CN101518038A - System and method for sharing credentials stored in a credential module of a first device - Google Patents

Abstract

A primary appliance reversibly engageable with a secondary appliance for sharing credentials, the primary appliance comprising: a credential module configured to enable the primary device to make and receive calls; and an interface with a secondary device, the interface comprising: a physical interface for physically reversibly engaging the primary device and the secondary device; and a conductive interface operable to enable the secondary device to communicate with the credential module once physically engaged. A secondary appliance reversibly engageable with a primary appliance having a credential module that enables the primary appliance to make and receive calls, comprising: a business module configured to be enabled by the credential module; and an interface for a host device, the interface comprising: a physical interface for physically reversibly engaging a secondary device with the primary device; and a conductive interface that enables the secondary device to communicate with the credential module upon physical engagement of the secondary device with the primary device.

Description

System and method for sharing credentials stored in a credential module of a first device

technical field

The invention relates to a system for sharing user credentials in mobile phones, in particular mobile phones using SIM (Subscriber Identity Module) cards.

Background technique

Mobile phones have become a ubiquitous part of society. Mobile phones are usually owned by users who pay for outgoing and incoming calls. In recent years, many additional services have been added to mobile phones. Such services include additional communication options (eg, sending text messages, accessing the Internet, receiving broadcasts, and connecting to computers).

Other businesses use the communication channel to access and transact with remote service providers such as banks, merchants, and content providers such as providing music, video, ringtones, and news. There are also some services that are limited to the handset unit (eg, listening to music, watching videos, playing games, and managing contacts and calendars). Some services use short-range communication (eg, infrared, Bluetooth, or NFC (Near Field Communication)) to pay for fees.

Many services acquired or consumed using a mobile phone require a subscription and identification of the user and/or user rights. A SIM card is an exemplary standard module containing data used to determine a user's identity and rights. Typically, the SIM card also carries other user-related data (eg, contacts and calendar databases, and downloaded content). Thus, the SIM card will convert a generic device into a personalized device by maintaining the user's credentials (eg, data identifying the user and/or user rights) and/or content owned by the user and stored in the SIM card.

Figure 1 is a simplified schematic block diagram of a typical mobile device according to the prior art. Figure 1 shows a mobile device 100 (eg, a smart mobile phone). Credentials module 110 (eg, SIM card) is a module that identifies the user, his/her account, and optionally other access rights the user may have. Credentials module 110 may also store other personal data (eg, contact lists, calendars, Internet favorites, text messages sent/received, and content owned by the user). The credential module 110 interfaces with the device service 140 through the device interface 120 and the module interface 130 . Device service 140 represents a service module comprising hardware and software components of device 100 that provide voice or non-voice services. Device interface 120 and module interface 130 are generally conventional electrical contacts for operatively connecting device services 140 requiring appropriate user credentials with credential module 110 .

Often, a mobile device can be connected to another device to extend the functionality of the device. For example, a mobile phone can be connected to a car adapter to provide safer driving through hands-free communication; a mobile phone can be connected to a table stand to provide better sound quality and a more convenient headset; Synchronize contacts, calendars, and files; or a mobile phone can be connected to a Bluetooth headset to provide hands-free mobile communication.

Fig. 2 is a simplified schematic block diagram of a typical mobile device connected to an accessory according to the prior art. Mobile device 100' includes accessory interface 150 for operative connection to accessory 160 via device interface 162. Accessory 160 provides improved or additional services represented by accessory services 164 . Accessory interface 150 and device interface 162 are logical, electrical, and/or physical interfaces (e.g., socket-to-socket connections, cradles, and Bluetooth connections) that operably connect device 100′ to accessory 160. Current accessories are limited to the use of SIM-related services available on the device containing the SIM card, which may be limited by the capabilities or features of the device.

Users of mobile devices may frequently move SIM cards from one device to another, depersonalizing and deactivating a first device while personalizing and activating a second device. Fig. 3A is a simplified schematic block diagram of two typical mobile devices according to the prior art. FIG. 3A shows a first device 100A and a second device 100B providing similar or different device services 140A and 140B. Module transfer operation A is a manual process that allows a user to selectively insert a credential module 110 into either the first device 100A or the second device 100B, thereby deactivating the other device while selectively personalizing and activating the current device. Moving the credential module 110 from the first device 100A to the second device 100B by the module transfer operation A is considered an inconvenient task.

