Method and device for remote management and verification of remote management authority

Abstract

The present disclosure relates to a communication method and system for integrating a fifth generation (5G) communication system supporting a higher data rate than a fourth generation (4G) system with an Internet of Things (IoT) technology. The present disclosure can be applied to smart services based on 5G communication technology and IoT-related technologies, such as smart homes, smart buildings, smart cities, smart cars, connected cars, healthcare, digital education, smart retail, safety and security services. A method for remote management of a terminal and remote management authority verification includes: receiving a remote management instruction package; obtaining certificate information configured for a security module, which can be used when remotely managing a security service module corresponding to at least one identifier among a plurality of identifiers; and verifying a remote security service module management certificate of a bundled management server and a remote management instruction package by using the obtained certificate information.

Description

Technical Field

[0001] The present disclosure relates to a method and device for remote management and verification of remote management authority, and more specifically, to a method and device for a terminal to select certificate issuer information and a valid certificate or identifier of a server capable of remotely managing a security service installed in the terminal and to verify the validity of the selected certificate and the validity of a remote management command. Background Art

[0002] In order to meet the demand for wireless data traffic that has increased since the deployment of 4G communication systems, efforts have been made to develop improved 5G or pre-5G communication systems. Therefore, 5G or pre-5G communication systems are also referred to as "super 4G networks" or "post-LTE systems." Consider implementing 5G communication systems in higher frequency (mmWave) bands (e.g., 60GHz bands) to achieve higher data rates. In order to reduce the propagation loss of radio waves and increase the transmission distance, beamforming, massive multiple-input multiple-output (MIMO), full-dimensional MIMO (FD-MIMO), array antennas, analog beamforming, and massive antenna technology are discussed in 5G communication systems. In addition, in the 5G communication system, system network improvements are being developed based on advanced small cells, cloud radio access networks (RAN), ultra-dense networks, device-to-device (D2D) communications, wireless backhaul, mobile networks, cooperative communications, coordinated multi-points (CoMP), receiving-end interference elimination, etc. In the 5G system, hybrid FSK and QAM modulation (FQAM) and sliding window superposition coding (SWSC) as advanced coding modulation (ACM) and filter bank multi carrier (FBMC), non-orthogonal multiple access (NOMA), and sparse code multiple access (SCMA) as advanced access technologies have also been developed.

[0003] The Internet, which is a human-centered connected network in which humans generate and consume information, is now evolving into the Internet of Things (IoT), in which distributed entities such as things exchange and process information without human intervention. The Internet of Everything (IoE), which is a combination of IoT technology and big data processing technology through connection with cloud servers, has emerged. Since IoT implementation requires technical elements such as "sensing technology", "wired / wireless communication and network infrastructure", "service interface technology" and "security technology", sensor networks, machine-to-machine (M2M) communication, machine type communication (MTC), etc. have been studied recently. Such an IoT environment can provide intelligent Internet technology services that create new value for human life by collecting and analyzing data generated among connected things. IoT can be applied to various fields, including smart homes, smart buildings, smart cities, smart cars or connected cars, smart grids, health care, smart appliances and advanced medical services through the integration and combination between existing information technology (IT) and various industrial applications.

[0004] In line with this, various attempts have been made to apply 5G communication systems to IoT networks. For example, technologies such as sensor networks, machine type communications (MTC), and machine-to-machine (M2M) communications can be implemented through beamforming, MIMO, and array antennas. The application of cloud radio access networks (RANs) as the above-mentioned big data processing technology can also be considered as an example of the fusion of 5G technology and IoT technology.

[0005] Various services can be provided according to the above development of mobile communication systems, and therefore a method for efficiently providing these services is required. More specifically, a method and apparatus are required in which a terminal selects an identifier of a server capable of remotely managing a security service installed in the terminal, or a valid certificate and certificate issuer information that can be used when downloading and installing a bundle between the terminal and the server, and verifies the validity of the selected certificate.

[0006] The above information is presented as background information only to assist with understanding the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with respect to the present disclosure. Summary of the invention

[0007] Technical issues

[0008] The disclosed embodiments may provide a device and method in which a security service module may be remotely installed in a security module installed in an electronic device, security services may be provided via the security service module and security information stored in the security module, and the installed security service module may be remotely controlled.

[0009] In addition, the disclosed embodiments may provide a device and method for selecting and verifying a certificate between a terminal and a bundle management server, which certificate is to be used for remote management of bundles classified into different bundle family identifiers, bundle family identifiers and bundle family manager identifiers, or bundle family identifiers, bundle family manager identifiers and bundle owner identifiers.

[0010] Solution to the problem

[0011] According to one aspect of the present disclosure, a method is performed by a first entity included in a terminal in a wireless communication system, the method comprising: receiving a remote bundling management command from a server; verifying a first bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal; sending a remote bundling management command to a second entity included in the terminal; and receiving an execution result of the remote bundling management command from the second entity, wherein the second bundling policy is verified by the second entity based on the information included in the remote bundling management command and the bundling policy stored in the terminal, and wherein the remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

[0012] In some examples, the information included in the remote bundle management command includes at least one of a bundle identifier, a bundle family identifier of the bundle, a bundle family manager identifier of the bundle, a bundle owner identifier of the bundle, and a remote management command type.

[0013] In some examples, the bundling policy stored in the terminal includes at least one of end-user consent and bundling management server verification.

[0014] In some examples, verifying the first bundling policy includes verifying user consent.

[0015] In some examples, the verification of the second bundling policy includes verifying a bundling management server.

[0016] According to another aspect of the present disclosure, a method performed by a second entity included in a terminal in a wireless communication system includes:

[0017] Receiving a remote bundling management command from a first entity included in a terminal; verifying a second bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal; and sending an execution result of the remote bundling management command to the first entity, wherein the remote bundling management command is sent from a server to the first entity, wherein the first bundling policy is verified by the first entity based on information included in the remote bundling management command and the bundling policy stored in the terminal, and wherein the remote bundling management command is executed by the terminal based on the verification result of the first bundling policy and the second bundling policy.

[0018] According to another aspect of the present disclosure, a first entity included in a terminal includes: a transceiver capable of sending or receiving at least one signal; and a controller coupled to the transceiver, wherein the controller is configured to: receive a remote bundling management command from a server, verify a first bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal, send a remote bundling management command to a second entity included in the terminal, and receive an execution result of the remote bundling management command from the second entity, wherein the second bundling policy is verified by the second entity based on the information included in the remote bundling management command and the bundling policy stored in the terminal, and wherein the remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

[0019] According to another aspect of the present disclosure, a second entity included in a terminal includes: a transceiver capable of sending or receiving at least one signal; and a controller coupled to the transceiver, wherein the controller is configured to: receive a remote bundling management command from a first entity included in the terminal, verify a second bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal, and send an execution result of the remote bundling management command to the first entity, wherein the remote bundling management command is sent from a server to the first entity, wherein the first bundling policy is verified by the first entity based on the information included in the remote bundling management command and the bundling policy stored in the terminal, and wherein the remote bundling management command is executed by the terminal based on the verification result of the first bundling policy and the second bundling policy.

[0020] According to some embodiments of the present disclosure, a method for managing and verifying a remote management certificate by a terminal may include: receiving a remote management instruction package for remotely controlling a specific security service module and a remote security service module management certificate of the security service module management server from a security service module management server; obtaining certificate information configured for the security module, which certificate information can be used when remotely managing a security service module corresponding to at least one of a security service module owner identifier, a security service module family manager identifier, and a security service module family identifier of the specific security service module; and verifying the remote security service module management certificate and the remote management instruction package of the bundled management server by using the obtained certificate information.

[0021] According to some embodiments of the present disclosure, a terminal may include a transceiver and at least one processor, which is used to execute control to: obtain remote security service module management certificate information, which can be used when remotely managing a specific security service module corresponding to at least one identifier among a security service module family identifier and a security service module family manager identifier; and receive a remote management instruction package for remotely controlling the security service module and a remote security service module management certificate of the security service module management server from a bundled management server.

[0022] According to some embodiments of the present disclosure, one or more processors may execute control to: verify a remote management instruction packet for remotely controlling a security service module and a remote security service module management certificate of a security service module management server based on certificate information configured for the security module, wherein the certificate information may be used when remotely managing a security service module corresponding to at least one of a security service module owner identifier, a security service module family manager identifier, and a security service module family identifier of a security service module pre-configured for the security service module; and remotely manage the security service module.

[0023] The technical subject matter pursued by the present disclosure may not be limited to the above-mentioned technical subject matter, and other technical subject matter not mentioned may be clearly understood by those skilled in the art to which the present disclosure belongs through the following description.

[0024] Before proceeding to the following detailed description, it may be helpful to set forth definitions of certain words and phrases used throughout this patent document: the terms "include" and "comprising" and their derivatives mean inclusion without limitation; the term "or" is inclusive, meaning and / or; the phrases "associated with" and "associated with" and their derivatives may mean including, included within, interconnected with, containing, contained within, connected or connected with, coupled or coupled with, communicable with, cooperating with, interwoven, juxtaposed, proximate, combined with or combined with, having, having the property of, etc.; and the term "controller" means any device, system, or part thereof that controls at least one operation, such device may be implemented in hardware, firmware, or software, or some combination of at least two of them. It should be noted that the functionality associated with any particular controller may be centralized or distributed, whether locally or remotely.

[0025] In addition, the various functions described below can be implemented or supported by one or more computer programs, each of which is formed by a computer-readable program code and embodied in a computer-readable medium. The terms "application" and "program" refer to one or more computer programs, software components, instruction sets, processes, functions, objects, classes, instances, related data, or a portion thereof suitable for implementation in a suitable computer-readable program code. The phrase "computer-readable program code" includes any type of computer code, including source code, object code, and executable code. The phrase "computer-readable medium" includes any type of medium that can be accessed by a computer, such as a read-only memory (ROM), a random access memory (RAM), a hard drive, a compact disk (CD), a digital video disc (DVD), or any other type of memory. "Non-transitory" computer-readable media does not include wired, wireless, optical, or other communication links that transmit temporary electrical signals or other signals. Non-transitory computer-readable media include media in which data can be permanently stored and media in which data can be stored and then overwritten, such as rewritable optical disks or erasable memory devices.

[0026] Definitions for certain words and phrases are provided throughout this patent document, those of ordinary skill in the art should understand that in many, if not most instances, such definitions apply to prior, as well as future uses of such defined words and phrases.

[0027] Advantageous Effects of the Invention

[0028] According to various embodiments, the terminal may verify and execute the remote binding management command. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, wherein like reference numerals represent like parts:

[0030] Figure 1 A diagram showing a method for a terminal to perform a mobile communication network connection using a smart security platform (SSP) equipped with a telecommunication bundle including a profile according to some embodiments;

[0031] Figure 2 A conceptual diagram showing the internal structure of an SSP according to some embodiments;

[0032] Figure 3 A diagram illustrating an example of a hierarchy of certificates (certificate hierarchy or certificate chain) issued by a certificate issuer (CI), a public key included in each certificate, and a digital signature configuration of the certificate issuer (CI) according to some embodiments;

[0033] Figure 4 A diagram illustrating an example of a hierarchy of certificates (certificate hierarchy or certificate chain) issued by a certificate issuer (CI), a public key included in each certificate, and a digital signature configuration of the certificate issuer (CI) according to some embodiments;

[0034] Figure 5 A diagram showing an example for allowing a terminal to download and install bundled, internal and external elements of a terminal via an SSP according to some embodiments;

[0035] Figure 6 A diagram illustrating an example of a process in which a subscriber subscribes to a service via a service provider and the service provider and a bundle management server prepare to download a bundle in accordance with some embodiments;

[0036] Figure 7 A diagram showing an example of a configuration of a terminal and a method in which a service provider, a bundle management server, and a device manager interoperate according to some embodiments;

[0037] Figure 8 A diagram illustrating an example of a general process of performing remote bundling management by a terminal according to some embodiments;

[0038] Fig. 9 A diagram illustrating an example of a general process of performing remote bundling management by a terminal according to some embodiments;

[0039] Fig.10 A diagram showing an example of configuring a bundling policy according to some embodiments;

[0040] Fig.11 A diagram illustrating an example of configuring SSP remote management for remote bundle management according to some embodiments;

[0041] Fig.12 A diagram illustrating an example of a process for configuring SSP remote management permissions between a device manager, a service provider, and a bundle management server, and between a device manager and an SSP, according to some embodiments;

[0042] Fig.13 A diagram illustrating an example of a process for generating remote bundle management commands by a bundle management server according to some embodiments;

[0043] Fig.14 A diagram illustrating an example of a process for a terminal to verify and execute a remote bundle management command received from a bundle management server according to some embodiments;

[0044] Fig.15 A diagram showing a configuration of a terminal according to some embodiments; and

[0045] Fig.16 A diagram illustrating a configuration of a bundle management server according to some embodiments. DETAILED DESCRIPTION

[0046] Discussed below Figures 1 to 16 The various embodiments used to describe the principles of the present disclosure in this patent document are for illustration only and should not be interpreted in any way as limiting the scope of the present disclosure. Those skilled in the art will appreciate that the principles of the present disclosure can be implemented in any appropriately arranged system or device.

[0047] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0048] When describing the embodiments of the present disclosure, descriptions related to technical contents known in the art and not directly related to the present disclosure will be omitted. Such unnecessary omissions are intended to prevent the main idea of ​​the present disclosure from being obscured and to convey the main idea more clearly.

[0049] For the same reason, in the accompanying drawings, some elements may be exaggerated, omitted or schematically shown. In addition, the size of each element does not fully reflect the actual size. In the accompanying drawings, the same or corresponding elements are provided with the same reference numerals.

