SAFETY ELEMENT, METHOD FOR OPERATING A SAFETY ELEMENT AND METHOD FOR INSTALLING A GENERAL APPLICATION PROGRAM

Description

[0001] The invention relates to a security element for a mobile device. The security element has a main security area, a first profile security area configured to receive a first profile, and a second profile security area separate from the first profile security area and configured to receive a second profile. The main security area is configured to perform management functions for the profile security areas. The invention also relates to a method for operating a corresponding security element. The invention further relates to a method for installing an application program.

[0002] Security elements are well known. A security element can, for example, be designed as an eUICC (Embedded Universal Integrated Circuit Card) and integrated into a mobile device, such as a mobile phone.

[0003] The typical structure and operation of an eUICC is known from the technical specification "Remote Provisioning Architecture for Embedded UICC" (version 3.2, June 27, 2017) of the GSMA (GSM Association) and the further technical specification "Secure Element Access Control" (version 1.0.20, March 2014) of GlobalPlatform Inc.

[0004] According to these specifications, it is common for the eUICC to have an ISD-P1 with a first profile and an ISD-P2 with a second profile. For example, if the eUICC is operated with the first profile as the active profile, an application program from the ISD-P1 can be executed. However, if the eUICC is operated with the second profile as the active profile, an application program from the ISD-P2 can be executed.

[0005] Furthermore, when operating the eUICC, it is common for an ISD-P1 application program to be terminated when switching from the first profile of the ISD-P1 to the second profile of the ISD-P2. This prevents any eUICC application program from continuing.

[0006] From KR 101803084 B1, a security element is known that has a higher-level central security domain (ISD-R) and two or more lower-level profile security domains (ISP-P). Profiles for connecting to networks of different mobile operators are stored in the lower-level security domains. Only one profile security domain can be active at a time. One of the lower-level common security domains is implemented as a common security domain (ISD-P Common). Different state rules and access conditions apply to the common security domain than to the profile security domains. The common security domain is always active and cannot be deleted. Applications are installed in the common security domain, e.g., a financial application that can be used by the profiles.Due to the different state rules and access conditions, compatibility with the relevant standards cannot be easily guaranteed.

[0007] The object of the invention is to provide a security element, a method for operating a security element and a method for installing an application program, in which or with which an application program can be continued even when a profile is changed.

[0008] The problem is solved by a security element according to the independent claims.

[0009] A security element according to the invention is suitable for a mobile device. The security element has a main security area, a first profile security area which is configured to receive a first profile, and a second profile security area which is separate from the first profile security area and is configured to receive a second profile. The main security area is designed, in particular, only to carry out management functions for the profile security areas. As an important idea of ​​the invention, it is provided that the security element has a general security area configured to receive a general application program, which is designed separately from the profile security areas and is active when the first profile security area is active and also when, in particular instead of the first profile security area, the second profile security area is active.

[0010] The invention is based on the finding that it is expedient to continue executing an application program even when changing profiles, in particular from the first profile to the second profile. This is achieved by creating a general security area. The general security area is simultaneously active or in an active state with the first profile or the first profile security area, but also simultaneously active with the second profile or the second profile security area. Therefore, the general application program can also be executed without interruption when a profile change is performed, i.e., when changing from the first profile to the second profile, or from the second profile to the first profile.

[0011] In particular, the first profile security area is active when the first profile is active, and the second profile security area is active when the second profile is active.

[0012] In particular, the profile security areas are configured in such a way that only one profile area can be active at a time. Therefore, when switching from the first profile to the second, the first profile is deactivated and the second profile is activated. The advantage is that the general application program can continue to run through the general security area despite the profile change.

[0013] The safety element can also have more than two profile safety areas.

[0014] In particular, the general security area is profile-independent. Furthermore, the general security area is designed to be profile-free, meaning the general security area has no profile. The general security area is therefore not designed as an emergency profile area, which can be used if none of the profile security areas is available.

[0015] The security element is designed, in particular, as an eUICC (Embedded Universal Integrated Circuit Card). The mobile device is designed, in particular, as a mobile terminal, preferably a smartphone or Internet of Things device.

