Methods for loading a communication profile into a secure element, and associated secure element, profile management unit, and communication device

Abstract

The present invention relates to methods for loading a communication profile into a secure element (SE), as well as an associated secure element (SE), a profile management unit (LPA), and a communication device (APP). More particularly, the present invention relates to a method implemented by a secure element (SE) equipping a communication device (APP), the method comprising, for a communication profile, a first phase of loading the profile into the secure element (SE) comprising: following receipt of a loading suspension command from the profile management unit, a suspension of the loading of the profile comprising: a recording of the generated session keys (S-ENC, S-MAC); and a sending, to the profile management unit (LPA), of a token (PTK) signed by the secure element (SE). Figure for abstract: Fig. 2B

Description

Title of the invention: Methods for loading a communication profile into a secure element, and associated secure element, profile management unit, and communication device Technical field

[0001] The present invention relates to the field of secure elements of the eUICC type (for "embedded Universal Integrated Circuit Card" in English) in which communication profiles are recorded. In particular, the present invention relates to methods for loading a communication profile into a secure element, as well as an associated secure element, a profile management unit, and a communication device. The present invention finds a particularly advantageous, although in no way limiting, application for loading and installing communication profiles in secure elements of the eUICC type integrated into communication devices using mobile telephone networks, such as telephones, connected objects, vehicles, etc. Prior art

[0002] The invention is placed in particular in the particular context of the installation of communication profiles in secure elements of the eUICC type integrated into communication devices, for example telecommunications terminals of the smart phone type (or "smartphones" in English), communicating electricity or water meters, vehicles. Secure elements of the eUICC type are described in the GSMA SGP.02 standard entitled "Remote Provisioning Architecture for Embedded UICC", for example in its version 4.2.1 published in November 2021.

[0003] eUICC secure elements are permanently integrated into communication devices to replace removable physical SIM cards, traditionally used to authenticate a user to the operator of a mobile telephone network. eUICC secure elements are configured to store one or more communication profiles and are reprogrammable. These secure elements allow, for example, a user to change operator without having to physically replace a SIM card.

[0004] As is known, a communication profile is a set of data enabling authentication with an operator of a communication network and communication on this network. Typically, a communication profile includes subscription data such as an IMSI (International Mobile Subscriber Identity) identifier, encryption keys and authentication algorithm parameters specific to the associated operator. It may also include a file system, applications, and / or predetermined execution rules. Such communication profiles are notably defined in the aforementioned GSMA SGP.02 standard and the Trusted Connectivity Alliance standard entitled “eUICC Profile Package: Interoperable Format Test Specification”, for example in its version 3.2.1 published in December 2022.

[0005] In the current state of the art, communication profiles are in particular loaded and installed in secure elements by manufacturers of communication devices ("In-Factory Profile Loading" in English). The installation of a profile in an eUICC type secure element is in particular defined by the GSMA SGP.02 standard cited above or by the GSMA SGP.22 standard entitled "RSP Technical Specification", for example in its version 3.0 published in October 2022. A manufacturer of communication devices may for example have communication profiles provided in advance by a profile provision server (i.e. the SM-DP+ server in the aforementioned GSMA SGP.22 standard) and install these profiles in the factory in the secure elements integrated in the communication devices. The advantage of such an installation is that once the device leaves the factory, it is able to communicate on the network and access the operator's services.

[0006] However, installing a communication profile in a secure element equipping a communication device requires a particularly long time. In fact, according to the GSMA standard, a profile is sent to a secure element in the form of a plurality of profile elements defined according to the standard named ASN. 1 and / or according to the aforementioned Trusted Connectivity Alliance standard, these profile elements being encrypted. The reception, decryption, and installation of the profile elements by the secure element are time-consuming operations. On the scale of thousands or millions of communication devices, the time required to install the communication profiles in the secure elements in the factory is such that it does not allow efficient use of the manufacturer's resources and leads to a significant loss of productivity.

[0007] Ultimately, existing solutions for loading and installing communication profiles in secure elements integrated into communication devices in the factory are not fully satisfactory in that they require excessive time. Statement of the invention

[0008] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0009] To this end, a method is proposed implemented by a secure element equipping a communication device, the method comprising, for a communication profile nication, a first phase of loading the profile into the secure element including: - a reception, from a profile management unit of the communication device, of a public key of a profile provision server associated (uniquely) with the profile; - generation of session keys from the public key of the profile provision server associated with the profile; - following receipt of a loading suspension command from the profile management unit, a suspension of the loading of the profile comprising: • a recording, in a memory of the secure element, of the generated session keys; and • sending, to the profile management unit, a token signed from an encryption key of the secure element.

[0010] The proposed method implemented by the secure element is a method for loading at least one communication profile into the secure element.

[0011] Correlatively, a method is proposed implemented by a profile management unit of a communication device, the method comprising, for a communication profile, a first phase of loading the profile into a secure element equipping the communication device comprising: - a recording, in a memory of the communication device, of encrypted elements of the profile provided by a profile provision server; - sending, to the secure element, a public key from the profile provision server associated (uniquely) with the profile; - sending a loading suspension command to the secure element; and - a recording, in the memory of the communication device, of a token received from the secure element and signed by the secure element using an encryption key of the secure element.

