Apparatus, method and computer program product for controlling the usability of an application module by means of security module

ES 2 393 568 T3

DESCRIPTION

Device with procedure and computer program product to control the possibility of using an application module by means of a security module

Technical aspect

The present invention relates to a security module and to a method for controlling the usability of an application module. The present invention relates in particular to a security module suitable for a communications terminal equipment that is prepared to authenticate a telecommunications network and that comprises at least one usable application module as well as a method to control the possibility of using the device. application module.

State of the art

Security modules are especially known for mobile communication terminal equipment, for example mobile radiotelephones, in the form of chip cards such as so-called SIM cards (Subscriber Identity Module). These security modules are also widely used in communication terminal equipment in fixed networks. In addition to subscriber identification, the security modules also serve in particular for the authentication of telecommunication networks. The protocols for end-to-end network authentication by means of the security module are described in various standardization publications. Authentication of network access to mobile networks based on 3GPP AKA (3GPP: Third Generation Partnership Project); AKA: Authentication and Key Agreement Protocol is defined for example in technical specifications (ETSI TS 133 102 V6.3.0 (2004-12); Universal Mobile Telecommunications System (UMTS), (Universal

Mobile Telecommunications); 3G Security; Security Architecture (3GPP TS 33.102 Version 6.9.0, Edition 6) or EtSI TS 131 102 V6.9.0 (2005-03) Universal Mobile Telecommunications System (UMTS); Characteristics of the US-IM Application (3GPP TS 31.102 Version 6.9.0 Edition 6). The authentication of access to the IMS (IP Multimedia Subsystem) based on 3GPP AKA is defined for example in the technical specifications ETSI TS 131 103 V6.7.0 (2005-03): Digital Cellular Telecommunications System (Digital Cellular Telecommunications System) (Phase 2+); Universal Mobile Telecommunications Systems (UMTS); Characteristics of the IP Multimedia Services Identity Module (ISIM), Application (3GPP TS 31.103 Version 6.7.0 Edition 6). The authentication of access to public wireless local networks (WLAN) based on EAP (Extensible Authentication Protocol) is described for example in ETSI TS 102 310 V6.1.0 (2005-02); Smart Cards (Smart Cards); Extensible Authentication Protocol Support in the UICC (Edition 6). Other authentication mechanisms are described in ETSI TS 101 181 V8.8.0 (2001-12); Digital Cellular Telecommunications System (Phase 2+); Security Mechanisms for SIM Application Toolkit Stage 2 (3GPP TS 03.48 Version 8.8.0 Edition 1999) and in ETSI TS123048 V5.8.0 (2003-12); Digital Cellular Telecommunications System (Phase 2+); Universal Mobile Telecommunications System (UMTS), Universal Mobile Telecommunications System); Security Mechanisms for the (U) SIM Apliccation Toolkit; Stage 2 (Security Mechanism for the Application Toolkit (U) SIM (3GPP TS 23.048 Version 5.8.0, Edition 5) for SMS (Short Messaging Services). Typically the security modules also comprise application modules which in particular can often also be used independently of the network. For example, a cryptography module can be used to decode coded data, without requiring access to an authenticated telecommunications network. Similarly, an application module can be used for online payments through the Internet, without necessarily using the mobile telephone network or the WLAN, which are exploited by the editor of the security module that it offers to a user of a telecommunications network, in particular a mobile radiotelephony network or WLAN, who provides a subscriber with a security module or application module for use in the telecommunications network, therefore, there is no control to know if the subscriber uses application modules independent of the network, without using the user's telecommunications network either. This means that the security module does not request any link from the use of independent applications of the network to the use of the user's telecommunications network.

In the Wireless Application Protocol (WAP) Forum “Wireless Appplication Protocol, WAP-182-ProvArch20010314-a, Provisioning Architecture Overview” of the March 14, 2001 outlines security considerations for the configuration of WAP clients, typically client wireless terminal equipment. The protected configuration of a WAP client takes place on the basis of a trust relationship between a trusted provider (Trusted Provisioning Server - TPS) of the configuration context and the WAP client. When setting the configuration context, for example, security parameters such as shared secrets or certificates can also be used.

