Quantum-resistant SIM card

Abstract

To provide a legacy mobile communication device that includes a quantum-resistant smart card configured to provide a mobile communication device with access to a mobile network or an integrated telecommunications network.SOLUTION: A legacy mobile communication device includes a quantum-resistant SIM card that encrypts data in accordance with standard of at least 256-bit encryption, including at least AES-256 and eAES as defined in the ISO / IEC 18033-3:2011 standard, dynamically loads an upgraded protocol stack that enables connectivity to a new wireless network over an existing frequency, and supports encryption of data that follows the standard of at least 256-bit encryption using at least AES-256 or eAES as defined in the ISO / IEC 18033-3:2011 standard.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present disclosure generally relates to SIM cards, which refers to chip card devices. [Background technology]

[0002] SIM cards are commonly known for use with mobile devices.

[0003] SIM stands for subscriber identity module or subscriber identification module. Thus, a SIM card contains unique information that identifies it to a particular mobile network, which allows a subscriber (like you) to use the communication features of the device.

[0004] Some mobile devices require a SIM card to identify the owner and communicate with a mobile network. For simplicity, reference will be made below to mobile phones that use removable SIM cards, but it should be understood that any mobile device that uses a SIM card, whether embedded or not, is considered equivalent by the present invention.

[0005] A SIM card simply looks like a small piece of plastic. The essential part is a tiny integrated chip that can be read by the mobile device in which it is inserted and that contains a unique identification number, a phone number, and other data specific to the user to whom it is registered.

[0006] Hereinafter, 1G refers to the first generation of wireless cellular technology, 2G refers to the second generation of technology, etc.

[0007] 2G telephony technology began in 1991 and introduced call and text encryption along with data services such as SMS, picture messaging, and MMS.

[0008] The introduction of 3G networks in 1998 brought faster data speeds than 2G, as well as a number of improvements that made security substantially better than the original GSM.

[0009] One caveat for a 3G / LTE user is that she / he may not be using it. Most phones are programmed to gracefully "fail over" to GSM if 3G / 4G connectivity is deemed unavailable. Active attackers exploit this feature to implement rollback attacks, i.e., clogging 3G / 4G connectivity, thereby reinstating all of the GSM attacks available against 2G.

[0010] Hence, there appears to be a need to improve security in existing 2G, 3G and 4G mobile phones, which is essential for mobile phone users to accomplish confidential network transactions.

[0011] One of the problems that the present invention aims to overcome is the provision of improved security in existing 2G, 3G and 4G mobile phones. Summary of the Invention [Means for solving the problem]

[0012] According to one aspect of the invention, a quantum-resistant SIM card is configured to enable access to a mobile network or a converged telecommunications network for a mobile communications device, the quantum-resistant SIM card comprising: encryption means configured for encryption of data according to a standard of at least 256-bit encryption from the list including at least AES-256 and eAES defined in the ISO / IEC 18033-3:2011 standard; dynamic loading means configured for dynamically loading an upgraded protocol stack into the intended legacy communications device to enable the intended legacy communications device to connect to a new wireless network by re-using existing frequencies mastered by the intended legacy communications device; and at least one hardware accelerator system enabling the SIM card to provide support for encryption of data according to a standard of at least 256-bit encryption from the list including at least AES-256 and eAES defined in the ISO / IEC 18033-3:2011 standard.

[0013] In a preferred embodiment, eAES includes a round function and a key schedule, where the round function is based on AES and the key schedule is any one of the combinations in a list including at least SHA2+HKDF, SHA3(cSHAKE).

[0014] In a further preferred embodiment, a combined SHA2+HKDF, subkey is calculated based on the intended user's key using the HKDF extension of the user's key, the cipher suite string and the number of rounds.

[0015] In a further preferred embodiment, cSHAKE is used as a key derivation mechanism in the construction of eAES.

[0016] The foregoing and other objects, features and advantages of the present invention, as well as the manner in which they are accomplished, will become more apparent and the invention itself will be best understood from a consideration of the following description taken in conjunction with the accompanying drawings illustrating several preferred embodiments of the present invention.

