Encryption scheme for providing software update to update agent

Abstract

To provide an efficient and secure solution for managing encryption of a software image updated on a secure element.SOLUTION: The present invention relates to methods, apparatuses and systems for implementing an encryption scheme for providing a software image to a secure element. The software image is converted into a sequence of ciphered blocks, which is protected with an authentication tag to obtain a sequence of protected blocks, which are then transmitted to an update agent on the secure element. The steps of converting the software image into a sequence of ciphered blocks and protecting the sequence of ciphered blocks with an authentication tag are implemented by an authenticated encryption function using a same block cipher.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to updating software such as operating systems on secure elements, and more particularly to methods, update agents, and systems for implementing a cryptographic scheme for providing software images to secure elements. [Background technology]

[0002] Background of the Invention Recently, mobile devices have emerged that are configured to employ electronic subscriber profiles for communicating over mobile networks, and such mobile devices typically comprise a smart card that includes an electronic / embedded Secure Element (SE), such as an electronic / embedded Universal Integrated Circuit Card (eUICC), smart SD, or smart microSD, to name a few.

[0003] A Secure Element is a tamper-resistant element, TRE, that provides a secure memory and execution environment within the smart card / device in which application code and application data can be securely stored and managed. The Secure Element ensures that access to data stored on the card is only provided with authorization.

[0004] Secure elements designed for use in telecommunications products such as mobile devices are configured to store one or more electronic subscriber profiles, in particular electronic subscriber identity module (eSIM) profiles, that may enable the mobile device to connect to one or more mobile networks. The subscriber profiles (e.g., eSIM profiles) may be generated by a mobile network operator (MNO) and downloaded to the mobile network device. The subscriber profiles may then be installed on the secure element of the mobile device and used by the mobile device to communicate over the corresponding mobile networks.

[0005] Historically, the software of a secure element has not changed beyond the manufacturing stage, meaning that if any issue related to the software inside the secure element is discovered (a new attack or vulnerability, a new update to the sector specification, or the expected lifecycle of a device using the secure element), the only possible action is to change the entire secure element. Having to change the entire secure element makes it particularly difficult for manufacturing to keep up with market demands (since software updates after manufacturing are not possible), especially if manufacturing has to take place in an authenticated environment inside a factory.

[0006] The GSMA Remote Provisioning Architecture provides a platform for implementing procedures to load software onto a Secure Element (SE) or Tamper Resistant Element (TRE). The GSMA platform makes it possible to implement changes to profiles stored within a Secure Element by providing the Secure Element with a bound installation package containing profile updates.

[0007] To ensure the integrity of the bound installation package, the GSMA Remote Provisioning Architecture implements an encryption scheme based on the SCP03t algorithm, which includes two different encryption algorithms defined within the Advanced Encryption Standard (AES): a first algorithm, AES CBC, to ensure confidentiality, and a second algorithm, AES CMAC, to provide authentication and integrity. SCP03t thus follows the Encrypt-the-MAC approach, with separate algorithms for encryption and integrity / authenticity.

[0008] This encryption scheme implemented within the GSMA platform requires several round trips between the TRE and the server before a bound profile package containing the profiles to be used for loading can be prepared, which may not be optimal for broadcast deployment of new software.

[0009] In addition, due to the complex SPC03t-based security scheme, the bound profile package provided to the secure element has a complex structure. When the update agent in the secure element receives the bound profile package, it needs to perform a time-consuming decryption algorithm to be able to extract the necessary data from the bound profile package.

[0010] Furthermore, the GSMA Platform does not allow for the implementation of changes to the underlying software present within the SE / TRE, such as changes to the operating system, as the security scheme provided lacks the additional layer of protection that may be necessary for the rollout of sensitive data, such as a new operating system.

[0011] Recently, an operating system update scheme has been introduced that facilitates updating the operating system installed on the SE / ITR after the SE / TRE has finished its manufacturing phase.

[0012] Some applications of a download / update security scheme may need to be as fast as possible for several reasons. Some examples may be that the scheme needs to be applied to several targets on a manufacturing line, or that this process has constraints due to its allocation within another process, such as when the secure element is updated as part of a device update and the device manufacturer has set limits. Therefore, when implementing an SCP03t-based security scheme to facilitate secure software downloads onto a secure element, it is difficult to meet customer requirements for minimal delays during software updates.