[0016] The respective profile is designed in particular as a combination of a file structure, data and applications that are provided on the security element or are intended to be present on it and that, when activated, enable access to a specific mobile network infrastructure.

[0017] Preferably, the general security area contains the general application program, and the general application program remains active even if a profile change is performed. This is advantageous because a task that was performed by the general application program before the profile change can continue to be executed after the profile change, particularly without interruption. This prevents a restart of the general application program.

[0018] Furthermore, it is preferably provided that the general application program is designed as a contactless registry service. The contactless registry service (CRS) can operate faster and more reliably if it runs without interruption. Depending on the contactless registration service, for example, a payment transaction can be carried out. This payment transaction can now also be carried out during a profile change. According to the invention, the general security area is encompassed by the main security area. Advantageously, no further, separate area needs to be created to execute the general application program. The general application program can then be executed in the main security area.

[0019] Furthermore, it is preferably provided that the security element has a main control authority, which has respective access information for the profile security areas, and a general control authority, which has access information for the general security area. The main control authority is designed in particular as an ECASD (eUICC Controlling Authority Security Domain). Furthermore, the main control authority is responsible in particular for the secure storage of login information required to support the required security areas or security domains of the security element. The general control authority can, for example, be referred to as a CASD (Controlling Authority Security Domain). The general control authority is responsible in particular for the secure storage of login information required to support the general security area.

[0020] Furthermore, it is preferably provided that the general control instance is designed separately from the main control instance of the security element. The separate design of the general control instance makes the security element more secure. The login information for the general security area can now be stored and adapted independently of the login information for the other security areas, in particular the profile security areas.

[0021] Alternatively, it can also be provided that the general control instance is included in the main control instance of the security element. The advantage here is that the main control instance can be used at least partially by the general control instance.

[0022] Furthermore, it is preferably provided that the security element has an access rule application master, which has an interface for exchanging access rules for at least one further application program of the security element with the mobile device, and that the access rule application master is arranged in the general security area. The access rule application master is designed, in particular, as an ARA-M (Access Rule Application Master). In particular, the security element has only a single access rule application master. A card issuer or security element issuer defines access control rules for the applications of the security element and delivers these rules to the access rule application master (ARA-M). In particular, the access rule application master is responsible for retrieving all available access rules upon a request from an access control enforcer on the mobile device.Placing the access rule application master in the general security area ensures that the access rule application master is available for all profile security areas and the general security area. Furthermore, the access rule application master is only present in an active state once in the security element.

[0023] Furthermore, it is preferably provided that the security element has an access rule file area formed outside the profile security areas, and at least one access rule for a profile application program of one of the profile security areas is arranged in the access rule file area. The access rule file area is designed in particular as a PKCS#15 file structure (PKCS - Public Key Cryptographic Standards) and in particular has access rule files (ARF - Access Rule Files). By storing the at least one access rule in the access rule file area, the profile security area can also be designed to be access rule application client-free, i.e., without an access rule application client (ARA-C - Access Rule Application Client). The required access rule can then be provided to the profile security area via the access rule file area.

[0024] Furthermore, it is preferably provided that the access rule of the profile application program of the respective profile security area is arranged in the access rule file area if the respective profile security area is designed to be free of access rule application clients. The arrangement of the access rule in the access rule file area is preferably provided if the respective profile security area is designed to be free of access rule application clients, ie, the respective profile security area does not have an access rule application client.

[0025] The invention also relates to a method for operating a security element, in which the following steps are carried out: Operating the security element with a first profile of the security element; executing a general application program of the security element, in particular in a general security area of ​​the security element, while the security element is operated with the first profile of the security element; switching from the first profile to a second profile of the security element, in particular by activating the second profile and deactivating the first profile; and operating the security element with the second profile while the general application program is executed, in particular continuously.

[0026] Continuous execution means in particular that the general application program is executed continuously or without interruption.

[0027] The general application program is executed in a general security area which is encompassed by the main security area of ​​the security element.

[0028] Furthermore, it is preferably provided that the general application program is executed depending on access information for the general security area and the access information is provided by a general control instance of the security element, in particular one that is different from a main control instance of the security element.