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate presently preferred embodiments of the invention and, together with the general description given above and the detailed description given below, serve to explain features of the invention. [Brief description of the drawings]

[0018] [Figure 1] 1 shows an example of a UICC-based SIM card known from the prior art and which can be used to implement the present invention. [Diagram 2] 1 shows an example of a connection between a UICC-based SIM card and a contactless front-end (CLF) according to the prior art. [Diagram 3] 1 illustrates an example of software layers with an NR compatibility stack application as implemented in the case of a UICC-based SIM card supporting multiple MNO profiles in accordance with the present invention. [Figure 4] Included are flow diagrams illustrating transactions accomplished in accordance with implementations of the present invention. [Diagram 5] 1 includes a pseudocode example for a secure key expansion function according to an example of the present invention. [Figure 6] It provides a flow diagram for the respective execution of the key schedule and the round functions, noting that the secure key expansion of FIG. 5 is used for the key schedule, and that the round functions are equivalent to the AES round functions, which are defined in the ISO / IEC 18033-3:2011 standard and are therefore provided here for informational purposes only, and are standard components that are reused to provide an improved version of the standard thanks to the improved key schedule. [Figure 7]It provides a flow diagram for the respective execution of the key schedule and the round functions, noting that the secure key expansion of FIG. 5 is used for the key schedule, and that the round functions are equivalent to the AES round functions, which are defined in the ISO / IEC 18033-3:2011 standard and are therefore provided here for informational purposes only, and are standard components that are reused to provide an improved version of the standard thanks to the improved key schedule. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] The same reference numbers are used herein, where possible, to designate identical elements common to the drawings, and images may be simplified for illustrative purposes and not drawn to scale.

[0020] The present invention relates to a SIM card, meaning a chip card device. SIM cards are described in patent publications, examples of which are DE101009006487 A1, US5442704 A, US5491827A and US6859650, which are incorporated herein by reference. However, the terms "SIM card" and "SIM" may include any type of smart card that allows the same or similar type of functionality as a SIM. A SIM card is considered regardless of its form factor, or embedded / integrated nature. A SIM card is further considered to be intended to access a mobile network or an integrated telecommunications network, with a 256-bit symmetric encryption level as a minimum security, allowing an end user to communicate securely, even if the user uses a legacy phone, meaning only for 2G, 3G or 4G networks that lack such encryption by default, provided that the telecommunications network operator adapts the communication with its counterpart to support such encryption.

[0021] Specifically, a SIM card according to the invention is preferably enabled to support at least the following encryption algorithms:

[0022] AES-256, as defined in the corresponding ISO / IEC 18033-3:2011 standard, and

[0023] eAES, defined in the algorithm and flow diagram description provided below, allows for key sizes up to 512 bits in its current design (in theory, keys up to 1024 bits are supported but are out of range).

[0024] Since eAES is a fairly recent nomenclature, we quote here the definition provided by ISO in consideration of its standardization: The goal of eAES is to extend 18033 with a new key schedule for AES with key sizes of 256 and above. 18033 is, of course, the ISO number. eAES is described in more detail in the publication "Towards post-quantum symmetric cyptography, John Gregory Underhill and Stiepan Aurelien Kovac, and Xenia Bogomolec", https: / / eprint.iacr.org / 2019 / 553.pdf Available online at: http: / / www.nist.gov / pubs / articles / 2013023133 / eAES-evolved-AES-20130231325, which is incorporated herein by reference. eAES, evolved AES, brings a modified key schedule to AES that is based on a cryptographically secure key derivation function, making classical attacks such as related-key attacks impossible and side-channel attacks more difficult, since an attacker needs to obtain all the round keys as they are incremented. Given its quantum-resistant focus, it allows for keys of 256 bits or more, which is in line with what NIST IR 8105 predicted (doubling the key size). The proposed new maximum size is 512.

[0025] In cases where smart cards are used, as opposed to being limited to SIM cards, eAESe can be used with DUKPT. It should be noted that ANSI X9.24-3-2017 is a reference to the DUKPT standard.

[0026] In particular, the case where legacy devices use a SIM card according to the invention, joining New Radio (NR) networks («5G») using frequencies of other previous GSM generations (2G, 3G and / or 4G), is supported here, provided that operators switch to such upgraded legacy networks instead of deploying full-fledged 5G networks. At the same time, the SIM card according to the invention renders ineffective so-called «downgrade attacks» aimed at lowering the security level of communications to 2G, which is close to non-existent due to today's available decryption hardware.

