Content providing to integrated secure element

Abstract

A method for preparing contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, comprising: • a) provide in the HSM a pre-shared key, PSK, which is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed (SI), wherein the KDC is identical for a multitude of multiple iSEs, and the first seed (51) is specific or unique for a specific contents provider (CP) of said contents; • b) in the HSM, provide a second seed (S2) which is specific or unique for the iSE, and from the PSK and the second seed, apply a CEK-key-derivation scheme so as to derive a code encryption key, CEK; • c) in the HSM, encrypt the code package with the code encryption key, CEK, and by applying a code encryption scheme, so as to generate an encrypted code package (OS packet); • d) in the HSM, generate a header including the second seed (S2) and, if required: information on the code encryption scheme of step c) or / and information on the CEK-key-derivation scheme of step b); • e) in the HMS, encrypt the header with the PSK, or with a header encryption key derived from the PSK, and by applying a header encryption scheme, so as to generate an encrypted header (Header); • f) in the HSM, merge the encrypted code package (OS packet) and the encrypted header (Header) so as to create a binary large object, BLOB, to be transferred to the iSE.

Description

[0001] Content providing to integrated Secure Element

[0002] Field of the invention

[0003] The present invention relates to content providing to and integrated Secure Element, iSE, which is integrated or is destined to be integrated into a board (chipset) of a mobile network communication device, or briefly mobile device. Particularly, the invention relates to preparing content to be provided to an iSE at an HSM, and to providing to and receiving content provided by an HSM at an iSE.

[0004] Background of the invention and prior art

[0005] A mobile network communication device, or briefly mobile device, is an entity having capability to communicate in a mobile communication network, sometimes also referred to as radio network or wireless network. A mobile device hosts a Secure Element, also referred to as UICC or xlllCC, in which credentials for authentication of the mobile device or a mobile device holder versus the mobile communication network, and possibly also vice- versa, are stored. The data set or credentials used in authentication is also referred to as a subscriber identity profile, or briefly profile. A Secure Element can include either only one profile (particularly in a traditional SIM card) or alternatively several profiles.

[0006] As form factors of Secure Elements or UICCs of mobile devices, pUICCs or SIM cards and embedded UICCs, eUlCCs, are known for a long time. The pUICC and eUlCC formfactors provide an own stand-alone hardware of the Secure Element. A newer concept of Secure Element or UICC for mobile devices is that of an integrated Secure Element, iSE, also referred to as integrated UICC, iUICC, wherein the functionality equal to that of a traditional SIM card is implemented directly into a board, also referred to as chipset, of the mobile device. The iSE or iU ICC does not provide of an own stand-alone hardware, however is from hardware side integrated into the hardware of the mobile device's board or chipset. At some time, of course, also the board or chipset has to be produced and assembled from parts.

[0007] Code like an operating system or applications, data and credentials for authentication of the Secure Element are provided to Secure Elements by specialized Secure Element manufacturers. For pUICCs and elllCCs, the code, data and credentials can be programmed into the pUICCs and elllCCs during manufacture of the pUICCs and eUlCCs at the Secure Element manufacturer.

[0008] An iSE cannot be removed from the mobile device like a SIM card. Providing contents like code (including operating system and / or applications) or data to the iSE requires complex interaction between the Secure Element manufacturer providing the code or data on the one hand, and a manufacturer of the mobile device and a manufacturer of the board or chipset on the other hand, thus between three different manufacturer parties.

[0009] A hardware security module, HSM, is a secured hardware processing entity which is used in distributed manufacturing architectures, wherein one party provides software contents to be provided to a hardware, however a different party provides the software to the hardware. The HSM contains secret credentials like keys or seeds (random or pseudo-random numbers that can be added to initial key material to create uniqueness) which are credentials required for providing the desired software contents to the hardware, without the party executing the providing of software contents to the hardware having knowledge of the secret credentials.

[0010] In a typical iSE setup, three parties are involved, namely (1) an integrated Secure Element manufacturer, iSE manufacturer, which is a provider of an operating system, personalization data, applications and profiles for the iSE, (2) a mobile device manufacturer, and (3) a board or chipset manufacturer. The iSE manufacturer provides the software to be programmed into the iSE, however not the SE hardware, since the SE hardware is incorporated into the board (chipset) of the mobile device. The board (chipset) manufacturer manufactures a board (chipset) hardware, which is to be installed into a mobile device later, and into which an iSE hardware is incorporated, which still lacks the iSE software (which software will be provided to the iSE later from an HSM). Typically, secure credentials, and / or software contents secured with the secret credentials, are provided by the iSE manufacturer or / and the mobile device manufacturer, and the iSE manufacturer or / and the mobile device manufacturer provides the secure credentials and secured software contents to an HSM, or partly generates the credentials and / pr secured software contents in the HSM. The HSM, with the secret credentials and / or secured software contents included in the HSM, is provided to the board (chipset) manufacturer which already possesses the board with the (empty) iSE lacking the iSE software contents, like operating system, applications, personalization data and profiles. The board (chipset) manufacturer transfers secured contents from the HSM to the iSE, without having knowledge of credentials kept secret in the HSM.

