Wireless devices and programs

Abstract

The present invention provides a wireless device and program for securely transmitting and receiving predetermined information stored in a subscriber identification module (SIM) to and from an external device. [Solution] In a mobile communication network, a wireless device comprises a SIM, which is an integrated circuit that stores a profile for accessing the mobile communication network, and a processing unit that performs communication processing via the mobile communication network. When the integrated circuit communicates with a management server, it performs key exchange processing with the management server to generate a communication key for encrypting the communication.

Description

Technical Field

[0001] The present disclosure relates to authentication technologies for wireless devices in a mobile communication network.

Background Art

[0002] Non-Patent Document 1 discloses an authentication method also called FIDO (Fast Identity Online) authentication. According to Non-Patent Document 1, a secret key, also called a credential, is stored in an authenticator, and a public key corresponding to the secret key is stored in an authentication server. The authentication server transmits challenge data to the authenticator, and the authenticator generates a signature of the challenge data based on the stored secret key and transmits it to the authentication server. The authentication server verifies the signature with the stored public key to authenticate the authenticator, and thus authenticate the user using the authenticator. A so-called tamper-resistant device is used for the authenticator.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Wireless devices (WDs) that communicate via mobile communication networks are equipped with an integrated circuit called a subscriber identification module (SIM). The WD accesses the mobile communication network based on information stored in the SIM, which is also referred to as a profile. In the following description, the term SIM refers to a combination of removable SIM cards, embedded SIMs (eSIMs) that cannot be removed from the WD, and embedded general-purpose integrated circuit cards (eUICCs). The eUICC is an integrated circuit configured to allow remote rewriting of its profile. Because SIMs are tamper-resistant devices, they can be used as authenticators for authentication of WDs (or WD users) by an authentication server.

[0005] As described in Non-Patent Document 1, in order to cope with the loss or change of WD (Warning Device), it is required to back up the private key stored in the SIM used as an authenticator, or to share it with SIMs implemented in other WDs used by the same user. For this reason, for example, it is conceivable to store the private key on a server on the network (hereinafter referred to as the management server) and download it to the original SIM or a SIM implemented in another WD as needed. However, when the private key stored in the SIM is sent to the management server, the SIM needs to pass the private key to an application running on the wireless device's processor, but if a malicious application is running on the processor, the private key may be leaked.

[0006] This disclosure provides a technology for securely transmitting and receiving predetermined information stored in a SIM card to and from an external device. [Means for solving the problem]

[0007] According to one aspect of the present disclosure, a wireless device for a mobile communication network includes an integrated circuit that stores a profile for accessing the mobile communication network, and processing means for performing communication processing over the mobile communication network, wherein the integrated circuit is configured to perform key exchange processing with a server when communicating with the server to generate a communication key for encrypting the communication. [Effects of the Invention]

[0008] According to this disclosure, predetermined information stored in the SIM can be securely transmitted to and from an external device. [Brief explanation of the drawing]

[0009] [Figure 1] An example system configuration diagram. [Figure 2] A sequence diagram of the process of registering a public key with the authentication server. [Figure 3] A sequence diagram of the process for storing the private key on the management server. [Figure 4] A sequence diagram of the process for obtaining a private key from the management server. [Figure 5] Another sequence diagram of the process of registering a public key with the authentication server. [Modes for carrying out the invention]

[0010] The embodiments will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention as defined in the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more features from the multiple features described in the embodiments may be arbitrarily combined. Furthermore, identical or similar configurations will be given the same reference numeral, and redundant descriptions will be omitted.

[0011] <First Embodiment> Figure 1 is a system configuration diagram used to describe the embodiment. WD1 includes a SIM 10 and a processing unit 11. WD1 may be a device that is intended for human operation, such as a smartphone or tablet, or a device that is not intended for human operation, such as a so-called IoT (Internet of Things) device.

[0012] SIM10 is a tamper-resistant integrated circuit that stores a profile file for accessing the mobile communication network 21. SIM10 also stores an identifier for SIM10 (SIM identifier) ​​and a subscriber identifier. The SIM identifier is information for identifying individual SIM10s and may be, for example, an Integrated Circuit Card Identifier (ICCID) or an Embedded Identification Document (EID). The subscriber identifier is an identifier assigned by the operator of the mobile communication network 21 for each contract with a subscriber and may be, for example, an International Mobile Subscriber Identifier (IMSI). The subscriber identifier is also the identifier associated with the profile file for accessing the mobile communication network 21.

