DE102017009312A1 - Chipset with distributed SIM functionalities and USIM applications of different authentication types - Google Patents

Abstract

The invention provides a chipset with an application registry list containing an application registry entry for each USIM application stored in the chipset. At least some or all of the application registry entries are typed in that the application registry list contains an authentication type entry for each typed application registry entry, which designates which type of authentication is supported by the respective USIM application. A USIM application scheduler, also included in the chipset, chooses to select a USIM application of the particular type of authentication on the occasion of an authentication process of a particular type of authentication to be performed using the authentication type entry, and executes it. Manual selection of a USIM application suitable for the authentication type is not required.

Description

Field of the invention

The invention relates to a chipset for a mobile terminal, with an integrated subscriber identity module, wherein the functionality of a SIM card or a UICC distributed in the chipset of the mobile terminal is integrated.

State of the art

The world is mobile connected, and mobile networking continues. Mobile-enabled terminals communicate via mobile networks. Classic mobile-capable devices include smartphones and cell phones. Mobile terminal devices also include control devices (control devices or measuring devices or combined control / measuring devices) for industrial installations in the commercial or private environment. For example, industrial facilities are production facilities that have one or more control devices (terminals) that can communicate with a background system and / or with each other over a cellular network. Other industrial devices are smart home devices such as e.g. Heaters or electricity consumers with terminals in the form of control devices.

To use a mobile-enabled terminal, such as smartphones or mobile phones, in a mobile network of a network operator, the terminal includes a subscriber identity module containing at least one subscription. The subscription is formed by a USIM application (USIM = Universal Subscriber Identity Module) and a subscription profile or profile. The profile accomplishes the configuration of the terminal for connections in the mobile network. The profile is formed by a record that allows the establishment, operation and removal of a connection of the terminal in the mobile network, and includes, for example, a cryptographic authentication key Ki and an International Mobile Subscriber Identity IMSI. The USIM application accomplishes the construction, operation and dismantling of connections of the terminal in the mobile network, using the profile.

Mobile terminals such as smartphones include a chipset that includes a plurality of chips or processors, specifically an application processor, a baseband processor, and possibly a specially secured secure processing unit SPU. For the upcoming 5G mobile standard currently being developed, the concept of the integrated UICC or iUICC for short is proposed, with the functionality of a SIM card or UICC distributed into the chipset, i. integrated into one or more chips or processor (s) of a mobile terminal.

The document US 2016/0086159 A1 (STM) of the prior art discloses a chipset for a mobile terminal with an integrated subscriber identity module, wherein the functionality of a SIM card or a UICC distributed in the chipset of the mobile terminal is integrated, according to the preamble of claim 1.

For iUICCs, the concept of having USIM applications for different 5G authentication types in a persistent storage of the mobile terminal is proposed, according to e.g. different network access types such as GSMA or CDMA. If a user wants to authenticate in a network, he must manually check the network type and load the correct USIM application for execution in a secure memory (e.g., Secure Processor) of the mobile phone.

A smart card application of a certain type of authentication only offers a single type of authentication. A SIM card or a UICC contains a USIM application for carrying out authentications in a mobile radio network between the SIM card / UICC or a mobile terminal containing the SIM card / UICC and a network server of the mobile radio system. Thus, a SIM card or a UICC with a single USIM application thus offers authentication of only the authentication type supported by the USIM application, in the case of SIM and UICC of the authentication type GSMA. For authentication processes in a mobile network that meets a different standard and therefore uses a different authentication type, another SIM card or UICC is required.

In general, an authentication in a subscriber identity module is caused by the fact that the subscriber identity module contains an authentication vector from a server in the mobile radio network system. Authentication vectors are described in cellular specifications.

Summary of the invention

The invention is based on the object to provide a chipset for a mobile device with an integrated subscriber identity module that can support different types of authentication and at the same time provides a user convenience of the mobile terminal.

The object is achieved by a chipset according to claim 1. Advantageous embodiments of the invention are specified in the dependent claims.