[0011] The document [1] EP4158516A1 (GD 513840) from the prior art discloses a method for programing an operating system into an integrated Secure Element, iSE, wherein the operating system is transferred from a hardware security module, HSM, to the iSE in an encrypted form, encrypted with a shared-secret which is derived by each of the HSM and the iSE by a key derivation mechanism, based on a public / private key pair of the HSM and a public / private key pair of the iSE, wherein each party calculates the shared-secret from the own private key and the other party's public key. Together with the operating system, personalization data, applications and profiles can be loaded from the HSM to the iSE.

[0012] The method of [1] EP4158516A1 provides for a secure solution for programming an operating system into a particular iSE integrated into a particular board or chipset, provided, the HSM and the iSE exchange their public keys.

[0013] According to [1] EP4158516A1, all code and data, which may include the operating system, personalization data, applications and profiles, preferably are loaded from the HSM to the iSE in a monolithic encrypted binary large object, Blob, which is encrypted with a key that is specific to the HSM and the iSE, thus specific to one specific instance of a board (chipset). When a general update of the operating system for multiple boards or chipsets or iSE is desired or required, with the solution proposed in [1] EP4158516A1, it is required to have available public keys of all iSEs / boards / chipset to which the update shall be provided.

[0014] The key management for the multiple iSEs / boards / chipset at the HSM, so as to enable providing the operating system update to multiple iSEs, is cumbersome.

[0015] For other contents to be provided to an iSE, for example iSE unique data, the system proposed in [1] EP4158516A1 might well be applicable, in parallel to the inventive system.

[0016] Cloning of contents, particularly code, in other words copying the contents / code to further target platforms than the allowed one or ones is a problem for platforms embodied as iSEs, i.e. when contents / code has to be loaded and installed or stored into an iSE. of the invention

[0017] It is an object of the present invention to provide an efficient and flexible and secure solution that enables providing contents to iSEs which are identical for multiple iSEs, such as operating systems or operating system updates. of the invention

[0018] The object of the invention is achieved by a method with following features, according to claim 1. Embodiments of the invention are presented in dependent claims.

[0019] In greater detail, the object of the invention is achieved by an method for preparing contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, which is integrated into or destined to be integrated into a board of a mobile device, the method comprising the steps:

[0020] - provide in the HSM contents at least in form of a code package, which when transferred to the iSE enables installation of code corresponding to the code package in the iSE, and encrypt the code package in the HSM. The method is characterized by the steps: a) provide in the HSM a pre-shared key, PSK, which is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed SI; the key-derivation constant KDC is identical for a multitude of multiple iSEs; the first seed SI is specific or unique for a specific contents provider CP of said contents, however the first seed SI is (in general) not specific for only one single iSE; b) in the HSM, provide a second seed S2 which is specific or unique for the iSE, and from the PSK and the second seed, apply a CEK-key-derivation scheme so as to derive a code encryption key, CEK; c) in the HSM, encrypt the code package with the code encryption key, CEK, and by applying a code encryption scheme, so as to generate an encrypted code package; d) in the HSM, generate a header including the second seed and, if required: information on the code encryption scheme of step c) or / and information on the CEK-key-derivation scheme of step b); e) in the HMS, encrypt the header with the PSK and by applying a header encryption scheme, so as to generate an encrypted header; f) in the HSM, merge the encrypted code package and the encrypted header (Header) so as to create a binary large object, BLOB, to be transferred to the iSE.

[0021] The pre-shared key, PSK, is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed SI.

[0022] The a key-derivation constant, KDC, is universal, thus not specific to a single iSE, and not or at least not necessarily specific or to a single contents provider, and is permanently stored in the iSE. Thus, the key-derivation constant, KDC, can be used as a root for individualization for any contents provider or / and for any iSE, in that further data such as a seed, which is specific to the contents provider or iSE is combined with the root provided by the universal key-derivation constant KDC. The first seed SI is specific or unique for a specific contents provider CP of said contents. Correspondingly, the pre-shared key PSK is specific or unique for a specific contents provider CP of said contents. The first seed SI and the pre-shared key PSK thus enable to individualize the contents to be provided to iSEs to only the iSEs of one single content provider, preventing other contents providers from installing the contents in their iSEs. Herein, the contents provider may be embodied as one single contents provider or a group of cooperating contents providers, which share the same seed SI and pre-shared key PSK, and thus to the external act like a single contents provider.