[0029] Furthermore, it is preferably provided that the general application program is executed depending on at least one access rule and the access rule is provided by an access rule application master which is arranged in the general security area and has an interface for exchanging at least one further application program of the security element with a mobile device comprising the security element.

[0030] Furthermore, it is preferably provided that the first profile security area has the first profile and the second profile security area has the second profile. For example, the respective profile security area has the corresponding profile after it has been installed by a profile provider.

[0031] The invention also relates to a method for installing a general application program, in which the following steps are carried out: Providing the general application program by a distribution device; in particular, requesting the general application program from the distribution device by a security element; distributing the general application program to the security element; and installing the general application program in a general security area of ​​the security element.

[0032] The distribution device is designed, in particular, as a central or distributed server device. Through distribution, the general application program is transmitted, in particular at least in sections, wirelessly from the distribution device to the security element or to a mobile device with the security element.

[0033] The preferred embodiments and their advantages presented with reference to the respective method according to the invention apply accordingly to the security element according to the invention. The physical components of the security element according to the invention are each designed to carry out the respective steps of the respective method.

[0034] Further features of the invention emerge from the claims, the figures and the description of the figures.

[0035] Embodiments of the invention are explained in more detail below with reference to a schematic drawing.

[0036] Showing: Fig. 1 shows a schematic representation of an embodiment of a security element according to the invention with a general security area; and Fig. 2 shows a schematic representation of a further embodiment of the security element with an access rule application master in the general security area.

[0037] In the figure, identical or functionally identical elements are given the same reference symbols.

[0038] Fig. 1 shows a schematic representation of a security element 1. According to the exemplary embodiment, the security element 1 is designed as an eUICC (Embedded Universal Integrated Circuit Card).

[0039] Furthermore, Fig. 1 a mobile device 2 with an access control enforcer 3. According to the exemplary embodiment, the mobile device 2 is embodied as a mobile terminal, in particular as a smartphone. However, the mobile device 2 can also be embodied as an Internet of Things (IoT) device. The access control enforcer 3 retrieves the access rules from the security element 1 and applies these rules to restrict access of a device application of the device 2 to various applications of the security element 1.

[0040] The security element 1 has a main security area 4, a first profile security area 5 and a second profile security area 6.

[0041] According to the exemplary embodiment, the main security area 4 is configured as an ISD-R (Issuer Security Domain Root). The main security area 4 is particularly responsible for creating a new profile security area and for lifecycle management of all profile security areas of the security element 1. In particular, there should only be one main security area 4 on the security element 1. The main security area 4 is installed and personalized by the manufacturer of the security element 1, in particular during security element production. The main security area 4 is particularly associated with itself. In particular, the main security area 4 cannot be deleted or deactivated.

[0042] According to the exemplary embodiment, the profile security domains 5, 6 are configured as ISD-P (Issuer Security Domain Profiles). The respective profile security domain 5, 6 is used in particular for a profile download and installation in cooperation with the profile packet interpreter for decoding or interpreting a received profile packet.

[0043] The first profile area 5 has a first profile 7. The second profile area 6 has a second profile 8. According to the exemplary embodiment, the respective profile 7, 8 comprises a profile file system 23 and profile application programs 22. In particular, one of the profile application programs 22 is only executed if the associated profile 7, 8 is active.

[0044] Furthermore, the security element 1 according to the embodiment has an operating system 9.

[0045] According to the exemplary embodiment, the security element 1 also has a general security area 11. The general security area 11 is designed to accommodate a general application program 10. According to the exemplary embodiment, the general security area 11 has the application program 10. According to the exemplary embodiment, the general security area 11 is not shown separately from the main security area 4 according to the invention.

[0046] The general security area 11 is designed to be accessible when the first profile 7 is active. However, the general security area 11 is also designed to be accessible when the second profile 8 is active. The general application program 10 can therefore operate continuously during a profile change, for example, when changing from the first profile 7 to the second profile 8.