[0013] The processing unit 11 may include one or more processors, an integrated circuit that performs communication processing for accessing the mobile communication network 21, also known as a modem chip, a non-volatile memory device, and a volatile memory device. One or more processors execute an operating system (OS) and an application program (APP) stored in the non-volatile memory device.

[0014] Network 2 in Figure 1 is a collective term for the mobile communication network 21 and the data network (DN) 22, such as the Internet. WD1 can communicate with the authentication server 3 and management server 4, which are connected to DN22 via the mobile communication network 21. The authentication server 3 and management server 4 can also be considered devices within DN22. In Figure 1, the authentication server 3 and management server 4 are shown as devices within DN22, but one or both of them may be devices within the mobile communication network 21.

[0015] Authentication server 3 is a device that authenticates WD1 using the SIM10 implemented in WD1 as an authenticator. Authentication server 3 may be configured to issue an access token to WD1 when authentication of WD1 is successful. The access token may be, for example, information that proves to a server (not shown) connected to the mobile communication network 21 or DN22 that WD1 has been authenticated. WD1 may present the access token to a server (not shown) connected to the mobile communication network 21 or DN22 when accessing the server.

[0016] To enable authentication by the authentication server 3, the SIM 10 generates a private key (credential) and a corresponding public key for use in authentication by the authentication server 3. The public key generated by the SIM 10 is registered with the authentication server 3 in advance.

[0017] Figure 2 shows the sequence of operations for registering a public key with the authentication server 3. In S10, the processing unit 11 sends a registration request to the authentication server 3. Information for communicating with the authentication server 3 is stored in the processing unit 11 beforehand. The registration request includes a SIM identifier. In response to the registration request, the authentication server 3 sends challenge data to the processing unit 11 in S11. The challenge data may be random data.

[0018] In S12, the processing unit 11 outputs challenge data to the SIM 10 and instructs it to generate a key. In S13, the SIM 10 generates a private key and a public key pair, and in S14 stores the private key. Based on the generated private key, the SIM 10 generates signature data for the challenge data, and in S15 outputs the public key and signature data to the processing unit 11. In S16, the processing unit 11 sends the public key and signature data to the authentication server 3. The authentication server 3 verifies the signature data using the public key. If the verification is successful, in S17 the authentication server 3 stores the public key associated with the SIM identifier received in S10, and in S18 notifies the processing unit 11 that registration is complete.

[0019] In FIG. 2, the authentication server 3 stores the public key in association with the SIM identifier stored in the SIM 10, but it can be configured to store the public key in association with the subscriber identifier stored in the SIM 10. Furthermore, it can be configured to store the public key in association with the combination of the SIM identifier and the subscriber identifier stored in the SIM 10. When storing the public key in association with the subscriber identifier, the processing unit 11 transmits the subscriber identifier in S10. Also, when storing the public key in association with the combination of the SIM identifier and the subscriber identifier, the processing unit 11 transmits both the SIM identifier and the subscriber identifier in S10.

[0020] The management server 4 backs up the secret key generated by the SIM 10 in the process of FIG. 2. For this purpose, the SIM 10 transmits the secret key generated in the process of FIG. 2 to the management server 4. Here, a configuration can be considered in which the SIM 10 outputs the secret key to the processing unit 11 in order to store the secret key in the management server 4, and the processing unit 11 transmits it to the management server 4. By using a protocol in which the processing unit 11 and the management server 4 use encrypted communication, for example, the Hypertext Transfer Protocol Secure (HTTPS), eavesdropping in the network 2 can be prevented. However, if there is a malicious program in the program executed by the processor of the processing unit 11, the secret key may leak. In the present embodiment, it prevents eavesdropping not only in the network 2 but also in the processing unit 11.