[0023] The pre-shared key, PSK, also enables the content provider to securely communicate with multiple iSEs or boards with an identical shared-key PSK. When identical code like an operating system is to be provided to multiple iSEs or boards, the code can be provided to the HSM secured with universal the pre-shared key, PSK.

[0024] When a BLOB with code is to be provided to a specific target iSE, then in the HSM, a code encryption key CEK is derived from the pre-shared key PSK and a second seed S2 which is now specific to the specific target iSE. The code is encrypted with the iSE specific (= board specific) code encryption key and sent from the HSM to the iSE. The iSE can internally also derive the code encryption key, decrypt the code package and install the code. A different iSE which would have a different second seed S2, and thus a different code encryption key CEK, however cannot decrypt the code package. The usage of the iSE specific code-encryption key CEK thus prevents cloning of the code.

[0025] Thus, code can first be provided to the HSM in a universal format, which is suitable for multiple iSEs, and be made individual for a target iSE in the HSM.

[0026] This holds particularly for code in form of an operating system or updates for an operating system, which are typically identical for multiple iSEs or board, thus can be sent to multiple iSEs in an identical form, whereas an individualization to a single iSE is performed to prevent unallowed cloning of the code. - 1-

[0027] The header of the BLOB, on the other hand is encrypted with the pre-shared key PSK which is identical for multiple iSEs and specific only to the contents provider. Thus the header can always be decrypted by the correct contents provider, so as to analyze the code package and initiate further processing.

[0028] In addition, in that the code encryption key CEK is derived from the contents provider specific pre-shared key PSK, also the code encryption key CEK is bound to the contents provider. Abusive spreading of contents to iSEs of other contents providers is prevented.

[0029] Accordingly, the invention provides an efficient and flexible and secure solution that enables providing contents to iSEs which are identical for multiple iSEs, such as operating systems or operating system updates.

[0030] The binary large object, BLOB, is a format which allows that, when a BLOB including contents is loaded into an iSE, and the BLOB is processed in the iSE, then by the loading and processing the contents are installed or stored in the iSE in a controlled manner, essentially without the necessity to manually effect the installing or storing by sending, after the loading, single commands to the iSE.

[0031] The pre-shared key PSK can be derived inside the iSE. Alternatively, the pre-shared key PSK can be derived external to the iSE. In case any one or several or all were generated externally, the PSK and / or the KDC and / or the first seed SI may be injected into the iSE.

[0032] According to some embodiments, the code package comprises one or several of the following:

[0033] - an operating system package, OS package, which when transferred to the iSE, enables installation of an operating system to the iSE;

[0034] - an application package, which transferred to the iSE, enables installation of an application to the iSE; - an operating system package update, OS update package, which when transferred to the iSE, enables installation of an operating system update to the iSE;

[0035] - an application update package, which transferred to the iSE, enables installation of an application update to the iSE;

[0036] - universal data, particularly universal personalization data, which are identical for a multitude of multiple iSEs, and which are designed to be combined with an operating system or application in the iSE, particularly to effect personalization of said operating system or of said application.

[0037] Apart from executable code such as an operating system or an application (or an update for the same), also some data may be identical for multiple iSEs or boards, and can be handled identical to the handling of the executable code like an operating system or application (or update for the same).

[0038] In the case that several or all of operating system, application and universal data are to be provisioned from the HSM to the iSE, then either one single code package can be formed for all contents, or for each component (operating system, application, universal data) a separate code package can be generated.

[0039] According to some embodiments, the method further comprises the steps: a-1) in the HSM, provide a signing key which is specific or unique to the contents provider; g) in the HSM, with the signing key, calculate a signature over the encrypted code package or / and over the encrypted header, and merge the signature into the BLOB.

[0040] According to some embodiments, the method further comprises preparing in the HSM further contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, comprising steps: h) in the HSM, provide contents in the form of personalization data which is specific or unique to the iSE, and which is designed to be combined with the code, so as to generate personalized code, or / and one or several profiles specific or unique to the iSE; i) in the HSM, encrypt the personalization data, so as to generate encrypted personalization data or / and encrypt the profiles so as to generate encrypted profiles; j) in the HSM, merge the encrypted personalization data or / and encrypted profiles into the BLOB.