[0013] It is therefore desirable to provide a solution for managing the encryption of software images in a more efficient manner that addresses the above-mentioned shortcomings. Summary of the Invention [Means for solving the problem]

[0014] Summary of the Invention The present invention addresses the above mentioned objectives with the subject matter covered by the independent claims. Preferred embodiments of the invention are defined in the dependent claims.

[0015] According to a first aspect of the present invention, there is provided a method for providing a software image to a secure element, the method comprising: converting the software image into a sequence of encrypted blocks; protecting the sequence of encrypted blocks with an authentication tag to obtain a sequence of protected blocks; and transmitting the sequence of protected blocks to an update agent on the secure element. The steps of converting the software image into a sequence of encrypted blocks and protecting the sequence of encrypted blocks with an authentication tag are implemented by an authenticated encryption function using the same block cipher.

[0016] The proposed method provides an efficient and secure solution for encrypting software to be loaded onto a secure element after its manufacturing is complete. The adoption of an authenticated encryption function that uses the same block cipher for both encryption and authentication not only provides an efficient and secure solution, but also facilitates hardware implementations that are low cost, low latency, and fast. Applications requiring high data throughput can benefit from these high-speed implementations.

[0017] In some embodiments of the present invention, the method further includes segmenting the software image into a sequence of input blocks, and the authenticated encryption function encrypts each input block using a block cipher, thereby obtaining a sequence of encrypted blocks.

[0018] In some embodiments of the present invention, the authenticated encryption function encrypts each input block by applying a forward cipher function of a block cipher to each input block to obtain a sequence of output blocks, and performing an exclusive-or (XOR) operation on each pair of input block and corresponding output block to obtain a sequence of encrypted blocks.

[0019] One advantage of this implementation is that the forward (encryption) direction of the block cipher can be used for both encryption and decryption. This simplifies the implementation of the security scheme, as the procedures can be implemented by hardware with a reduced footprint (e.g., less memory). Furthermore, for block ciphers such as AES (Advanced Encryption Standard), it can often be easier to implement efficient encryption than decryption, since the internal coefficients are optimized for this direction.

[0020] In some embodiments of the invention, the method further comprises concatenating the sequence of encrypted blocks with additional authentication data, preferably comprising certain configurable parameters outside the ciphertext itself, such as the underlying exchange protocol, in particular the protocol version number, a message-specific nonce, the recipient's address, etc.

[0021] Using additional authentication data allows these parameters to be verified, since the additional authentication data can be verified along with the ciphertext by examining the authentication tag. An attacker cannot simply change these parameters by, for example, switching to an older, less secure protocol number.

[0022] In some embodiments of the present invention, the authenticated encryption function further comprises applying a hash function to the sequence of encrypted blocks to obtain a hash tag, the hash function being generated using a block cipher.

[0023] Preferably, the hash function is the GHASH function, which is based on operations in a finite Galois field, in particular multiplication. The GHASH function is used to generate message authentication codes by the GCM (Galois / Counter Mode) algorithm implemented within the AES (Advanced Encryption Standard), which also supports additional authenticated data (AAD) that is authenticated using GHASH but transmitted as plaintext.

[0024] Using only one AES calculation per data block along with Galois field multiplication, and without an additional MAC added to each block, both the confidentiality and authenticity of the protected blocks transmitted to the secure element are ensured. Thus, more data can be packed into a block, reducing the length of the transmitted bound installation package.

[0025] Preferably, the hash tag is encrypted using a nonce to derive the authentication tag, which further enhances confidentiality and integrity.

[0026] In some embodiments of the present invention, an authentication tag is appended to the concatenated sequence of encrypted blocks to obtain a sequence of protected blocks.

[0027] Authentication tags support tag-based authentication mechanisms to ensure the authenticity of encrypted data, i.e., to reveal accidental errors or intentional alterations of the data.

[0028] Preferably, the authentication tag includes a cryptographic checksum for the encrypted data in the encrypted block.

[0029] In some embodiments of the present invention, transmitting the sequence of protected blocks to an update agent on the secure element includes segmenting the sequence of protected blocks, where segments other than the first to last carry portions of the encrypted software image and the last segment carries an authentication tag, and transmitting the segments to the update agent.

[0030] In this way, a compact representation of the data being transmitted (i.e., software images, updates, profiles) is achieved, where each segment contains more data, which reduces the size of the complete distribution package.