[0021] FIG. 3 is a sequence of the secret key storage process to the management server 4 according to the present embodiment. The processing unit 11 outputs an instruction to store the secret key in the management server 4 to the SIM 10 in S20. When the WD1 is a smartphone or the like, the process of S20 can be triggered by the operation of the WD1 by the user of the WD1. Also, when the WD1 is an IoT device, the process of S20 can be triggered by a signal transmitted from a remote operation terminal of the WD1 (not shown) to the WD1 via the network 2. Furthermore, in S13 and S14 of FIG. 1, by generating and storing the secret key, the process of S20 can be triggered.

[0022] In response to a storage instruction from the processing unit 11, the SIM 10 communicates with the management server 4 in S21 and starts the communication key exchange process. The information necessary for communicating with the management server 4 is stored in the SIM 10 in advance. Alternatively, the information necessary for communicating with the management server 4 is notified by the processing unit 11 in S20.

[0023] The communication key exchange process could be, for example, a Transport Layer Security (TLS) handshake performed over HTTPS. Through the communication key exchange process, SIM10 and management server 4 generate a common encryption key (communication key) to be used for encrypting communication. After the communication key is generated, information sent and received between SIM10 and management server 4 is encrypted using the generated communication key. The authentication process in S22 is optional and will be described later. In S23, SIM10 sends the private key and the SIM identifier of SIM10 to management server 4. In S24, management server 4 stores the received private key associated with the received SIM identifier and notifies SIM10 of the completion of storage in S25. In S26, SIM10 notifies processing unit 11 of the completion of storage.

[0024] In communication between SIM10 and management server 4, SIM10 performs processing at or above the Transmission Control Protocol (TCP) layer, while processing unit 11 performs processing at or below the Internet Protocol (IP) layer. In this case, TCP packets are sent and received between SIM10 and processing unit 11. Similar to network 2, processing unit 11 cannot decrypt the encrypted information sent and received between SIM10 and management server 4, thereby reducing the risk of private key leakage.

[0025] The SIM10 has a processor and is configured to run simple applications such as applets. Therefore, it is possible to have the SIM10 perform processing that conforms to encrypted communication protocols such as HTTPS.

[0026] Optional S22 can be executed by the management server 4 to authenticate WD1. When performing authentication with S22, an account for WD1 (or its user) must be created in the management server 4 beforehand, and the information necessary for WD1 (or its user) authentication must be stored in the management server 4, associated with that account. For example, if WD1 is a smartphone, the S22 authentication process may be performed using a password entered by the WD1 user. Furthermore, S22 authentication can be based on EAP-AKA as defined in RFC4187. Additionally, S22 authentication can be based on mutual TLS (mTLS) as defined in RFC8705. In the case of mTLS, the S22 process may be performed in conjunction with the S21 process. Furthermore, when using EAP-AKA or mTLS, the information necessary for authentication is also stored in the SIM 10 or processing unit 11 beforehand.

[0027] When authentication is performed in S22, the management server 4 stores the private key in S24, associating it with the SIM identifier and account.

[0028] Figure 4 shows the sequence of operations for SIM10 to acquire the secret key stored in the management server 4. In S30, the processing unit 11 instructs SIM10 to acquire the secret key from the management server 4. If WD1 is a smartphone or the like, the process in S30 may be triggered by an operation of WD1 by the user of WD1. If WD1 is an IoT device, the process in S30 may be triggered by a signal sent to WD1 via network 2 by a remote control terminal of WD1 (not shown).

[0029] In response to the acquisition instruction from the processing unit 11, SIM 10 communicates with the management server 4 in S31 and starts the communication key exchange process. The authentication process in S32 corresponds to the process in S22 in Figure 2. In S33, SIM 10 sends its SIM identifier to the management server 4. In S34, the management server 4 sends the secret key associated with the SIM identifier received in S33 to SIM 10. In S35, SIM 10 stores the secret key and in S36 notifies the processing unit 11 that the acquisition is complete.

[0030] Optional S32 is executed if the management server 4 has also associated the private key with the account. In this case, the management server 4 sends the private key associated with the account authenticated in S32 and the SIM identifier received in S33 to the SIM 10 in S34.

[0031] In the sequences shown in Figures 3 and 4, the management server 4 stored the private key associated with the SIM identifier. In other words, in the sequences shown in Figures 3 and 4, the SIM identifier of SIM 10 was used to identify each private key. However, as explained in the registration of the public key to the authentication server 3, it is also possible to use a configuration in which the subscriber identifier is used instead of the SIM identifier to identify the private key, or a configuration in which the subscriber identifier is used in addition to the SIM identifier.