[0050] By referring to the embodiments described in detail below in conjunction with the accompanying drawings, the advantages and features of the present disclosure and the ways to achieve them will be apparent. However, the present disclosure is not limited to the embodiments set forth below and can be implemented in various different forms. The following embodiments are provided only to fully disclose the present disclosure and inform those skilled in the art of the scope of the present disclosure, and the present disclosure is defined only by the scope of the attached claims. Throughout the specification, the same or similar reference numerals designate the same or similar elements.

[0051] Here, it will be understood that each frame of the flowchart diagram and the combination of frames in the flowchart diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the function specified in the flowchart frame or multiple flowchart frames. These computer program instructions can also be stored in a computer-available or computer-readable memory, which can instruct the computer or other programmable data processing device to operate in a particular way, so that the instructions stored in the computer-available or computer-readable memory produce an article including an instruction device, which implements the function specified in the flowchart frame or multiple flowchart frames. The computer program instructions can also be loaded on a computer or other programmable data processing device so that a series of operating steps are performed on the computer or other programmable device, thereby generating a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the function specified in the flowchart frame or multiple flowchart frames.

[0052] In addition, each box of the flowchart diagram can represent a module, segment or part of the code, which includes one or more executable instructions for implementing (multiple) specified logical functions. It should also be noted that in some alternative embodiments, the functions mentioned in the box may not occur in order. For example, depending on the functions involved, two boxes shown in succession can actually be executed substantially simultaneously, or the boxes can sometimes be executed in reverse order.

[0053] As used herein, "unit" refers to a software element or a hardware element that performs a predetermined function, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). However, "unit" does not always have a meaning limited to software or hardware. "Unit" can be constructed to be stored in an addressable storage medium or to execute one or more processors. Therefore, "unit" includes, for example, software elements, object-oriented software elements, class elements or task elements, processes, functions, attributes, processes, subroutines, program code segments, drivers, firmware, microcodes, circuits, data, databases, data structures, tables, arrays and parameters. The elements and functions provided by "unit" can be combined into smaller numbers of elements or "units", or divided into larger numbers of elements or "units". In addition, elements and "units" can be implemented as reproducing one or more CPUs in equipment or secure multimedia cards. In addition, "unit" in an embodiment can include one or more processors.

[0054] Specific terms used in the following description are provided to help understanding of the present disclosure, and the use of these specific terms may be changed in other forms without departing from the technical spirit of the present disclosure.

[0055] A secure element (SE) refers to a security module comprising a single chip that is capable of storing security information (e.g., mobile communication network access keys, user identification information (such as ID cards / passports, credit card information, encryption keys, etc.) and using the stored security information to place and operate control modules (e.g., network access control modules such as USIM, encryption modules, key generation modules, etc.). SE can be used in various electronic devices (e.g., smart phones, tablets, wearable devices, motor vehicles, IoT devices, etc.), and can provide security services (e.g., mobile communication network access, payment, user authentication, etc.) via security information and control modules.

[0056] SE can be divided into universal integrated circuit card (UICC), embedded security element (eSE), smart security platform (SSP) (which is an integrated form of UICC and eSE), etc., and can be further subdivided into removable, embedded and integrated types, where SE is integrated into a specific device or system on chip (SoC) in the integrated type, depending on the type of connection to the electronic device or the type of installation on the electronic device.

[0057] A universal integrated circuit card (UICC) is a smart card inserted into a mobile communication terminal, etc. for use, and is also referred to as a UICC card. A UICC may include an access control module for accessing a network of a mobile communication service provider. Examples of access control modules include a universal subscriber identity module (USIM), a subscriber identity module (SIM), an IP multimedia service identity module (ISIM), etc. A UICC with a USIM is also generally referred to as a USIM card. Similarly, a UICC including a SIM module is generally referred to as a SIM card. A SIM module may be placed when the UICC is manufactured, or a SIM module of a mobile communication service to be used may be downloaded to a UICC card when the user desires. In addition, for a UICC card, multiple SIM modules may be downloaded and installed, and at least one of the SIM modules may be selected for use. A UICC card may or may not be embedded in a terminal. A UICC embedded in a terminal for use is referred to as an embedded UICC (eUICC). Specifically, a UICC embedded in a system-on-chip (SoC) of a single processor structure in which a communication processor of a terminal, an application processor of a terminal, or two processors are integrated is also referred to as an integrated UICC (iUICC). Typically, eUICC and iUICC are embedded in a terminal for use, and may refer to a UICC card capable of remotely downloading and selecting a SIM module. In the present disclosure, a UICC card capable of remotely downloading and selecting a SIM module is collectively referred to as eUICC or iUICC. That is, among UICC cards capable of remotely downloading and selecting a SIM module, UICC cards embedded or not embedded in a terminal are collectively referred to and used as eUICC or iUICC. The SIM module information to be downloaded is collectively referred to as the term eUICC profile, iUICC profile, or more simply, profile.

[0058] Embedded security element (eSE) refers to an embedded SE that is fixed to an electronic device for use. eSE is usually manufactured specifically for the manufacturer at the request of the terminal manufacturer, and can be manufactured to include an operating system and a framework. eSE remotely downloads and installs a service control module of the applet type, and can be used for various security service purposes, such as electronic wallets, ticketing, electronic passports, and digital keys. In the present disclosure, SEs in the form of a single chip attached to an electronic device capable of remotely downloading and installing a service control module are collectively referred to as eSE.

[0059] The smart security platform (SSP) is capable of integrating support for UICC and eSE functions on a single chip, and the SSP can be classified into a removable SSP (rSSP), an embedded SSP (eSSP), and an integrated SSP (iSSP) embedded in a SoC. The SSP may include a main platform (PP) and at least one secondary platform bundle (SPB) operating on the PP, the main platform may include at least one of a hardware platform and a low-level operating system (LLOS), and the secondary platform bundle may include at least one of a high-level operating system (HLOS) and an application executed on the HLOS. The secondary platform bundle is also referred to as an SPB or a bundle. The bundle can access resources such as a central processing unit and a memory of the PP via a main platform interface (PPI) provided by the PP, and can therefore be executed on the PP. The bundle can be equipped with communication applications such as a subscriber identity module (SIM), a universal SIM (USIM), and an IP multimedia SIM (ISIM), and may also be equipped with various applications such as an electronic wallet, ticketing, an electronic passport, and a digital key.

[0060] According to the bundle that is downloaded and installed remotely, the SSP can be used for the above-mentioned UICC or eSE purposes, and multiple bundles can be installed on a single SSP and operated simultaneously to allow UICC and eSE to be used interchangeably. That is, if a bundle including a profile is operated on an SSP, the SSP can be used for UICC purposes to access the network of a mobile communication service provider. As in an eUICC or iUICC, the corresponding UICC bundle can remotely download at least one profile into the bundle and select the at least one profile to perform an operation. If a bundle including a service control module is operated on an SSP, the SSP can be used for eSE purposes, wherein the service control module is equipped with an application that can provide services (such as an e-wallet, ticketing, e-passport, or digital key) on the SSP. Multiple service control modules can be installed and operated by being integrated into one bundle, or can be installed and operated as corresponding independent bundles.

[0061] Hereinafter, the terms used in the present disclosure will be described in more detail.

[0062] In the present disclosure, SSP is a security module in the form of a chip, which can integrate support for UICC and eSE functions on a single chip, and SSP can be classified into removable SSP (rSSP), embedded SSP (eSSP) and integrated SSP (iSSP) embedded in SoC. SSP can download and install bundles from an external bundle management server (Secondary Platform Bundle Manager, SPB Manager) by using Over-the-Air (OTA) technology.

[0063] In the present disclosure, a method of downloading and installing a bundle in an SSP by using OTA technology can be applied in the same manner to a removable SSP (rSSP) that can be inserted into and removed from a terminal, an embedded SSP (eSSP) installed in a terminal, and an integrated SSP (iSSP) included inside a SoC installed in a terminal.

[0064] In the present disclosure, the term UICC may be used interchangeably with SIM, and the term eUICC may be used interchangeably with eSIM. In the present disclosure, the term SSP may be used interchangeably with eUICC and eSIM.

[0065] In the present disclosure, a secondary platform bundle (SPB) is operated using resources of a PP of an SSP on a primary platform (PP), wherein a UICC bundle may refer to a software package of applications, file systems, authentication key values, etc. stored in an existing UICC, and an operating system (HLOS) in which the applications, file systems, authentication key values, etc. operate. In the present disclosure, a secondary platform bundle may be used interchangeably with a bundle, a profile, and an applet. In the present disclosure, a security service module may be used interchangeably with an SSP and a bundle.

[0066] In the present disclosure, a USIM profile may refer to the same thing as a profile, or may refer to a package of information included in a USIM application in a profile.

[0067] In the present disclosure, the operation of enabling a bundle by a terminal or an external server may refer to an operation of performing configuration to change the state of a corresponding profile to an enabled state so that the terminal can receive services provided by the bundle (e.g., communication services via a communication service provider, credit card payment services, user authentication services, etc.). A bundle in an enabled state may be expressed as "an enabled bundle". A bundle in an enabled state may be stored in a storage space inside or outside the SSP while being encrypted.

[0068] In the present disclosure, the enabled bundle can be changed to an activated state according to an external input of the bundle (e.g., user input, push, request of an application in the terminal, authentication request of a communication service provider, PP management message, etc.) or an operation within the bundle (e.g., timer and polling). The bundle in the activated state may refer to being loaded from a storage space inside or outside the SSP into an operating memory inside the SSP by using a security control device (security CPU) inside the SSP, processing security information, and providing security services to the terminal.

[0069] In the present disclosure, the operation of disabling a bundle by a terminal or an external server may refer to an operation of performing a configuration to change the state of the bundle to a disabled state so as to prevent the terminal from receiving the service provided by the bundle. A profile in a disabled state may be expressed as "disabled bundle". A bundle in an enabled state may be stored in a storage space inside or outside the SSP while being encrypted.

[0070] In the present disclosure, the operation of deleting a bundle by a terminal or an external server may refer to an operation of performing configuration to change the state of the bundle to a deleted state so as to prevent the terminal or the external server from enabling or disabling the bundle. A bundle in a deleted state may be expressed as a "deleted bundle".

[0071] In the present disclosure, a bundle management server may provide the function of generating a bundle, encrypting the generated bundle, generating a bundle remote management instruction, or encrypting the generated bundle remote management instruction through a request of a service provider or a request of another bundle management server. The bundle management server providing the above functions may be described as at least one of a secondary platform bundle manager (SPB manager), a remote bundle manager (RBM), an image delivery server (IDS), a subscription manager data preparation (SM-DP), a subscription manager data preparation plus (SM-DP+), a manager bundle server, a management subscription manager data preparation plus (management SM-DP+), a bundle encryption server, a bundle generation server, a bundle provider (BP), a bundle provider, and a bundle provisioning credential holder (BPC holder).

[0072] In the present disclosure, the bundle management server can download, install or update the bundle in the SSP, and can be used to manage the key and certificate configuration for remotely managing the state of the bundle. The bundle management server providing the above functions can be expressed as at least one of a secondary platform bundle manager (SPBM), a remote bundle manager (RBM), an image delivery server (IDS), a subscription manager secure routing (SM-SR), a subscription manager secure routing plus (SM-SR+), an eUICC profile manager or an off-card entity of a profile management credential holder (PMC holder), and an eUICC manager (EM).

[0073] In the present disclosure, a subscription relay server may be expressed as at least one of a secondary platform bundle manager (SPBM), a remote bundle manager (RBM), a secondary platform bundle discovery server (SPBDS), a bundle discovery server (BDS), a subscription manager discovery service (SM-DS), a discovery service (DS), a root subscription relay server (root SM-DS), and an alternative subscription relay server (alternative SM-DS). A subscription relay server may receive an event registration request (register event request or event registration request) from one or more bundle management servers or subscription relay servers. One or more subscription relay servers may be used in combination, and in this case, the first subscription relay server may receive an event registration request not only from the bundle management server but also from the second subscription relay server. In the present disclosure, the functions of the subscription relay server may be integrated into the bundle management server.

[0074] In the present disclosure, a bundle management server may be collectively referred to as a combination of the functions of generating, encrypting and transmitting bundles or bundle remote management instructions and the functions of configuring SSP and managing installed bundles. In addition, a bundle management server may be collectively referred to as a combination of the functions of a subscription relay server. Therefore, in various embodiments, the operations of a bundle management server and a subscription relay server may be performed in one bundle management server. Each function may be performed separately by multiple bundle management servers separated from each other. In the specification, a bundle management server or a subscription relay server may be expressed as a bundle server. The bundle server may be one of a bundle management server and a subscription relay server, or may be a device including a bundle management server and a subscription relay server.

[0075] In the present disclosure, the bundle management server and the subscription relay server may be collectively referred to as the term SPBM or RBM. The bundle server may be referred to as the bundle management server. The bundle server may be referred to as the security service module management server.

[0076] The term "terminal" used in the present disclosure may refer to a mobile station (MS), a user equipment (UE), a user terminal (UT), a wireless terminal, an access terminal (AT), a terminal, a subscriber unit, a subscriber station (SS), a wireless device, a wireless communication device, a wireless transmission / reception unit (WTRU), a mobile node, a mobile device or other terms. Various embodiments of the terminal may include a cellular phone, a smart phone with a wireless communication function, a personal portable assistant (PDA) with a wireless communication function, a wireless modem, a portable computer with a wireless communication function, a shooting device (such as a digital camera) with a wireless communication function, a game device with a wireless communication function, a music storage and playback device with a wireless communication function, an Internet appliance that implements wireless Internet access and browsing, and a portable unit or terminal that combines the functions of an Internet appliance. The terminal may include a machine-to-machine (M2M) terminal and a machine type communication (MTC) terminal / device, but is not limited thereto. In the present disclosure, a terminal may also be referred to as an electronic device.

