Mobile Terminal Security Applet Provisioning via Segmented Elements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in meeting high security requirements for both low and high-security applications, necessitating a secure method for provisioning cryptographic keys and a security applet for ID application programs.
Innovation Solution
A method for provisioning an ID application program on a mobile device with cryptographic keys and a security applet, involving independent security elements, where a provisioning component generates and manages asymmetric key pairs and introduces a security applet into a secure element, ensuring cryptographic security and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single security element is used in the mobile device, then the device complexity is reduced, but the security reliability is compromised because the provisioning server would have access to all security functions including those needed for user authentication
Solution Approach 1:
The patent divides the security functionality into two separate security elements: a first security element that stores the security applet and can be accessed by the provisioning server, and a second security element that stores authentication keys and is not accessible by the provisioning server. This segmentation allows the system to maintain high security reliability while managing device complexity through functional separation.
2Ease of operation
If the provisioning server has access to the security element for incorporating the security applet, then the ease of operation for provisioning is improved, but the security risk increases due to potential unauthorized access to key material
Solution Approach 1:
The patent segments the security element into two independent parts: the first security element that the provisioning server can access for applet incorporation, and the second security element that remains protected from provisioning server access. This allows easy provisioning operations while preventing unauthorized access to sensitive key material.
Solution Approach 2:
The patent introduces an intermediary architecture where the provisioning server interacts only with the first security element through defined interfaces, while the second security element remains isolated. This intermediary structure enables controlled provisioning operations without exposing the authentication keys to the provisioning server.
3Ease of operation
If cryptographic keys are stored in a centralized location for easy management, then the ease of operation is improved, but the reliability decreases due to single point of failure and increased attack surface
Solution Approach 1:
The patent implements segmentation of cryptographic key storage across two separate security elements. The first security element contains keys for provisioning operations, while the second security element contains keys for authentication. This distribution improves reliability by eliminating single points of failure while maintaining operational ease through specialized key management in each element.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
The invention relates to a method for provisioning an ID application program (108) installed on a mobile device (100) with cryptographic keys and a security applet (114). The mobile device (100) comprises a first security element (112) and a second security element (110).The procedure comprises: • upon sending a first key generation request from a provisioning component of the ID application program (108) to the second security element (110), the second security element (110) generating a first asymmetric key pair associated with the ID application program (108), • upon sending a first request from the provisioning component via a network (150) to a provisioning server (280) to introduce the security applet (114) for the ID application program (108), the provisioning server (280) introducing the security applet (114) for the ID application program (108) into the first security element (112) via the network (150).