[0012] The proposed method implemented by the profile management unit is a method for loading at least one communication profile into the secure element.

[0013] The present invention proposes loading into the memory of the communication device an encrypted profile provided by a profile provision server (e.g. the SM-DP+ server) and initiating the loading of the profile into the secure element. Then, the loading of the profile is suspended (i.e. paused) so that: on the one hand, the communication device includes in memory the encrypted elements of the profile as well as the token signed by the secure element; and that, on the other hand, the secure element includes in memory the session keys associated with the profile and making it possible to de- encrypt this profile.

[0014] In this way, the proposed solution not only allows an encrypted profile to be loaded into the memory of the communication device, but also allows the profile stored in the communication device to be cryptographically linked to the secure element intended to receive this profile. In particular, the secure element generates the session keys using the public key of the profile provisioning server associated with this profile, and then saves these keys. This ensures that the secure element is involved in loading this profile. Furthermore, the communication device saves both the encrypted elements of the profile and the token signed by the secure element, the signature of the token making it possible to prove the involvement of the secure element in loading this profile.

[0015] Following the suspension of the loading of the profile, the communication device has all the information allowing it to complete the installation of the profile in the secure element. In other words, the communication device does not require additional information, in particular provided by the network, to complete the installation of the profile. The present invention thus makes it possible, in a manner similar to the prior art solutions described above, to supply communication devices at the factory that are capable of accessing the services of an operator.

[0016] On the other hand, compared to these solutions, the present invention makes it possible to significantly reduce the time required to load a communication profile into a secure element of a communication device in the factory, which makes it possible to increase the productivity of the production line of a communication device manufacturer. In fact, the proposed solution makes it possible to relocate the loading and installation of the profile into the secure element to a later stage, for example once the communication device has been deployed. This makes it possible to relocate these time-consuming operations outside the factory for a manufacturer, while maintaining the same level of security.

[0017] Thus, the present invention makes it possible to provide in a minimal time communication devices capable of accessing the services of an operator, while ensuring that each communication profile is effectively linked to the secure element intended to install this profile.

[0018] According to a particular implementation mode, the suspension of the loading of the profile is triggered following the generation, by the secure element, of the session keys and before a reception, by the secure element, of encrypted elements of the profile.

[0019] According to this mode of implementation, the loading of the profile into the secure element is suspended following the generation of the session keys by the secure element using the public key of the profile provisioning server associated with this profile. This makes it possible to ensure that the secure element has been cryptographically involved in the

[0020]

[0021]

[0022]

[0023]

[0024]

[0025]

[0026] profile loading. In addition, loading is suspended here before loading and installing the encrypted elements of the profile into the secure element, i.e. before time-consuming operations for a manufacturer. This mode of implementation is particularly advantageous in that it makes it possible to minimize the loading time of the profile produced in the factory by a manufacturer of communication devices, while ensuring that the profile recorded in the communication device is cryptographically linked to the secure element intended to install this profile. According to a particular implementation mode, the token signed by the secure element is sent to the profile provision server or a third-party server. Sending the token signals to a third party, for example the network operator associated with the communication profile, that the profile has been loaded into a communication device. Signing the token by the secure element also provides proof to the third party that the profile has been loaded into the communication device including the secure element that is actually intended to receive this profile. According to a particular implementation mode, the method implemented by the secure element comprises a second phase of loading the profile comprising, following receipt of a loading resume command from the profile management unit: - a reception, from the profile management unit, of the token and encrypted elements of the profile; and - decryption of the encrypted profile elements from the saved session keys and installation of the decrypted profile elements into the secure element memory. Correlatively, according to a particular implementation mode, the method implemented by the profile management unit comprises a second phase of loading the profile comprising: - sending, to the secure element, a command to resume loading; and - sending, to the secure element, the token and encrypted elements of the profile. It is proposed here to carry out a second loading phase to complete the installation of the profile in the secure element and to activate it. At the end of this second loading phase, the communication device can then access the services of the network operator associated with the profile. It should be noted that the exchange of the token between the communication device and the secure element contributes to ensuring the security of the proposed solution for loading a profile into the secure element. Indeed, the secure element can verify the signature of the token and therefore its prior involvement during the first phase of loading the profile. This also makes it possible to verify that the encrypted profile elements, provided by the management unit and intended to be installed, are actually associated with the recorded session keys.

[0027] Furthermore, no limitation is attached to the time interval between the first and second charging phases, nor to the operations performed by the device between them. In particular, the second charging phase can be performed following deployment of the communication device, i.e. outside the manufacturer's factory.

[0028] As indicated above, the communication device has, once the loading of the profile is suspended, all the information necessary to complete the installation of the profile. The communication device could, for example, complete the loading of the profile while being offline (i.e. not connected to the network).

[0029] According to a particular implementation mode, the second loading phase (i.e. sending the loading resume command) is triggered by: a power-up (i.e. a start-up or “power-up” in English) of the communication device; a network access request from the communication device; an activation command obtained via a user interface; an activation command issued by a third-party server; or a change in an operating mode of the communication device (e.g. exiting a factory mode).

[0030] This mode of implementation makes it possible to precisely control the resumption of loading of the communication profile in the secure element and therefore the activation of the profile.