[0032] Furthermore, if the management server 4 stores the private key in association with the SIM identifier, the SIM 10 that sends the private key to the management server 4 in Figure 3 and the SIM 10 that retrieves the private key from the management server 4 in Figure 4 must be the same hardware. Similarly, if the private key is stored in association with the subscriber identifier, the profile stored in the SIM 10 that sends the private key to the management server 4 in Figure 3 and the profile stored in the SIM 10 that retrieves the private key from the management server 4 in Figure 4 must be the same. Therefore, for example, if the private key stored in SIM 10 is corrupted, it is possible to download the private key from the management server 4, or if the profile is moved to another SIM 10, it is possible to download the private key from the management server 4, but it is not possible to download the private key to a SIM 10 with a different SIM identifier or subscriber identifier. Consequently, it is not possible to share a private key among multiple WD1s used by the same user.

[0033] Therefore, a configuration using a group identifier can be used. When a group identifier is used, SIM10 performs authentication processing in S22 of Figure 3 and sends the group identifier and private key to the management server 4 in S23. The management server 4 stores the private key in association with the account and group identifier in S24. SIM10 also performs authentication processing in S32 of Figure 4 and sends the group identifier to the management server 4 in S33. The management server 4 sends the private key associated with the account and group identifier to SIM10 in S34.

[0034] Since the group identifier is used together with the account, it is acceptable for them to be duplicated if the accounts are different. In other words, the group identifier only needs to be unique within the same account, and can be arbitrarily assigned by the account user. By identifying the private key using the account and group identifier, the private key can be sent to and stored on a different SIM 10 than the one that sent it to the management server 4. Therefore, even if the SIM identifier or subscriber identifier of SIM 10 changes due to a change in model or loss of WD1, the same private key can be used as before.

[0035] Furthermore, if a user using multiple WD1 devices wishes to use the same private key across those WD1 devices, the private key can be distributed to each of the WD1 devices via the management server 4. In other words, the private keys used by multiple WD1 devices can be synchronized. The reason for using both an account and a group identifier is to accommodate scenarios where some of the multiple WD1 devices share a first private key, and other parts of the WD1 devices share a second private key. However, if the number of private keys that can be shared among multiple WD1 devices used by a single user is limited to one, then a configuration using only an account and without a group identifier is also acceptable. In this case, the account would serve the role of the group identifier.

[0036] As described above, according to this embodiment, the private key stored in the SIM can be securely sent and received with an external device.

[0037] <Second Embodiment> Next, the second embodiment will be described, focusing on the differences from the first embodiment. In the first embodiment, the SIM 10 communicated encrypted with the management server 4 when storing the private key in the management server 4 and when retrieving it from the management server 4. However, in the registration process of the public key authentication server 3 shown in Figure 2, the processing unit 11 needed to read the SIM identifier and subscriber identifier stored in the SIM 10. Therefore, if a malicious application is running in the processing unit 11, the information stored in the SIM 10 could be misused. Thus, encrypted communication by the SIM 10 can be applied not only to the sending and receiving of private keys, but also to the sending and receiving of any information stored in the SIM 10.

[0038] Figure 5 shows, as an example, the sequence when SIM10 is made to perform encrypted communication during the registration process of the public key authentication server 3. In S40, the processing unit 11 sends a registration instruction to SIM10. In response to the registration instruction from the processing unit 11, SIM10 communicates with the authentication server 3 in S41 and starts the communication key exchange process. The information for communicating with the authentication server 3 is stored in SIM10 in advance. Alternatively, the information for communicating with the authentication server 3 is notified by the processing unit 11 in S40. In S42, SIM10 sends a registration request including the SIM identifier to the authentication server 3. In response to the registration request, the authentication server 3 sends challenge data to SIM10 in S43.

[0039] In S44, SIM10 generates a private key and a public key pair, and in S45 stores the private key. Based on the generated private key, SIM10 generates signature data for the challenge data, and in S46 sends the public key and signature data to the authentication server 3. The authentication server 3 verifies the signature data using the public key. If the verification is successful, in S47, the authentication server 3 associates the public key with the SIM identifier received in S42 and stores it, and in S48 notifies SIM10 that registration is complete. In S49, SIM10 notifies the processing unit 11 that registration is complete.