Existing systems, such as that taught in U.S. Patent No. 6,868,282 to Carlsson (hereinafter referred to as Carlsson '282), teach methods for: a first device reading a user from a SIM card resident in the device The entire content of this document is hereby incorporated by reference. Figure 3B is a simplified schematic block diagram of two typical mobile devices adapted from Figure 3 of Carlsson '282.

Figure 3B shows how two mobile devices (e.g. MS A and MS B) communicate with each other to access whichever SIM card (i.e. SIM card A and SIM card B). The method taught by Carlsson '282 is limited in that it requires mediation by the main CPU of MS A and/or MS B (CPU/MEM of FIG. 3B ) in order to process the memory stored in SIM card A and/or SIM card B. The secure exchange of user credentials for a device, and the need for both devices to function in order for one device to use the other device's user credentials.

A user desiring to carry a first device housing a credential module operates the second device by coupling the credential module of the first device to the second device without having to remove the credential module from the first device.

Contents of the invention

The object of the present invention is to provide a system for sharing user credentials in mobile phones, in particular mobile phones using SIM cards.

For purposes of clarity, the term "device" as used herein is specifically defined to mean a device serving a user and owned by the user or other individual. Thus, the first device may be, for example, a cellular handset owned by the user, and the second device may be, for example, a car phone owned by the user, or a public telephone available to the user.

Preferred embodiments of the present invention seek to provide a system for physically engaging a first device with a second device and then operatively connecting the second device to a credential module residing in the first device, while It is not necessary to physically remove the credential module from the first device.

Therefore, according to the present invention, for the first time there is provided a system for sharing credentials, the system comprising: (a) a master device including a credential module operable to make and receive calls using the credential module; and (b) at least A secondary device configured to: (i) physically interface with the primary device to establish an interface with the configuration module; and (ii) provide services using the credential module through the interface.

Preferably, the interface is electrically conductive.

Preferably, the interface is a short range contactless interface.

Most preferably, the short-range contactless interface uses at least one communication technology selected from the group consisting of ISO 14443 technology, NFC technology, Bluetooth technology, infrared technology and acoustic interface technology.

Preferably, said service comprises at least one service selected from the group consisting of enabling telephony, sending text messages, providing user identity, providing identity of a subscription record in an operator database, providing permission to said User access to credit account data, providing data allowing said user to access bank accounts, providing access to electronic wallets, providing access to said user's contacts database, providing access to said user's calendar database, providing Access to content owned by the user, provides access to ringtones, provides access to music, provides access to videos, and provides DRM access codes.

According to the present invention, for the first time there is provided a primary device reversibly engageable with a secondary device for sharing credentials, the primary device comprising: (a) a credential module configured to enable the primary device to make and receive calls; and (b) an interface with the secondary device, the interface comprising: (i) a physical interface capable of physically reversibly engaging the primary device with the secondary device; and (ii) a conductive interface operable to enable the secondary device to Ability to communicate with credential modules.

According to the present invention, for the first time there is provided a secondary device reversibly engageable for sharing credentials with a primary device having a credential module enabling the primary device to make and receive calls, the secondary device comprising: (a) a business module configured to be enabled by the credential module; and (b) an interface for the primary device comprising (i) a physical interface capable of physically reversibly engaging the secondary device with the primary device; and (ii) a conductive An interface operable to enable the secondary device to communicate with the credential module when the secondary device is physically engaged with the primary device.

Preferably, the service module comprises at least one service selected from the group consisting of enabling telephony, sending text messages, providing user identity, providing identity of subscription record in operator database, providing permission for said user access to credit account data, provide data allowing said user to access bank accounts, provide access to electronic wallets, provide access to said user's contact database, provide access to said user's calendar database, provide access to Access to content owned by the user, provides access to ringtones, provides access to music, provides access to videos, and provides DRM access codes.

These and other embodiments are apparent from the following detailed description and examples.