[0031] According to a particular embodiment, the method comprises, following the first loading phase and before the second loading phase, a power-down (i.e. a shutdown or "power-down" in English) and a power-up (i.e. a start-up or "power-up" in English) of the communication device. In addition, the second loading phase (i.e. the sending of the loading resume command) can be triggered by: the power-up of the communication device; or by a network access request following the power-up.

[0032] This mode of implementation makes it possible in particular to relocate the installation of the communication profile and its activation to a later stage, for example when the communication device is deployed in the field, i.e. outside the manufacturer's factory.

[0033] According to a particular implementation mode, another token signed by the secure element is sent to the profile supply server following the installation of the decrypted elements of the profile or to a third-party server.

[0034] This mode of implementation makes it possible to signal to the profile provision server (i.e. the SM-DP+ server), and in particular to the network operator associated with the communication profile, that the installation of the communication profile in the secure element has been completed and that this profile is activated.

[0035] According to a particular implementation mode, the method implemented by the secure element comprises, for another communication profile (distinct from the profile mentioned above), a said first phase of loading the other profile, and may further comprise a said second phase of loading the other profile.

[0036] Correlatively, according to one mode of implementation, the method implemented by the management unit comprises a said first phase of loading the other profile, and may further comprise a said second phase of loading the other profile.

[0037] Thus, the method implemented by the secure element and the method implemented by the profile management unit may respectively comprise, for each profile of a plurality of profiles, a said first phase and a said second phase of loading the profile.

[0038] This mode of implementation is particularly advantageous in that it allows a plurality of communication profiles to be loaded into the communication device.

[0039] According to a particular implementation mode, the loading suspension command and the public key of the profile supply server are included in the same message.

[0040] According to this mode of implementation, the management unit signals to the secure element from the start of loading the profile that the loading of the profile will be suspended. This makes it possible in particular to minimize the number of messages exchanged between the management unit and the secure element. As a result, this mode of implementation makes it possible to minimize the duration of the first loading phase.

[0041] Alternatively, the loading suspension command may be included in a dedicated message sent by the management unit to the secure element, which makes it possible to precisely control the suspension of the loading of the profile. For example, the loading suspension command may be issued by the profile management unit in response to a message from the secure element signaling that the session keys have been generated.

[0042] According to one aspect of the invention, there is also proposed a method implemented by the communication device for loading at least one communication profile into a secure element equipping the communication device, this method comprising: the steps of the method implemented by the secure element according to the invention; and the steps of the method implemented by the profile management unit according to the invention.

[0043] According to one aspect of the invention, a secure element is proposed comprising: - a module for receiving, from a profile management unit of a communication device, a public key of a profile provision server associated (uniquely) with the profile; - a module for generating session keys from the public key of the profile provision server associated with the profile; - a module for suspending a profile load following reception from a loading suspension command from the profile management unit, the suspension module comprising: • a recording module, in a memory of the secure element of the generated session keys; and • a module for sending, to the profile management unit, a token signed from an encryption key of the secure element.

[0044] The secure element may be configured to implement each of the modes of implementation of the method according to the invention. In particular, for each step of a method according to the invention, the proposed secure element may comprise a corresponding module configured to implement said step.

[0045] Correlatively, there is proposed a communication profile management unit of a communication device comprising: - a module for recording, in a memory of the communication device, encrypted elements of the profile provided by a profile supply server; - a module for sending, to a secure element equipping the communication device, a public key from the profile supply server associated (uniquely) with the profile; - a module for sending a loading suspension command to the secure element; and - a module for recording, in the memory of the communication device, a token received from the secure element and signed by the secure element using an encryption key of the secure element.

[0046] The profile management unit may be configured to implement each of the modes of implementation of the method according to the invention. In particular, for each step of a method according to the invention, the proposed profile management unit may comprise a corresponding module configured to implement said step.

[0047] According to one aspect of the invention, there is provided a communication device comprising a secure element according to the invention and / or a profile management unit according to the invention.

[0048] According to one aspect of the invention, there is provided a computer program comprising instructions for executing the steps of a method according to the invention, when said program is executed by at least one processor.

[0049] More particularly, a first computer program is proposed comprising instructions for executing the steps of a method implemented by a secure element, when said program is executed by at least one processor. A second computer program is also proposed comprising instructions for executing the steps of a method implemented by a management unit. profile according to the invention, when said program is executed by at least one processor. In addition, a set of computer programs comprising the first and second computer programs is provided.

[0050] In the context of the invention, a computer program may be formed of one or more sub-parts stored in the same memory or in separate memories. The program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0051] According to one aspect of the invention, there is provided an information medium readable by a processor or a computer and on which is recorded a computer program in accordance with the invention or a set of computer programs in accordance with the invention.