[0031] According to a second aspect of the present invention, there is provided a server, in particular a subscription manager data preparation server, configured for providing protected software updates to a secure element by means of bound installation packages, the server being configured to generate the bound installation package from a software image by implementing an authenticated encryption function using a block cipher to encrypt the software image and to calculate an authentication tag for the encrypted software image.

[0032] In some embodiments of the invention according to the second aspect, a server is configured to perform the method according to the first aspect.

[0033] According to a third aspect of the present invention, there is provided a mobile network system for providing services to a mobile device, the mobile device including a secure element, the system including a server, in particular a subscription manager data preparation server, configured to provide protected software updates to the secure element by means of bound installation packages, the server being configured to generate the bound installation package from the software image by implementing an authenticated encryption function using a block cipher to encrypt the software image using a block cipher and to calculate an authentication tag for the software image encrypted using the same block cipher, and transmitting the sequence of protected blocks to an update agent on the secure element.

[0034] According to a fourth aspect of the present invention there is provided an update agent for use in a secure element for installing a software update on the secure element, the update agent being configured to: receive a sequence of protected segments comprising a software image for performing the software update, the sequence having been generated by the method of the first aspect and comprising a sequence of encryption blocks and an authentication tag; extracting the software image from the sequence of encryption blocks and implementing an authenticated decryption function to authenticate the software image by checking the authentication tag.

[0035] Preferably, the update agent is configured to perform the software update using the software image if the authentication tag is verified, and to return a failure message otherwise.

[0036] According to a fifth aspect of the present invention, there is provided a non-transitory computer-readable medium for providing a protected software image to a secure element, the medium comprising stored instructions which, when executed by a processor, perform the following steps: generating a bound installation package from the software image to be provided to the secure element by implementing an authenticated encryption function for encrypting the software image using a block cipher and calculating an authentication tag for the encrypted software image, and transmitting the sequence of protected blocks to an update agent on the secure element.

[0037] Aspects and embodiments described herein provide an efficient and secure solution for managing the encryption of software images updated on a secure element.

[0038] It should be noted that all devices, elements, units and means described in this application may be implemented by software or hardware elements or a combination thereof. All steps performed by the various entities described in this application and the functions described are intended to mean that the respective entities are adapted or configured to perform the respective steps and functions.

[0039] Further aspects, features, and advantages of the present invention will become apparent to those skilled in the art from the following detailed description of preferred embodiments and modifications of the invention, when considered in conjunction with the accompanying drawings.

[0040] BRIEF DESCRIPTION OF THE DRAWINGS Reference is now made to the accompanying drawings. [Brief explanation of the drawings]

[0041] [Figure 1] 1 illustrates a simplified representation of a remote eSIM provisioning system, according to one embodiment. [Figure 2]FIG. 1 shows a security scheme for performing software / OS updates on the eSIM provisioning system. [Figure 3] 1 illustrates a modified security scheme for performing software / OS updates, according to one embodiment of the present invention. [Figure 4] 1 illustrates a flow diagram of a method for providing a software image to a secure element, according to one embodiment. [Figure 5] 5 illustrates an implementation of the steps of the method of FIG. 4 according to a preferred embodiment. [Figure 6] 5 illustrates an implementation of the steps of the method of FIG. 4 according to a preferred embodiment. [Figure 7] 5 illustrates an implementation of the steps of the method of FIG. 4 according to a preferred embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0042] Detailed Description A detailed description of the present invention will now be provided with reference to the accompanying drawings, which illustrate examples of specific embodiments of the invention. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the present invention, although different, are not necessarily mutually exclusive. For example, a particular feature, structure, or characteristic described herein in connection with one embodiment may be implemented within other embodiments without departing from the scope of the invention. In addition, it should be understood that the location or arrangement of individual elements within each disclosed embodiment may be modified without departing from the scope of the invention. Therefore, the following detailed description should not be taken in a limiting sense, and the scope of the present invention is defined solely by the appended claims, appropriately interpreted along with the full range of equivalents to which such claims are entitled. In the drawings, like numerals refer to the same or similar features throughout the several views.