[0077] In the present disclosure, the SSP capable of downloading and installing a bundle may be embedded in an electronic device. If the SSP is not embedded in the electronic device, the SSP physically separated from the electronic device may be inserted into the electronic device so as to be connected to the electronic device. For example, the SSP may be inserted into the electronic device in the form of a card. The electronic device may include a terminal, and in this case, the terminal may be a terminal including the SSP capable of downloading and installing a bundle. The SSP may not only be embedded in the terminal, but may also be inserted into the terminal so as to be connected to the terminal when the terminal and the SSP are separated.

[0078] In the present disclosure, a terminal or electronic device may include software or an application installed in the terminal or electronic device to control the SSP. The software or application may be referred to as, for example, a local bundling assistant (LBA) or a local bundling manager (LBM). In the present disclosure, the term LBA or LBM may be used interchangeably with a local profile assistant (LPA).

[0079] In the present disclosure, the bundle identifier is referred to as a factor matching a bundle identifier (SPB ID), a bundle family identifier (SPB family ID), a bundle family manager identifier (SPB family host object ID), a bundle matching ID, and an event identifier (event ID). The bundle identifier (SPB ID) may indicate a unique identifier for each bundle. The bundle family identifier may indicate an identifier that distinguishes the type of bundle (e.g., a telecommunications bundle for accessing a mobile communication service network). In the present disclosure, the bundle family identifier may be referred to as spbFamilyId. The bundle family manager identifier may indicate an identifier that identifies the subject that manages the bundle family identifier (e.g., a communication service provider, a terminal manufacturer, a specific group, etc.). In the present disclosure, the bundle family manager identifier may be referred to as Oid. The bundle identifier may be used as a value that can index a bundle in a bundle management server. In the present disclosure, the SSP identifier (SSP ID) may be a unique identifier of an SSP embedded in a terminal, and may be referred to as an sspID. As in an embodiment of the present disclosure, if the terminal and the SSP chip are not separated, the SSP identifier may be a terminal ID. The SSP identifier may refer to a specific bundle identifier (SPB ID) in the SSP. In more detail, the SSP identifier may refer to a bundle identifier of a loader (Secondary Platform Bundle Loader, SPBL) or a management bundle that performs management to install, enable, disable, and delete another bundle in an SSP. An SSP may have multiple SSP identifiers, and multiple SSP identifiers may be values ​​derived from a single unique SSP identifier.

[0080] In the present disclosure, a loader (Secondary Platform Bundle Loader, SPBL) may refer to a management bundle that performs management to install, enable, disable, and delete another bundle in an SSP. The LBA of a terminal or remote server may install, enable, disable, and delete a specific bundle via a loader. In the present disclosure, a loader may also be referred to as an SSP.

[0081] In the present disclosure, a bundle provisioning credential (BPC) may be a means for mutual authentication, bundle encryption, and signature between a bundle management server and an SSP. The BPC may include one or more of a symmetric key, a RIVEST SHAMIR ADLEMAN (RSA) certificate and private key, an elliptic curve cryptography (ECC) certificate and private key, a root authentication authority (CA), and a certificate chain. If there are multiple bundle management servers, different BPCs of the corresponding multiple bundle management servers may be stored or used in the SSP.

[0082] In the present disclosure, the profile management certificate (PMC) may be a means for mutual authentication, transmission data encryption, and signature between the profile management server and the eUICC. The PMC may include one or more of a symmetric key, an RSA certificate and a private key, an ECC certificate and a private key, a root CA, and a certificate chain. If there are multiple profile management servers, different PMCs of the corresponding multiple profile management servers may be stored or used in the eUICC.

[0083] In the present disclosure, an event may be a term that collectively refers to a bundle download, remote bundle management, or other bundle or SSP management / processing instructions. An event may be named a remote bundle provision operation (remote bundle provision operation or RBP operation) or an event record, and each event may be referred to as data including a bundle management server in which the event is stored, the address of a subscription relay server or each server identifier, and at least one of a matching identifier (matching ID or matchingID) or an event identifier (event ID or eventID) corresponding to the event. Bundle download may be used interchangeably with bundle installation. An event type may be used as a term to indicate whether a particular event is a bundle download, remote bundle management (e.g., delete, enable, disable, replace, update, etc.), or other bundle or SSP management / processing commands, and may be referred to as an operation type (or OperationType), an operation class (or OperationClass), an event request type, an event class, an event request class, and the like.

[0084] In the present disclosure, a bundle image (or image) may be used interchangeably with a bundle, or may be used as a term to indicate a data object of a specific bundle, and may be referred to as a bundle TLV or a bundle image TLV. If an encryption parameter is used to encrypt a bundle image, the bundle image may be referred to as a protected bundle image (PBI) or a protected bundle image TLV (PBI TLV). If an encryption parameter is used to encrypt a bundle image that can only be decrypted by a specific SSP, the bundle image may be referred to as a bound bundle image (BBI) or a bound bundle image TLV (BBI TLV). A bundle image TLV may be a data set that represents information constituting a profile in a TLV (tag, length, and value) format.

[0085] In the present disclosure, local bundle management (LBM) may be referred to as bundle local management, local management, local management command, local command, LBM package, bundle local management package, local management package, local management command package, and local command package. LBM can be used to change the state (enable, disable, or delete) of a specific bundle or modify (update) the content (e.g., bundle nickname or bundle metadata) of a specific bundle via software installed in a terminal. LBM may include one or more local management commands, and in this case, for local management commands, the bundles subject to the local management commands may be respectively the same or different from each other.

[0086] In the present disclosure, remote bundle management (RBM) may be referred to as bundle remote management, remote management, remote management command, remote command, remote bundle management package (RBM package), bundle remote management package, remote management package, remote management command package, and remote command package. RBM may be used to change the state of a particular bundle (enable, disable, or delete) or to modify (update) the content of a particular bundle (e.g., bundle nickname, bundle profile information (bundle metadata), etc.). RBM may include one or more remote management commands, and for remote management commands, the bundles subject to the remote management commands may be respectively the same or different from each other.

[0087] In the present disclosure, a target binding may be used as a term referring to a binding that is subject to a local management command or a remote management command.

[0088] In the present disclosure, a certificate or digital certificate may refer to a digital certificate for mutual authentication based on an asymmetric key including a pair of public keys (PK) and a private key (SK). Each certificate may include one or more public keys (PK), a public key identifier (PKID) corresponding to the corresponding public key, and an identifier (certificate issuer ID) and a digital signature of a certificate issuer (CI) that has issued the corresponding certificate. The certificate issuer may be referred to as an authentication issuer, a certificate authority (CA), an authentication authority, etc. In the present disclosure, a public key (PK) and a public key identifier (public key ID, PKID) may be used interchangeably with a storage space that stores: a specific public key or a certificate including a public key; a part of a specific public key or a part of a certificate including a public key; a calculation result of a specific public key or a calculation result (e.g., hash) value of a certificate including a public key; a calculation result (e.g., hash) value of a part of a specific public key or a calculation result (e.g., hash) value of a part of a certificate including a public key; or data.

[0089] In the present disclosure, if a certificate (primary certificate) issued by one certificate issuer is used to issue other certificates (secondary certificates), or if a secondary certificate is used to connectively issue a third or more certificates, the correlation of the corresponding certificates may be referred to as a certificate chain or a certificate hierarchy, where the CI certificate used to issue the initial certificate may be referred to as a certificate root, a top certificate, a root CI, a root CI certificate, a root CA, a root CA certificate, etc.

[0090] In the present disclosure, the service provider may indicate an enterprise that issues a request to the bundle management server to request bundle generation, and provides services to the terminal via the generated bundle. For example, a service provider may represent a communication service provider (mobile operator or operator) that provides communication network access services via a bundle equipped with a communication application, and may be collectively referred to as the business support system (BSS), operation support system (OSS), point-of-sale terminal, and all of other IT systems of the communication service provider. In the present disclosure, the service provider is not limited to expressing only one specific enterprise, and may be used as a group or association (or consortium) referring to one or more enterprises, or an agent (representative) representing the group or association. In the present disclosure, a service provider may be referred to as a business operator (operator or OP or Op.), a bundle owner (BO), an image owner (Image Owner, IO), etc., and each service provider may be configured or assigned at least one name and / or unique identifier (object identifier (OID)). If a service provider refers to a group, association, or representative of one or more enterprises, the name or unique identifier of the group, association, or representative may be a name or unique identifier shared by all enterprises belonging to the group or association or all enterprises cooperating with the representative.

[0091] In the present disclosure, the terminal manager (device manager) may issue a requirement to a bundle management server or a service provider to request the generation of a bundle, may subscribe to the service of a service provider, and may indicate to the SSP of the terminal managed by the device manager the enterprise that provides services via the bundle. The device manager may be a service subscriber that has signed a contract with a service provider and subscribed to the services provided by the service provider. For example, the device manager may represent a business operator or an M2M service provider that provides and uses remote measurement services by using an IoT terminal, and may refer to an enterprise or terminal manufacturer that manufactures and sells terminals. In the present disclosure, the device manager is not limited to representing only one specific enterprise, and may be used as a group or association (or consortium) referring to one or more enterprises, or an agent (representative) representing the group or association. In the present disclosure, the device manager may be referred to as a bundle owner (BO), a bundle manager, an image owner (IO), a service subscriber, etc., and each device manager may be configured or assigned at least one name and / or a unique identifier (object identifier (OID)). If the device manager refers to a group, association, or representative of one or more enterprises, the name or unique identifier of the group, association, or representative may be a name or unique identifier shared by all enterprises belonging to the group or association or all enterprises cooperating with the representative.

[0092] In the present disclosure, AKA may indicate authentication and key agreement, and may indicate an authentication algorithm for accessing 3GPP and 3GPP2 networks.

[0093] In the present disclosure, K (or K value) may be an encryption key value stored in the eUICC, which is used in the AKA authentication algorithm.

[0094] In the present disclosure, OPc may be a parameter value that may be stored in the eUICC and used in the AKA authentication algorithm.

[0095] In the present disclosure, NAA is a network access application, and may be an application program stored in a UICC in order to access a network, such as a USIM or an ISIM. NAA may be a network access module.

[0096] In the present disclosure, the telecommunication bundle may be a bundle equipped with at least one NAA or equipped with a function of remotely downloading and installing at least one NAA. In the present disclosure, the telecommunication bundle may include a telecommunication bundle identifier indicating the telecommunication bundle.

[0097] Furthermore, in describing the present disclosure, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present disclosure, the detailed description thereof will be omitted.

[0098] In the following, various embodiments of methods and apparatus for online installation and management of bundles via a remote server will be described.

[0099] Figure 1 A diagram illustrating a method for a terminal to perform mobile communication network connection using a Smart Security Platform (SSP) equipped with a telecommunication bundle including a profile according to some embodiments.

[0100] like Figure 1 As shown, the SSP 120 may be embedded in the SoC 130 of the terminal 110. The SoC 130 may be a communication processor, an application processor, or a processor in which both processors are integrated. The SSP 120 may be a removable type 122 in the form of an independent chip not integrated into the SoC, or may be an embedded type 124 previously embedded in the terminal 110.

[0101] The bundle with the profile may indicate that it includes "access information" that enables access to a specific communication service provider. For example, the access information may be an International Mobile Subscriber Identity (IMSI) as a subscriber identifier, and a K or Ki value required for authentication to the network in addition to the subscriber identity.

[0102] The terminal 110 may perform authentication with an authentication processing system (e.g., a home location register (HLR) or an authentication center (AuC)) of a mobile communication service provider by using at least one of the telecommunications bundles 140 and 150 installed inside the SSP 120. For example, the authentication processing may be an authentication and key agreement (AKA) process. If the authentication is successful, the terminal 110 may use mobile communication services, such as using mobile data or phone calls, through a mobile communication network 160 of the mobile communication system. Each of the two telecommunications bundles 140 and 150 may store different authentication information, and the terminal 110 may cause the two telecommunications bundles 140 and 150 to operate simultaneously or in a time-division manner according to the configuration to use the mobile communication network.

[0103] By using the payment bundle 170 installed in the SSP 120 , the terminal 110 can use online payment via a terminal application, or can use offline payment via an external credit card point of sale (PoS) device, and the identity of the terminal owner can be authenticated using an electronic identification card (eID) bundle 180 .

[0104] Figure 2 A conceptual diagram showing the internal structure of an SSP according to some embodiments.

[0105] exist Figure 2In the embodiment, the SSP 210 may include a primary platform (PP) 220, and one or more secondary platform bundles (SPBs) 230 and 240 operating thereon. The primary platform 220 may include hardware (not shown) and at least one low-level operating system (LLOS) 222. The secondary platform bundle 230 may include a high-level operating system (HLOS) 232 and at least one application 234 operating thereon. Each of the secondary platform bundles 230 and 240 may access resources of a central processing device, a memory, etc. of the primary platform 220 so as to operate on the SSP 210 by using a primary platform interface (PPI) 250.

[0106] Figure 3 A diagram showing an example of a hierarchy of certificates (certificate hierarchy or certificate chain) issued by a certificate issuer (CI), a public key included in each certificate, and a digital signature configuration of the certificate issuer (CI) according to some embodiments. In the present disclosure, a certificate issuer (CI) may be used interchangeably with a certificate authority (CA).

[0107] refer to Figure 3 , a certificate issuer (CI) can generate a public key 313 and a private key to be used by the certificate issuer itself, can generate a CI certificate (certificate issuer certificate) 311 that includes the public key 313 of the two generated keys in its own certificate, and can attach a digital signature 315 generated using its private key to the certificate of the certificate issuer itself.