[0052] The information carrier may be any entity or device capable of storing the program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM. Furthermore, the information carrier may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0053] The secure element, the profile management unit, the communication device, the computer program, and the information medium proposed have the advantages described above in connection with the methods implemented by the secure element and the profile management unit. Brief description of the drawings

[0054] Other characteristics and advantages of the present invention will emerge from the description provided below, illustrating modes of implementation of the invention given by way of example and without any limiting character, with reference to the attached drawings:

[0055] [Fig.l] ([Fig.l]) represents an example of hardware architecture of a communication device equipped with a secure element according to an embodiment of the invention;

[0056] [Fig.2A] ([Fig.2A]), [Fig.2B] ([Fig.2B]), and [Fig.2C] ([Fig.2C]) represent a communication device equipped with a secure element during different steps of a method implemented by the secure element and of a method implemented by a profile management unit of the communication device according to an embodiment of the invention; and

[0057] [Fig.3A] ([Fig.3A]) and [Fig.3B] ([Fig.3B]) represent, in flowchart form, steps of a method implemented by a secure element equipping a communication device and of a method implemented by a profile management unit of the communication device according to an embodiment of the invention. Description of the embodiments

[0058] The present invention applies, in particular, to the installation of a communication profile in a secure element of eUICC type integrated into a communication device. The following description of the invention will refer to this particular context, which is given only as an illustrative example and should not limit the invention.

[0059] We introduce below, with reference to [Fig.l], the architecture of the communication device equipped with a secure element according to an example. We then describe, with reference to Figures 2A-2C and 3A-3B, a mode of implementation of a method implemented by the secure element of the communication device, and of a method implemented by a profile management unit of a communication device. These two methods also form a method for loading at least one communication profile into a secure element equipping a communication device.

[0060] The secure element may be configured to implement the method mentioned above. A profile management unit will also be described, configured to implement the other method.

[0061] [Fig.l] represents an example of hardware architecture of a communication device equipped with a secure element according to an embodiment of the invention.

[0062] The communication device APP comprises, according to the embodiment illustrated by [Fig.l]: a secure element SE; a non-volatile memory MEM_APP; and a processing unit or processor PROC_APP. The APP device may, for example, be a mobile phone, a tablet, a personal computer, a sensor equipped with a communication module, or any other communication device.

[0063] More particularly, the APP device has the hardware architecture of a computer. The memory MEM_APP constitutes an information medium in accordance with the invention, readable by the processor PROC_APP, on which is recorded a computer program PROG_APP in accordance with one aspect of the invention. The program PROG_APP comprises instructions for carrying out steps of a method implemented by an LPA profile management unit (shown in Figures 2A-2C) of the APP device, when the PROG_APP program is executed by the PROC_APP processor. In addition, the PROG_APP program defines in particular an LPA profile management unit and the associated functional modules, which rely on or control the hardware elements of the APP device.

[0064] It should be emphasized that, for each of the steps or operations described below and implemented by the LPA profile management unit, the latter may comprise a corresponding module configured to implement said step or operation.

[0065] As illustrated by [Fig.l], the APP device has a communication module COM_APP configured to communicate with the secure element SE. The communication module COM_APP is further configured to communicate, via a communication network R (e.g. a mobile telephone network), with other communication devices (not shown in [Fig.l]), such as servers. No limitation is attached to the nature of the communication interfaces between the APP device and the communication network R.

[0066] The secure element SE comprises, according to the embodiment illustrated by [Fig.l]: a non-volatile memory MEM_SE; and a processing unit or processor PROC_SE.

[0067] The secure element SE equips the communication device APP. It can in particular be permanently integrated into this device, for example by welding. We consider below that the secure element SE is an element of the eUICC type according to the aforementioned GSMA SGP.02 or GSMA SGP.22 standard. It should nevertheless be noted that the invention applies to any type of secure element, including secure elements other than eUICC elements but which also allow the storage of profiles in a secure manner.

[0068] In the context of the invention, a secure element is an electronic device (e.g. a circuit) configured to process and store data securely, i.e. in compliance with the security rules and requirements set by trusted authorities. More specifically, a secure element implements an operating system, protected against unauthorized access, and configured to execute a set of computer programs and to store confidential data.

[0069] As illustrated in [Fig.l], the memory MEM_SE of the secure element SE is intended to store at least one communication profile P. The memory MEM_SE comprises in particular one or more secure domains (commonly noted ISD-P, not shown) respectively intended to contain a communication profile P. We detail below the loading of the communication profile P into the memory MEM_SE of the secure element SE with reference to figures 2A-2C and 3A-3B.

[0070] More particularly, the secure element SE has the hardware architecture of a computer. The memory MEM_SE associated with the secure element SE constitutes an information medium in accordance with one aspect of the invention, readable by the processor PROC_SE, on which is recorded a computer program PROG_SE in accordance with the invention. The program PROG_SE comprises instructions for carrying out steps of a method implemented by the secure element SE equipping the device APP, when the program PROG_SE is executed by the processor PROC_SE. In addition, the program PROG_SE defines the functional modules of the secure element SE, which rely on or control the hardware elements of the latter.

[0071] Note that, for each of the steps or operations described below and implemented by the secure element SE, the latter may comprise a corresponding module configured to implement said step or operation.

[0072] As illustrated by [Fig.l], the secure element SE has a communication module COM_SE configured to communicate with the communication device APP. The communications between the secure element SE and the device APP may for example comply with the ISO 7816 standard, and more particularly with the ISO 7816-3 standard (published in November 2006) and the ISO 7816-4 standard (published in May 2020).

[0073] The architectures of the communication device APP and of the secure element SE having been presented, we now describe the method proposed for loading a communication profile P into the memory MEM_SE of the secure element SE.