ES 2 393 568 T3

Document US 2004/0123152 describes a platform for hardware-based security brands such as SIM cards or USB (Universal Serial Bus) brands. Security marks comprise one or more security domains for installing and running applications. The security domains are each assigned to an application provider and comprise internal security mechanisms. The security mechanisms are based on registered security rules, which include in particular also rules for blocking and releasing proof of use of access (Credentials) and which have cryptographic keys.

Presentation of the invention

One of the objectives of the present invention is to propose a suitable security module for a communications terminal equipment as well as a method to control the possibility of using a security module application module, which does not present the disadvantages of the state of The technique. It is in particular an objective of the present invention to propose a security module as well as a method to control the possibility of using an application module of the security module, which allows at least a certain coupling of the use of independent application modules from the network to the use of a certain telecommunications network.

At this point it must be remembered that the concept of usability describes the property that an application module has of being available (for a user) for use. Correspondingly an application module with the possibility of suspended use (for the user) is not available for use since the application module for the user for example is not visible, selectable, activatable or executable.

According to the present invention, the aforementioned objectives are achieved, in particular by the elements of the independent claims. Further advantageous embodiments appear in addition to the dependent claims and the description.

The security module is provided for a communication terminal equipment and comprises at least one usable application module. The security module is also prepared to authenticate a telecommunications network.

The aforementioned objectives are achieved by the present invention in particular because the security module is provided with a locking module to cancel the possibility of using the application module. In addition to this, the security module comprises a release module to restore (respective establish) the possibility of using the application module, as well as a control module to activate the release module (respective to activate the restoration of the possibility of utilization), depending on the data received that can be authentically assigned to a specific telecommunications network. The security module comprises, for example, several control modules, each of which is assigned to an application module. The security module is preferably designed as a device, in particular as a smart card, which can be releasably connected to the communication terminal equipment. The specialist will understand that the security module can also be realized in a variant as a computer program product with means of coding the computer program for controlling one or more processors of the communication terminal equipment. In a variant embodiment, the security module is designed as a subscriber identification module. The security module is made, for example, for mobile communication terminal equipment prepared for mobile radiotelephony networks. Due to the fact that the possibility of using a data-dependent application module that can be authentically assigned to a certain telecommunications network or can be suspended, it is possible to link the use of network-independent applications to the use of a certain telecommunications network. For example, the possibility of using the application module may be linked to the condition that the user of the communications terminal equipment registers in the determined telecommunications network and then receives authentication data from this telecommunications network. The condition for the possibility of use preferably also extends to telecommunications networks that have a Roaming agreement with the specific telecommunications network, that is, the possibility of use is therefore linked to its use in telecommunications networks of the operator of the network. particular network and the roaming partner of the operator of the particular network. Through the explicit transmission of authenticated authorization messages, respective authorization data, the possibility of using an application module can be linked to certain conditions of the operator of the telecommunications network, for example to a certain amount of services that are obtained by the user. of the operator of the telecommunications network.

In different or combined embodiments, the control module is also prepared to activate the locking module, depending on the number of uses of the application module, the number of selections of the application module, the number of uses of the functions of the application module, the number of sessions established through a logical channel of the communication module, the number of resetting cycles of the security module and / or reaching a certain time. By monitoring different parameters, it is possible to dynamically control the usability of an application module, flexibly adapting it to different requirements.

ES 2 393 568 T3

In different or combined embodiments, the control module is also prepared to activate the release module, independently of the authorization messages received, which can be authentically assigned to the specific telecommunications network and / or are dependent of received authentication data that can be assigned to the given telecommunications network. Controlling the usability of an application module based on the authentication data received has the advantage that the usability can be controlled without further modifications to the network infrastructure, only in the security module.

In different or combined embodiments, the locking module is prepared to suspend the possibility of using the application module by deactivating, locking, hiding, releasing and / or uninstalling the application module. The release module is correspondingly prepared to re-establish the usability of the application module by means of activation, unlocking, listing, awakening and / or installation of the application module.

In a variant embodiment, the security module comprises at least one expiration record that is assigned to one or more application modules. The control module is prepared to store in the expiration register current data related to the number of uses of the application module, the number of selections of the application module, the number of uses of functions of the application module, the number of established sessions through a logical channel of the application module, to the number of reset cycles of the safety module and / or to the duration time.

