Method for personalizing a chip module

Abstract

A method (100) for personalizing a chip module (10) is specified. The method comprises the following steps: loading initialization data (22) into a memory (14) of the chip module (10), wherein the initialization data (22) includes an operating system (23) and static configuration data (24) for the chip module (10); executing the initialization data (22) by the chip module (10) and starting the operating system (23); loading individual personalization information (26) into the memory (14) of the chip module (10) using the operating system (23); executing a personalization sequence by the operating system (23) on the chip module (10), wherein, upon execution of the personalization sequence, the individual personalization information (26) previously loaded into the memory (14) of the chip module (10) is associated with the chip module (10).The special feature of the method described here is that the individual personalization information is loaded into the memory of the chip module using the operating system, and a personalization sequence is executed by the operating system.

Description

Technical area

[0001] The invention relates to a method for personalizing a chip module, in particular a chip module which is used to obtain personalized or subscriber-based access to services provided by a service provider. background

[0002] Chip modules are used in many areas to grant or deny authorization to access services. A chip module contains data that can uniquely identify a person or device. A chip module also contains a processor that can perform computational steps.

[0003] A chip module can be a chip card or an integrated module, such as an integrated circuit. In the case of a chip card, the chip module is a separate physical component, but the chip module's functionality can also be implemented on an electronic component integrated into a device.

[0004] A chip module implemented as a chip card, for example, comprises a card body and an integrated circuit with a chip embedded in the card body. In this case, the chip is inserted into a cavity or module opening in the card body.

[0005] Before chip modules can be used as unique identifiers, they typically need to be initialized and personalized. During initialization, for example, an operating system and static configuration data are loaded onto the chip module. In this state, the chip modules of a service provider are similar. To uniquely assign a chip module to a person, the chip module must then be personalized. To personalize the chip module, for example, a unique character string and / or a key is stored on the chip module. After personalization, the chip module can be used to grant or deny individual and person-specific access to services, possibly with specific rights or roles.

[0006] WO 2021 / 239 272 A1 describes a method for personalizing a chip card. Description of the invention

[0007] The challenge can be seen as increasing the flexibility in personalizing chip modules without compromising on security.

[0008] This object is achieved by a method according to claim 1. Further embodiments emerge from the dependent claims and from the following description.

[0009] According to one aspect, a method for personalizing a chip module is provided. The method comprises the following steps: loading initialization data into a memory of the chip module, wherein the initialization data contains an operating system and static configuration data for the chip module; executing the initialization data by the chip module and starting the operating system; loading individual personalization information into the memory of the chip module using the operating system; executing a personalization sequence by the operating system on the chip module, wherein the individual personalization information is linked to the chip module upon execution of the personalization sequence.

[0010] The chip module referenced here could, for example, be a SIM card. Even though this example refers to a SIM card, the explanations also apply to an integrated module in which the functions of a SIM card are implemented. A SIM card is a subscriber identity module card. The abbreviation SIM stands for "subscriber identity module." With such a card, it is possible to identify oneself for access to the services of a service provider, and the service provider can assign the use of a personalized chip module, i.e. a chip module on which the aforementioned personalization sequence has been executed, to a specific person, for example for billing purposes. SIM cards are used, for example, for terminal devices to access communication networks, in particular wireless mobile networks, although this example should not be construed as limiting.

[0011] The individual personalization information may contain individual personalization data and / or individual personalization sequences, i.e. the personalization sequences executed by the operating system either originate from the individual personalization information or are already present on the chip module.

[0012] The fact that the individual personalization information is linked to the chip module when executing a personalization sequence means, in particular, that the personalization data is transferred into the relevant data structures of the chip module in order to enable unique identifiability of the chip module and to establish the intended functionality of the chip module.

[0013] The term "chip module" is not intended to be restrictive with regard to the structural design of the chip module. The chip module can therefore be a separate physical component, such as a chip card, but the chip module's function can also be implemented on an electronic component integrated into a device.

[0014] The initialization data is usually loaded into the memory via a communication interface on the chip module. A so-called bootloader can be used for this purpose, for example. The initialization data can be transferred to the chip module via a wired connection and stored in the memory. The initialization data is typically transferred to the chip module's memory in encrypted form. The static configuration data is data that is independent of the subscriber identity and configures the chip module for access to services from a specific service provider. The static configuration data can contain different values ​​or parameters for different service providers. However, this configuration data is referred to as static because it is typically the same for all subscribers of a service provider.