[0074] [Fig.2A], [Fig.2B], and [Fig.2C] represent a communication device equipped with a secure element during different steps of a method implemented by the secure element and of a method implemented by a profile management unit of the communication device according to an embodiment of the invention.

[0075] As indicated previously, the present invention makes it possible to load a communication profile P into the secure element SE of the APP device introduced with reference to [Fig.l],

[0076] The present invention aims in particular to reduce the time required for a manufacturer to factory load a profile into a secure element of a communication device (“In-Factory Profile Loading” in English).

[0077] To do this, the present invention proposes to factory load the installation package BPP (i.e. an installation package, or “Bound Profile Package” in English) of the profile P into the APP device and to initiate the loading of the profile P. Then, the loading of the profile P is suspended (i.e. paused) so that the profile recorded in the APP device is cryptographically linked to the secure element SE intended to receive this profile.

[0078] Following the suspension of the profile loading, the APP device has all the information allowing it to complete the installation of the P profile in the SE secure element. The proposed solution makes it possible to relocate the loading and the installation of the P profile in the SE secure element, i.e. time-consuming operations for the manufacturer, while maintaining the same level of security.

[0079] Therefore, the proposed method comprises: a first loading phase illustrated by [Fig.3A] (for example, carried out in the factory); and a second loading phase illustrated by [Fig.3B] (for example, carried out once the APP device is deployed in the field).

[0080] We describe below the proposed method with reference to Figures 3A and 3B. In addition, we also describe Figures 2A, 2B, and 2C, which respectively represent the communication device APP: before the first loading phase S100; between the first phase S100 and the second loading phase S200; and following the second loading phase S200.

[0081] It is important to note that the method proposed for loading the profile P into the secure element SE is implemented by the APP device and comprises: the steps of a method implemented by the secure element SE equipping the APP device; and the steps of a method implemented by a profile management unit LPA of the APP device.

[0082] The proposed method can implement all or part of the steps of the sub-procedure for installing a profile compliant with the GSMA SGP.22 standard. The following description of the invention will refer to this installation sub-procedure as an illustrative and non-limiting example, the invention obviously applying to other procedures for installing a profile in a secure element.

[0083] In addition, we describe below an example of implementation of the invention in which the local profile assistant (i.e. the "Local Profile Assistant" in English in the GSMA SGP.22 standard) is implemented by the profile management unit LPA of the communication device APP. However, the invention is not limited to this example, and it also applies to embodiments in which the local profile assistant module would be implemented by the secure element SE.

[0084] [Fig.3A] and [Fig.3B] represent, in flowchart form, steps of a method implemented by a secure element equipping a communication device and of a method implemented by a profile management unit of the communication device according to an embodiment of the invention.

[0085] Below we describe steps involving data exchanges between different entities, including the FCT_SRV server, the LPA profile management unit, and the SE secure element. Each of these data exchange steps is implemented by the two entities communicating with each other. For the sake of brevity, we describe these data exchange steps from the perspective of a single entity (e.g. the sender); but the other entity (e.g. the receiver) also implements a corresponding step. For example, a data sending step by the LPA profile management unit LPA profile will correspond to a step of reception of this data by the SE secure element. Similarly, we use hereinafter a single reference sign to designate such a step of data exchange implemented by the two entities which communicate with each other (for example, a single reference sign can be used to designate both the sending by the LPA profile management unit, and the reception by the SE secure element).

[0086] [Fig.3A] illustrates the first phase S100 of loading the communication profile P into the secure element SE. As illustrated by this figure, the first loading phase S100 comprises all or part of the steps S110 to S190 described below.

[0087] As illustrated by [Fig.2A], before implementing the proposed method, a factory server FCT_SRV comprises a BPP installation package of the profile P provided by an SM-DP+ profile provision server. The BPP installation package notably comprises a public key PK.DP of the SM-DP+ server and encrypted elements xPE associated with the profile P.

[0088] In step SI 10, the factory server FCT_SRV sends the BPP installation package to the APP device, the APP device saving it in its non-volatile memory MEM_APP. In other words, the FCT_SRV server loads the BPP installation package into the APP device.

[0089] Note that, during the first loading phase S100, the factory server FCT_SRV is not necessarily connected to the SM-DP+ server (i.e. non-connected mode). The BPP installation package of the profile P can be previously generated by the SM-DP+ server and provided to the factory server FCT_SRV.

[0090] Alternatively, an embodiment could be envisaged in which the APP device would receive the BPP installation package directly from the SM-DP+ server.

[0091] In step S120, the profile management unit LPA sends, to the secure element SE, an initialization command CMD_LBPP for loading the profile P. The command CMD_LBPP comprises initialization data including in particular the public key PK.DP of the profile supply server SM-DP+. In particular, the public key PK.DP of the server SM-DP+ is a single-use key associated with the profile P.

[0092] During this step, the LPA profile management unit performs, for example, step [1] of the profile installation sub-procedure as specified in the GSMA SGP.22 standard.

[0093] In step S130, the secure element SE initiates the loading of the profile P. The secure element thus generates session keys S-ENC, S-MAC associated with the profile P from the public key PK.DP of the server SM-DP+. This step, and in particular the generation of the session keys, makes it possible to ensure that the secure element SE is involved in loading the P profile.