[0043] 1 shows an exemplary architecture of an SM-DP+ based system 1 according to a particular embodiment of the present invention. This architecture is an adaptation of the GSMA architecture described in the SGP.22 RSP Technical Specification, Version 2.0 (hereinafter referred to as GSMA RSP22) published by the GSM Association. The eSIM provisioning system 1 is organized around several elements: an SM-DP+ (Subscription Manager - Data Preparation and Secure Routing 300), an SM-DS (Subscription Manager - Discovery Server 310), an LPA (Local Profile Assistance 250), and an eUICC 100, the latter being part of a mobile device 200 of an end user 330.

[0044] The SM-DP+ 300 is responsible for creating, downloading, remotely managing (enabling, disabling, updating, deleting) and protecting subscriber profiles provided by the MNO 320. In particular, the SM-DP+ 300 can be configured to provide profiles within bound profile packages or bound installation packages and to enable secure transmission of bound profile / installation packages.

[0045] The LPA (Local Profile Assistant 250) is a collection of functions within the device 200 that is responsible for providing the functionality to download (encrypted) profiles to the eUICC / TRE / SE 100. The LPA 250 also presents a local management end user interface to the end user 330 so that the end user 330 can manage the status of profiles on the eUICC / TRE / SE 100.

[0046] The SM-DS310 provides a means for the SM-DP+300 to communicate with the eUICC / TRE / SE100.

[0047] External device 200 may represent an entity that controls and communicates with SE 100. External device 200 may be a mobile terminal or any device in which an SE is installed.

[0048] The update agent 110 is an entity within the secure element 100 (separate from the OS 130) that is responsible for receiving installation packages and performing software updates. The update agent is loaded onto the secure element or TRE together with the (initial) operating system (OS 130 in Figure 1) during factory manufacturing of the secure element 100. Initially, the OS 130 is assumed to be in control, meaning that the OS 130 is the OS that runs when the TRE 100 boots up.

[0049] Figure 2 shows a software update security scheme for providing a software image (e.g. operating system, OS, image) by means of a bound installation package (short: installation package) to the secure element 100 of Figure 1. The scheme for providing a software image for update adapts the general scheme known from GSMA RSP22 to the architecture of Figure 1.

[0050] The diagram in Figure 2 shows the various forms that a profile package (i.e., a bound installation profile) can take from the time it is generated until it is downloaded onto a secure element. Specifically, a bound installation profile is created in several stages I to V starting from a software image by performing several operations such as appending and segmentation.

[0051] In the first stage I, an image 501 provided by an image publisher is appended with a manifest 502 and a manifest signature 501. The manifest 502 contains information about the new software image being uploaded and ensures that the image is acceptable and that the publisher is trustworthy. The resulting block contains readable data that is not yet encrypted.

[0052] In Stage II, the SM-DP+ 300 can generate an unprotected image package from the package obtained in Stage I, containing a sequence of TLVs (Tag Length Values) TLV1,...,TLVn 510 of profile elements. Preferably, the TLVs are according to the SIMalliance eUICC Profile Package: Interoperable Format Technical Specification V2.0.

[0053] In stage III, the SM-DP+300 can generate a protected package profile from the unprotected package profile by applying TLV encryption and MACing. These operations can preferably follow the scheme described in the GSMA "Remote Provisioning of Embedded UICC Technical specification" V3.1. Preferably, the TLV encryption is performed by applying a private profile protection key PK-ENC generated by the SM-DP+300. The resulting data block is divided into segments 1 to X521.

[0054] In stage IV, the SM-DP+ 300 can link or bind the protected image package obtained in stage III to a specific eSIM / eUICC, thereby generating a bound installation profile package 500. This is done by key agreement between the eSIM and the SM-DP+.

[0055] Finally, in stage V, the bound installation profile package 500, comprising the header portion 530 and the data carrying portion 520, is segmented into blocks and delivered to the update agent 110 on the eSIM or secure element 100. Preferably, the segments are sent by means of a STORE DATA command.

[0056] The scheme in Figure 2 is based on the SCP03t algorithm (described, for example, in SGP.02 = v4.2 section 4.1.3.3) for implementing encryption and authentication in Stage III. Specifically, the SCP03t algorithm includes two different encryption algorithms defined in the Advanced Encryption Standard (AES): AES CBC, which is the first algorithm to ensure confidentiality, and AES CMAC, which is the second algorithm to provide authentication and integrity. In other words, SCP03t follows the Encrypt-the-MAC approach, with separate algorithms for encryption and integrity / authenticity.