[0015] After the initialization data has been loaded into the memory of the chip module, the initialization data is executed, thereby placing the operating system and the static configuration data in a state in which the operating system is executed by the processor of the chip module (i.e., the operating system is started) and the static configuration data is associated with the respective instance of the operating system on the chip module.

[0016] At this point, the chip module is not yet personalized, but the chip module is prepared for personalization. Personalization is essential for the unique identifiability of the chip module and is almost always necessary to establish the intended functionality of the chip module. In one embodiment, a pre-personalization sequence can be applied at the end of initialization, before the operating system is started, e.g., to personalize a unique ID and keys for administration using the bootloader. After the operating system has started and the pre-personalization sequence has been executed, the chip module is individualized, but does not yet have an executable, fully personalized (profile) configuration. The chip module is only fully personalized and functional once the personalization of a (profile) configuration has been fully completed.Using the described method, individual personalization sequences / individual personalization data are then loaded into the chip module's memory in subsequent steps using the operating system. However, the personalization data is not yet linked to the data structures of the chip module and / or the operating system that are relevant for unique identifiability and, in most cases, also for the chip module's intended functionality. Explicit operating system commands or implicit operating system states initiate the processing of the individual personalization sequences / individual personalization data preloaded in the chip module's memory, and the personalization data is transferred to the existing data structures of the chip module and / or the operating system. At the end of the final personalization sequence, the chip module is fully personalized and contains a fully functional (profile) configuration.The personalization sequence is executed on the chip module, i.e., by a processor within the chip module. Therefore, no external functional module is required, and the personalization data stored in the chip module's memory does not need to be transferred from the chip module to the outside.

[0017] The special feature of the method described here is that the individual personalization information is loaded into the memory of the chip module using the operating system and in particular using operating system calls, and a personalization sequence is executed by the operating system. The bootloader of the chip module is therefore not used to load the individual personalization information, unlike the loading of the initialization data. This means that the individual personalization information can be transferred to the memory of the chip module independently and separately from the initialization data (namely using the operating system and in particular during runtime of the operating system, i.e. while the operating system is running on the chip module ora processor of the chip module) and furthermore, that the personalization sequence can also be executed at an individually definable time and independently of the loading of the initialization data and the loading of the individual personalization information by the operating system on the chip module. The scope of the data to be personalized can vary; i.e., depending on the previous history, it can be an initial complete personalization, but it can also be a supplementary personalization; constant elements can also be taken into account, so that a completely personalized, fully functional profile configuration could also be replaced.

[0018] This embodiment of the method makes it possible to execute the aforementioned steps for personalizing the chip module (loading the initialization data, loading the individual personalization information, executing the personalization sequence) independently of one another, both in terms of time and location. This means that the initialization data containing the operating system and the static configuration data, on the one hand, and the individual personalization information, on the other, can be loaded into the chip module's memory at different times and / or by different instances.The same applies to the execution of the personalization sequence, in which the individual personalization information is linked to the chip module, i.e., transferred to the relevant data structures of the chip module to enable the unique identifiability of the chip module and / or establish the intended functionality of the chip module. The personalization sequence is a sequence of functions of the operating system. This sequence of functions is executed during the runtime of the operating system, i.e., while the operating system is running on a processor of the chip module. The personalization sequence can be executed temporally and / or spatially independently of the loading of the initialization data and / or the loading of the individual personalization information into the memory of the chip module.

[0019] The ability or possibility of loading, optionally decrypting, and / or executing a chip module personalization sequence should be controlled by the chip module operating system. In addition to explicit chip module operating system commands, implicit states in the chip module's personalization lifecycle could also be used. For example, a personalization sequence can be executed when the operating system is rebooted.

[0020] After all personalization sequences have been executed, the chip module contains a fully personalized profile configuration with the personalization data defined in the personalization sequences. The chip module is fully personalized and can be distinguished from other chip modules.

[0021] In one embodiment, the method further comprises the following step: checking a loading authorization before the individual personalization information is written into the memory of the chip module.

[0022] For this purpose, for example, a key derivation token can be introduced into the operating system of the chip module in order to secure the loading of the individual personalization information and, if applicable, a subsequent decryption process and / or processing process of the individual personalization information.

[0023] The loading authorization specifically refers to the fact that the writing of the individual personalization information into the chip module's memory is only possible if this loading authorization is present. This increases the security of the process by ensuring that the individual personalization information can only be written into the chip module's memory if the loading authorization is present.