In a variant embodiment, the security module comprises at least one authorization record that is assigned to one or more application modules. The control module is prepared to store in the authorization record data related to the authorized number of applications module uses, the authorized number of application module selections, the authorized number of application module functions uses, the authorized number of sessions through a logical channel of application sessions, to the authorized number of reset cycles of the security module and / or to the authorized duration time.

In addition to the security module for communication terminal equipment and the method for controlling the use of an application module, the present invention also relates to a computer program product with means for coding the computer program for the control of one or several processors of a security module for a communications terminal equipment, whose security module is prepared to authenticate a telecommunications network and whose security module comprises at least one usable application module, the computer program product comprising in particular a computer-readable medium in which the encoding means of the computer program.

Brief description of the drawings

An embodiment of the present invention is described below with the help of an example. The exemplary embodiment is illustrated by the following attached figures:

Figure 1 shows a block diagram schematically representing a communications terminal equipment with a security module, the security module being realized as a device that is releasably connected to the communications terminal equipment.

Figure 2 shows a block diagram that represents another example of a communications terminal equipment with a security module, the security module being realized as a computer program product with means of coding the computer program for the control of one or more processors of the communications terminal equipment.

Figure 3 shows a block diagram that schematically illustrates a possible embodiment of the security module as well as the corresponding process developments.

Figure 4 shows a block diagram that schematically illustrates another possible security module as well as the respective process developments.

Figure 5 shows a block diagram that schematically illustrates another possible security module as well as the corresponding process developments.

realization of the realization of

Figure 6 shows a block diagram that schematically illustrates another possible embodiment of the security module as well as the respective process developments.

Guidelines for the realization of an invention

In Figures 1 to 6, the corresponding components are each designated with the same reference sign.

In Figures 1 to 6, reference 1 designates a security module that is prepared to authenticate a telecommunications network 2. An end-to-end authentication of the telecommunications network 2 is performed by the

ES 2 393 568 T3 security module 1 based for example on the known authentication mechanisms, mentioned initially. The security module comprises several application modules 11, 11 'that can be used by the user of the security module 1 or by the operating time environment (Client Execution Environment) or by applications of the communication terminal equipment 10. For application modules 11, 11 'that require user interaction, the user can enter data, for example via data entry elements 101, 101' (keyboard, mouse) and which are reproduced for the user through screen 102 or acoustically. In addition to the usable application modules 11, 11 'the security module 1 comprises other function modules, in particular a locking module 12, a release module 13 and a control module 14 as well as an expiration register as well as a authorization record 16. The blocking module 12 is prepared to suspend the use of one or more application modules 11, 11 ', that is to say to block the availability and / or the right to use the corresponding application module 11, 11'. The release module 13 is prepared to restore the use of one or more application modules 11, 11 ', that is to say to establish and guarantee (again or possibly for the first time) the availability and / or authorization for the use of the modules. respective application numbers 11, 11 '. The control module 14 is prepared to activate the respective release module 13 to restore use, as well as to activate the respective lock module 12 to suspend use, depending on the use of one or more application modules 11, 11 ', is that is, depending on defined conditions relative to the use of the application modules 11, 11 '. The function modules are preferably designed as programmed software modules. The function modules comprise computer program codes for the control of one or more processors found in the device on which the security module 1 is made. As schematically represented in FIG. 1, the security module 1 is preferably designed as a device that is releasably connected to the communication terminal equipment 10, preferably as a smart card, in particular as a subscriber identification module in the form of a a SIM card. As schematically represented in Figure 2, in one of the variants, the security module is organized as a computer program product that is incorporated directly into the communications terminal equipment 10 and that controls one or more processors of the communications terminal equipment 10. The specialist will understand that the function modules can also be made in part or in full in the form of hardware. The communication terminal equipment 10 comprises at least one communication module for data communication through telecommunication networks 2,

Four. The communication terminal equipment 10 is realized, for example, as a mobile radiotelephone, PDA (Personal Data Assistant), laptop or as a personal computer. The telecommunications network 2 preferably comprises a mobile telephone network, for example a GSM network (Global System for Mobile Communication), a UMTS network (Universal Mobile Telephone System), another mobile radio system, for example satellite-based and / or a (public) WLAN. The specialist will understand that the telecommunications network 2 can also comprise a fixed network, for example an ISDN (Integrated Services Digital Network) or the Internet. The telecommunications network 4 corresponds technologically, for example, to the telecommunications network 2, but has a different network identification (for example another mobile network code MNC) and is typically exploited by another operator. In figure 1, reference 3 refers to an authentication center, which on the network side supports end-to-end network authentication by means of the security module 1. Reference 5 refers to an authentication module. Authorization control that it does not have does not have to be performed in the authentication center 3, but can be assigned to another network unit of the telecommunications network 2, for example to an authorization control server. The authorization control module 5 is preferably realized as a computer program product, which includes computer program codes for the control of one or more processors of a network unit of the telecommunications network 2. With regard to the function of the module of authorization control 5 will be discussed later.