[0057] The software update security scheme described above, which may be implemented on the adapted GSMA remote provisioning architecture of Figure 1, requires several interactions between the Secure Element (or TRE) 100 and the SM-DP+ server 300 before the bound profile package used for loading is ready, and may not be optimal for broadcast deployment of new software. This scheme also lacks an additional layer of protection that may be required for deploying critical data such as a new OS.

[0058] Additionally, the update agent within the secure element must perform time-consuming decryption algorithms to be able to extract the software updates from the received installation packages.

[0059] Therefore, implementing the above security schemes would not satisfy customer demands for minimal delays during software updates.

[0060] To address this issue, the present invention proposes a method, apparatus, and system for managing the encryption of image segments in a more efficient manner, specifically a faster encryption scheme for implementation by the SM-DP+ server 300 in Stage III of the security scheme of Figure 2.

[0061] The proposed encryption scheme is based on AES GCM (Galois / Counter Mode), which provides both confidentiality and authenticity using only one AES calculation per data block along with Galois field multiplication, without the need for an additional MAC.

[0062] Figure 3 illustrates a modified security scheme for generating protected software packages used to perform software / OS updates, according to one embodiment of the present invention. This modified security scheme is based on the novel package protection scheme implemented in Stage III, which is further described below with respect to Figures 4 through 7.

[0063] Each of the n segments 523 carries an encryption block 521, which is a block or segment containing the encrypted software image. The final segment 524 carries an authentication tag 522. The authentication tag may be a cryptographic checksum for the encrypted data in the encryption block. The authentication tag may be designed to ensure the authenticity of the encrypted data, i.e., to reveal accidental errors or intentional modifications of the data.

[0064] This new scheme takes advantage of the better overall performance of AES CGM compared to previous implementations that use two different algorithms: because it is no longer necessary to transmit a MAC within each protected image segment, more data can be packed into each segment, resulting in a smaller overall installation package delivered to the secure element.

[0065] A method for providing a software image to a secure element, which implements the security scheme of Figure 3, is shown in Figures 4 to 7. Figure 4 shows a flow diagram of the main steps, and Figures 5 to 7 show preferred implementations of the main steps from Figure 4. The method may be implemented by a server such as the SM-DP+ server 300 of Figure 1.

[0066] 4, in a first step S1, a software image 501 provided to the secure element is converted into a sequence of encrypted blocks by applying an authenticated encryption function using a block cipher. Then in step S2, the sequence of encrypted blocks is protected with an authentication tag by applying an authenticated encryption function using the same block cipher to obtain a sequence of protected blocks. In step S3, the obtained sequence of protected blocks can be transmitted to the update agent 110.

[0067] The same block cipher is used, and an authenticated encryption function is applied for both encryption and authentication. The block cipher can be a parameterized group of permutations for a fixed-length bit string. A key, which is also a bit string of a given length, is used to determine the permutations.

[0068] An example of an authenticated encryption function employed herein is the Galois / Counter Mode (GCM) algorithm for authenticated encryption, which is constructed from an approved symmetric-key block cipher with a block size of 128 bits, such as the Advanced Encryption Standard (AES) algorithm.

[0069] A preferred implementation of step S1 above will now be illustrated with respect to FIG.

[0070] In step S11 of FIG. 5, the received software image 501 is divided into a plurality of input blocks BI 1, ...,BI N First, segment it into

[0071] An authenticated encryption function is then applied to each of the input blocks to obtain an encrypted block, by, inter alia, applying a forward encryption function F to each input block in step S12 and performing a block-wise XOR operation between the resulting block and the input block in step S13. In other words: - Input blocks: BI1,...,BI N - Output blocks: BO1,...,BO N , but BO i =F(BI i ),i=1,...,N - Encryption block: X1,...,X N , but X i =BO i XOR BI i ,i=1,...,N is.

[0072] The forward encryption function F is, for example, a forward encryption function CIPH with a symmetric key K. K The key K can be uniformly and randomly generated, is secret, and should be used only for GCM in conjunction with the chosen block cipher.

[0073] Step S1 of Figure 4 and the corresponding sub-steps S11 to S13 of Figure 5 implement a confidentiality mechanism. Step S2 of Figure 4 and the corresponding sub-steps S21 to S23 of Figure 6 implement an authentication mechanism for the encrypted block obtained in step S1.

[0074] Referring to Figure 6, the encrypted blocks X1,...,X N is subjected to an authentication operation using a hash function.