[0027] The SIM card according to the invention therefore solves two main problems of the current interconnected society. This is especially true in countries where people rely on their mobile device as the only access to banking services, with all the security this carries. For this reason, the eAES algorithm, in its 256-bit variant, should be used by default, both for integrity protection and encryption, as well as the corresponding keys to identify the user within the network.

[0028] The eAES algorithm is quantum-resistant, i.e., according to subject matter experts, including major technology company IBM, by upgrading the original key schedule of the weak AES, making it resistant to computers that are expected to be on the market by 2023-2033, thereby making it cryptographically secure, including against attacks by such computers, and not possible related-key attacks (which are possible with the original AES key schedule and are further enabled by quantum computers). The SIM card according to the invention enables quantum-resistant mobile and convergent communications. Moreover, the SIM card according to the invention, in the case of its removable version, makes this possible without replacing the device using it, allowing a smooth and environmentally friendly transition to 5G networks.

[0029] Similarly, on the carrier infrastructure side, switching to eAES will enable the reuse of existing hardware optimized to run AES, thus delivering similar benefits in terms of financial and environmental cost savings.

[0030] Feature SIM card as used herein includes legacy SIM card technology, but is also known in the art under the names eSIM, SoC and UICC. An eSim, as the name suggests, is an embedded SIM, where a SIM SoC (system on chip) emulates the functionality of a traditional SIM card.

[0031] In the following, reference is made to the term UICC, which may be used interchangeably with SIM card for the purposes of the present invention. The term UICC stands for Universal Integrated Circuit Card. UICC is the newer generation of SIM used in high speed wireless networks. UICC identifies the user to his / her wireless operator so they know your plan and services. It may store the user's contacts, enable secure and reliable voice and multimedia data connections, international roaming, and add new applications and services remotely. UICC is known as a universal application distribution platform that works with any 3G or 4G device. For 2G devices, it is common to use a conventional SIM card.

[0032] However, a big advantage of the UICC over a SIM card is that it can have multiple applications on it. One of these, the USIM application, identifies you and your phone plan to your wireless service provider using one of these standards: Universal Mobile Telecommunications System (UMTS), High Speed ​​Packet Access (HSPA) or Long Term Evolution (LTE). Another application, the CDMA SIM (CSIM), allows access to a CDMA network, which is distinct from a GSM or UMTS network. Other possible applications include ISIM, which secures mobile access to multimedia services, and non-communication applications such as payments. For example, many subscribers have a UICC with USIM and ISIM applications for phone services and multimedia, respectively.

[0033] Another advancement is that the UICC can communicate using the Internet Protocol (IP), the same standard used by the Internet and new generation wireless networks. It can also support multiple PIN codes, which can help prevent third parties from misusing personal information.

[0034] FIG. 1 shows an example of a UICC card that can be used to implement the present invention. The contact elements in the terminal at positions C4 and C8 are optional. If present and not used, they are either pulled to state L or provide high impedance to the UICC. These contacts can be used if the UICC is determined to be a multi-application UICC or if the terminal supports an optional interface using these contacts. Contact C6 does not need to be provided for plug-in / mini-UICCs. The UICC card (or SIM card in any form factor) can further integrate hardware accelerators to enable it to execute SHA-2, HMAC and AES algorithms without implementing them in software, with SHA-3 (CSHAKE) as an optional add-on, on its microprocessor and integrated memory, which is beyond the scope of the present invention and it is intended to reuse industry standard components for that purpose, such as but not limited to ARM cores.