In the following sections the operation of the security module 1 is explained, making reference to figures 3 to 6. In figures 3 to 6, references 7, 7 'refer to application modules (Client Applications) of the equipment communications terminal 10; reference 8 refers to the Client Execution Environment of the communications terminal equipment 10. Reference 9 refers to an incident control module (Client Event Handler) of the communication terminal equipment 10; reference 6 refers to a network gateway, and reference 17 refers to the Execution Environment of the security module 1. Figures 3 to 6 reproduce a logical / functional presentation. The flow of data and the flow of control at the application level between an active application module 11 of the security module 1, and an application module 7 assigned to the communication terminal equipment 10 are indicated in Figures 3 to 6 by means of the step S7. With step S7 'it is indicated schematically where events such as the selection of an application (for example application module 11 of the security module 1) are activated by the application modules 7 of the communication terminal equipment 10.

As represented in Figures 3 to 6, in the operating time environment 17 of the security module 1, in step S1 'data is received from the authentication center 3 or the authorization control module 5, which is they lead, for example, in step S1 through network port 6. The data from the authentication center 3 comprises authentication data that was transmitted during the authentication of the telecommunications network 2 to the security module 1 to signal the authentication of the telecommunications network 2. The data from the authorization module 5 comprises at least minus one authorization message that is transmitted from authorization control module 5 to security module 1. The authorization message can be authenticated and relayed to the telecommunications network 2 respective to the authorization control module

ES 2 393 568 T3

5, to a corresponding authorization control server or to a trusted service provider. The authorization message comprises, for example, authorization data with instructions for the release or restoration of the right to use one or more application modules 11, 11 '. The authorization data can also be generated implicitly in the security module based on a received authorization message. In the environment of the operating time 17 of the security module 1, authenticable time stamps can also be received from a trusted time server via the telecommunications network 2, 4. Furthermore, in the operating time environment 17 of the security module 1, data from the operating time environment 8 of the communication terminal equipment 10 are received in step S2 ', which are for example passed through the module in step S2. event control 9 of the communications terminal equipment 10. The operating time environment data 8 includes instructions for selecting and activating application modules 11, 11 ', for selecting and activating functions of application modules 11, 11', as well as for resetting. security module 1.

As shown in Figures 3 to 5, the data received from the operating time environment 17 from the security module 1 is retransmitted in step S3 to the control module 14.

As represented in FIG. 6, the security module 1 comprises in a variant embodiment several control modules 14 ', 14 ", which are each assigned to one of the application modules 11, 11'. In the variant embodiment according to FIG. 6, the data of the operating time environment 8 relating to the control of one of the application modules 11, 11 'are retransmitted in step S3' respectively to the control module 14 ', 14 '' corresponding assigned. In the variant embodiment according to FIG. 6, the authorization messages for one or more application modules determined in step S3 'are transmitted in each case to the corresponding assigned control module 14', 14 ".

As shown in Figures 3 and 4, the control module 14 updates in step S4 the authorization record 16 based on the received authorization messages or authentication data signaling the authentication of the telecommunications network 2. Based on the received authorization messages or the authentication data, the control module 14 activates the authorization module 13 which in step S6 releases the use of one, several or all of the application modules 11, 11 'or resets it. The release or restoration of the use of an application module 11, 11 'is achieved by means of the release module 13 because the respective application module 11 is activated, unlocked, awakened, installed or listed. , eleven'. A lock mark that is read by the application module 11, 11 'can also be erased. The authorization register 16 comprises authorization conditions for one or more specific application modules 11, 11 'or for all the application modules 11, 11' of the security module 1. The authorization conditions include, for example, for one or more application modules 11, 11 'the authorized number of uses of the application module 11, 11', the authorized number of selections of the application module 11, 11 ', the authorized number of uses of functions of the application module 11, 11 ', the authorized number of sessions through a logical channel of the application module 11, 11', the authorized number of resetting cycles of the security module 1 and / or the authorized time of use of the application module 11, 11 '. The authorization conditions are established in the authorization register 16, based for example on the received restoration instructions or on the authentication data, for which the authorization conditions are contained in the restoration facilities or are hidden in storage. security module 1.