[0041] The further contents may be encrypted identically as the contents of the code package. However, if the further contents are specific to a target iSE, it can be of advantage to encrypt the further contents with an iSE specific encryption key.

[0042] Therefore, according to some embodiments, the providing of further contents described above further comprises the steps: a-2) in the HSM, provide a public and private key of a public / private key pair of the HSM, and a public key of a public / private key pair of the iSE; k) in the HSM, derive a shared-secret, SS, from the private key of the HSM and the public key of the iSE, by a key-derivation scheme; wherein: in i), the personalization data or / and profiles is / are encrypted with the shared-secret, SS; in j), the HSM public key is merged into the BLOB.

[0043] The key-derivation scheme for the shared-secret, SS, may be for example one of the following: Diffie Hellman, EC; Elliptic Curve Diffie Hellman, ECDH; Elliptic Curve Integrated Encryption Scheme, ECIES.

[0044] In the above described embodiments, preferably, the header generated in step d) further comprises information on the key-derivation scheme for the shared-secret, SS.

[0045] According to some embodiments, the method further comprises the step:

[0046] I) it the HSM, calculate an integrity check value, particularly a hash value or / and a message authentication code MAC, over some or all of the contents, particularly over the code or / and the personalization data or / and the profiles; wherein the integrity check value is calculated:

[0047] - over the unencrypted contents; or / and

[0048] - over the encrypted contents; m) merge the calculated integrity check value to the BLOB, particularly merge the calculated integrity check value to the header before the header is encrypted.

[0049] According to some embodiments, the code package further comprises universal data which are identical for a multitude of multiple iSEs.

[0050] According to some embodiments, the step to provide in the HSM contents at least in form of a code package comprises: before step c):

[0051] - provide the code package external to the HSM in encrypted form encrypted with a transport key, which may be either the code-encryption key, CEK, or the pre-shared key, PSK, or a different transport key;

[0052] - import the encrypted code package into the HSM;

[0053] - in the HSM, in case the transport key is not the code-encryption key, CEK, decrypt the code package with the transport key, which is provided in the HSM;

[0054] - provide the decrypted code package for step c).

[0055] According to the above described embodiments, the code package is brought into a transport key encrypted form, encrypted with the transport key at some time.

[0056] When the PSK is selected as transport key, multiple identical PSK-encrypted code packages for multiple iSEs / boards can be securely handled outside an HSM, even be sent by email or data transfer platform.

[0057] When a code package is to be transferred to a target iSE, and it is encrypted with a transport key which is not iSE-specific code encryption key CEK, then the transport key encrypted code package in imported to the HSM, decrypted and re-encrypted with the iSE-specific code encryption key CEK, and then transferred to the iSE.

[0058] As a general rule for the pre-shared key, the derived pre-shared key PSK can be directly transferred into a Hardware Security Module HSM.

[0059] Alternatively, the derived pre-shared key PSK can be sent from the location of derivation of the PSK, e.g. a manufacturer of the iSE, to an intermediate party, such as a content provider of contents in an arbitrary form, which can be for example via email, or via data upload over a communication network. The content provider receives the pre-shared key PSK and transfers it to a Hardware Security Module HSM.

[0060] Similarly, code or data to be provided in the HSM can be transferred to the HSM either directly, or alternatively indirectly via an intermediate party such as the content provider of the contents to be provided to the iSE.

[0061] While the foregoing description was directed primarily to the preparation of the contents to be transferred to an iSE, the following description will go into greater detail on providing prepared contents to a specific target iSE.

[0062] The inventive method is for providing contents from a hardware security module, HSM, to an integrated Secure Element, iSE, which is integrated into or destined to be integrated into a board of a mobile device.

[0063] The method comprises the step to- provide from the HSM to the iSE, contents in form of at least an encrypted code package.

[0064] The method is characterized by the steps:

[0065] - provide the contents from the HSM to the iSE as a BLOB which was prepared by a method according to a method as described above; is-1) in the iSE, provide the pre-shared key, PSK; or provide the key-derivation constant, KDC, and the first seed, and derive the PSK from the KDC and the first seed; is-2) in the iSE, decrypt the header of the BLOB with the PSK, and extract from the decrypted header the second seed; is-3) in the iSE, derive the code encryption key from the PSK and the extracted second seed (S2); is-4) in the iSE, decrypt the code package with the code encryption key, CEK; is-5) in the iSE, install the code corresponding to the code package to the iSE, and in the case of claim 9, store the universal data to the iSE.