[0047] In addition, the general security area 11 only requires the general application program 10 to be installed once. Without the general security area 11, as is the case with known eUICCs, for example, a known application program would have to be installed for the first profile 7 and again for the second profile 8, so that the known application program is deactivated or terminated in the first profile security area 5 after the profile change and activated or restarted after an interruption in the second profile security area 6.

[0048] According to the exemplary embodiment, the general application program 10 is embodied as a contactless registration service 12. Another form of the general application program 10 is embodied as a PPSE 13 (Proximity Payment System Environment) according to the exemplary embodiment. The PPSE on the security element 1 includes, in particular, a list of all applications supported by a contactless interface of the security element 1 or the mobile device 2.

[0049] Furthermore, according to the exemplary embodiment, the security element 1 has a main control authority 14, which provides access information 15 for the respective profile security area 5, 6. The main control authority 14 is designed, in particular, as an ECASD. Separated from the main control authority 14, the security element 1 also has, according to the exemplary embodiment, a general control authority 16. The general control authority 16 provides access information 17 for the general security area 11.

[0050] The security element 1 has according to Fig. 2an access rule application master 18, an access rule application client 19, and an access rule file area 20. The access rule application master 18 is particularly designed as an ARA-M. The access rule application client 19 is particularly designed as an ARA-C. The access rule file area 20 is particularly designed as a PKCS#15 and, according to the exemplary embodiment, has at least one access rule 21 for at least one of the profile application programs 22 and / or the general application program 10. The access rule is particularly designed as an ARF.

[0051] In particular, only the first profile security area 4 is configured with the access rule application client 19, and the second profile security area 5 is configured without the access rule application client 19. The respective access rule 21 for one of the profile application programs 22 of the second profile area is then provided by the access rule file area 20 as a substitute. This allows a profile security area to be provided with access rules 21 even without the access rule application client 19.

[0052] The access rule file area 20 can be arranged in the respective profile area 5, 6 and / or outside the respective profile area 5, 6 in the security element 1.

Claims

1. Security element (1) for a mobile device (2), having a main security area (4), a first profile security area (5) that is configured to receive a first profile (7), and a second profile security area (6), separate from the first profile security area (5) and configured to receive a second profile (8), wherein the main security area (4) is designed to perform management functions for the profile security areas (5, 6), wherein the security element (1) has a general security area (11) that is configured to receive a general application program (10), is formed separately from the profile security areas (5, 6) and is active when the first profile security area (5) is active and also when the second profile security area (6) is active, characterized in that the general security area (11) is contained within the main security area (4) and the general application program (10) is executed in the main security area (4).

2. Security element (1) according to Claim 1, wherein the general security area (11) contains the general application program (10), and the general application program (10) is also active if a profile change is performed.

3. Security element (1) according to Claim 2, wherein the general application program (10) is in the form of a contactless registry service.

4. Security element (1) according to one of the preceding claims, wherein the security element (1) has a main control instance (14) that has respective access information (15) for the profile security areas (5, 6), and a general control instance (16) that has access information (17) for the general security area (11).

5. Security element (1) according to Claim 4, wherein the general control instance (16) is formed separately from the main control instance (14) of the security element (1).

6. Security element (1) according to one of Claims 1 to 5, wherein the general control instance (16) is contained within the main control instance (14) of the security element (1).

7. Security element (1) according to one of the preceding claims, wherein the security element (1) has an access rule application master (18) that has an interface for exchanging access rules (21) for at least one further application program (22) of the security element (1) with the mobile device (2), and the access rule application master (18) is arranged in the general security area (11).

8. Security element (1) according to one of the preceding claims, wherein the security element (1) has an access rule file area (20) formed outside the profile security areas (5, 6), and at least one access rule (21) for a profile application program (22) of one of the profile security areas (5, 6) is arranged in the access rule file area (20) .

9. Security element (1) according to Claim 8, wherein the access rules (21) of the profile application program (22) of the respective profile security area (5, 6) are arranged in the access rule file area (20) if the respective profile security area (5, 6) is formed so as to be free from any access rule application client.

10. Security element (1) according to one of the preceding claims, wherein the first profile security area (5) contains the first profile (7) and the second profile security area (6) contains the second profile (8).