Description of drawings

The invention is herein described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 is a simplified schematic block diagram of a typical mobile device according to the prior art;

Figure 2 is a simplified schematic block diagram of a typical mobile device connected to an accessory according to the prior art;

Figure 3A is a simplified schematic block diagram of two typical mobile devices according to the prior art;

Figure 3B is a simplified schematic block diagram of two typical mobile devices adapted from Carlsson '282 of Figure 3;

Figure 4 is a simplified schematic block diagram of two mobile devices according to a preferred embodiment of the present invention;

Figure 5A is a simplified schematic block diagram of an exemplary alternative to implementing connections B and C of Figure 4 in accordance with a preferred embodiment of the present invention;

Figure 5B is a simplified schematic block diagram of an exemplary alternative to implementing connections B and C of Figure 4 according to another preferred embodiment of the present invention;

Figure 5C is a simplified schematic block diagram of an exemplary alternative to the embodiment of Figure 5B in accordance with a preferred embodiment of the present invention;

Figure 5D is a simplified schematic block diagram of an exemplary alternative to the embodiment of Figure 5C in accordance with a preferred embodiment of the present invention;

Figure 6 is a simplified flowchart of the operation of the credential sharing system in accordance with a preferred embodiment of the present invention.

Detailed ways

The invention relates to a system for sharing user credentials in mobile phones, in particular mobile phones using SIM cards. The principles and operation of sharing user credentials in mobile phones according to the present invention may be better understood with reference to the following description and accompanying drawings.

Referring now to the drawings, FIG. 4 is a simplified schematic block diagram of two mobile devices in accordance with a preferred embodiment of the present invention. A first device 200A (eg, a cell phone) is physically engaged with a second device 200B. The expression "physical engagement" is used herein to mean that the body of the first device 200A is inserted into the body of the second device 200B, or is mechanically connected to the body of the second device 200B, so that the first device 200A and the second device 200B temporarily act as one. single integrated unit. For example, the first device 200A may be inserted into a slot of the second device 200B, or into a stand forming part of or connected to the second device 200B.

User credentials stored in credential module 210 include, for example: data specific to the user (e.g., the identity of the user, and the identity of the subscription record in the operator database); data allowing the user to access credit or bank accounts;" "e-wallets"; the user's contacts and calendar databases; content owned by the user (e.g., downloaded ring tones, music, and videos); and the content required to access digitally protected content under digital rights management (DRM) mechanisms code.

The credential module 210 is preferably a security chip (such as a SIM card) that protects content through a tamper-resistant physical structure and digital cryptography. Credential module 210 enables operation of device 200A using existing known techniques. Operation of device 200A is enabled by providing the identity, code, and operating parameters. Credentials module 210 may include a microprocessor for performing cryptographic operations (eg, encryption schemes, challenge-response procedures, digital signatures, and password generation processes).

Credential module 210 is operatively connected to device service 240A through device interface 220 and module interface 230A. As noted above, device interface 220 and module interface 230A include mechanical, electrical, and logical connections. The device interface 220 and the module interface 230A may for example be based on card and reader interfaces respectively defined under the ISO 7816 standard. The first device 200A includes hardware and software for providing device services 240A (eg, service modules for enabling telephony, text messaging, storage, and multimedia). At least some device services 240A require access to and use of user credentials in credential module 210 .

In a similar manner, the second device 200B includes a credential module 210', a device interface 220', a module interface 230B, and a device service 240B. Device business 240B may be similar to and/or different from device business 240A. For example, the second device 200B may be a high powered hands-free car phone integrated with a digital radio receiver for subscription-based broadcasting. In such an example, device business 240B includes hardware and software for cellular telephones and digital radio receivers, both of which require the presence of credential module 210' for operation.

According to a preferred embodiment of the present invention, the first device 200A can be physically bonded to the second device 200B, enabling the device service 240B to use the credential module 210 of the first device 200A. A physical bond may be formed by direct connection of module interface 230B to device interface 220 via connection B, or to module interface 230A via connection C. This will be described in more detail below with reference to Figures 5A-D. Thus, when the first device 200A is physically engaged with the second device 200B, the second device 200B operates using the credential module 210 of the first device 200A.

In contrast to the prior art of FIG. 3A , while the credential module 210 is being used by the second device 220B, the first device 200A is preferably turned off (ie not running). Thus, a connection is made between the second device 200B and the credential module 210, but not between the second device 220B and the first device 200A.