[0108] refer to Figure 3 , the CI certificate 311 can be used to issue 391 an object 1 certificate 331. Object 1 can be, for example, a bundle management server (SPBM). Object 1 can generate a public key 333 and a private key to be used by it, and can generate an object 1 certificate 331 that includes the public key 333 of the two generated keys in its own certificate. Object 1 can send a request to a certificate issuer (CI) to receive a digital signature (CI digital signature) 335 of the certificate issuer by using the private key (CI private key) of the certificate issuer. Object 1 certificate 331 may include an identifier 337 of the certificate issuer, which corresponds to the public key (CI public key) 313 of the certificate issuer that should be used when verifying the digital signature 335 of the certificate issuer included in the object 1 certificate 331. The identifier 337 of the certificate issuer may include at least one of a public key identifier (CI public key ID) of the certificate issuer and a CI identifier (CI ID, CI object ID, object universal unique identifier, or object UUID).

[0109] refer to Figure 3, the CI certificate 311 can be used to issue 393 an object 2 certificate 351. Object 2 can be, for example, an SSP manufacturer (SSP maker). Object 2 can generate a public key 353 and a private key to be used by it, and can generate an object 2 certificate 351 by including the public key 353 of the two generated keys in its own certificate. Object 2 can send a request to the certificate issuer to receive the digital signature (CI digital signature) 355 of the certificate issuer by using the private key (CI private key) of the certificate issuer. The object 2 certificate 351 may include an identifier 357 of the certificate issuer, which corresponds to the public key (CI public key) 313 of the certificate issuer that should be used when verifying the digital signature 355 of the certificate issuer included in the object 2 certificate 351. The identifier 357 of the certificate issuer may include at least one of a public key identifier (CI public key ID) of the certificate issuer and a CI identifier (CI ID, CI object ID, object universal unique identifier, or object UUID). The certificate issuer signatures 335 and 355 included in the object 1 certificate 331 and the object 2 certificate 351 may have different values, but the public key identifier 357 of the certificate issuer may have the same value.

[0110] refer to Figure 3 , the object 2 certificate 351 can be used to issue 395 an object 3 certificate 357. Object 3 can be, for example, an SSP manufactured by an SSP manufacturer (SSP maker) or a secondary platform loader (SPBL) placed inside the SSP. Object 3 can generate a public key 373 and a private key to be used by it, and can generate an object 3 certificate 371 including the public key 373 of the two generated keys in its own certificate. Object 3 can send a request to object 2 to receive the digital signature 375 of object 2 by using the private key of object 2. Object 3 certificate 371 may include an identifier 377 corresponding to the public key 353 of object 2, which should be used when verifying the digital signature 375 of object 2 included in the object 3 certificate 371. The identifier 377 may include at least one of a publisher identifier (object ID or object universal unique identifier (object UUID)) of the publisher and a public key identifier (public key ID).

[0111] Despite Figure 3 Although not shown, there may be at least one sub-certificate issuer (sub-CI or sub-certificate authority (sub-CA)) between the certificate issuer (CI), object 1, and object 2. The sub-certificate issuer certificate may be issued by the certificate issuer (CI) through the CI certificate 311, or may be issued by another sub-certificate issuer through its own sub-certificate issuer certificate. The sub-certificate issuer may issue the object 1 certificate or the object 2 certificate by using the certificate of the sub-certificate issuer.

[0112] Despite Figure 3 It is not shown, but there may be at least one sub-certificate issuer (sub-CI or sub-certificate authority (sub-CA)) between Object 2 and Object 3. The sub-certificate issuer certificate may be issued by Object 2 through Object 2 certificate 351, or may be issued by another sub-certificate issuer through its own sub-certificate issuer certificate. The sub-certificate issuer may issue Object 3 certificate and Object 2 certificate by using its own sub-certificate issuer certificate.

[0113] refer to Figure 3 , the extended configuration values ​​317, 339, 359 and 379 of the corresponding certificates 311, 331, 351 and 371 may include a bundle family identifier (SPB family ID) of the bundle that can be downloaded and installed in the corresponding certificate, or a bundle family identifier (SPB family ID) and a bundle family manager identifier (SPB family host object ID).

[0114] Figure 3 The object 1 certificate 331, the object 2 certificate 351, and the object 3 certificate 371 shown in the example of FIG. 3 may all have the same CI certificate 311 as the highest certificate or certificate root. Therefore, in order for the object 1, the object 2, and the object 3 to authenticate each other, the CI certificate 311 or the CI public key 313 included therein may be required. More specifically, in Figure 3 In the example of , in order for object 1 and object 2 to authenticate each other by using digital certificates and signatures, object 1 may need object 2's signature, object 2 certificate 351, and CI public key 313, and object 2 may need object 1's signature, object 1 certificate 331, and CI public key 313. More specifically, in Figure 3 In the example of , in order for object 1 and object 3 to authenticate each other by using digital certificates and signatures, object 1 may need object 3's signature, object 3 certificate 371, object 2 certificate 351, and CI public key 313, and object 3 may need object 1's signature, object 1 certificate 331, and CI public key 313. In this case, for object 3 certificate 371, object 2 certificate 351 may be referred to as a sub-certificate issuer (sub-CI or sub-certificate authority (sub-CA)) certificate.

[0115] Figure 4 A diagram illustrating an example of a hierarchy of certificates (certificate hierarchy or certificate chain) issued by a certificate issuer (CI), a public key included in each certificate, and a digital signature configuration of the certificate issuer (CI) according to some embodiments.

[0116] refer to Figure 4, the CI certificate 421 may be used to issue 497 a connection certificate 441, or the object 2 certificate 451 may be used to issue 499 a connection certificate 441. A sub-certificate issuer certificate (not shown) that may exist between the CI certificate 421 and the object 2 certificate 451 and between the object 2 certificate 451 and the object 3 certificate 471 may be used to issue the connection certificate 441. The connection certificate 441 may receive a digital signature 445 by using a private key of the issuer. The connection certificate 441 may include an identifier 447 corresponding to a public key of the issuer, which should be used when verifying the signature 445 included in the connection certificate 441. The identifier 447 may include at least one of an issuer identifier (object ID or object universal unique identifier (object UUID)) and a public key identifier (public key ID) of the issuer. The public key 443 of the connection certificate 441 may be a value corresponding to the issuer identifier 447 of the object 1 certificate 431, or a value corresponding to the issuer identifier of a sub-issuer certificate (not shown) that may exist between the CI certificate 411 and the object 1 certificate 431. The extended configuration value 449 of the connection certificate 441 may include the bundle family identifier (SPB family ID) of the bundle to which the publisher has allowed object 1 to download object 3 to the corresponding certificate, or the bundle family identifier (SPB family ID) and the bundle family manager identifier (SPB family host object ID).

[0117] refer to Figure 4 , the extended configuration values ​​417, 427, 439, 449, 459 and 479 corresponding to certificates 411, 421, 431, 441, 451 and 471 may include a bundle family identifier (SPB family ID) of the bundle that can be downloaded and installed in the corresponding certificate, or a bundle family identifier (SPB family ID) and a bundle family manager identifier (SPB family host object ID).

[0118] Despite Figure 4 It is not shown, but there may be at least one sub-certificate issuer (sub-CI or sub-certificate authority (sub-CA)) between the certificate issuer (CI), Object 1, and Object 2. The sub-certificate issuer certificate may be issued by the certificate issuer (CI) through the CI certificate 411, or may be issued by another sub-certificate issuer through its own sub-certificate issuer certificate. The sub-certificate issuer may issue the Object 1 certificate or the Object 2 certificate by using the certificate of the sub-certificate issuer. The extended configuration value of the sub-certificate issuer certificate may include a bundle family identifier (SPB family ID) of the bundle that may be downloaded and installed in the corresponding certificate, or a bundle family identifier (SPB family ID) and a bundle family manager identifier (SPB family host object ID).

[0119] Despite Figure 4It is not shown, but there may be at least one sub-certificate issuer (sub-CI or sub-certificate authority (sub-CA)) between Object 2 and Object 3. The sub-certificate issuer certificate may be issued by Object 2 through Object 2 certificate 451, or may be issued by another sub-certificate issuer through its own sub-certificate issuer certificate. The sub-certificate issuer may issue Object 3 certificate and Object 2 certificate by using its own sub-certificate issuer certificate.

[0120] refer to Figure 4 , the object 1 certificate 431 and the object 2 certificate 451 shown may have different CI certificates 411 and CI certificates 421, respectively, as the highest certificates or certificate roots. Therefore, in order for objects 2 and 3 to authenticate object 1, the CI certificate 411 and / or CI public key 413 included therein may be required. In order for object 1 to authenticate objects 2 and 3, the CI certificate 421 and / or CI public key 423 included therein may be required. More specifically, in Figure 4 In the example of , in order for object 1 and object 2 to authenticate each other by using digital certificates and signatures, object 1 may need object 2's signature, object 2 certificate 451, and CI public key 423, and object 2 may need object 1's signature, object 1 certificate 431, and CI public key 413. Figure 4 In the example, in order for Object 1 and Object 3 to authenticate each other by using digital certificates and signatures, Object 1 may need Object 3's signature, Object 3 certificate 471, Object 2 certificate 451, and CI public key 423, and Object 3 may need Object 1's signature, Object 1 certificate 431, and CI public key 413.

[0121] refer to Figure 4 , in order for object 3 to authenticate object 1, the connection certificate 441, CI certificate 421 and / or public key 423 included therein may be required. More specifically, in Figure 4 In the example of , in order for object 3 to authenticate object 1 by using the digital certificate and signature of object 1, object 3 may need the signature of object 1, object 1 certificate 431, connection certificate 441, and CI public key 423. In order for object 3 to authenticate object 1, connection certificate 441, object 2 certificate 451, CI certificate 421, and / or public key 423 included therein may be needed. More specifically, in Figure 4 In the example of , in order for object 3 to authenticate object 1 by using object 1's digital certificate and signature, object 3 may need object 1's signature, object 1 certificate 431 , connection certificate 441 , object 2 certificate 451 , and CI public key 423 .

[0122] Figure 5 A diagram illustrating an example of allowing a terminal to download and install bundled internal and external elements of a terminal via an SSP according to some embodiments.

[0123] exist Figure 5 In the embodiment, the terminal 510 may be a terminal in which the SSP 530 is placed and the LBA 512 for controlling the SSP 530 is installed. The SSP 530 may be embedded in the terminal 510 or may be removable. The SSP 530 may include a main platform 531, a secondary platform bundle loader (SPBL) 533, and one or more secondary platform bundles 535, 537, or 539. The secondary platform bundles 535, 537, or 539 may not be installed in the SSP 530 when the terminal is shipped, but may be remotely downloaded and installed after shipping.

[0124] refer to Figure 5 , the corresponding bundles may have different bundle family identifiers, or different bundle family identifiers and bundle family manager identifiers 541 or 542. The SSP 530 or SPBL 533 may store and manage certificate configurations 551 that are allowed to be used to download and install bundles with different bundle family identifiers, or bundle family identifiers and bundle family manager identifiers. The LBA 512 may request the certificate configuration 551 from the SSP 530 or SPBL 533, and the certificate configuration may be copied and stored in the LBA 512.

[0125] refer to Figure 5 , the SSP 530 or the SPBL 533 may store and manage the certificate information 552, 553, or 554 to which different family identifiers and different bundle family manager identifiers are assigned. The certificate information 552, 553, or 554 to which the family identifier and the bundle family manager identifier are assigned may be used to download a bundle including the assigned family identifier and the bundle family identifier. The SSP 530 or the SPBL 533 may refuse to download and install a bundle that does not include the family identifier and the bundle family identifier assigned to the corresponding certificate information 552, 553, or 554.

[0126] refer to Figure 5 , different bundle family identifiers are assigned to SSP 530 or SPBL 533, and SSP 530 or SPBL 533 can store and manage certificate information 555 or 556 to which no bundle family manager identifier is assigned. Certificate information 555 or 556 to which a family identifier is assigned can be used to download a bundle including the assigned family identifier.

[0127] refer to Figure 5 , the SSP 530 or the SPBL 533 may store and manage the certificate information 557 to which no bundle family identifier and bundle family manager identifier are assigned.

[0128] Figure 5The certificate information 552, 553, 554, 555, 556, and 557 stored and managed by SSP 530 or SPBL 533 may be Figure 3 or Figure 4 The CI certificate in the certificate hierarchy, the public key identifier of the CI certificate, the certificate issued by the certificate issuer (CI) existing on the certificate hierarchy, or the public key identifier of the corresponding certificate. When downloading and installing the bundle from the bundle management server 551 or 553, the SSP 430 or SPBL433 can select the certificate information configured for the bundle family identifier assigned to the bundle, or the certificate information configured for the bundle family identifier and the bundle family manager identifier assigned to the bundle, and can transmit the information to the bundle management server 551 or 553. The certificate information can be a certificate or public key of the certificate issuer (CI) of the certificate hierarchy, and can be an identifier corresponding to the certificate and public key (for example, CI ID, CI ID, CI object ID, object universal unique identifier (object UUID) or CI public key ID).

[0129] Figure 6 A diagram illustrating an example of a process in which a subscriber subscribes to a service via a service provider, and the service provider and a bundle management server prepare to download a bundle, in accordance with some embodiments.

[0130] exist Figure 6 In the figure, the terminal 600 may be a terminal in which the SSP 610 is placed and the LBA 620 for controlling the SSP 610 is installed. Although not shown in the figure, in the bundle management server 650, a bundle requested by the service provider 640 may be generated and waited, and the service provider 640 may have at least one of a bundle identifier (SPB ID) of the generated bundle, a bundle family identifier (SPB Family ID), a bundle family manager identifier (SPB Family Host Object ID), and an address (SPBM Addr) of the bundle management server 650.