[0040] Furthermore, the application of encrypted communication by SIM 10 to which information stored in SIM 10 is to be determined according to the importance of the information and can be set in the processing unit 11 in advance. In summary, according to this embodiment, predetermined information stored in SIM can be securely transmitted to and from external devices.

[0041] Furthermore, this disclosure provides a program executable on one or more processors. The program, when executed on one or more processors of the device, includes instructions that cause the device to function, for example, as WD1 or management server 4. Furthermore, this disclosure provides a non-temporary computer-readable storage medium storing the above program. Furthermore, this disclosure provides methods that WD1 and management server 4 execute for the processes illustrated in Figures 2 to 5. Furthermore, this disclosure provides a program for causing a device having one or more processors to execute these methods, and a non-temporary computer-readable storage medium storing the program.

[0042] The invention is not limited to the embodiments described above, and various modifications and changes are possible within the scope of the gist of the invention.

[0043] With the above configuration, predetermined information stored on the SIM can be securely transmitted to and from external devices. Therefore, it becomes possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote sustainable industrialization and foster innovation." [Explanation of symbols]

[0044] 10: SIM, 11: Processing Unit

Claims

1. A wireless device for a mobile communication network, An integrated circuit that stores a profile for accessing the aforementioned mobile communication network, Processing means for performing communication processing via the aforementioned mobile communication network, Equipped with, The aforementioned integrated circuit is a wireless device configured to perform a key exchange process with a server when communicating with the server and generate a communication key for encrypting the communication.

2. The wireless device according to claim 1, wherein the integrated circuit performs the key exchange process in accordance with Hypertext Transfer Protocol Secure (HTTPS).

3. In the communication with the server, The wireless device according to claim 1, wherein the processing means performs processing at or below the Internet Protocol (IP) layer, and the integrated circuit performs processing at layers higher than the IP layer.

4. In the communication with the server, The wireless device according to claim 1, wherein the integrated circuit encrypts the information stored in the integrated circuit with the communication key and transmits it to the server, or decrypts the information encrypted with the communication key received from the server with the communication key and stores it.

5. The wireless device according to claim 4, wherein the integrated circuit encrypts the secret key stored in the integrated circuit with the communication key and transmits it to the server.

6. The wireless device according to claim 5, wherein when the integrated circuit encrypts the secret key stored in the integrated circuit with the communication key and transmits it to the server, it also encrypts the identifier of the integrated circuit or the subscriber identifier associated with the profile, which is stored in the integrated circuit, with the communication key and transmits it to the server.

7. The identifier of the aforementioned integrated circuit is an integrated circuit card identifier (ICCID) or an embedded identification document (EID), The wireless device according to claim 6, wherein the subscriber identifier is an International Mobile Subscriber Identifier (IMSI).

8. The wireless device according to claim 4, wherein the integrated circuit, upon receiving a secret key encrypted with the communication key from the server, decrypts the secret key encrypted with the communication key using the communication key and stores it.

9. The wireless device according to claim 8, wherein the integrated circuit receives the private key encrypted with the communication key from the server as a response to the integrated circuit encrypting the identifier of the integrated circuit or the subscriber identifier associated with the profile stored in the integrated circuit with the communication key and sending it to the server.

10. The wireless device according to claim 5, wherein when the integrated circuit encrypts the secret key stored in the integrated circuit with the communication key and transmits it to the server, it encrypts a group identifier for identifying a group of integrated circuits that the server can transmit the secret key to with the communication key and transmits it to the server.

11. The server stores the authentication information for the wireless device. The wireless device according to claim 10, wherein the integrated circuit performs the key exchange process with the server, and after the server authenticates the wireless device based on the authentication information, the integrated circuit encrypts the secret key stored in the integrated circuit with the communication key and transmits it to the server.

12. The wireless device according to claim 10, wherein the integrated circuit encrypts the group identifier with the communication key and transmits it to the server in order to receive the secret key encrypted with the communication key from the server.

13. A program that, when executed on one or more processors of a device having one or more processors, causes the device to function as a wireless device according to any one of claims 1 to 12.

Images