[0075] Optionally, in step S24, additional authentication data (AAD) can be appended to the encrypted block before applying the hash function. The AAD can include network addresses, ports, protocol version numbers, and other fields that indicate how the clear text, i.e., the software image, should be treated. The AAD data is readable, i.e., unencrypted.

[0076] In step S21, a hash function can be applied to the sequence of encrypted blocks. The hash function is generated using the same block cipher used for confidentiality protection. Examples of such hash functions include the GHASH function, which is based on finite Galois field arithmetic, defined in NIST Special Publication 800-38D: Recommendation for Block Cipher Modes of Operation GCM, Nov. 2007. GHASH(X1,...,X N )=Y m However, X1,...,X N denotes the sequence of encryption blocks, and Y m denotes the hashtag obtained by applying the hash function.

[0077] In a further step S22, the hash tag Y is used to obtain the authentication tag AuthTag 522 (see FIG. 3). m Preferably, the encryption is performed using a nonce, such as an initialization vector, that has strict uniqueness requirements.

[0078] The resulting authentication tag is [X1||...||X N ||AuthTag] is finally appended to a sequence of encrypted blocks, resulting in the protected image package 520 shown in FIG.

[0079] In step S3 of the flowchart of FIG. 4, the protected image package 520 is transmitted to the update agent 110.

[0080] A preferred implementation of step S3 is shown in Figure 7. As shown in Figure 3, in step S31 the protected image package 520 is segmented into a sequence of protected blocks 523, 524, which are transmitted to the update agent in step S32. Preferably, all but the first and last segments 523 carry portions of the encrypted software image, and the last segment 524 carries an authentication tag.

[0081] In a further aspect of the invention, there is provided a server configured to implement the above-mentioned method, which may be the SM-DP+ server 300 of Figure 1. The server 300 may be configured to generate a bound installation package 500 according to the security scheme of Figure 3 and to provide the bound installation package 500 to the secure element 100.

[0082] Specifically, the server 300 may be configured to generate the bound installation package 500 from the software image 501 by implementing an authenticated encryption function that uses a block cipher to encrypt the software image 501 and to calculate an authentication tag 522 for the encrypted software image. Furthermore, the server may be configured to perform all steps and sub-steps of the method according to the embodiment shown in Figures 4 to 7.

[0083] The mobile network system 1 of FIG. 1 is an exemplary system that implements the encryption scheme of FIG. 3 in an SM-DP+ server 300 according to the methods of FIGS. 4-7, in accordance with certain embodiments of the present invention.

[0084] In a further aspect of the present invention, there is provided an update agent 110 for use within the secure element 100 for installing software updates on the secure element 100. The update agent may be the update agent 100 shown in Figure 1. The update agent is configured to implement a security scheme such as the security scheme shown in Figure 3.

[0085] Specifically, update agent 110 may receive a sequence of protected segments 523 containing a software image 501 for performing a software update, which may have been generated by a method according to an embodiment of the present invention, as described above with respect to Figures 4 through 7. Upon receiving the sequence of protected segments, update agent 110 may implement an authenticated decryption function to extract software image 501.

[0086] Preferably, the update agent implements a GCM authenticated decryption function, which is the inverse of the authenticated encryption function implemented by the SM-DP+ server 300. Using this function, the ciphertext, which is a sequence of protected segments, is decrypted to plaintext and the authenticity of the ciphertext is verified. The update agent 110 can extract the software image from the decrypted plaintext, verify the authentication tag, and, if the authentication tag is verified, use the software image to perform the software update. If verification of the authentication tag fails, the update agent can return a failure message to the secure element and / or device.

[0087] The aspects and embodiments described herein provide an efficient and secure solution for managing the encryption of software images updated on a secure element.

[0088] The proposed bounded package encryption takes advantage of the overall superior performance of AES CGM compared to traditional SCP03t-based implementations. Each protected segment sent to the update agent carries only the payload data without the need to include a message authentication code (MAC), which is typically 8 bytes long. This allows the data transmitted to the update agent to be packed into fewer segments, resulting in a smaller size of the complete distribution package. This in turn allows the update agent component within the secure element to occupy a smaller footprint, making it possible to target secure elements with less available memory.