[0131] refer to Figure 6 In operation 6001, a subscriber 630 may select and subscribe to a service (e.g., a data service via a mobile communication network, etc.) provided by a service provider 640. The subscriber 630 may selectively transmit to the service provider 640 an identifier (SSP ID) of the SSP 610 installed in the terminal 600 in which a bundle is to be installed, in order to use the service provided by the service provider 640.

[0132] In operation 6003, the service provider 640 and the bundle providing server 650 may perform a bundle download preparation process. In operation 6003, the service provider 640 may selectively transmit to the bundle management server 650 an identifier (SSP ID) of the SSP 610 in which the bundle is to be installed, and may transmit to the bundle management server 650 at least one of a specific bundle identifier (SPB ID), a bundle family identifier (SPB family ID), and a bundle family manager identifier (SPB family host object ID), which enables the provision of a service selected by the subscriber from among the bundles prepared in the server. In operation 6003, the bundle management server 650 may select one of a bundle having a transmitted specific bundle identifier, a bundle having a bundle family identifier, and a bundle having a bundle family identifier and a bundle family manager identifier, and may transmit to the service provider 640 an identifier of the selected bundle. The service provider 640 or the bundle providing server 650 may newly generate a bundle matching ID so that the selected bundle can be identified. The bundle providing server 650 may connect and manage the transmitted SSP identifier (SSP ID) and the selected bundle. In operation 6003, the bundle management server 650 may transmit a bundle management server address (SPBM Addr) via which the selected bundle may be downloaded. The bundle management server address may be its own address in which the prepared bundle is stored or an address of another bundle management server, and may be an address of another bundle management server via which download information (server address, etc.) of the prepared bundle may be stored and obtained.

[0133] refer to Figure 6 In operation 6005, the service provider 640 may transmit the prepared bundle download information to the subscriber 630. For the bundle download information, at least one of a bundle management server address (SPBMAddr) for which the bundle is prepared, a bundle matching ID of the prepared bundle, a bundle family identifier (SPB Family ID) of the prepared bundle, and a bundle family manager identifier (SPB Family Host ID) may be selectively transmitted.

[0134] refer to Figure 6, in operation 6006, the bundle download information may be transmitted to the LBA 620 of the terminal 600. The bundle download information may be at least one of the address (SPBM Addr) of the bundle management server to be accessed by the LBA 620, the bundle identifier of the bundle prepared in operation 6003, the bundle family identifier (SPBM Family ID) of the prepared bundle, and the bundle family manager identifier (SPB Family Host Object ID). The bundle identifier may include at least one of the bundle event ID or the bundle matching ID generated in operation 6003. The bundle identifier may include at least one of the bundle family identifier of the prepared bundle and the bundle family manager identifier (SPB Family Host Object ID). The bundle event ID may include at least one of the address of the bundle management server and the bundle matching ID of the bundle prepared in operation 6003. The bundle download information may be input by the subscriber 630 (e.g., QR code scanning, direct text input, etc.) to the LBA 620, or may be input to the LBA 620 by using a push input via an information providing server (not shown). The LBA 620 may access an information providing server (not shown) configured in advance for the terminal 600 to receive the bundle download information.

[0135] Figure 7 A diagram showing an example of a configuration of a terminal 700 and a method in which a service provider 730, a bundle management server 740, and a device manager (device subscription manager) 750 interoperate according to some embodiments.

[0136] refer to Figure 7 , the terminal 700 may include at least one bundle management software (or LBA) 710 and at least one SSP 720. The SSP 720 may include at least one SPBL 760 and a bundle 770.

[0137] In operation 7001, the service provider 730 may request remote bundle management from at least one bundle management server 740. The bundle management server 740 may be owned by the service provider 730, or may be operated by a third party via a contract. The remote management request may include at least one of new bundle installation, enabling, disabling, deleting an installed bundle, and obtaining and modifying bundle information.

[0138] In operation 7002, the device manager 750 may request remote bundling management from at least one bundling management server 740. The bundling management server 740 may be owned by the service provider 730 or the device manager 750, or may be operated by a third party via a contract.

[0139] The device manager 750 may request remote binding management from the service provider 730 via operation 7003. According to the request, in operation 7001, the service provider 730 may request remote binding management from at least one binding management server 70.

[0140] In operation 7004, the bundle management server 740 may transmit a remote management command to the bundle management software 710. The remote management command may be a remote management command generated by the bundle management server 740 for at least one of the remote management requests for a specific bundle made in operations 7001, 7002, and 7003.

[0141] In operation 7005, the bundle management software 710 may identify at least one of the bundle configuration, bundle management software configuration, SPBL configuration, and terminal configuration indicated by the remote management command. If confirmation from the user 760 is required to execute the remote management command according to the confirmed configuration, confirmation from the user 760 may be requested and received.

[0142] In operation 7006, the remote management command may be transmitted to the SSP 720 via the bundle management software 710. In the present disclosure, the bundle management operation of the service provider may be referred to as remote bundle management (remote SPB management).

[0143] In operation 7006, the SSP 720 or the SPBL 760 may check a bundle policy for processing the received remote bundle management command. The bundle policy may be stored in the bundle 770, the SPBL 760, or the bundle management software 710, and checking the bundle policy may also include checking the bundle management software 710 or the bundle management server 740. For a more detailed method of checking the bundle policy, reference will be made to the drawings described later.

[0144] Figure 8 A diagram illustrating an example of a general process of performing remote bundling management by a terminal 800 according to some embodiments.

[0145] exist Figure 8 In order to describe the configuration of the terminal 800, the LBA 810, the SSP 820, the service provider 830, the bundle management server 840 and the user 850, reference will be made to Figure 7 Description.

[0146] refer to Figure 8In operation 8001, LBA 810 may find that the remote management command of SSP 820 exists in bundle management server 840. Operation 8001 may use a general user interface for user interaction with a terminal. For example, user 850 may input a specific operation (QR code scanning, etc.) to LBA 810, or may select a specific menu of LBA 810. Operation 8001 may be input from bundle management server 840, a third bundle management server (not shown), or a specific server (not shown).

[0147] refer to Figure 8 In operation 8002, LBA 801 may request and download a remote bundle management command from a bundle management server 840. LBA 810 may request information for requesting a remote bundle management command from SSP 820, and may transmit the information to bundle management server 840. In operation 8003, bundle management server 840 may verify the information, and after successfully performing the verification, bundle management server 840 may transmit a remote bundle management command to LBA 810 in response to the request. The remote bundle management command may include at least one of an identifier of a bundle targeted for bundle management, a bundle family identifier of a target bundle, a bundle family manager identifier of a target bundle, a bundle owner identifier of a target bundle, and a remote management command type.

[0148] In operation 8004, LBA 810 can check the policy of the bundle targeted for remote bundle management or the policy of SSP820. LBA 810 can check the bundle policy of the target bundle stored in terminal 800 by using the target bundle identifier configured for the remote bundle management command. The bundle policy can be stored in the metadata of the bundle, and the metadata of the bundle can be stored in LBA 810 or SSP 820. If remote management requiring end-user consent is performed according to the bundle policy, LBA 810 can request user consent for the remote management command from the user. The bundle policy for remote bundle management can be configured for LBA810, and when remote management requiring end-user consent is performed according to the bundle policy configured for LBA 810, LBA 810 can request user consent for the remote management command from the user. If at least one of the bundle policy stored in the metadata of the bundle and the bundle policy configured for LBA 810 for the remote management command requires user consent, LBA 810 can request user consent for the remote management command from the user. Operation 8004 may use a common user interface for the user to interact with the terminal. When remote management requiring end-user consent is performed according to a bundling policy, LBA 810 may perform operation 8005 after successfully performing user consent. When remote management not requiring user consent (end-user consent) due to a bundling policy is performed, LBA 810 may perform operation 8005 without requiring user consent.

[0149] In operation 8004, when the end-user consent is configured to be mandatory for at least one of the bundled metadata, the terminal 800, the LBA 810, and the SSP 820, the LBA 810 may perform operation 8005 after successfully performing the user consent. For example, in the case of a user terminal (such as a smart phone) that requires the user consent to be performed, the configuration may be performed. If the user consent is not possible, the LBA 810 may reject the remote management command.

[0150] If the remote binding management server that has transmitted the remote binding management command needs to be verified according to the binding policy in operation 8004, LBA 810 can selectively verify whether the binding management server 840 corresponds to the binding management server that allows the remote management command to be transmitted according to the binding policy. If LBA 810 selectively performs the verification, LBA810 can perform operation 8005 after successfully performing the verification of the remote binding management server.

[0151] In operation 8005, LBA 810 may request remote bundling management from SSP 820. In operation 8006, SSP 820 may check the bundling policy of the target bundling or the remote bundling management policy configured for SSP 820 in order to perform remote bundling management. For example, in the case of remote bundling management for installing a bundling, SSP 820 may receive a portion of the summary information (bundling metadata) and / or the bundling policy of the bundling to be installed in SSP 820 from the bundling management server 840 via LBA 810. As another example, in addition to the bundling policy stored in itself, SSP 820 may also receive all or part of the bundling policy from LBA 810. SSP 820 may check the bundling policy of the target bundling stored in SSP 820 by using the target bundling identifier configured for the remote bundling management command. The detailed operation of SSP 820 checking the bundling policy will refer to the description of the accompanying drawings described later.

[0152] If it is necessary to verify the remote bundling management server that has transmitted the remote bundling management command according to the bundling policy, the SSP 820 can verify whether the bundling management server 840 corresponds to the bundling management server that allows the remote management command to be transmitted according to the bundling policy. If the remote bundling management command is transmitted from the bundling management server that does not allow the remote management command to be transmitted according to the bundling policy, the SSP 820 can terminate the remote bundling management. Even if the remote bundling management is performed on the bundling for which the remote management is not allowed according to the bundling policy, the SSP 820 can terminate the remote bundling management.

[0153] If the bundling policy needs to verify the remote bundling management server, SSP 820 can use the verification key (credential) or verification method stored in the bundling policy of the bundling specified by the transmitted remote management command to verify the bundling management server 840 that has transmitted the remote management command. For example, the bundling policy can store a public key, a digital certificate, a public key identifier (PKI) corresponding to a digital certificate or a public key of a digital certificate that can be used to verify a digital signature, a public key of a higher certificate that can verify a digital certificate, or a public key identifier corresponding to a public key of a higher certificate. The stored information can be information associated with a digital certificate for remote bundling management corresponding to a bundling, which is issued to the bundling management server 840 by the service provider 830 or the bundle owner, wherein the bundling belongs to the service provider 830 or the bundle owner itself. In addition to the information, the bundling policy can also selectively include whether the bundling management server verification is required. SSP820 can verify the digital signature included in the received remote bundling management command according to the configuration. If the remote bundling management command is transmitted from a bundling management server for which unauthorized verification is impossible, SSP 820 can terminate the remote bundling management.

[0154] In operation 8007, the SSP 820 may transmit the result of the remote management command to the LBA 810. In operation 8008, the LBA 810 may notify the user of the result of executing the remote management command via the user interface. The LBA 810 may notify the bundle management server 840 of the result of executing the remote management command, and in operation 8010, the bundle management server 840 may notify the service provider 830 of the result of executing the remote bundle management. The result notified in operation 8010 may include part or all of the result of executing the remote bundle management transmitted from the LBA 810 in operation 8009.

[0155] Fig. 9 A diagram illustrating an example of a general process of performing remote bundling management by terminal 900 according to some embodiments.

[0156] exist Fig. 9 In order to describe the configuration of the terminal 900, the LBA 910, the SSP 920, the service provider 930, the bundle management server 940 and the user 950, reference will be made to Figure 7 Description.

[0157] refer to Fig. 9 In operation 9001, LBA 910 may find that a remote management command for SSP 920 exists in bundle management server 940. Operation 9001 may use a common user interface for user interaction with a terminal. For example, user 950 may input a specific operation (QR code scanning, etc.) to LBA 910, or may select a specific menu of LBA 910. Operation 9001 may be input from bundle management server 840, a third bundle management server (not shown), or a specific server (not shown) without involving user 950.

[0158] refer to Fig. 9 In operation 9002, the LBA 910 may request and download a remote bundle management command from the bundle management server 940. The LBA 910 may request information for requesting a remote bundle management command from the SSP 920, and may transmit the information to the bundle management server 940. In operation 9003, the bundle management server 940 may verify the information, and after successfully performing the verification, the bundle management server 840 may transmit the remote bundle management command to the LBA 910 in response to the request. The remote bundle management command may include at least one of an identifier of a bundle targeted for bundle management, a bundle family identifier of a target bundle, a bundle family manager identifier of a target bundle, a bundle owner identifier of a target bundle, and a remote management command type.

[0159] In operation 9004, LBA 910 may request remote bundling management from SSP 920. In operation 9005, SSP 920 may check the bundling policy of the target bundling or the remote bundling management policy configured for SSP 920 to perform remote bundling management. For example, in the case of remote bundling management for installing a bundling, SSP 920 may receive a portion of the summary information (bundling metadata) and / or the bundling policy of the bundling to be installed in SSP 920 from the bundling management server 940 via LBA 910. As another example, in addition to the bundling policy stored in itself, SSP 920 may also receive all or part of the bundling policy from LBA 910. As another example, SSP 920 may preferably apply the remote bundling management policy configured for SSP 920, regardless of the summary information of the bundling. As another example, SSP 920 may check the bundling policy of the target bundling stored in terminal 900 by using the target bundling identifier configured for the remote bundling management command. The detailed operation of the SSP 920 checking the bundling policy will be described with reference to the drawings described later.

[0160] If it is necessary to verify the remote bundling management server that has transmitted the remote bundling management command according to the bundling policy, the SSP 920 can verify whether the bundling management server 940 corresponds to the bundling management server that allows the remote management command to be transmitted according to the bundling policy. If the remote bundling management command is transmitted from the bundling management server that does not allow the remote management command to be transmitted according to the bundling policy, the SSP 920 can terminate the remote bundling management. Even if the remote bundling management is performed on a bundling for which remote management is not allowed according to the bundling policy, the SSP 920 can terminate the remote bundling management.