[0066] It is noted that the second seed is iSE specific, such that only the correct target iSE is able to derive the correct code encryption key, CEK, and decrypt the code package. Accordingly, abusive cloning of code packages, such as loading a code package which is allowed for only one single target iSE to multiple iSEs, is prevented.

[0067] According to some embodiments, step is-1), in the iSE, comprises to provide the key-derivation constant and to derive the pre-shared key, PSK. Herein, according to some embodiments, the pre-shared key, PSK, is derived by an iSE boot-loader provided in the iSE.

[0068] Herein, different iSE boot-loaders may be provided in the iSE for different OS manufacturer, particularly in that different KDCs may be provided in the iSE boot-loader for different OS manufacturers.

[0069] According to some embodiments, the BLOB further comprises the signature generated as described above, wherein the method comprises, in the iSE, extracting the signature from the BLOB and verifying the signature, wherein successful verifying of the signature is required as a condition that one, several or all of steps is-1) - is-4) are executed.

[0070] According to some embodiments, the BLOB further comprises encrypted personalization data or / and encrypted profiles, wherein the method comprises, in the iSE, extracting and decrypting the encrypted personalization data or / and encrypted profiles and storing of installing them to the iSE.

[0071] According to some embodiments, the personalization data or / and profiles is / are encrypted with the shared-secret, SS, and the BLOB contains the HSM public key, wherein the method comprises, in the iSE:

[0072] - extract the HSM public key from the BLOB;

[0073] - derive the shared-secret, SS, from the iSE private key and the extracted HSM public key;

[0074] - decrypt the encrypted personalization data or / and encrypted profiles extracted from the BLOB with the derived shared-secret, SS.

[0075] According to some embodiments, the BLOB comprises a integrity check value, particularly an integrity check value merged into the header before the header is encrypted, wherein the method at the iSE comprises, particularly after decrypting the header:

[0076] - retrieving the integrity check value from the header;

[0077] - verifying the retrieved integrity check value.

[0078] Herein, verifying the integrity check value may particularly comprise one or both of the following:

[0079] - the integrity check value is calculated:

[0080] - if the integrity check value was calculated over the unencrypted contents, then decrypt the corresponding content and verify the integrity check value; or / and

[0081] - if the integrity check value was calculated over the encrypted contents, then leave the corresponding content in encrypted form and verify the integrity check value.

[0082] Following entities and elements are or can be involved in the invention.

[0083] HSM: hardware security module as a secure hardware container for credentials and code or / and data secured with credentials. iSE: integrated secure element integrated into board (chipset) of a mobile device.

[0084] Board (chipset). Mobile Device.

[0085] Code package: when transferred to an iSE enables installation of code corresponding to the code package in the iSE.

[0086] Code: operating system, application, or other code, also universal data including personalization data which are identical for multiple iSEs.

[0087] Data: personalization data, profiles, or other data.

[0088] KDC: key-derivation constant, KDC, permanently stored in the iSE, for example in a permanent iSE memory, such as OTP or ROM, and which is universal, meaning KDC is identical for a multitude of multiple iSEs, and not specific to one single iSE.

[0089] Seed: a random number or pseudo-random number.

[0090] First seed SI: a seed specific or unique for a specific contents provider of contents.

[0091] PSK: pre-shared key, PSK, derived from the universal key-derivation constant, KDC, and the first seed; thus PSK is specific to a content provider, and not specific to a single iSE; a symmetric key.

[0092] Second seed S2: a seed specific or unique for a specific iSE.

[0093] CEK: code encryption key, CEK, derived from PSK and second seed; thus CEK is specific to a content provider and specific to a specific iSE; used to encrypt code, particularly operating system and its updates, and applications and their updates.

[0094] SS: shared-secret, SS, a symmetric key derived by a derived from public / private key pairs of HSM and iSE by a key derivation scheme, e.g. DH, ECDH, ECIES.

[0095] DH: Diffie Hellman key derivation scheme.

[0096] ECDH: Elliptic Curve Diffie Hellman key derivation scheme.

[0097] ECIES: Elliptic Curve Integrated Encryption Scheme.

[0098] Data encryption, particularly encryption of personalization data or / and profiles: can be done either also by the code encryption key, CEK, or by a different key; particularly, data can be encrypted by a shared-secret, SS.