[0089] The possibility of updating software in the tamper-resistant element TRE or secure element SE with the proposed scheme proves useful not only to provide patches and security and bug fixes at any point in the lifecycle of the TRE, but also to update the operating system in the TRE in order to keep up with market evolutions.

[0090] In the foregoing specification, the present invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and changes can be made therein without departing from the broader scope of the present invention. For example, the process flows above have been described with reference to a particular order of process actions. However, the order of many of the actions in the described processes can be changed without affecting the scope or operation of the present invention. Accordingly, the specification and drawings should be considered in an illustrative rather than a restrictive sense.

Claims

1. A method for providing a software image to a secure element, - Converting the software image into a sequence of encrypted blocks (S1), - Protect the sequence of the encrypted blocks with an authentication tag to obtain the sequence of protected blocks (S2), - Transmitting the sequence of protected blocks to the update agent (110) on the secure element (100) (S3) Includes, The steps of converting and protecting are implemented by an authenticated cryptographic function that uses the same block cipher, The authentication encryption function further includes segmenting the software image into a sequence of input blocks (S11), wherein the authenticated encryption function encrypts each input block using the block cipher, thereby obtaining a sequence of encrypted blocks. The aforementioned authenticated encryption function is: - Applying the forward encryption function of the block cipher to each input block to obtain a sequence of output blocks (S12), and - Perform an exclusive OR operation on each pair of input blocks and corresponding output blocks to obtain the sequence of encrypted blocks (S13) Encrypt each input block by method.

2. The method according to claim 1, wherein the authenticated encryption function is a Galois / counter-mode algorithm for authenticated encryption.

3. The method according to claim 1, wherein the forward encryption function is a transpose of a fixed-length bit sequence having a symmetric key, the symmetric key is generated uniformly and randomly, is secret, and is used only for Galois / counter mode in conjunction with the block cipher.

4. The method according to claim 1, further comprising concatenating the sequence of encrypted blocks with additional authentication data (S24).

5. The method according to claim 1, wherein the authenticated encryption function applies a hash function to the sequence of encryption blocks to obtain a hash tag (S21), and the hash function is generated using the block cipher.

6. The method according to claim 5, wherein the hash function is a GHASH function based on operations in a finite Galois field.

7. The method of claim 5, further comprising encrypting the hash tag using a nonce to obtain the authentication tag (S22).

8. The method according to claim 7, further comprising adding the authentication tag to the concatenated sequence of encrypted blocks in order to obtain the protected sequence of blocks (S23).

9. The method according to claim 1, wherein transmitting the sequence of protected blocks to the update agent in the secure element (S3) includes segmenting the sequence of protected blocks (S31), where each segment except the first to last carries a portion of the encrypted software image, and the last segment carries the authentication tag, and transmitting the segments to the update agent (110) (S32).

10. A server (300), specifically a subscription manager data preparation server, configured to provide protected software updates to a secure element (100) by bound installation package (500), is configured to generate the bound installation package (500) from a software image (501) by implementing an authenticated encryption function that uses a block cipher to encrypt the software image (501), and to calculate an authentication tag (522) for the encrypted software image. Further configured to carry out the method according to any one of claims 1 to 9, Server (300).

11. A mobile network system (1) for providing services to a mobile device (200), wherein the mobile device (200) includes a secure element (100), and the system (1) includes the server (300) described in claim 10. Mobile network system (1).

12. An update agent (110) for use within the secure element (100) to install a software update on the secure element (100), - Receiving a sequence of protected segments (523) including a software image (501) for performing the software update, wherein the sequence of protected segments (523) is generated by the method of any one of claims 1 to 9 and includes a sequence of encryption blocks (521) and authentication tags (522), An update agent (110) is configured to perform the following actions.

13. The update agent (110) according to claim 12, wherein the update agent (110) is configured to perform a software update using the software image (501) if the authentication tag (522) is verified, and otherwise return a failure message.

14. A non-temporary computer-readable medium for providing a protected software image to a secure element (100), which, when executed on a processor, allows for the following steps, i.e. - To generate a bound installation package (500) from the software image (501) by encrypting the software image (501) using a block cipher and implementing an authenticated encryption function for calculating an authentication tag (522) for the encrypted software image, and - Transmitting the bound installation package to the update agent (110) on the secure element (100) Includes a stored instruction that executes, When the instruction is executed on the processor, it performs the steps described in any one of claims 1 to 9. Non-temporary computer-readable media.

Images