[0035] A SIM card according to the invention embeds an application that dynamically loads into a legacy device, using protocols for the transmission of digital information available for the SIM card technology in use, as known in the art, to provide the legacy device with an upgraded protocol stack (see FIG. 3 for an example representation of the different software layers in a UICC system, including the upgraded protocol stack, labeled "NR compatible stack application" - a note on "eAES improved ISDR"; ISDR (Issuer Security Domain - Root) is a GlobalPlatform representation, where the invention provides for the replacement of the AES encryption in [1] by the eAES upgraded (non-standard) version of [1], which will hopefully be standardized in the future. As this may cause problems in some usage scenarios, the use of [1] as is, relying on the original AES, is supported by the fact that the invention also supports AES-256 and SHA2(-512) as in [1], which combination is the strongest encryption profile supported by [1], not a weak profile. Reference [1]: GlobalPlatform: Secure channel protocol '3'-card specification v2.2-amendment d v1.1.1 (July 2014)) reuses existing 2G, 3G or 4G frequencies to connect to the New Radio (NR, also called 5G) network, whatever is in use in the country, if the operator wishes to use such a design (the operator may also use the existing 3G or 4G network with upgraded encryption). In NR terminology, what it specifically does is to enable compatibility with bearer types NG-RAN, independent of the frequency selected by the Mobile Network Operator (MNO), if the MNO chooses to use such bearer types. To achieve that goal, it uses the call control by USIM functionality described in 3GPP TS 31.111 version 9.4.0 Release 9 to replace call and / or USSD operations by their secure equivalents on the NR network.The latter part also applies if the MNO chooses not to use NR for the USSD messages, e.g., the USSD messages are replaced by a secure equivalent using eAES encryption, which is also described in this invention. Figure 3 shows how this should be implemented for a UICC-based SIM card supporting multiple MNO profiles.

[0036] In the case of newer 4G phones, where the radios are software upgradeable, this can be combined with a software upgrade, in some cases allowing connection to a «true» NR network. The same theory applies to 5G devices as far as the AES algorithm and its upgrade to eAES are concerned (e.g. a software update allows switching to eAES on those devices). As the protocol stacks in question are standard, they will not be described in detail here.

[0037] Here we will describe an example of a communication interface between a SIM card and a legacy communication device. Figure 2 shows an example of a connection between a UICC-based SIM card and a contactless front-end (CLF) according to the prior art. Vcc (contact C1) and Gnd (contact C5) provided in the UICC are reused by the terminal to provide power supply. SWIO (contact C6) of the UICC is used for data exchange between the UICC and the CLF.

[0038] The SIM card includes at least one hardware accelerator system that enables the SIM card to support the eAES algorithm. The at least one hardware accelerator provides support for one or more of the following: Secure Hash Algorithm 2 (SHA-2) + Hash-based Message Authentication Code (HMAC) or SHA-3 (specifically, its CSHAKE key derivation function). A "glue" type of computer code is configured to perform eAES while benefiting from optimal hardware acceleration. Preferably, SHA-2 + HMAC (based key derivation function) is used to provide the highest level of compatibility.

[0039] FIG. 4 includes a flow diagram illustrating a method of a transaction accomplished using a SIM card in accordance with the present invention.

[0040] First, in box Initiate an Action (e.g., Mobile Payment), an action is initiated in the communications device housing the SIM card, for example by the intended user through a user interface (both not shown in FIG. 4).

[0041] In the next step, the initiated action is communicated as USSD to the SIM card in box [SIM Captures USSD, Encrypts it with Sender Key and then Sends it to the Operator] where it is encrypted using the user's key (Sender Key) and sent to the operator operating the network to which the user is connected with the communication device. USSD stands for Unstructured Supplementary Service Data and is a Global System for Mobile (GSM) communication technology used to transmit text between a mobile phone (communication device) and an application program in the network. USSD is similar to Short Message Service (SMS), but unlike SMS, USSD transactions only occur during a session. In this example, USSD is used to initiate a mobile payment, which is "mobile" since it is initiated from the communication device. The term "operator" is employed herein to designate any one of, for example, a mobile communication operator, a bank, or a clearing house. Their meanings are therefore interchangeable with the term operator.

[0042] In the next step, the encrypted USSD received by the operator is processed by the operator in box [Operator decrypts message to USSD and checks user ID and balance] where the operator decrypts the message from the USSD and checks the user ID and balance of the account belonging to the user linked to that user ID, thereby determining whether a mobile payment can be made from that account.

[0043] In the next step, a decision is made in box "Is identity verified?" depending on the fact that the check of the user identity is positive or negative. If negative, the initiated action is rejected in box "Reject" and the method ends there. If positive, the method proceeds to box "Payment request?".

[0044] In the next step from box [Payment Request?] it is decided / checked whether a payment is intended through the initiated instance. If yes, the method proceeds to the check / decision in box [Balance Available?]. If no, the method proceeds to box [Return Balance to Sender Encrypted with Sender Key].