[0099] Brief description of the drawings Embodiments of the invention will now be described with reference to the accompanying drawings, throughout which like parts are referred to by like references, and in which represents:

[0100] Fig. 1 step-wise generation of a BLOB to be provided to an iSE, at an HSM, according to an embodiment of the invention;

[0101] Fig. 2 a BLOB, similar to the BLOB shown at the last step of Fig. 1, according to embodiments of the invention;

[0102] Fig. 3 a BLOB, partially similar to the BLOB shown in Fig. 1 and 2, with an additional decryption key, SH, according to embodiments of the invention;

[0103] Fig. 4 a BLOB, partially similar to the BLOB shown in Fig. 3, with additional key derivation data, K_DD, according to embodiments of the invention;

[0104] Fig. 5 a BLOB, partially similar to the BLOB shown in Fig. 1 and 2, and with details of the OS packet, according to embodiments of the invention;

[0105] Fig. 6 details of a header of a BLOB, according to embodiments of the invention;

[0106] Fig. 7 a BLOB including a header as shown in Fig. 6, according to embodiments of the invention.

[0107] Detailed description of the invention

[0108] Fig. 1 shows a schematic representation of step-wise generation of a BLOB to be provided to an iSE, at an HSM, according to an embodiment of the invention.

[0109] The step-wise generation of a BLOB to be provided to an iSE is a method for preparing contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, according to an embodiment of the invention. The iSE is integrated into or destined to be integrated into a board of a mobile device.

[0110] According to Fig. 1, first code to implement in the iSE an operating system is merged into the BLOB. The method comprises the following steps. (1) Provide in the HSM contents CC in form of a code package, which is embodied as an operating system package, which when transferred to the iSE enables installation of code in form of an operating system corresponding to the code package in the iSE, and encrypt the code package in the HSM. a) Provide in the HSM a pre-shared key, PSK, which is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed SI, wherein the KDC is identical for a multitude of multiple iSEs, and the first seed SI is specific or unique for a specific contents provider CP of said contents. b) in the HSM, provide a second seed S2 which is specific or unique for the iSE, and from the PSK and the second seed, apply a CEK-key-derivation scheme so as to derive a code encryption key, CEK; c) in the HSM, encrypt the code package with the code encryption key, CEK, and by applying a code encryption scheme, so as to generate an encrypted code package; d) in the HSM, generate a header including the second seed and, if required: information on the code encryption scheme of step c) or / and information on the CEK-key-derivation scheme of step b); e) in the HMS, encrypt the header with the PSK and by applying a header encryption scheme, so as to generate an encrypted header, Header; f) in the HSM, merge the encrypted code package, OS packet, and the encrypted header, Header, so as to create a binary large object, BLOB, to be transferred to the iSE.

[0111] Further according to Fig. 1, personalization data are merged into the BLOB, as well as an HSM ECC public key.

[0112] The corresponding method comprises: a-2) in the HSM, provide a public and private key of a public / private key pair of the HSM, and a public key of a public / private key pair of the iSE; k) in the HSM, derive a shared-secret, SS, from the private key of the HSM and the public key of the iSE, by a key-derivation scheme; h) in the HSM, provide contents in the form of personalization data which is specific or unique to the iSE, and which is designed to be combined with the code, so as to generate personalized code, or / and one or several profiles specific or unique to the iSE; i) in the HSM, encrypt the personalization data, so as to generate encrypted personalization data or / and encrypt the profiles so as to generate encrypted profiles; in i), the personalization data or / and profiles is / are encrypted with the shared-secret, SS; j) in the HSM, merge the encrypted personalization data or / and encrypted profiles into the BLOB; in j), the HSM public key (HSM ECC Public Key) is merged into the BLOB.

[0113] Further according to Fig. 1, a signature is merged into the BLOB.

[0114] The corresponding method comprises: a-1) in the HSM, provide a signing key SignK which is specific or unique to the contents provider (CP); g) in the HSM, with the signing key (SignK), calculate a signature Sign over the encrypted code package, OS packet, or / and over the encrypted header, Header, and merge the signature Sign into the BLOB.

[0115] Fig. 2 to Fig. 6 show BLOBs, according to embodiments of the invention. The BLOBs may have been generated by a method according to Fig. 1, with additional details as depicted in the respective Fig. 2 to Fig. 6.

[0116] Fig. 2 shows a BLOB, similar to the BLOB shown at the last step of Fig. 1, according to embodiments of the invention. Particularly, the BLOB includes a BLOB header, Header, a signature built over the BLOB header, Sign, and an OS packet.

[0117] Fig. 3 shows a BLOB, which comprises, in comparison to the BLOB shown in Fig. 2, an additional header encryption key, SH, according to embodiments of the invention. The header encryption key may be the pre-shared key, PSK, according to the present invention, or a header encryption key derived from the pre-shared key, PSK. According to some embodiments, the header decryption key, SH, is a key derived from the pre-shared key, PSK, and the header encryption key, SH, has a limited duration and will expire after said duration.