[0161] As a result of checking the bundle policy, if the remote management requires the device manager or subscriber to agree to the verification, in operation 9006, the SSP 920 may recognize the subscriber's intention. In the present disclosure, the subscriber may be a user or group who purchases a bundle from the service provider 930 to use a specific service, or may be a device manager (individual or group) who manages the terminal 900. The execution of operation 9006 may also include the terminal 900, the service provider 930, the device manager 950, and / or the bundle management server 940. The implementation of operation 9006 may utilize various other means provided by the terminal 900, the bundle management server 940, the service provider 930, and the device manager 950, such as checking the digital signature or certificate of the service provider 930 or the device manager 950 for any data (e.g., a remote management request message, an arbitrary string generated by the bundle management server 940 or the SSP 920, etc.), or recognizing by the device manager 950 or the service provider 930 a private key (credential key) previously provided in a bundle installed in the terminal, the SSP 920, the LBA 910, and / or the bundle management server 940. The subscriber consent verification means required to be used in operation 9006 may be configured in the bundle policy, and if the means is not configured in the bundle policy, any means agreed / selected by the terminal 900, the bundle management server 940, the service provider 930, or the device manager 950 may be used. If, as a result of checking the bundle policy, the remote management does not require the subscriber consent verification, operation 9006 may be omitted. If the subscriber consent verification fails, the SSP 920 may terminate the remote management. If the subscriber consent verification is not required, or if the subscriber consent verification succeeds, the SSP 920 may perform remote management on the target bundle.

[0162] If the bundling policy needs to verify the remote bundling management server, the SSP 920 can use the verification key (credential) or verification method stored in the bundling policy of the bundling specified by the transmitted remote management command to verify the bundling management server 940 that has transmitted the remote management command. For example, the bundling policy can store a public key, a digital certificate, a public key identifier (PKI) corresponding to a digital certificate or a public key of a digital certificate that can be used to verify a digital signature, a public key of a higher certificate that can verify a digital certificate, or a public key identifier corresponding to a public key of a higher certificate. The stored information can be information associated with a digital certificate for remote bundling management of a bundling, which is issued to the bundling management server 940 by the service provider 930 or the bundle owner, wherein the bundling belongs to the service provider 930 or the bundle owner itself. In addition to the information, the bundling policy can also selectively include whether the bundling management server verification is required. The SSP 920 can verify the digital signature included in the received remote bundling management command according to the configuration. If the remote bundling management command is transmitted from a bundling management server for which unauthorized verification is impossible, the SSP 920 can terminate the remote bundling management.

[0163] If it is necessary to verify the remote bundling management server that has transmitted the remote bundling management command according to the bundling policy, the SSP 920 can verify whether the bundling management server 940 corresponds to the bundling management server that allows the remote management command to be transmitted according to the bundling policy. If the remote bundling management command is transmitted from a bundling management server that is not allowed, the SSP 920 can terminate the remote bundling management. Even if the remote bundling management is performed on the bundling that is not allowed to be remotely managed according to the bundling policy, the SSP 920 can terminate the remote bundling management. In operation 9007, the SSP 920 can transmit the result of the remote management command to the LBA 910. In operation 9008, the LBA 910 can notify the bundling management server 940 of the result of executing the remote management command, and in operation 9009, the bundling management server 940 can notify the service provider 930 or the device manager 950 of the result of executing the remote bundling management. The result notified in operation 9009 may include part or all of the result of executing the remote bundling management transmitted from the LBA 910 in operation 9008.

[0164] Fig.10 A diagram showing an example of configuring a bundling policy according to some embodiments.

[0165] refer to Fig.10 , the bundling strategy 1010 can be expressed as a series of parameters. For ease of description, Fig.10The bundling policy 1010 is expressed in the form of a table, but does not necessarily have a table format and can be configured by listing parameters. It should be noted that Fig.10 The configuration values ​​of the corresponding parameters shown in are merely examples of bundling policies for ease of description, and actual configuration values ​​may be different for each bundling.

[0166] The bundle policy 1010 may include a type of local management or remote management command ("command" list) 1011 received by each bundle. Each remote management command may be expressed as a string or number string indicating the corresponding command. Fig.10 In the example, the local management or remote management command is configured to express the following five: "Install", "Enable", "Disable", "Delete", and "Update Metadata". However, the types of local management or remote management commands that can be included in the command type 1011 are not limited thereto, and can be extended to various other bundled management commands. Fig.10 In the example, local management or remote management commands are expressed separately, but one or more local management or remote management commands may be grouped together. For example, commands may be divided into two types, such as "installation" and "other (or the like)" so as to separately express commands corresponding to bundled installation and commands corresponding to others, and all commands may also be expressed in one type (such as "all commands (All)") without classifying the types of commands.

[0167] The bundling policy 1010 may include a “local management” configuration 1012 which indicates a detailed configuration for local management of a corresponding command according to the classification of the command type 1011 .

[0168] More specifically, the local management configuration 1012 may also include an indicator ("allow" indicator) 1012a, which indicates whether each local management command is allowed. If the bundled local management command is allowed, the indicator 1012a may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "yes". If the bundled local management command is not allowed, the indicator 1012a may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "no".

[0169] The local management configuration 1012 may also include an indicator ("end-user consent" indicator) 1012b, which indicates whether the execution of each local management command must require the consent of the end user. If the bundled local management command needs to be initiated by the end user, the indicator 1012b may be expressed as a string, a numeric string and / or a logical symbol (Boolean) indicating "required". If the bundled local management command does not need to be initiated by the user, and if the terminal can initiate the command by itself, the indicator 1012b may be expressed as a string, a numeric string and / or a logical symbol (Boolean) indicating "not required". If the bundled local management command is not allowed according to the configuration of the indicator 1012a that allows local management commands, the indicator 1012b may be expressed as a string, a numeric string and / or a logical symbol (Boolean) indicating "not applicable (N / A)".

[0170] The bundling policy 1010 may include a “remote management” configuration 1013 which indicates a detailed configuration for remote management of a corresponding command according to the classification of the command type 1011 .

[0171] More specifically, the remote management configuration 1013 may also include an indicator ("allow" indicator) 1013a, which indicates whether each remote management command is allowed. If the bundled remote management command is allowed, the indicator 1013a may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "yes". If the bundled remote management command is not allowed, the indicator 1013a may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "no".

[0172] The remote management configuration 1013 may also include an indicator ("end-user consent" indicator) 1013b, which indicates whether the execution of each remote management command must require end-user consent. If the bundled remote management command must require user consent, the indicator 1013b may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "required", so that if necessary, the means for verifying the user's intention may be indicated in more detail. If user consent is described as "required", but no verification means are specified, or the terminal cannot use the indicated means for user consent verification, the terminal may select any one of the available verification means. If the bundled remote management command does not require user consent, the indicator 1013b may be expressed as a string, a numeric string, and / or a logical symbol (Boolean) indicating "not required". If the bundled remote management command is not allowed according to the configuration of the indicator 1013a that allows the remote management command, the indicator 1013b may be expressed as a string, a numeric string, and / or a logical symbol (Boolean) indicating "not applicable (N / A)".

[0173] The remote management configuration 1013 may also optionally include an indicator ("SPBM verification" indicator) 1013c, which indicates whether the execution of each remote management command necessarily requires information verification (SPBM verification) of the bundled management server that has transmitted the remote management command. The indicator may also optionally include a series of methods that can verify the information of the bundled management server or a verification key (credential) that can be used for the verification method. If no verification means is specified, it may be indicated that verification is not required. If the information of the bundled management server that has transmitted the remote management command must be checked in order to execute the bundled remote management command, the indicator 1013c may be expressed as a string and / or a numeric string indicating the identifier of the bundled management server, and if necessary, multiple bundled management server identifiers may be included. The bundled management server identifier may be referred to as data including at least one of the address (FQDN, IP address, or URL) of the bundled management server or the object identifier (OID) of the corresponding server. Depending on the command type 1011, the bundled management server identifier may not be included, and depending on the command type 1011, different bundled management server identifiers may be included. If a digital signature must be verified using a digital certificate specified by a service provider or bundle owner in order to verify that the bundle management server that has transmitted the remote management command has executed the bundled remote management command, indicator 1013c can store a public key, a digital certificate, a public key identifier (PKID) corresponding to a digital certificate or a public key of a digital certificate, a public key of a higher certificate that enables verification of a digital certificate, or a public key identifier corresponding to a public key of a higher certificate that can be used to verify the digital signature specified by the service provider or bundle owner. Indicator 1013c may include a shared private key (shared secret, password, symmetric key, etc.) specified by the service provider or bundle owner. Indicator 1013c may include multiple verification methods.

[0174] The remote management configuration 1013 may also include an indicator ("Subscriber Consent Verification" indicator) 1013d, which indicates whether the execution of each remote management command must require subscriber consent verification. If subscriber consent verification is required to execute the bundled remote management command, the indicator 1013d may be expressed as a string, a numeric string, or a logical symbol (Boolean) indicating "required", so that if necessary, the means of subscriber consent verification may be indicated in more detail. Various other verification means may be used, for example, verifying security information, such as the subscriber's private key ("credential key" of 1013d), or verifying the subscriber's digital signature ("signature token" of 1013d) using a digital certificate. If subscriber consent verification is described as "required", but no verification means are specified, or the terminal and / or the bundled management server cannot use the indicated subscriber consent verification means, the terminal and / or the bundled management server may select any one of the available verification means. If subscriber consent verification is not required to execute the bundled remote management command, the indicator 1013d may be expressed as a string, a numeric string, and / or a logical symbol (Boolean) indicating "not required". If the bundled remote management command is not permitted according to the configuration of the indicator 1013a for permitting the remote management command, the indicator 1013d may be expressed as a character string, a numeric string, and / or a logical symbol (Boolean) indicating "not applicable (N / A)".

[0175] The remote management configuration 1013 may also optionally include an indicator ("SPBM owner verification" indicator) 1013e, which indicates whether the execution of each remote management command must require verification of the subject that has requested the remote management command. If the subject that has requested the bundled remote management command must be verified in order to execute the remote management command, the indicator 1013e ​​may be expressed as a character string and / or a numeric string indicating an identifier of the bundle owner or manager, and if necessary, multiple bundle owner or manager identifiers may be included. The bundle owner identifier or the bundle manager identifier may be an object identifier (OID) of a service provider or a device manager, and may be referred to as data including at least one or more object identifiers. Depending on the command type 1011, the bundle owner identifier or the bundle manager identifier may not be included, and depending on the command type 1011, different bundle owner identifiers or bundle manager identifiers may be included.

[0176] Fig.11 A diagram illustrating an example of configuring SSP remote management for remote bundle management according to some embodiments.

[0177] refer to Fig.11 , SSP remote management configuration 1110 can be expressed as a series of parameters. For ease of description, Fig.11The bundling policy 1110 is expressed in the form of a table, but does not necessarily have a table format and can be configured by listing parameters. It should be noted that Fig.11 The configuration values ​​of the corresponding parameters shown in are merely examples of SSP remote management configuration for ease of description, and actual configuration values ​​may be different.

[0178] The SSP remote management configuration 1110 may include 1120 identifiers indicating the classification of bundles installed or to be installed in the SSP. The identifiers indicating the classification of bundles installed or to be installed in each SSP may include one of a bundle family identifier, a bundle family manager identifier, a bundle owner identifier, or a device manager identifier of the bundle, and may appear in various combinations of the identifiers listed above. Fig.11 , the SSP remote management configuration is expressed as a combination of a bundle family identifier, a bundle family manager identifier, and a bundle owner identifier, but may also be expressed as a combination of various values ​​that may be configured for other bundles, bundle metadata, and remote bundle management commands. For example, the SSP remote management configuration may be expressed as a combination of a bundle family identifier, a bundle family manager identifier, and a bundle owner identifier 1120a, and this may refer to an SSP remote management configuration applied to a bundle in which a specific bundle family identifier, a specific bundle family manager identifier, and a specific bundle owner identifier are configured. The SSP remote management configuration may be expressed as a combination of a bundle family identifier and a bundle family manager identifier 1120b, and this may refer to an SSP remote management configuration applied to a bundle in which a specific bundle family identifier and a bundle family manager identifier are configured, and may be a configuration that is applied regardless of the bundle owner identifier. The SSP remote management configuration may be expressed using only the bundle family identifier 1120c, and this may refer to an SSP remote management configuration applied to a bundle in which a specific bundle family identifier is configured, and may be a configuration that is applied regardless of the bundle family manager identifier and the bundle owner identifier. The SSP remote management configuration may be "All Identifier Combinations (All)" 1120d, and may refer to all bundles regardless of the identifiers configured for the bundles. The SSP remote management configuration may be a configuration that additionally includes specific remote bundle management commands.

[0179] If the execution of each remote management command must require subscriber consent verification, the SSP remote management configuration 1110 may indicate a means ("subscriber intent verification method" indicator) 1130 that can verify the subscriber's intention. For example, if the received remote bundling management command includes a digital signature of the subscriber, the means 1130 for verifying the subscriber's intention may include a public key that can be used to verify the digital signature, a digital certificate or a public key identifier corresponding to the public key of the digital certificate, and a public key identifier (PKID) corresponding to the public key of a higher certificate that can verify the digital certificate. Security information (such as the subscriber's private key) and various other verification means may be specified. If the means for subscriber consent verification are not specified, or the terminal and / or the bundling management server cannot use the indicated subscriber consent verification means, the terminal and / or the bundling management server may select any one of the available verification means. If no verification means are specified, it may be indicated that verification is not required.