[0094] The S-ENC, S-MAC session keys are for example generated in the following manner. An elliptic curve key negotiation algorithm is used to establish a shared secret between the SE secure element and the SM-DP+ server. The S-ENC, S-MAC session keys are then derived from the shared secret using the X9.63 key derivation function with the SHA-256 hash function.

[0095] Furthermore, the secure element SE can verify the initialization data received and therefore the authenticity and integrity of the communication profile P intended to be installed. This step also makes it possible to verify that the communication interface between the profile management unit LPA and the secure element SE is operational (i.e. functional).

[0096] During this step, the secure element SE performs, for example, step [2] of the sub-procedure for installing a profile as specified in the GSMA SGP.22 standard.

[0097] In step S140, the profile management unit LPA sends, to the secure element SE, a loading suspension command CMD_SSP signaling to the secure element SE to suspend the loading of the profile P.

[0098] [Fig.3A] illustrates an embodiment according to which the CMD_SSP command is included in a dedicated message sent by the LPA management unit to the secure element SE. In particular, the CMD_SSP command can be issued by the LPA profile management unit in response to a message from the secure element SE signaling that the S-ENC, S-MAC session keys have been generated (message not shown in [Fig.3A]).

[0099] Alternatively, the loading suspension command CMD_SSP could be included in the loading initialization command CMD_LBPP sent in step S120. Although, in this alternative, the CMD_SSP command is received as soon as the loading of the profile P is initialized, it should be emphasized that the CMD_SSP command indicates to the secure element SE to suspend the loading after the generation of the session keys S-ENC, S-MAC.

[0100] Figures 3A-3B represent, by way of example, an embodiment in which the loading of the profile P is suspended following the generation of the session keys S-ENC, S-MAC and before the installation of profile elements PE by the secure element SE. This embodiment is particularly described since it makes it possible to minimize the loading time of the profile P carried out in the factory by the manufacturer, while ensuring that the profile P recorded in the communication device APP is linked to the secure element SE intended to install the profile P.

[0101] However, within the scope of the invention, embodiments could also be envisaged in which the suspension of the loading would take place during a subsequent step of the loading of the profile P. For example, the loading of the profile P could be suspended following installation of part of the PE profile elements in the SE secure element.

[0102] In step S150, following receipt of the suspension command CMD_SSP, the secure element SE records the context data associated with the loading of the profile P in its non-volatile memory MEM_SE. The recording of this context data makes it possible to subsequently continue loading the profile P. In particular, the secure element SE records the session keys S-ENC, S-MAC.

[0103] In step S160, the secure element SE sends, to the profile management unit LPA, a first signed token PTK and suspends the loading of the profile P.

[0104] The secure element SE can in particular obtain the first PTK token by generating a nonce (i.e. a random number) and signing it from an encryption key. To sign the nonce, the secure element SE can for example use a private key associated with the secure element SE, or an encryption key derived from its unique identifier (i.e. the EID for “eUICC Identifier” in English), and any hash function (e.g. SHA-256).

[0105] The first PTK token makes it possible to signal to the LPA profile management unit that the secure element SE is suspending the loading of the profile P. Furthermore, the signature of the first PTK token by the secure element SE makes it possible to prove the involvement of the secure element SE in the loading of the profile P.

[0106] In step S170, the profile management unit LPA records, in the non-volatile memory MEM_APP of the APP device, the first PTK token received from the secure element SE.

[0107] In step S180, the LPA profile management unit sends, to the factory server FCT_SRV, the first PTK token signed by the secure element SE.

[0108] The factory server FCT_SRV can, in step S181, send the first token to the SM-DP+ server, which makes it possible to signal to the network operator that the profile P has been partially loaded into the secure element SE. The signing of the first token PTK by the secure element SE also makes it possible to prove that the profile P has been loaded into the APP device equipped with the secure element SE actually intended to receive this profile P (i.e. the target secure element of this profile).

[0109] Alternatively, the LPA profile management unit could send the first PTK token directly to the SM-DP+ server, or to a network operator server.

[0110] In step S190, the communication device APP is powered down, which causes the secure element SE to be powered down. As detailed below, powering down the device APP is optional and described as a non-limiting example.

[0111] As illustrated by the embodiment of [Fig.2B], at the end of the first loading phase S100, the communication device APP comprises in memory: the BPP installation package including the xPE encrypted elements of the P profile; and the first PTK token signed by the SE secure element. The SE secure element includes in memory the context data associated with loading the P profile, including the S-ENC, S-MAC session keys associated with the P profile and allowing the xPE encrypted elements to be decrypted.

[0112] Thus, the APP device has, at the end of the first loading phase S100, all the information to complete the installation of the profile P in the secure element SE.

[0113] [Fig.3B] illustrates the second phase S200 of loading the communication profile P into the secure element SE. As illustrated by this figure, the second loading phase S200 comprises all or part of the steps S210 to S280 described below.

[0114] In step S210, the communication device APP is powered up (i.e. started), which causes the secure element SE to be powered up.

[0115] Figures 3A-3B represent, by way of non-limiting example, an embodiment in which the APP device is stopped then restarted between the first phase S100 and the second phase S200 of loading the profile P. This embodiment is notably described to illustrate a deployment of the APP communication device in the field, that is to say that the APP device has left the manufacturer's factory and is for example supplied to a user.