The release or the establishment of the use of an application module based on received authentication data is linked in a variant to additional conditions that specify, for example, a certain number of authentications of the telecommunications network 2, within a period of time definite.

As represented in FIGS. 5 and 6, the security module 1 comprises in a variant embodiment several authorization registers 16, 16 ', which are each assigned to one of the application modules 11, 11'. In the variant embodiment according to Figures 5 and 6 the control module 14 (respective 14 ', 14' ') updates in step S4' each time the corresponding authorization record 16, 16 ', based on the authorization messages or required authentication data.

In order to pursue and redirect authorizations that are modified, the security module 1 has one or more expiration records 15, 15 '. Figure 3 illustrates a variant embodiment in which the security module 1 has an expiration record. Figures 4 to 6 illustrate preferred embodiments in which the security module 1 comprises several expiration registers 15, 15 'which are each assigned respectively to an application module 11, 11'. In the expiration record 15, 15 'indications relating to activities carried out or pending to be carried out, related to one or more application modules 11, 11' are stored. If the expiration record 15, 15 'is prepared as an incremental record, the time values ​​or the number of activities (uses) are counted incrementally starting from zero. If the expiration record 15, 15 'is prepared as a decremental record, the time values ​​or the number of activities (uses) are discounted starting from an initial limit value (authorization condition). The expiration register 15, 15 'comprises in particular data relating to the number of uses of the application module 11, 11', the number of selections of the application module 11, 11 ', the number of uses of functions of the application module 11 , 11 ', to the number of sessions established through a logical channel and the application module 11, 11', to the number of

ES 2 393 568 T3 resetting cycles of the security module 1 and / or to a period of time, for example the time elapsed since the authorization was granted. The specialist will understand that expiration record 15, 15 'may correspond to authorization record 16, 16', in which case setting authorization record 16 is equivalent to setting an initialization value of expiration record 15, which Over time or depending on its use, it decreases.

If the data received includes a request related to one of the application modules 11, 11 'or a request for resetting the security module 1, the control module 14, 14' updates in step S5, S5 'the corresponding record of expiration 15, 15 'and checks the authorization for the selection or activation of the affected application module 11, 11' respective a function of the affected application module 11, 11 '. The verification of the authorization is based on the corresponding authorization record 16, 16 'and / or the corresponding expiration record 15, 15'. In the case of the incremental expiration record 15, 15 ', no authorization is no longer present when the increased value reaches or exceeds the corresponding maximum allowable value (the number of uses) in the authorization record 16, 16'. In the decremental expiration register 15, 15 'no authorization ceases to exist when the decremented value, starting from the original maximum admissible value (for example the number of selections) of the authorization register 16, 16' reaches the value zero. If there is no authorization, for example, a failure confirmation message is generated to the unit making the request. If the authorization is canceled due to the present request, the control module 14 activates the blocking module 12 which cancels the possibility of using one, several or all of the application modules 11, 11 '. Suspension of the possibility of using an application module 11, 11 'is achieved by means of the blocking module 11 because it deactivates, blocks, hibernates, or uninstalls the affected application module 11, 11' or because when it is removed it hides itself from a list. It is also possible to place a lock mark which, when the application is made by the application module 11, 11 ', reads itself, after which the application module 11, 11' terminates its activity. Otherwise, if there is an authorization, the corresponding activation module 11, 11 'is selected and activated, respectively the affected function. In an alternative embodiment variant, the expiration record 15 is updated, as indicated in FIG. 3, in step S8 by the respective application module

eleven. In the variant embodiment with several expiration registers 15, 15 ', the expiration register 15 is updated in step S8', as indicated in FIGS. 4 to 6, which corresponds to the respective application module 11, 11 '.

In the security module 11, several expiry registers 15, 15 'and authorization registers 16, 16' can also be provided for the application modules 11, 11 'of different telecommunication networks 2 respective operators.