a command relating to a profile for a security module of the equipment to access a network by mobile equipment. The method includes: sending, to a first server, a request including an anonymous identifier of the security module based on a physical identifier of the module and a random variable; receiving, from the first server, an address of a second server, which prepared the command and associated the command with the anonymous identifier, a request of the command having been previously received from a third server via the second server; sending, to the second server, the physical identifier of the module and of the random variable; receiving, from the second server, the command when a verification by the second server that the anonymous identifier of the security module has been computed on the basis of the received physical identifier and of the random variable is positive.

Method for obtaining a command relating to a profile for accessing a network

A technique for downloading a profile for access to a communication network by a security module. This access profile has been prepared by a network operator and is available from a server configured to provide this access profile by downloading to the security module. The security module obtains a first verification datum prepared by the network operator. A secure downloading session is established thereafter. During establishment, session keys are jointly generated between the server and the security module and the server is authenticated by the security module using a public downloading key. The security module verifies authenticity of the public downloading key by using the first verification datum enabling verification that the server uses a secret downloading key corresponding to that provided by the network operator during preparation of the first verification datum. When the public downloading key is not authentic, the security module interrupts downloading of the access profile.

Technique for downloading a network access profile

A method for setting up an execution rule of an operating environment for a communication terminal in a mobile network of an operator. The environment is referred to as a operator profile. The operator profile is stored in a subscriber module embedded in the terminal. According to the method, the subscriber module: obtains a first token signed by the operator and includes information relative to the identification of the rule; obtains a second token signed by a third party other than the operator and including a first element for verifying the authenticity of the first token; verifies the authenticity of the first token by using the first verification element; verifies the authenticity of the second token by using a second verification element; and sets up the rule in the subscriber module if the authenticity of the first and second tokens is verified.

Method and device for the dual-control set up of a configuration rule of an embedded SIM card

A communication system which includes a terminal, a telecommunications network server able to provide a network service to the terminal; and an application server able to provide application services to the terminal via the network and the network server. The terminal and the network server share and store a same network root key kept secret from the application server and are configured to generate, on the basis of this network root key, a network session key used to sign and verify the integrity of messages exchanged on the network between the terminal and the network server. The terminal and the application server share and store a same application root key kept secret from the network server, and configured to generate, on the basis of this application root key, an application session key used to encrypt and decrypt messages exchanged between the terminal and this application server via the network.

Communication system and method

A technique for managing a right of access to a service for a communicating device. A security element of the device authenticates a security element of an electrical power supply module subsequent to a detection of a start of distribution of electrical energy to the device so as to power it electrically. These security elements are then associated. The security element of the power supply module then configures the security element of the device, the latter having, once configured, a right of access to a valid service allowing it to access the service and this right of access remaining valid as long as the device is powered by this electrical power supply module.

Technique for managing a right of access to a service for a communicating device

A method for anonymously identifying a security module by a server. The method includes: receiving, from the module, a request for the address of a server managing subscription data of an operator, the request including a current identification value of the module, which depends on an identifier of the module and a current date; searching for the current identification value in at least one set of identification values, the set being associated with an operator and including, for a given module, a plurality of identification values, which are calculated depending on the identifier of the module and a date, the date varying for the plurality of identification values of the set between a start date and an end date; and sending, to the security module, the address of the server managing subscription data associated with the operator when the current identification value appears in the set of identification values.

Method for anonymously identifying a security module

The invention relates to a method for generating an authentication key in a security module which stores a first root key (K_root_A) shared with a first network entity, the method including the following steps:

Growing community of inventors

Chatillon, France

Said Gharout