[0045] In the next step, in box "Balance Available?", the account balance is checked for the payment of the desired amount. If the amount is greater than the amount revealed by the balance, the method proceeds to box "Reject", where the method ends. If the amount is equal to or less than the balance, the method proceeds to box "Log and Apply Transaction".

[0046] The next step, box [Log and Apply Transaction], performs the actual required processing of logging the transaction and accomplishing the transaction itself.

[0047] In the next step of box [Log and Apply Transaction], the method proceeds to decision box [Is eAES Recipient?]. In this box it is determined whether the recipient of the transaction can be contacted through secure messaging using eAES encryption. If yes, the method proceeds to box [Encrypt USSD with Recipient Key and Send to Recipient]. If no, the method triggers a notification to the recipient about the transaction, box [Recipient is Notified of Transaction].

[0048] If the method is directed to box [Encrypt USSD with Recipient Key and Send to Recipient], then a USSD is prepared with the encrypted message and the method proceeds to box [Recipient is notified of the transaction] where the encrypted USSD is used in the notification to the recipient of the transaction.

[0049] In the next step apart from box [Recipient is notified of transaction], a decision in box [Is encryption available?] checks whether the notification can be encrypted or not. In the positive case, the encrypted USSD is decrypted in the recipient's SIM as represented by box [SIM decrypts message for USSD]. In the negative case, the notification in the form of unencrypted USSD is received in plaintext as suggested by box [USSD is received in plaintext].

[0050] After the transaction has been applied and logged, it may be notified to the recipient in plaintext if the recipient's UE does not support eAES.

[0051] Returning now to the branch of the method that leads to box [Encrypt balance with sender key and return to sender], this is a step intended to inform the initiating user of her available balance, whereby the balance value is encrypted at the operator's end and sent back to the sender.

[0052] In the next step of box [SIM Captures and Decrypts Message], the encrypted message from the previous step is received in the SIM card of the sender's communication device where it is decrypted and the method ends.

[0053] Although the present invention has been disclosed in relation to certain preferred embodiments, numerous modifications, variations, and changes to the described embodiments, as well as equivalents thereof, are possible without departing from the scope and sphere of the present invention. Accordingly, the present invention is not limited to the described embodiments, but is intended to be given its broadest reasonable interpretation in accordance with the meaning of the appended claims. In particular, the present invention is in no way limited to the UICC SIM card format, but can be applied to either the case of a classical SIM card, or the newer case of an embedded SIM card or even a system-on-chip that emulates a SIM card.

[0054] Modern symmetric block cipher based encryption algorithms consist of two main parts: a key schedule, which determines the resistance of the construction against attacks on the key and serves to build round keys from the user's key, and a core encryption loop that is called for a certain number of rounds, hence sometimes shortened to «round function». In the AES standard, the key schedule mainly relies on the XOR (exclusive OR) binary operation and therefore cannot be considered cryptographically secure. This puts the burden on implementations to find workarounds to make the keys secure against related-key attacks, a necessity for quantum resistance, when using key sizes higher than 128 bits. Going forward, a solution to that problem is provided that is elegant and compatible with existing server software, especially Intel processors with AES-NI and SHA-NI instructions.

[0055] Now we come to the encryption mechanism implemented within the intended user / sender's SIM card, which utilizes eAES, which similarly uses round functions and key schedules.

[0056] The round function is identical to the AES specification, thereby allowing hardware compatibility with existing CPU optimizations for AES. The number of rounds processed in the main loop is determined by the value of Nr and differs from the AES specification (it is instead based on recommendations in the original Rijndael design underlying AES). This means that to achieve greater security, the core AES loop is executed more times than in the AES standard, the exact number of times being defined by Nr.