[0116] However, within the framework of the invention, embodiments could also be envisaged according to which the communication device APP is kept powered (i.e. remains switched on) between the first S100 and the second charging phase S200.

[0117] Generally, no limitation is attached to the operations carried out by the APP device between the first phase S100 and the second phase S200 of loading the profile P. Similarly, no limitation is attached to the duration between the first S100 and the second loading phase S200. For information purposes, the communication device APP could carry out, in a manner similar to the method described above, a first phase of loading another communication profile into the secure element SE.

[0118] In step S220, the profile management unit LPA sends, to the secure element SE, a load resume command CMD_RSM signaling to the secure element SE to resume loading the communication profile P. This CMD_RSM command triggers the completion of the installation of the profile P in the secure element SE and therefore the sending of the remaining packets of the installation package BPP.

[0119] [Fig.3B] illustrates an embodiment in which the sending of the CMD_RSM loading resume command is here triggered by the powering up of the APP device.

[0120] Alternatively, sending the CMD_RSM loading resume command could be triggered by a network access request from the APP device. Also, resuming loading of the P profile could be triggered by an activation command obtained via a user interface, or an activation command issued by a third-party server (e.g. following pre-activation of the profile on the Internet). A change in the operating mode of the communication device (e.g. exiting the “In-Factory Profile Provisioning” mode) could further trigger resuming loading of the P profile.

[0121] In step S230, the secure element SE obtains (i.e. reads from memory) the context data associated with the loading of the profile P, and recorded in the non-volatile memory MEM_SE when the loading of the profile P is suspended. In particular, the secure element SE obtains the recorded session keys S-ENC, S-MAC.

[0122] In step S240, the profile management unit LPA sends, to the secure element SE, the first token PTK.

[0123] The secure element SE then verifies the signature of the first token PTK, and therefore its prior involvement in the first phase S100 of loading the profile P. If (and only if) the result of this verification is positive (i.e. valid signature), the method continues at step S260 and the loading of the profile P continues; otherwise (i.e. invalid signature), the method ends.

[0124] In step S250, the profile management unit LPA sends, to the secure element SE, the remaining packets of the BPP installation package of the profile P. In particular, the profile management unit LPA sends, to the secure element SE, the encrypted elements xPE of the profile P.

[0125] It should be noted that the sending of the CMD_RSM command, the first PTK token, and the xPE encrypted elements can be carried out concomitantly or in separate messages.

[0126] In step S260, the secure element SE decrypts the received xPE encrypted elements using the session keys S-ENC, S-MAC.

[0127] In step S270, the secure element SE installs the decrypted elements PE of the profile P in the memory MEM_SE of the secure element SE. The elements PE of the profile P are thus recorded in a secure domain ISD-P of the secure element SE.

[0128] During steps S250-S270, the profile management unit LPA and the secure element SE perform, for example, steps [3] to [6] of the sub-procedure for installing a profile as specified in the GSMA SGP.22 standard.

[0129] In step S280, the secure element SE sends, to the profile management unit LPA, a second PIR token signed by the secure element SE, for example using a private key associated with the secure element SE. The second PIR token indicates that Installation of the P profile in the SE secure element is complete.

[0130] The profile management unit LPA can send, in step S281, the second PIR token to the SM-DP+ server, which makes it possible to signal to the network operator that the installation of the communication profile P in the secure element SE has been completed.

[0131] As illustrated by [Fig.2C], at the end of the second loading phase S200, the communication profile P, consisting of the (decrypted) PE elements of the profile, is installed in the secure element SE. At the end of this second phase S200, the APP device can then access the services of the network operator associated with the profile P. The communication device APP includes in memory the second PIR token signed by the secure element SE.

[0132] It should be noted that the order in which the steps of a method implemented by a secure element equipping a communication device or the steps of a method implemented by a profile management unit of the communication device are linked together, in particular with reference to the attached drawings, constitutes only an example of embodiment devoid of any limiting character, variants being possible.

[0133] A person skilled in the art will understand that the embodiments and variants described above constitute only non-limiting examples of implementation of the invention. In particular, a person skilled in the art will be able to envisage any adaptation or combination of the embodiments and variants described above in order to meet a very specific need.

[0134] The term module can correspond to a software component as well as to a hardware component or a set of hardware and software components, a software component itself corresponding to one or more computer programs or sub-programs or more generally to any element of a program capable of implementing a function or a set of functions as described for the modules concerned. In the same way, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions for the module concerned.

Claims

Claims

1. Method implemented by a secure element (SE) equipping a communication device (APP), the method comprising, for a communication profile (P), a first phase (S 100) of loading the profile (P) into the secure element (SE) comprising: - a reception (S 120), from a profile management unit (LPA) of the communication device (APP), of a public key (PK.DP) from a profile provision server (SM-DP+) associated with the profile (P); - a generation (S 130) of session keys (S-ENC, S-MAC) from the public key (PK.DP) of the profile provision server (SM-DP+) associated with the profile (P); - following a reception (S 140) of a loading suspension command (CMD_SSP) from the profile management unit (LPA), a suspension (S150-S160) of the loading of the profile (P) comprising: • a recording (S 150), in a memory (MEM_SE) of the secure element (SE), of the session keys (S-ENC, S-MAC) generated; and • a sending (S160), to the profile management unit (LPA), of a token (PTK) signed from an encryption key of the secure element (SE).