In the mode of operation described with respect to the first device 220A and the second device 200B, the second device 200B uses user credentials from the credential module 210 of the first device 200A, which are described with respect to the first device 220A and the second device 200B. The described mode of operation does not necessarily exclude the conventional mode of the prior art (ie, module transfer operation A of FIG. 3A ). In such a prior art mode of operation, the credential module 210' is removed from the first device 200A and inserted into the second device 200B, rather than connecting the first device 200A to the second device 200B.

Figure 5A is a simplified schematic block diagram of an exemplary alternative for implementing connections B and C of Figure 4 in accordance with a preferred embodiment of the present invention. In Figure 5A, credential module 210' includes a chip/body 210C sandwiched between an upper contact surface 220C and a lower contact surface 220C'. As shown in FIG. 4, such a structure enables access to the credential module 210' through a connection C to the module interface 230A for the operation of the first device 200A, or through a connection C to the module interface 230B for the operation of the second device 200B. The operating Connection B accesses the credential module 210'. The bodies of the first device 200A and the second device 200B are configured to allow physical contact between the contact surface 220C' and the module interface 230B when the first device 200A and the second device 200B are engaged.

Figure 5B is a simplified schematic block diagram of an exemplary alternative for implementing connections B and C of Figure 4 according to another preferred embodiment of the present invention. In Figure 5B, the credential module 210" has only a single contact surface 220C" for the chip/body 210C. The contact surface 220C" is physically connected to the first module interface 230A' such that the credential module 210" can be accessed using the device service 240A. First module interface 230A' is electrically connected to second module interface 230A", which is configured to interface with module interface 230B of second device 200B when physically engaged with first device 200A', thereby enabling device services 240B to Credential module 210" is accessed through contact surface 220C", first module interface 230A', second module interface 230A", and module interface 230B.

Figure 5C is a simplified schematic block diagram of an exemplary alternative to Figure 5B in accordance with a preferred embodiment of the present invention. In Figure 5C, double-sided module interface 230A'" connects credential module 210" of first device 200A" to device service 240A and device service 240B (via contact with module interface 230B).

Figure 5D is a simplified schematic block diagram of an exemplary alternative to Figure 5C in accordance with a preferred embodiment of the present invention. In FIG. 5D, the module interface 230A"" and the module interface 230B'" employ a contactless communication mechanism when connecting the credential module 210" of the first device 200A'" to the second device 200B'". Since the amount of data exchanged between the credential module 210" and the second device 200B" is usually very small, and because both the first device 200A'" and the second device 200B'" are autonomously powered by independent power sources, the contactless communication mechanism Any known wireless communication technology (eg, ISO 14443, NFC, Bluetooth, infrared, and acoustic interfaces) can be used.

Figure 6 is a simplified flowchart of the operation of the credential sharing system in accordance with a preferred embodiment of the present invention. Components (and reference numerals) of FIG. 4 are included in the description for clarity of description. The first device 200A housing the credential module 210 is used to access user credentials required for operation (step 400). Operation of the first device 200A is then terminated (step 410). The first device 200A is then physically engaged with the second device 200B (eg, by inserting the first device 200A into a slot or holder of the second device 200B) (step 420).

As in the embodiment in FIG. 5A , physical connection of the first device 200A to the second device 200B (step 420 ) establishes direct contact between the credential module 210 and the second device 200B (step 430 ). Alternatively, as in the embodiment in FIGS. 5B-D , the physical connection (step 420 ) of the first device 200A to the second device 200B establishes the credential module 210 and the second device 200B through the module interface 230A of the first device 200A. Indirect contact between (step 440). Both steps 430 and 440 enable the second device 200B to communicate with the credential module 210 (residing in the first device 200A) to receive user credentials required for operation of the second device 200B (step 460).

It should be noted that communication between the second device 200B and the credential module 210 is preferably effected using standard device/credential module protocols, and preferably without the involvement or involvement of any processor or communication functions forming part of the first identity 200A. Achieved without mediation. It should be understood that the user credentials accessed by the first device 200A from the credential module 210 in step 400 may be the same as or different from the user credentials accessed by the second device 200B from the credential module 210 in step 460 . In both cases (ie, step 400 and step 460), these user credentials may be responsive to specific actions selected by the user (eg, making a phone call, listening to a digital radio broadcast, and initiating an electronic banking transaction).