[0024] In a further embodiment, the individual personalization information is provided in an encrypted form for loading into the memory of the chip module.

[0025] All known cryptographic mechanisms and necessary infrastructure can be used for this purpose. The individual personalization information, provided in encrypted form, is protected from third-party access.

[0026] In a further embodiment, the individual personalization information on the chip module is decrypted by the operating system before being stored in memory and is subsequently stored in memory in unencrypted form. This can reduce the computational effort required for the operating system to execute the personalization sequence.

[0027] In a further embodiment, the individual personalization information is stored in the memory in encrypted form by the operating system. This ensures the confidentiality of the individual personalization information. The personalization information is then decrypted during or immediately before the personalization sequence is executed by the operating system.

[0028] In a further embodiment, the individual personalization information is provided in an unencrypted form for loading into the memory of the chip module. If the individual personalization information is loaded into the memory of the chip module in a secure environment, it is not mandatory for the individual personalization information to be encrypted. In this way, the computational effort on the chip module can be reduced if no encryption or decryption of the personalization information needs to occur on the chip module. For security reasons, however, it may be necessary for the unencrypted personalization information to be stored in the memory of the chip module in encrypted form by the operating system.

[0029] In a further embodiment, the method includes the step of checking a personalization authorization before the personalization sequence is executed by the operating system on the chip module.

[0030] For personalization authorization, a key derivation token can also be introduced into the operating system of the chip module, for example, in order to link the execution of the personalization sequence by the operating system (e.g. a processing operation and / or decryption operation) to the presence of the personalization authorization.

[0031] The personalization authorization specifically refers to the fact that the operating system can only execute the personalization sequence if this personalization authorization is present. This increases the security of the process by ensuring that the personalization sequence is only executed if the personalization authorization is present.

[0032] In a further embodiment, the method further comprises the following step: deleting the individual personalization information from the memory of the chip module after executing the personalization sequence.

[0033] Once the personalization sequence is executed by the operating system, the chip module is fully personalized and functional, and can be distinguished from other chip modules. This essentially eliminates the need to store the personalization sequences in the chip module's memory, and these can be deleted to free up storage space. However, it should be noted that this step of the method is optional, and it is also conceivable for the personalization sequences to remain in memory after the personalization sequence has been executed by the operating system. This allows the personalization sequence to be executed again later and the chip module to be personalized for the same subscriber, for example, if there are changes to the operating system.

[0034] In a further embodiment, the method further comprises the following step: retaining the loaded individual personalization information in the memory of the chip module after executing the personalization sequence. In this variant, the originally loaded individual personalization information is retained in the memory of the chip module, and the personalization sequence can be executed again later if necessary based on this originally loaded personalization information. Short description of the characters

[0035] Some details are described in more detail below using the attached drawings. These illustrations are schematic and not to scale.

[0036] Like reference numerals refer to like or similar elements. They show: Fig. 1 a schematic representation of a chip module; Fig. 2 a schematic representation of the data for a chip module; Fig. 3 a schematic representation of a method for personalizing a chip module. Detailed description

[0037] Fig. Figure 1 shows a chip module 10 as described above. The chip module 10 contains a processor 12 and a memory 14. The memory 14 is, for example, a non-volatile memory. The processor 12 is configured to execute instructions, in particular those instructions stored in the memory 14. The chip module 10 also has a communication interface 16. Data can be written to the memory 14 via the communication interface 16.

[0038] Fig. Figure 2 shows schematically the structure of data 20 which is transferred via the communication interface 16 into the memory 14 of the chip module 10 from Fig. 1. The data 20 comprises initialization data 22 and individual personalization information 26. The initialization data 22, in turn, comprises an operating system 23, non-personalized application data, and static configuration data 24. The operating system 23 is configured to load personalization information 26 into the memory 14. It is further configured to execute personalization sequences. The actions are preferably executed using predefined commands. The non-personalized application data can, for example, be profiles—still to be personalized—for logging into mobile networks or payment applications.

[0039] The operating system 23 is loaded into the memory 14 and can then be executed by the processor 12. The personalization information 26 is loaded into the memory 14 using functions of the operating system 23, when the latter is executed on the processor 12, and stored there at initial memory addresses. The personalization information 26 is preferably generated in a secure environment. Depending on the production environment, the transfer to the memory 14 takes place in a secure form after an optional check of the loading authorization.

[0040] The personalization information 26 contains one or more personalization sequences as well as individual personalization data. The personalization information 26 is expediently provided as a so-called "BLOB" (Binary Large Object).