2. Method according to claim 1, in which the suspension (S150-S160) of the loading of the profile (P) is triggered following the generation (S 130), by the secure element (SE), of the session keys (S-ENC, S-MAC) and before a reception (S250), by the secure element (SE), of encrypted elements of the profile (xPE).

3. Method according to claim 1 or 2, wherein the token (PTK) signed by the secure element (SE) is sent (S 180) to the profile provision server (SM-DP+) or a third-party server (FCT_SRV).

4. Method according to one of claims 1 to 3, comprising a second phase (S200) of loading the profile (P) comprising, following the reception (S220) of a loading resume command (CMD_RSM) from the profile management unit (LPA): - a reception (S240, S250), from the unit of profile management (LPA), token management (PTK) and encrypted profile elements (xPE); and - decryption (S260) of the encrypted elements (xPE) of the profile (P) from the recorded session keys (S-ENC, S-MAC) and installation (S270) of the decrypted elements of the profile (P) in the memory (MEM_SE) of the secure element (SE).

5. The method of claim 4, wherein the second loading phase (S200) is triggered by: a power-up (S210) of the communication device (APP); a network access request from the communication device (APP); an activation command obtained via a user interface; an activation command issued by a third-party server; or a change in an operating mode of the communication device (APP).

6. Method according to claim 4 or 5, comprising, following the first loading phase (S 100) and before the second loading phase (S200), a power-off (S 190) and a power-on (S210) of the communication device (APP), the second loading phase is triggered by: the power-on (S210) of the communication device (APP); or by a network access request following the power-on (S210).

7. Method according to one of claims 1 to 6, comprising, for another communication profile, a said first phase (S 100) of loading the other profile.

8. Method according to one of claims 1 to 7, in which the loading suspension command (CMD_SSP) and the public key (PK.DP) of the profile provision server (SM-DP+) are included in the same message (CMD_LBPP).

9. Method implemented by a profile management unit (LPA) of a communication device (APP), the method comprising, for a communication profile (P), a first phase (S 100) of loading the profile (P) into a secure element (SE) equipping the communication device (APP) comprising: - a recording (SI 10), in a memory of the communication device (MEM_APP), of encrypted elements of the profile (P) provided by a profile provision server (SM-DP+); - a sending (S 120), to the secure element (SE), of a public key (PK.DP) of the profile provision server (SM-DP+) associated with the profile (P); - a sending (S 140), to the secure element (SE), of a loading suspension command (CMD_SSP); and - a recording (S 170), in the memory of the communication device (APP), of a token (PTK) received from the secure element (SE) and signed by the secure element (SE) from an encryption key of the secure element (SE).

10. Method according to claim 9, comprising a second phase (S200) of loading the profile (P) comprising: - sending (S220), to the secure element (SE), a loading resume command (CMD_RSM); and - sending (S240, S250), to the secure element (SE), the token (PTK) and encrypted elements (xPE) of the profile (P).

11. Secure element (SE) comprising: - a module (S 120) for receiving, from a profile management unit (LPA) of a communication device (APP), a public key (PK.DP) from a profile provision server (SM-DP+) associated with the profile (P); - a module (S 130) for generating session keys (S-ENC, S-MAC) from the public key (PK.DP) of the profile supply server (SM-DP+) associated with the profile (P); - a module (S150-S160) for suspending a loading of the profile (P) following a reception (S 140) of a loading suspension command (CMD_SSP) from the profile management unit (LPA), the suspension module comprising: • a recording module (S 150), in a memory (MEM_SE) of the secure element (SE), the session keys (S-ENC, S-MAC) generated; and • a sending module (S160), to the profile management unit (LPA), of a token (PTK) signed from an encryption key of the secure element (SE).

12. Communication profile management unit (LPA) of a communication device (APP) and comprising: - a recording module (SI 10), in a memory of the communication device (MEM_APP), of encrypted elements of the profile (P) provided by a profile provision server (SM-DP+); - a sending module (S 120), to a secure element (SE) equipping the communication device (APP), of a public key (PK.DP) of the profile provision server (SM-DP+) associated with the profile (P); - a sending module (S 140), to the secure element (SE), of a loading suspension command (CMD_SSP); and - a recording module (S 170), in the memory of the communication device (APP), of a token (PTK) received from the secure element (SE) and signed by the secure element (SE) from an encryption key of the secure element (SE).

13. Communication device (APP) comprising a secure element (SE) according to claim 11 and / or a profile management unit (LPA) according to claim 12.

14. Computer program (PROG_SE, PROG_APP) comprising instructions for executing the steps of a method according to one of claims 1 to 8 when the program is executed by at least one processor (PROC_SE), or for executing the steps of a method according to claim 9 or 10 when said program is executed by at least one processor (PROC_APP).

15. Information carrier (MEM_SE, MEM_APP) readable by a processor (PROC_SE, PROC_APP) on which a computer program (PROG_SE, PROG_APP) according to claim 14 is recorded.

Images