It should be understood that while the first device 200A housing the credential module 210 is typically a mobile device (preferably a cell phone), the second device 200B may be a mobile or stationary device (e.g., another cell phone, car phone, desktop accessories, and personal computers). It is further emphasized that the second device 200B may include a separate credential module (i.e., credential module 210'), and/or be configured to accept the credential module 210 of the first device 200A upon removal from the first device 200A. Module 210.

While a limited number of embodiments have been described, it should be understood that various changes, modifications, and other applications of the invention may be made.

Claims (13)

1. system that is used for sharing voucher, described system comprises:

(a) main equipment comprises credentials module, and described main equipment uses described credentials module operatively to dial and receive calls; And

(b) at least one secondary device is configured to:

(i) physically engage with described main equipment, thus the interface of foundation and described credentials module; And

(ii) use described credentials module to provide professional by described interface.

2. system according to claim 1, wherein said interface conducts electricity.

3. system according to claim 1, wherein said interface is a short distance noncontact interface.

4. system according to claim 3, wherein said short distance noncontact interface uses at least a communication technology of selecting from the group that comprises ISO 14443 technology, NFC technology, Bluetooth technology, infrared technique and acoustics interfacing.

5. system according to claim 1, wherein said business comprises at least a business of selecting from following group, described group comprises enabled phone, send text message, user identity is provided, the identity of the subscription record in operator's database is provided, the data that allow described user capture house account are provided, the data that allow described user capture bank account are provided, visit to stored value card is provided, visit to described user's contact database is provided, provide described user's schedule access of database, the visit of the content that described user is had is provided, visit to the bell sound is provided, visit to music is provided, visit to video is provided, and provide DRM access code.

6. a main equipment can reversibly engage with secondary device, is used for sharing voucher, and described main equipment comprises:

(a) credentials module is configured to make described main equipment to dial and to receive calls; And

(b) to the interface of described secondary device, described interface comprises:

(i) physical interface is used for physically reversibly engaging described main equipment and described secondary device; And

(ii) conductive interface operatively makes described secondary device communicate by letter with described credentials module by physical engagement the time.

7. a secondary device that is used for sharing voucher can reversibly engage with main equipment, and described main equipment has the credentials module that makes described main equipment dial and to receive calls, and described secondary device comprises:

(a) business module is configured to be enabled by described credentials module; And

(b) be used for the interface of described main equipment, described interface comprises:

(i) physical interface is used for physically reversibly described secondary device being engaged with described main equipment; And

(ii) conductive interface operatively makes described secondary device can communicate by letter with described credentials module during with described main equipment physical engagement at described secondary device.

8. secondary device according to claim 7, wherein said business module comprises at least a business of selecting from following group, described group comprises enabled phone, send text message, user identity is provided, the identity of the subscription record in operator's database is provided, the data that allow described user capture house account are provided, the data that allow described user capture bank account are provided, visit to stored value card is provided, visit to described user's contact database is provided, provide described user's schedule access of database, the visit of the content that described user is had is provided, visit to the bell sound is provided, visit to music is provided, visit to video is provided, and provide DRM access code.

9. method of between first equipment and second equipment, sharing voucher, wherein said first equipment has credentials module, said method comprising the steps of:

(a) optionally operate described first equipment and be used for communicating by letter, thereby make it possible to dial and receive calls with described credentials module;

(b) physically with described first equipment and described second device engagement, thereby described second equipment is connected with described credentials module interface, is used to enable the business of described second equipment.

10. method according to claim 9, wherein said interface connect and comprise that joint electrically contacts.

11. connecting, method according to claim 9, wherein said interface comprise use short distance noncontact interface.

12. method according to claim 11, wherein said short distance noncontact interface uses at least a communication technology of selecting from the group that comprises ISO 14443 technology, NFC technology, Bluetooth technology, infrared technique and acoustics interfacing.

13. method according to claim 9, wherein said business comprises at least a business of selecting from following group, described group comprises enabled phone, send text message, user identity is provided, the identity of the subscription record in operator's database is provided, the data that allow described user capture house account are provided, the data that allow described user capture bank account are provided, visit to stored value card is provided, visit to described user's contact database is provided, provide described user's schedule access of database, the visit of the content that described user is had is provided, visit to the bell sound is provided, visit to music is provided, visit to video is provided, and provide DRM access code.

Images