The chipset according to the invention according to claim 1 contains an application registry list, the contains an application registry entry for each USIM application stored in the chipset. At least some or all of the application registry entries are typed in that the application registry list contains an authentication type entry for each typed application registry entry, which designates which type of authentication is supported by the respective USIM application. A likewise contained in the chipset USIM application scheduling means (hereinafter sometimes abbreviated as "the scheduler") selects, on the occasion of an authentication process to be performed, which is subject to a certain type of authentication, a suitable USIM application and brings them to execution. The authentication process is subject to a specific type of authentication that the mobile network over which the authentication process is done, this authentication type is sufficient. A suitable USIM application is a USIM application that is subject to the type of authentication to which the authentication process is also subject. The suitability of the USIM application is determined using the authentication type entry in the application registry list. A manual selection of a USIM application suitable for the authentication type is not required, but the selection is carried out automatically by the USIM application scheduling device.

Therefore, a chipset is provided according to claim 1, which can support different types of authentication, and at the same time offers a high ease of use for a user of the mobile terminal.

Any non-typed USIM applications that may additionally be present in the chipset can only be selected and executed in a conventional manner, for example by the user manually selecting a USIM application. Optionally, however, all the USIM applications stored in the chipset can also be typed.

The application registry list is optionally administrable, i. changeable by change instructions. The change instructions can be generated, for example, by user inputs at the mobile terminal, or by change information, e.g. Control commands sent from a server to the terminal and used in the chipset to generate change instructions. Transmission from the server to the terminal is performed, for example, over the cellular network or other wireless network (e.g., WiFi, Blue Tooth Low Energy BLE, Near Field Communication NFC, or Infrared) or other network.

As an authentication type is optionally provided: network standard GSMA or CDMA, another network standard, authentication algorithm AES, authentication algorithm DES, authentication algorithm 3DES, one of the aforementioned algorithms with or without elliptic curve cryptography, another authentication algorithm.

The application registry list can be changed by change instructions. The change instructions can be generated, for example, by: user inputs on the mobile terminal. Alternatively, it may be provided that the application registry list is automatically changed (for example, updated) by change information received at the terminal. In the latter case, a server sends the change information, e.g. Control commands, e.g. APDU commands, to the terminal (e.g., via the cellular network or other radio network or other network), and in response, the application registry list is updated according to the change information, e.g. according to the commands, changed.

For an authentication type several USIM applications of the same authentication type can be stored. In this case, the application registry list optionally includes prioritization entries by which a prioritization hierarchy of the multiple USIM application of the same type of authentication is defined among each other. The USIM application scheduler considers the prioritization entries when selecting a USMI application, or selects a USMI application using additionally the prioritization entries. If a highly prioritized USIM application is not executable or not functional, a lower priority USIM application is attempted until a USIM application of the appropriate authentication type is found to be executable and / or functional.

For completeness, it should be noted that in the chipset, more preferably at least one profile is stored for each USIM application, i. a subscription data set comprising at least IMSI and authentication key Ki, or such a profile is contained in the USIM application. A USIM application is personalized by the profile or subscription record. Only the USIM application personalized with the profile or the subscription data record enables authentication processes in the mobile radio network.

Optionally, the application memory in which the USIM applications are stored, outside the secure processing unit SPU arranged. The execution of the USIM applications, however, takes place within the secure processing unit SPU.

Optionally, the application registry list is stored in external memory external to the secure processing unit SPU. Optionally, the USIM application scheduling device is executed within the secure processing unit SPU, and the application registry list is loaded at runtime from the external memory into the secure processing unit SPU in order to generate a USIM file. Application of the specific type of authentication to select and bring to execution.

The application registry list can be stored in the same memory as the USIM applications or in another memory.

The USIM application scheduler is optionally set up within the Secure Processing Unit SPU.

Optionally, the USIM application scheduling facility may be designed as part of a CoreOS, that is, a core operating system or core operating system that permanently runs in the Secure Processing Unit SPU. This CoreOS has other components in addition to the USIM application scheduler, and in addition to the application scheduling according to the invention also performs other tasks, e.g. Hardware abstraction of Application Programming Interfaces (APIs) and the like.