[0118] Fig. 4 shows a BLOB, which comprises, in comparison to the BLOB shown in Fig. 2, additional key derivation data, SH_KDD, according to embodiments of the invention. The key derivation data, SH_KDD, may be used to derive a header encryption key, SH, from the pre-shared key, PSK.

[0119] According to embodiments of the invention, different key derivation data, SH_KDD, are used to derive different header encryption keys, SH, from the same pre-shared key, PSK. The different key derivation data, SH_KDD, are used to derive different header encryption keys, SH, may be used for example for different customers, or for different batches of a same customer or of different customers.

[0120] Fig. 5 shows a BLOB partially similar to the BLOB shown in Fig. 1 and 2, and with possible details of the OS packet, according to embodiments of the invention. The OS packet of Fig. 5 comprises a subscriber identity module, SIM, operating system, OS, i.e. a SIM OS. Further, the OS packet comprises an application package APP, which transferred to the iSE, enables installation of an application to the iSE. In further embodiments, the OS packet may comprise updates for an operating system and / or updates for applications.

[0121] Fig. 6 shows details of a header of a BLOB, according to embodiments of the invention. The BLOB according to Fig. 5 comprises a header encryption key, SH, and in addition, according to Fig. 5, an iSE Loader section and an integrity check value Cl.

[0122] Fig. 7 shows a BLOB including a header as shown in Fig. 6, according to embodiments of the invention. Cited documents

[0123] [1] EP4158516A1

Claims

What is claimed is1. An method for preparing contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, which is integrated into or destined to be integrated into a board of a mobile device, the method comprising the steps:- provide in the HSM contents at least in form of a code package, which when transferred to the iSE enables installation of code corresponding to the code package in the iSE, and encrypt the code package in the HSM; characterized by the steps: a) provide in the HSM a pre-shared key, PSK, which is derived from a universal key-derivation constant, KDC, permanently stored in the iSE, and a first seed (SI), wherein the KDC is identical for a multitude of multiple iSEs, and the first seed (SI) is specific or unique for a specific contents provider (CP) of said contents; b) in the HSM, provide a second seed (S2) which is specific or unique for the iSE, and from the PSK and the second seed, apply a CEK-key-derivation scheme so as to derive a code encryption key, CEK; c) in the HSM, encrypt the code package with the code encryption key, CEK, and by applying a code encryption scheme, so as to generate an encrypted code package (OS packet); d) in the HSM, generate a header including the second seed (S2) and, if required: information on the code encryption scheme of step c) or / and information on the CEK-key- derivation scheme of step b); e) in the HMS, encrypt the header with the PSK, or with a header encryption key, SH, derived from the PSK, and by applying a header encryption scheme, so as to generate an encrypted header (Header); f) in the HSM, merge the encrypted code package (OS packet) and the encrypted header (Header) so as to create a binary large object, BLOB, to be transferred to the iSE.

2. The method according to claim 1, wherein the code package comprises one or several of the following:- an operating system package, OS package, which when transferred to the iSE, enables installation of an operating system to the iSE;- an application package, which transferred to the iSE, enables installation of an application to the iSE;- an operating system package update, OS update package, which when transferred to the iSE, enables installation of an operating system update to the iSE;- an application update package, which transferred to the iSE, enables installation of an application update to the iSE;- universal data, particularly universal personalization data, which are identical for a multitude of multiple iSEs, and which are designed to be combined with an operating system or application in the iSE, particularly to effect personalization of said operating system or of said application.

3. The method according to claim 1 or 2, further comprising the steps: a-1) in the HSM, provide a signing key (SignK) which is specific or unique to the contents provider (CP); g) in the HSM, with the signing key (SignK), calculate a signature (Sign) over the encrypted code package (OS packet) or / and over the encrypted header (Header), and merge the signature (Sign) into the BLOB.

4. The method according to any of claims 1 to 3, further comprising preparing in the HSM further contents to be provided from a hardware security module, HSM, to an integrated Secure Element, iSE, comprising steps: h) in the HSM, provide contents in the form of personalization data which is specific or unique to the iSE, and which is designed to be combined with the code, so as to generate personalized code, or / and one or several profiles specific or unique to the iSE; i) in the HSM, encrypt the personalization data, so as to generate encrypted personalization data or / and encrypt the profiles so as to generate encrypted profiles; j) in the HSM, merge the encrypted personalization data or / and encrypted profiles into the BLOB.