[0057] An outline of the secure key expansion function is illustrated in Fig. 5 as pseudocode. The octet key size ks is calculated as the cipher block size in 32-bit words Nb × the number of rounds Nr + 1 × the number of octets in each 32-bit word. A temporary array of bytes tmp is generated by HKDF Expand (or alternatively cSHAKE) using the input cipher key and an optional distribution code dc array as input. HKDF is a simple key derivation function (KDF) based on the Hash-based Message Authentication [1] code (HMAC). The main approach followed here is HKDF Expand, where the KDF logically "expands" the key into some additional pseudorandom keys (the output of the KDF). It is formally described in RFC 5869. cSHAKE is a customizable variant of the SHAKE function defined in FIPS 202. SHAKE (Secure Hash Algorithm and KECCAK) is an Extensible Output Function (or XOF). It is like SHA-3, but with variable-sized outputs. The use of either HKDF or cSHAKE makes the key schedule cryptographically secure, as opposed to the original AES key schedule, which is based on XOR. Higher SHA-2 and SHA-3 profiles, such as SHA-2 512, are considered quantum-resistant, since the round functions themselves are considered quantum-resistant when operating with sufficiently large keys according to current knowledge, i.e., at least 256-bit keys, thereby making the entire construction quantum-resistant. This array of octet-sized integers is then converted to a 32-bit word and added to the round subkey array w.

[0058] 6 and 7 provide flow diagrams for the execution of the key schedule and round functions, respectively.

[0059] FIG. 6 illustrates the default HKDF (HMAC(SHA2)) key schedule in eAES, where based on the input encryption key (user's key), a subkey is calculated using the HKDF extension of the key, the cipher formal name string, and the number of rounds, as explained in more detail in the pseudocode in FIG. 5. With regard to FIG. 7, this illustrates an implementation example using SHA2+HKDF, which is an exact equivalent of the AES round function, so there is no point in describing the round function in more detail here. For further details, the reader is referred to ISO / IEC 18033-3:2011, or the corresponding NIST publications, both of which are available under FRAND conditions. The same applies to the details of HKDF, which are published as an IETF standard and therefore freely available on the Internet. Finally, since SHA-2 is also a NIST standard, it is available on the NIST website.

[0060] As already mentioned herein above, any smart card should be included as being adapted in place of a SIM card, so long as it allows the same type of functionality as a SIM, including payment, but without relying on USSD messages, which are specific to GSM systems, and therefore involves the use of a SIM card as such.

Claims

1. A legacy mobile communications device, comprising: A quantum-resistant SIM card, encrypting the data according to at least a 256-bit encryption standard, including at least AES-256 and eAES as defined in the ISO / IEC 18033-3:2011 standard; Dynamically loads an upgraded protocol stack that enables connection to new wireless networks over existing frequencies; Supports encryption of data in accordance with said standard of at least 256-bit encryption using at least AES-256 or eAES as defined in said ISO / IEC 18033-3:2011 standard. A quantum-resistant SIM card configured to A legacy mobile communication device comprising:

2. The eAES of the quantum-resistant SIM card is A key schedule, the key schedule comprising either SHA2+HKDF subkeys or SHA3 (cSHAKE) subkeys. The legacy mobile communications device of claim 1 , comprising:

3. The eAES of the quantum-resistant SIM card is a round function, the SHA2+HKDF subkey being calculated based on the intended user's key using an HKDF extension of the intended user's key, a cipher suite string, and a round number. The legacy mobile communications device of claim 2 , comprising:

4. 4. The legacy mobile communications device of claim 3, wherein the quantum-resistant SIM card's eAES computes the SHA2+HKDF subkeys by default.

5. The legacy mobile communications device of claim 3 , wherein the cryptographic formal name string enables market-specific or vertical-specific personalization.

6. The eAES of the quantum-resistant SIM card is A round function, in which cSHAKE is used as a key derivation mechanism in the construction of eAES as an alternative to SHA2+HKDF when SHA3 hardware acceleration is available. The legacy mobile communications device of claim 2 , comprising:

7. The quantum-resistant SIM card comprises: encryption means configured to encrypt said data according to eAES, which will be standardized in ISO / IEC 18033-3 and ISO / IEC 18033-7; The legacy mobile communication device of claim 1 , further comprising:

8. The quantum-resistant SIM card comprises: dynamic loading means configured to load the upgraded protocol stack for connecting to the new wireless network; The legacy mobile communications device of claim 1 , comprising:

9. The quantum-resistant SIM card comprises: at least one hardware accelerator enabling support for encryption of said data; The legacy mobile communications device of claim 1 , comprising:

10. 10. The legacy mobile communications device of claim 9, wherein the at least one hardware accelerator is operable to aid in random number generation in the case of eAES.

Images