According to other embodiments, the USIM application scheduler is designed as a distributed scheduler with multiple scheduler parts, with each USIM application having its own scheduler part. In these embodiments, regardless of which USIM application is currently running, always a scheduler part (in the background) is active, namely the scheduler part of the currently running USIM application.

According to other embodiments, the USIM application scheduler is a separate program, e.g. as a scheduling application (USIM application scheduling application) as well as the various USIM applications designed. The USIM application scheduling application may optionally be stored in the external NVM, or otherwise generally stored as the USIM applications. Optionally, the USIM application scheduling application is set up to run within the secure processing unit, but may be located outside, e.g. stored in the external NVM.

The USIM application scheduler is selectively invoked and executed by an operating system of the chipset, optionally by means of an interrupt mechanism. Optionally, the interrupt handling is activated as soon as an authentication vector - this is understood as any unique network distinguishing feature - is recognized by the currently running SPU operating system in the SPU. The interrupt activates the scheduler and then executes it briefly in the SPU. In accordance with the rules listed, the scheduler ensures that the correct network authentication application is loaded and executed.

According to some embodiments, a processor upstream of the secure processing unit, e.g. the base-band processor (modem) suspends network discovery and triggers the USIM application scheduler, i. causes the USIM Application Scheduler to be put into operation. The USIM application scheduler itself runs within the secure processing unit SPU.

list of figures

• 1 ein Chipset, gemäß Ausführungsformen der Erfindung;
• 2 eine Applikations-Registry-Liste, gemäß Ausführungsformen der Erfindung.

In the following the invention will be explained in more detail with reference to exemplary embodiments and with reference to the drawing, in which:

• 1 a chipset according to embodiments of the invention;
• 2 an application registry list, according to embodiments of the invention.

Detailed description of embodiments

1 shows a chipset, according to embodiments of the invention. The chipset comprises an application processor AP - here with several processor cores - a secure processing unit SPU, a modem or baseband processor BB, an external non-volatile memory Ext NVM, an external memory ext RAM and a system bus the application processor AP, secure processing unit SPU, modem or baseband processor BB, and external non-volatile memory Ext NVM can communicate with each other.

The secure processing unit SPU contains at least one secure CPU (shown here by way of example as SC 300 Core) and a secure internal main memory UICC RAM, which is accessible only to the secure CPU.

External application memory AP, secure processing unit SPU and modem or baseband processor BB have access to the external non-volatile memory ext NVM and the external memory ext RAM.

In the external non-volatile memory ext NVM are in the example off 1 five USIM applications V, W, X, Y and Z stored. For example, in alternative embodiments, some or all of the USIM applications may alternatively be stored in the application processor.

An application registry list ARL according to the invention is optionally stored in a memory within the secure processing unit SPU, in a memory of the application processor AP or in the external non-volatile memory ext NVM. There is very limited memory available within the Secure Processing Unit SPU. In this aspect, it is generally, and independently of the embodiments described here, preferred that the application registry list is stored in a memory outside the secure processing unit SPU.

A USIM application scheduling device SCH according to the invention is set up in the chipset in such a way that the CPU of the secure processing unit SPU has access to it.

According to 1 Step 1, a mobile network server MNO sends an authentication vector AV (eg according to a method described in 3G TS 33.102 or a comparable method) for an authentication process of a certain authentication type A to the terminal chipset.

According to 1 Step 2, the USIM application scheduler SCH gets information about the type of authentication available and selects, using the application registry list ARL, a USIM application suitable for the authentication type, here A, here USIM application W.

According to 1 Step 3, the selected USIM application W is loaded from the external non-volatile memory Ext NVM into the internal secure main memory UICC RAM of the secure processing unit SPU and executed there.