5. The method according to claim 4, further comprising the steps:a-2) in the HSM, provide a public and private key of a public / private key pair of the HSM, and a public key of a public / private key pair of the iSE; k) in the HSM, derive a shared-secret, SS, from the private key of the HSM and the public key of the iSE, by a key-derivation scheme; wherein: in i), the personalization data or / and profiles is / are encrypted with the shared-secret, SS; in j), the HSM public key (HSM ECC Public Key) is merged into the BLOB.

6. The method according claim 5, wherein the key-derivation scheme for the shared-secret, SS, is one of the following: Diffie Hellman, EC; Elliptic Curve Diffie Hellman, ECDH; Elliptic Curve Integrated Encryption Scheme, ECIES.

7. The method according to claim 5 or 6, wherein the header generated in step d) further comprises information on the key-derivation scheme for the shared-secret, SS.

8. The method according to any of claims 1 to 7, further comprising the step: l) it the HSM, calculate an integrity check value (Cl), particularly a hash value or / and a message authentication code MAC, over some or all of the contents, particularly over the code or / and the personalization data or / and the profiles; wherein the integrity check value (Cl) is calculated:- over the unencrypted contents; or / and- over the encrypted contents; m) merge the calculated integrity check value (Cl) to the BLOB, particularly merge the calculated integrity check value (Cl) to the header before the header is encrypted.

9. The method according to any of claims 1 to 8, wherein- the code package further comprises universal data which are identical for a multitude of multiple iSEs.

10. The method according to any of claims 1 to 9, wherein the step to provide in the HSM contents at least in form of a code package comprises: before step c):- provide the code package external to the HSM in encrypted form encrypted with a transport key, which may be either the code-encryption key, CEK, or the pre-shared key, PSK, or a different transport key;- import the encrypted code package into the HSM;- in the HSM, in case the transport key is not the code-encryption key, CEK, decrypt the code package with the transport key, which is provided in the HSM;- provide the decrypted code package for step c).

11. A method for providing contents from a hardware security module, HSM, to an integrated Secure Element, iSE, which is integrated into or destined to be integrated into a board of a mobile device, the method comprising the steps: - provide from the HSM to the iSE, contents in form of at least an encrypted code package; characterized by the steps:- provide the contents from the HSM to the iSE as a BLOB which was prepared by a method according to any of claims 1 to 9; is-1) in the iSE, provide the pre-shared key, PSK, or provide the key-derivation constant, KDC, and the first seed, and derive the PSK from the KDC and the first seed (SI), or derive the header encryption key, SH; is-2) in the iSE, decrypt the header of the BLOB with the PSK, or with the header encryption key, SH, derived from the PSK, and extract from the decrypted header the second seed (S2); is-3) in the iSE, derive the code encryption key from the PSK and the extracted second seed (S2); is-4) in the iSE, decrypt the code package with the code encryption key, CEK; is-5) in the iSE, install the code corresponding to the code package to the iSE, and in the case of claim 9, store the universal data to the iSE.

12. The method according to claim 11, wherein the BLOB further comprises the signature generated according to claim 3, and wherein the method comprises, in the iSE, extracting the signature from the BLOB and verifying the signature, wherein successful verifying ofthe signature is required as a condition that one, several or all of steps is-1) - is-4) are executed.

13. The method according to claim 11 or 12, wherein the BLOB further comprises encrypted personalization data or / and encrypted profiles according to claim 4, and wherein the method comprises, in the iSE, extracting and decrypting the encrypted personalization data or / and encrypted profiles and storing of installing them to the iSE.

14. The method according to claim 13, wherein the personalization data or / and profiles is / are encrypted with the shared-secret, SS, according to claim 5, and the BLOB contains the HSM public key, wherein the method comprises, in the iSE:- extract the HSM public key from the BLOB;- derive the shared-secret, SS, from the iSE private key and the extracted HSM public key;- decrypt the encrypted personalization data or / and encrypted profiles extracted from the BLOB with the derived shared-secret, SS.

15. The method according to any of claims 10 to 13, wherein the BLOB comprises a integrity check value (Cl) according to claim 8, particularly an integrity check value (Cl) merged into the header before the header is encrypted, wherein the method at the iSE comprises, particularly after decrypting the header:- retrieving the integrity check value (Cl) from the header;- verifying the retrieved integrity check value (Cl); wherein verifying the integrity check value (Cl) may particularly comprise one or both of the following:- the integrity check value (Cl) is calculated:- if the integrity check value (Cl) was calculated over the unencrypted contents, then decrypt the corresponding content and verify the integrity check value (Cl); or / and- if the integrity check value (Cl) was calculated over the encrypted contents, then leave the corresponding content in encrypted form and verify the integrity check value (Cl).

Images