[0180] Fig.12 A diagram illustrating an example of a process for configuring SSP remote management permissions between a device manager, a service provider, and a bundle management server, and between a device manager and an SSP, according to some embodiments;

[0181] refer to Fig.12 , the device manager 1210 may issue a remote bundle management token 1250 in order to give the bundle management server 1220 authority to generate and transmit remote bundle management commands for a bundle installed or to be installed in a terminal 1230 managed by the device manager 1210 itself. The remote bundle management token 1250 may be in the form of a digital certificate proving the remote bundle management authority, and may include a public key paired with a specific private key held by the bundle management server 1220. The remote bundle management token 1250 may selectively include at least one of the following values, based on which the bundle management server 1220 may specify a remotely manageable bundle among the bundles installed or to be installed in the terminal 1230 managed by the device manager 1210 itself.

[0182] -Bundle management period or remote bundle management token validity period

[0183] - Identifier of the SSP or terminal where the bundle is installed or to be installed

[0184] -Bundle Identifier

[0185] -Bundle family identifier

[0186] -Bundle Family Manager Identifier

[0187] -Bundle Owner Identifier

[0188] -Device Manager Identifier

[0189] - Remote bundle management commands allowed to the bundle management server

[0190] - Is it possible to issue new remote bundle management tokens

[0191] The remote bundle management token 1250 may also include a digital signature of the device manager, which is generated using a private key used by the device manager 1210 when issuing the remote bundle management token 1250. The device manager 1210 may possess digital certificates 1260a and 1260b including a public key paired with a private key. The digital certificate 1260b may be issued using a private key paired with the higher digital certificate 1260a.

[0192] The bundle management server 1220 may issue other remote bundle management tokens 1250a and 1250b to other bundle management servers 1220a and 1220b by using a private key paired with the remote bundle management token 1250 issued from the device manager 1210. If the remote bundle management token 1250 is configured so that a new token cannot be issued, the bundle management server 1220 may not be able to issue the remote bundle management token. The digital certificates 1250a and 1250b may selectively include at least one value, based on which the bundle management servers 1220a and 1220b may specify a remote manageable bundle, and the value may be the same as the value specified by the device manager 1210 to the remote bundle management token 1250, or may include some of the specified values, and the two values ​​may be different from each other.

[0193] refer to Fig.12 , the terminal 1230 may store a digital certificate or public key 1260c capable of verifying the remote bundle management token 1250 issued by the device manager 1210 and the remote bundle management tokens 1250a and 1250b issued by the bundle management server 1220. The digital certificate or public key 1260c may be the same as the digital certificates 1260a and 1260c of the device manager 1210, and may be the same as the public key included in the digital certificate. The digital certificate or public key 1260c may be one of the means capable of verifying the intention of the subscriber, such as Fig.11 shown.

[0194] Fig.13 A diagram illustrating an example of a process for generating remote bundle management commands by a bundle management server in accordance with some embodiments.

[0195] refer to Fig.13In operation 13001, the service provider 1300 or the device manager 1310 may request the bundle management server 1320 to generate a remote bundle management command. In operation 13001, the service provider 1300 or the device manager 1310 may request to generate a remote bundle management command including at least one of the following request values.

[0196] - Target terminal or SSP identifier

[0197] - Target bundle identifier

[0198] - The bundle family identifier of the target bundle

[0199] - The bundle family manager identifier of the target bundle

[0200] - The bundle owner identifier of the target bundle

[0201] - Remote management commands (e.g. install, enable, disable, delete, etc.)

[0202] refer to Fig.13 In operation 13002, the bundle management server 1320 may selectively determine whether the device manager 1310 or the service provider 1300 that has requested the remote bundle management command has authority to request the remote bundle management command of the corresponding bundle. The bundle management server 1320 may select at least one of the request values ​​transmitted by the device manager 1310 or the service provider 1300 that has requested the remote bundle management command in operation 13001, and if the selected request value does not match the value configured for the bundle management server 1320, the bundle management server 1320 may refuse to generate the remote bundle management command. For example, generation of a remote bundling management command may be denied if the bundle owner identifier of the requested target bundling does not match the device manager 1310 or the service provider 1300, the device manager 1310 or the service provider 1300 does not have request authority for the requested remote management command, the bundling management server 1320 does not have authority to generate a specific remote bundling management command for the requested target bundling, or at least one of the target bundling information (e.g., a target terminal or SSP identifier, a target bundling identifier, a bundle family identifier of the target bundling, a bundle family manager identifier of the target bundling, and a bundle owner identifier of the target bundling) and the requested command information do not match.

[0203] The bundle management server 1320 may selectively check the configuration of the bundle targeted by the requested remote bundle management command and may generate the remote bundle management command.The remote bundle management command may include at least one of the following values.

[0204] - Target bundle identifier

[0205] - The bundle family identifier of the target bundle

[0206] - The bundle family manager identifier of the target bundle

[0207] - The bundle owner identifier of the target bundle

[0208] - Remote management commands (e.g. install, enable, disable, delete, etc.)

[0209] If the bundle is configured to require subscriber consent verification for remote bundle management commands, the bundle management server may digitally sign the remote bundle management commands using a private key. The private key used may be the same as that used by Fig.12 A private key paired with a remote bundle management token issued by the device manager 1210 in the digital signature, which matches the configuration of the target bundle. When selecting a private key for generating a digital signature, a selection can be made for a private key paired with a remote bundle management token, in which at least one configuration value of the bundle matches at least one of the identifiers of the SSP or terminal in which the bundle has been installed or is to be installed, the bundle identifier, the bundle family identifier, the bundle family manager identifier, the bundle owner identifier, the device manager identifier, and the remote bundle management commands allowed to the bundle management server in the information configured for the remote bundle management token. In addition to the digital signature, the subscriber consent verification value can be a verification value generated using a shared private key previously shared with the bundle management server and the target bundle or target SSP.

[0210] If the configuration of the bundle includes a verification key (credential) or verification method specified by the service provider or bundle owner for the remote bundle management command, the bundle management server can add information that can be verified by the verification key to the remote bundle management command. For example, the service provider or bundle owner can perform a digital signature with a private key paired with a corresponding certificate so that it can be verified using the digital certificate included in the bundle policy. Information that can be verified using a shared secret key (shared secret, password, symmetric key, etc.) specified by the service provider or bundle owner can be included.

[0211] In operation 13002 , if it is allowed to generate digital signatures with the same private key for a plurality of remote binding management commands, the binding management server 1320 may generate one digital signature including the plurality of remote binding management commands.

[0212] If the remote bundling management command is successfully generated in operation 13002, the bundling management server 1320 may generate an identifier CodeM of the remote bundling management command and may store the identifier CodeM in combination with the target SSP identifier and the remote bundling management command.

[0213] In operation 13003, the bundle management server 1320 may transmit the remote bundle management command generation result (success or failure) to the service provider 1300 or the device manager 1310. If the generation of the remote bundle management command is successful, the bundle management server 1320 may selectively include and transmit an identifier of the remote bundle management command.

[0214] Fig.14 A diagram illustrating an example of a process in which a terminal verifies and executes a remote bundling management command received from a bundling management server according to some embodiments.

[0215] refer to Fig.14 , in operation 14001, the terminal 1400 may request a remote bundling management command from the bundling management server 1430, or may receive a remote bundling management command. For this reception, the LBA 1410 of the terminal 1400 may receive the remote bundling management command by using the information of the SSP 1420. When the remote bundling management command is transmitted to the LBA 1410, the bundling management server 1430 may transmit, together with the remote bundling management command, a digital certificate that can be used to verify the digital signature for the subscriber consent verification included in the remote bundling management command, or a higher certificate of the corresponding certificate. The digital certificate may be a remote bundling management token issued by the device manager to the bundling management server. A digital certificate that can be used to verify the signature included in the remote bundling management command for the bundling management server verification, or a higher certificate of the corresponding certificate may be selectively transmitted. The remote bundling management command may include at least one of an identifier of a bundle targeted for bundling management, a bundle family identifier of a target bundle, a bundle family manager identifier of a target bundle, a bundle owner identifier of a target bundle, and a remote management command type.

[0216] In operation 14002, LBA 1410 may check the information configured for the received remote bundling management command. LBA 1410 may compare the policy of the target bundling stored in terminal 1400 with at least one of the target bundling identifier, the bundle family identifier of the target bundling, the bundle family manager identifier of the target bundling, the bundle owner identifier of the target bundling, and the remote management command type in the information configured for the remote bundling management command. The bundling policy may be stored in the metadata of the bundle, SSP 1420, LBA 1410, or terminal 1400, and the priority of application may vary depending on the implementation. In operation 14002, if user consent is required before executing the remote bundling management command in the compared bundling policy, LBA 1410 may execute the user consent.

[0217] In operation 14003, LBA 1410 may transmit a remote bundle management command to SSP 1420. LBA 1420 may transmit a portion or all of the remote bundle management command received from the bundle management server 1430 in operation 14001. The transmitted remote bundle management command may be a command for remote management (enabling, disabling, deleting, information request, etc.) of a previously installed bundle or an installation command for a new bundle. A digital certificate that can be used to verify the digital signature for subscriber consent verification included in the remote bundle management command, and a higher certificate of the corresponding certificate may be transmitted together. A digital certificate that can be used to verify the digital signature for bundle management server verification included in the remote bundle management command, or a higher certificate of the corresponding certificate may be selectively transmitted.

[0218] In operation 14004, the SSP 1420 may check the policy of the target bundle. The SSP 1420 may compare the policy of the target bundle stored in the terminal 1400 with at least one of the target bundle identifier, the bundle family identifier of the target bundle, the bundle family manager identifier of the target bundle, the bundle owner identifier of the target bundle, and the remote management command type in the information configured for the remote bundle management command. The bundle policy may refer to Fig.10 Remote management configuration as described in . You can configure bundle policies for the SSP 1420 instead of bundle metadata.

[0219] In operation 14004, if subscriber consent verification is configured to be mandatory in the execution of the remote binding management command, the SSP 1420 may verify the subscriber consent verification value included in the remote binding management command transmitted from the LBA 1410. The configuration may be checked via the binding policy configured for the binding metadata or the self-binding policy configured for the SSP 1420.

[0220] When verifying the digital signature included in the remote binding management command in operation 14004, as shown in FIG. Fig.11 As shown, SSP 1420 can check the SSP remote management configuration and can select the subscriber consent verification means required for the verification configured for the target bundle. The subscriber consent verification means can be configured for the bundle policy in the metadata of the bundle, and the SSP can select the subscriber consent verification means.

[0221] For example, in order to verify the digital signature of the subscriber of the received remote bundle management command, SSP 1420 can select a public key, a digital certificate or a public key identifier corresponding to the public key of the digital certificate that can be used to verify the digital signature, and a public key identifier (PKID) corresponding to the public key of the higher certificate that can verify the digital certificate. Based on the subscriber's consent verification value, security information (such as the subscriber's private key) and various other verification means can be selected. For the verification means, an SSP remote management configuration or a bundle policy that matches at least one of the bundle identifier, bundle family identifier, bundle family manager identifier, and bundle owner / device manager identifier of the target bundle can be selected. If no verification means is specified, it may be indicated that verification is not required.

[0222] When the digital signature is verified, SSP 1420 can verify the digital certificate and its higher certificates, wherein the digital certificate can be used to verify the digital signature for subscriber consent verification transmitted together with the remote bundle management command. Verification of the validity of the digital certificate can also include verifying that at least one of the validity period, bundle identifier, bundle family identifier, bundle family manager identifier, bundle owner / device manager identifier, and allowed remote bundle management commands included in the digital certificate matches the policy of the target bundle and the SSP remote management configuration.

[0223] If the subscriber agrees that the verification is successful, the SSP 1420 may execute the remote binding management command. If the verification fails, the SSP 1420 may refuse to execute the remote binding management command.

[0224] In operation 14004, when executing a remote bundling management command, if information verification (SPBM verification) of the bundling management server that has transmitted the remote management command is configured as mandatory, the SSP 1420 may verify a bundling management server check verification value included in the remote bundling management command transmitted from the LBA 1410. The configuration may be checked via a bundling policy configured for the bundling metadata or a self-bundling policy configured for the SSP 1420.

[0225] When verifying the digital signature included in the remote binding management command in operation 14004, as shown in FIG. Fig.10 As shown, SSP 1420 may check the bundling policy of the target bundling and may select the verification means required for verification configured for the bundling policy.

[0226] For example, the received remote binding management command includes the digital signature of the binding management server, and in order to verify the digital signature, SSP 1420 can select a public key that can be used to verify the digital signature according to the binding policy of the target binding, the digital certificate or the public identifier of the public key corresponding to the digital certificate, and the public key identifier (PKID) corresponding to the public key of the higher certificate that can verify the digital certificate. Based on the binding management server checking the verification value, security information (such as a private key) and various other verification means can be selected. If the verification means is not specified, it may be indicated that verification is not required.

[0227] If the binding management server successfully verifies the information, the SSP 1420 may execute the remote binding management command. If the verification fails, the SSP 1420 may refuse to execute the remote binding management command.

[0228] The SSP 1420 may determine whether the bundling policy of the bundle targeted by the remote bundling management command is configured to verify at least one of end-user consent or subscriber consent verification. If the bundling policy is configured not to verify both end-user consent and subscriber consent verification, the SSP 1420 may refuse to execute the remote management command. If the bundling policy is configured to verify end-user consent or subscriber consent verification, the SSP 1420 or LBA 1410 may perform the configured consent verification, and if the verification is successful, the remote bundling management command may be executed.

[0229] In operation 14005 , the SSP 1420 may transmit the execution result of the remote bundle management command to the LBA 1410 .

[0230] Fig.15 A diagram showing a configuration of a terminal according to some embodiments.