2 shows the application registry list ARL 1 in more detail. The application registry list ARL contains registry entries for five USIM applications V, W, X, Y, Z, with authentication type AUTH-TYPE and prioritization PRIO. For authentication type A, two USIM applications V and W are stored in the external NVM, of which USIM application V is not executable, for example, temporarily unavailable, for example because of the geo-location of the terminal. USIM application V is prioritized higher than USIM application W. Upon arrival of an authentication vector AV of the authentication type A, therefore, USIM application V would be selected prior to USIM application W and brought to execution. Since USIM application V is not available, the next USIM application of the same type of authentication is selected in the prioritization list, ie USIM application W, and executed.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2016/0086159 A1 [0005]

Claims (13)

A chipset for a mobile terminal, the chipset comprising: a) an application memory in which one or more USIM applications (V, W, X, Y, Z) are stored, each USIM application being set up, authentication operations at least or exactly one certain authentication type (A, B, C, D, E, F) in a mobile network between the terminal and a network server, and b) a secure processing unit SPU executable on the USIM applications in a secure execution environment, so an integrated subscriber identity module (iUICC) is implemented, characterized by : c) an application registry list (ARL), - stored in a memory of the chipset, and - an application registry for each USIM application stored in the chipset Contains at least some or all USIM applications typified by the application registry list for each application registry entry of a typisi USIM application contains an authentication type entry (A, B, C, D), which designates which authentication type (A, B, C, D) by the respective USIM application (V, W, X, Y, Z) is supported; and d) a USIM application scheduling device (SCH), which is set up, on the occasion of an authentication process of a specific type of authentication to be performed using the authentication type entry (A, B, C, D), a USIM application (V, W, X, Y, Z) of the particular type of authentication and to bring to execution. Chipset after Claim 1 , wherein as authentication type one of the following is provided: network standard GSMA, network standard CDMA, another network standard, authentication algorithm AES, authentication algorithm DES, authentication algorithm 3DES, one of the aforementioned algorithms with or without elliptic curve cryptography, another authentication algorithm, a combination of a the aforementioned network standards and one of the aforementioned authentication algorithms. Chipset after Claim 1 or 2 , wherein the application registry list is changeable by change instructions, wherein in particular the change instructions can be generated by: - user input at the mobile terminal; and / or - change information sent to the terminal from a server via the cellular network or other wireless network or other network and used in the chipset to generate change instructions. Chipset after one of the Claims 1 to 3 in which - for at least one authentication type, several USIM applications of the same authentication type are stored, which support the same authentication type, and wherein the application registry list further contains at least one prioritization entry to at least some or all of these USIM applications of the same authentication type a prioritization hierarchy of the plurality of USIM application of the same type of authentication is determined among each other; and - the USIM application scheduler is further configured to select and execute a USIM application according to the prioritization hierarchy. Chipset after Claim 4 wherein the USIM application scheduler is further set up if a USIM application selected according to the prioritization hierarchy and tentatively executed is not executable, selecting a USIM application lower in the prioritization hierarchy and executing it bring to. Chipset after one of the Claims 1 to 5 , wherein in the chipset further to each USIM application at least one profile is stored. Chipset after one of the Claims 1 to 6 wherein the application memory, in which the one or more USIM applications (V, W, X, Y, Z) are stored, is arranged outside the secure processing unit SPU. Chipset after one of the Claims 1 to 7 wherein the application registry list is stored in a memory located outside the secure processing unit SPU. Chipset after one of the Claims 1 to 8th , wherein the memory in which the application registry list is stored, the application memory or a separate registration memory or other memory of the chipset is provided. Chipset after one of the Claims 1 to 9 further configured to cause the authentication process to be performed according to step d) in response to receipt of an authentication vector (AV) at the chipset. Chipset after one of the Claims 1 to 10 , further comprising an operating system configured to operate the Secure Processing Unit SPU, wherein the operating system is set up to perform the USIM application process on the occasion of the authentication process to be carried out in accordance with step d). Scheduling device (SCH) to call and bring to execution. Chipset after Claim 11 in which an operating system is set up to call and execute the USIM application scheduler (SCH) by means of an interrupt mechanism. Chipset after Claim 12 wherein the interrupt mechanism is arranged to be triggered by receiving an authentication vector at the chipset.

Images