[0041] The chip module 10 is personalized by the operating system 23 executing the personalization sequences contained in the personalization information 26 and thereby linking the individual personalization data with the non-personalized application data and thus with the chip module 10. A personalization sequence is in Fig. 2 by the dashed arrow with reference number 100. The operating system expediently starts the execution of the personalization with a single predefined command, for example, an EXECUTE command, with or after an optional authorization check. Through the personalization, the individual personalization data is written from the initial memory addresses where the personalization information 26 was stored to target addresses defined by the non-personalized application data. The target addresses can, for example, define a file system.

[0042] When executing the personalization sequence, the individual personalization data can be linked together with the static configuration data 24 to make the chip module 10 uniquely identifiable and distinguishable from other chip modules and / or to establish the intended functionality of the chip module.

[0043] Fig. 3 schematically shows the steps of a method 100 for personalizing a chip module 10. In step 102, initialization data 22 are loaded into the memory 14 of the chip module 10. In step 104, the initialization data 22 are executed by the chip module 10, and the operating system 23 is started. In step 106, personalization information 26 containing individual personalization data is loaded into the memory 14 of the chip module 10 using the operating system 23. This step is performed after the operating system has been started, and the operating system executes this step 106. In step 108, the personalization sequences contained in personalization information 26 are executed by the operating system 23 on the chip module 10, thereby linking the individual personalization data with the non-personalized application data and thus with the chip module 10. The reference numeral 100 in Fig.2 indicates the entirety of the steps of the method 100, it being understood that the last step 108, in which the personalization sequence is carried out, links the individual personalization data to the chip module 10, ie transfers the personalization data into the relevant data structures of the chip module in order to enable the unique identifiability of the chip module and / or to establish the intended functionality of the chip module.

[0044] Additionally, it should be noted that "comprising" or "having" does not exclude other elements or steps, and "a" or "an" does not exclude a plurality. Furthermore, it should be noted that features or steps described with reference to one of the above embodiments may also be used in combination with other features or steps of other embodiments described above. Reference signs in the claims are not to be considered as limitations. List of reference symbols 10 chip module 12 processors 14 storage 16 Communication interface 20 data 22 Initialization data 23 Operating system 24 static configuration data 26 individual personalization information 100 procedures 102-108 Procedural steps QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] WO 2021 / 239 272 A1

[0006]

Claims

[1] Method (100) for personalizing a chip module (10), the method comprising the following steps: Loading initialization data (22) into a memory (14) of the chip module (10), wherein the initialization data (22) contains an operating system (23), non-personalized application data and static configuration data (24) for the chip module (10); wherein the operating system is configured to execute a personalization sequence, Executing the initialization data (22) by the chip module (10) and starting the operating system (23); Loading individual personalization information (26 - Blob) into the memory (14) of the chip module (10) using the (previously started) operating system (23), wherein the individual personalization information (26) contains at least one personalization sequence and individual personalization data; Executing the personalization sequence(s) contained in the personalization information (26) by the operating system (23) on the chip module (10), wherein the individual personalization data are linked to the non-personalized application data upon execution of the personalization sequence(s). [2] The method (100) of claim 1, further comprising the step: Checking a loading authorization before the individual personalization information (26) is written into the memory (14) of the chip module (10). [3] Method (100) according to one of claims 1 or 2, wherein the individual personalization information (26) is provided in an encrypted form for loading into the memory (14) of the chip module (10). [4] Method (100) according to claim 3, wherein the individual personalization information (26) on the chip module (10) is decrypted by the operating system (23) before being stored in the memory (14) and is then stored in the memory (14) in unencrypted form. [5] Method (100) according to claim 3, wherein the individual personalization information (26) is stored in encrypted form in the memory (14) by the operating system (23). [6] Method (100) according to one of claims 1 or 2, wherein the individual personalization information (26) is provided in an unencrypted form for loading into the memory (14) of the chip module (10). [7] Method (100) according to one of the preceding claims, checking a personalization authorization before the personalization sequence is executed by the operating system (23) on the chip module (10). [8] Method (100) according to one of the preceding claims, further comprising the step: Deleting the individual personalization information (26) from the memory (14) of the chip module (10) after executing the personalization sequence. [9] Method (100) according to one of claims 1 to 7, further comprising the step: Maintaining the loaded individual personalization information (26) in the memory (14) of the chip module (10) after executing the personalization sequence.

Images