[0231] like Fig.15 As shown, the terminal may include a transceiver 1510 and at least one processor 1520. The terminal may include an SSP 1530. For example, the SSP 1530 may be inserted into the terminal or may be embedded in the terminal. The at least one processor 1520 may be referred to as a controller.

[0232] However, the configuration of the terminal is not limited to Fig.15 , and can include Fig.151530. According to some embodiments, the transceiver 1510, at least one processor 1520 and a memory (not shown) may be implemented in the form of a single chip. When the SSP 1530 is embedded, the configuration of the terminal may be implemented in the form of a single chip including the SSP 1530. According to some embodiments, the transceiver 1510 may send and receive signals, information, data, etc. according to various embodiments to the bundle management server. The transceiver 1510 may include an RF transmitter that up-converts and amplifies the frequency of the transmitted signal, an RF receiver that amplifies the received signal with low noise and down-converts the frequency, etc. However, this is only an embodiment of the transceiver 1510, and the elements of the transceiver 1510 are not limited to the RF transmitter and the RF receiver. The transceiver 1510 may receive a signal via a wireless channel, may output it to at least one processor 1520, and may send a signal output from at least one processor 1520 via a wireless channel.

[0233] According to some embodiments, the transceiver 1510 may receive from the bundle management server a certificate of the bundle management server, CI information to be used by the SSP 1530, a bundle family identifier, a binding bundle, etc. The transceiver 1510 may send the CI information corresponding to a specific bundle family identifier, authentication information of the SSP 1530, etc. to the bundle management server.

[0234] At least one processor 1520 is an element for overall control of the terminal. According to various embodiments as described above, the at least one processor 1520 may control the overall operation of the terminal.

[0235] The SSP 1530 may include a processor or controller for installing and controlling the bundle, or may install an application.

[0236] In accordance with some embodiments, at least one processor or controller within SSP 1530 can check certificate issuer (CI) information that can be used when downloading and installing a specific bundle corresponding to a specific bundle family identifier, and can verify at least one of the transmitted bundle management server certificate, the CI information to be used by the SSP, and the bundle family identifier based on the CI information for each bundle family identifier pre-configured for SSP 1530.

[0237] According to some embodiments, at least one processor 1520 can control the transceiver 1510 to transmit CI information corresponding to a specific bundling family identifier to a bundling management server, and can receive at least one of a certificate of the bundling management server, CI information to be used by a smart security platform (SSP), and a bundling family identifier from the bundling management server.

[0238] The SSP 1530 according to various embodiments may download the bundle and install the bundle. The SSP 1530 may manage the bundle.

[0239] According to some embodiments, SSP 1530 may operate under the control of processor 1520. Alternatively, SSP 1530 may include a processor or controller for installing and controlling the bundle, or may have applications installed therein. Some or all applications may be installed in SSP 1530 or in a memory (not shown).

[0240] The terminal may also include a memory (not shown), and may store data, such as default programs, applications, and configuration information for the operation of the terminal. The memory may include at least one storage medium of a flash memory type, a hard disk type, a multimedia card micro, a card type memory (e.g., SD or XD memory, etc.), a magnetic memory, a disk, an optical disk, a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), a programmable read-only memory (PROM), and an electrically erasable programmable read-only memory (EEPROM). The processor 1520 may perform various operations by using various programs, contents, data, etc. stored in the memory.

[0241] Fig.16 A diagram illustrating a configuration of a bundle management server according to some embodiments.

[0242] According to some embodiments, the bundle management server may include a transceiver 1610 and at least one processor 1620. The configuration of the bundle management server is not limited to Fig.16 , and can include Fig.16 According to some embodiments, the transceiver 1610, at least one processor 1620, and a memory (not shown) may be implemented in the form of a single chip.

[0243] According to some embodiments, the transceiver 1610 may send and receive signals, information, data, etc. according to various embodiments to and from a terminal, a subscriber, or a service provider. For example, the transceiver 1610 may receive SSP authentication information, certificate information corresponding to a bundle family manager identifier and a bundle family identifier or a specific bundle family identifier, etc. from the terminal, and may send a certificate of a bundle management server, certificate information to be used by the SSP, a bundle family identifier, a binding bundle, etc. to the terminal.

[0244] The transceiver 1610 may include an RF transmitter that up-converts and amplifies the frequency of a transmitted signal, an RF receiver that amplifies a received signal with low noise and down-converts the frequency, etc. However, this is merely an embodiment of the transceiver 1610, and the elements of the transceiver 1610 are not limited to the RF transmitter and the RF receiver. The transceiver 1610 may receive a signal via a wireless channel, may output it to at least one processor 1620, and may transmit a signal output from the at least one processor 1620 via a wireless channel.

[0245] At least one processor 1620 is an element for overall control of the bundle management server. According to various embodiments as described above, the processor 1620 may control the overall operation of the bundle management server. The at least one processor 1620 may be referred to as a controller.

[0246] According to some embodiments, at least one processor 1620 can select a certificate to be sent to the binding management server of the terminal, and certificate information to be used by the SSP of the terminal, can verify the authentication information (SSP credential) of the SSP of the terminal, and can generate an SPBMToken and a binding bundle.

[0247] According to some embodiments, at least one processor 1620 can send a certificate of a bundling management server, certificate information to be used by an SSP, a bundling family identifier, a binding bundle, etc. to the terminal, and can control the transceiver 1610 to receive certificate information corresponding to a specific bundling family identifier, authentication information of the SSP, etc. from the terminal.

[0248] The bundle management server may also include a memory (not shown), and may store data, such as default programs, applications, and configuration information for the operation of the bundle management server. The memory may include a flash memory type, a hard disk type, a multimedia card micro, a card type memory (e.g., SD or XD memory, etc.), a magnetic memory, a disk, an optical disk, a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), a programmable read-only memory (PROM), and at least one storage medium among an electrically erasable programmable read-only memory (EEPROM). The processor 1620 may perform various operations by using various programs, content, data, etc. stored in the memory.

[0249] In the above detailed embodiments of the present disclosure, the elements included in the present disclosure are expressed in the singular or plural, depending on the detailed embodiments presented. However, for ease of description, the singular form or the plural form is appropriately selected as the presented situation, and the present disclosure is not limited to the elements expressed in the singular or plural. Therefore, the elements expressed in the plural may also include a single element, or the elements expressed in the singular may also include multiple elements.

[0250] Although specific embodiments have been described in the detailed description of the present disclosure, various modifications and changes may be made thereto without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure should not be defined as limited to the embodiments, but should be defined by the appended claims and their equivalents.

[0251] It should be understood that the various embodiments of the present disclosure and the terms used therein are not intended to limit the technical features set forth herein to specific embodiments, and include various changes, equivalents and / or substitutes of corresponding embodiments. Regarding the description of the accompanying drawings, similar reference numerals may be used to specify similar or related elements. It should be understood that the singular form of the noun corresponding to an item may include one or more things, unless the relevant context clearly indicates otherwise. As used herein, each of the phrases such as "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "at least one of A, B or C" may include all possible combinations of items listed together in a corresponding phrase. As used herein, terms such as "first", "second", "the first" and "the second" may be used to simply distinguish a corresponding element from another element, and do not limit elements in other aspects (e.g., importance or order). It should be understood that if an element (e.g., a first element) is referred to as being “coupled with another element (e.g., a second element)”, “coupled to another element”, “connected with another element” or “connected to another element”, whether or not there is the term “operably” or “communicatively”, this means that the element can be coupled to the other element directly (e.g., wired), wirelessly or via another element (e.g., a third element).

[0252] As used herein, the term "module" may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with other terms (e.g., "logic," "logic block," "component," or "circuit"). A "module" may be the smallest unit of a single integrated component suitable for performing one or more functions, or a portion thereof. For example, according to an embodiment, a "module" may be implemented in the form of an application specific integrated circuit (ASIC).

[0253] The various embodiments described herein may be implemented as software (e.g., a program) including instructions stored in a machine-readable storage medium (e.g., an internal memory or an external memory) readable by a machine (e.g., a computer). A machine is a device that can call the stored instructions from the storage medium and operate according to the called instructions, and may include a terminal 250 according to various embodiments. When the instructions are executed by a processor (e.g., Figure 8 The processor 820 or Fig. 9When the processor 920 in the processor executes, the processor may perform the function corresponding to the instruction with or without using other components under the control of the processor. The instruction may include a code generated by a compiler or a code executable by an interpreter.

[0254] The machine-readable storage medium may be provided in the form of a non-transitory storage medium, wherein the term "non-transitory" simply means that the storage medium is a tangible device and does not include signals (e.g., electromagnetic waves), but the term does not distinguish between where data is semi-permanently stored in the storage medium and where data is temporarily stored in the storage medium.

[0255] The method according to various embodiments of the present disclosure may be included and provided in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., a compact disc read-only memory (CD-ROM)), or distributed online (e.g., downloaded or uploaded) via an application store (e.g., Play StoreTM), or distributed directly between two user devices (e.g., smart phones). If distributed online, at least a portion of the computer program product may be temporarily generated or at least temporarily stored in a machine-readable storage medium (such as a memory of a manufacturer's server, a server of an application store, or a relay server).

[0256] According to various embodiments, each element (for example, module or program) in the above-mentioned elements can include a single entity or multiple entities. According to various embodiments, one or more of the above-mentioned elements can be omitted, or one or more other elements can be added. Alternatively or additionally, multiple elements (for example, module or program) can be integrated into a single element. In this case, according to various embodiments, the integrated element can still perform the one or more functions in the same or similar manner as one or more functions of each of the multiple elements performed by a corresponding element in the multiple elements before integration. According to various embodiments, the operation performed by a module, program or another element can be performed sequentially, in parallel, repeatedly or heuristically, or one or more of the operation can be performed in different orders or omitted, or one or more other operations can be added.

[0257] Although the present disclosure has been described with various embodiments, various changes and modifications may occur to those skilled in the art. The present disclosure is intended to encompass such changes and modifications as fall within the scope of the appended claims.

Claims

1. A method performed by a first entity included in a terminal in a wireless communication system, the method comprising: receiving remote bundle management commands from the server; verifying the first bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal; sending a remote binding management command to a second entity included in the terminal; and receiving an execution result of the remote binding management command from the second entity, wherein the second bundling policy is verified by the second entity based on information included in the remote bundling management command and the bundling policy stored in the terminal, and The remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

2. The method according to claim 1, wherein: The information included in the remote bundle management command includes at least one of a bundle identifier, a bundle family identifier of the bundle, a bundle family manager identifier of the bundle, a bundle owner identifier of the bundle, and a remote management command type.

3. The method according to claim 1, wherein: The bundling policy stored in the terminal includes at least one of end-user consent and bundling management server verification.

4. The method according to claim 1, wherein: Verifying the first bundle policy includes verifying user consent, and The verification of the second bundling policy includes verifying the bundling management server.

5. A method performed by a second entity included in a terminal in a wireless communication system, the method comprising: receiving a remote binding management command from a first entity included in the terminal; verifying the second bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal; as well as sending the execution result of the remote binding management command to the first entity, Wherein, the remote binding management command is sent from the server to the first entity, wherein the first bundling policy is verified by the first entity based on information included in the remote bundling management command and the bundling policy stored in the terminal, and The remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

6. The method according to claim 5, wherein: The information included in the remote bundle management command includes at least one of a bundle identifier, a bundle family identifier of the bundle, a bundle family manager identifier of the bundle, a bundle owner identifier of the bundle, and a remote management command type.

7. The method according to claim 5, wherein: The bundling policy stored in the terminal includes at least one of end-user consent and bundling management server verification.

8. The method according to claim 5, wherein: Verification of the first bundling policy includes verifying user consent, and Wherein, verifying the second bundling policy includes verifying a bundling management server.

9. A first entity included in a terminal, the first entity comprising: a transceiver capable of transmitting or receiving at least one signal, and a controller coupled to the transceiver, wherein the controller is configured to: Receive remote bundle management commands from the server, verifying the first bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal, sending a remote binding management command to a second entity included in the terminal, and receiving an execution result of the remote binding management command from the second entity, wherein the second bundling policy is verified by the second entity based on information included in the remote bundling management command and the bundling policy stored in the terminal, and The remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

10. The first entity according to claim 9, wherein: The information included in the remote bundle management command includes at least one of a bundle identifier, a bundle family identifier of the bundle, a bundle family manager identifier of the bundle, a bundle owner identifier of the bundle, and a remote management command type.

11. The first entity according to claim 9, wherein: The bundling policy stored in the terminal includes at least one of end-user consent and bundling management server verification.

12. The first entity according to claim 9, wherein: The controller is configured such that verification of the first bundling policy includes verifying user consent, and The verification of the second bundling policy includes verifying the bundling management server.

13. A second entity included in a terminal, the second entity comprising: a transceiver capable of transmitting or receiving at least one signal, and a controller coupled to the transceiver, wherein the controller is configured to: receiving a remote binding management command from a first entity included in the terminal, verifying the second bundling policy based on information included in the remote bundling management command and the bundling policy stored in the terminal, and sending the execution result of the remote binding management command to the first entity, Wherein, the remote binding management command is sent from the server to the first entity, wherein the first bundling policy is verified by the first entity based on information included in the remote bundling management command and the bundling policy stored in the terminal, and The remote bundling management command is executed by the terminal based on the verification results of the first bundling policy and the second bundling policy.

14. The second entity according to claim 13, wherein: The information included in the remote bundle management command includes at least one of a bundle identifier, a bundle family identifier of the bundle, a bundle family manager identifier of the bundle, a bundle owner identifier of the bundle, and a remote management command type.

15. The second entity according to claim 13, wherein: The controller is configured such that verification of the second bundling policy includes verifying the bundling management server, wherein the bundling policy stored in the terminal includes at least one of end-user consent and bundling management server verification, and The verification of the first bundling policy is configured to verify user consent.

Images