Offline Secure Element File Updates Without OTA Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote file management solutions for secure elements in mobile terminals require an online OTA platform, leading to complex infrastructure and high economic costs due to individual script generation and key management, limiting the ability to update multiple secure elements efficiently.
Innovation Solution
A decentralized remote file management system using the SCP11c secure channel protocol allows offline scripting through an OfflineRFMAgent installed in the secure element, enabling secure file management operations without an online OTA platform, using ephemeral keys for authentication and allowing the same script to be used across multiple secure elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an online OTA platform is used for remote file management, then secure file update operations can be performed, but infrastructure complexity and economic costs increase
Solution Approach 1:
The patent extracts the RFM agent functionality from the online OTA platform and embeds it directly into the secure element. This allows the secure element to autonomously execute file management operations by receiving and processing update scripts locally, eliminating the need for continuous online platform infrastructure while maintaining secure operation capabilities.
Solution Approach 2:
The patent implements preliminary authentication and script preparation by establishing security credentials and authentication mechanisms in advance during device provisioning. The secure element is pre-configured with necessary keys and certificates, enabling it to independently verify and execute update scripts without requiring real-time online authentication infrastructure.
2Reliability
If individual script generation is performed for each secure element, then security is maintained, but productivity and efficiency decrease
Solution Approach 1:
The patent creates a universal update script format that can be processed by any secure element possessing the appropriate security credentials. The script structure and authentication mechanism are designed to be globally applicable across multiple devices, allowing a single script template to serve multiple secure elements simultaneously while maintaining individual security verification through the embedded RFM agent.
3Reliability
If an online OTA platform with key management system is deployed, then secure communication is achieved, but economic costs increase
Solution Approach 1:
The patent enables the secure element to perform self-authentication and self-verification of update scripts using pre-configured security credentials stored within the element itself. The RFM agent internally validates script authenticity and executes operations without requiring external key management infrastructure, thereby eliminating the need for expensive centralized security service deployments.
Data Source
AI summary
Methods, devices and systems are provided for performing remote file management (RFM) operations at a secure element (SE). A secure file update script is received at an OfflineRFMAgent, located within the SE, from an off-card entity (OCE). The secure file update script has been generated offline by an SE issuer managing the OCE, using a decentralized remote file management (DRFM) platform and comprises a plurality of remote management commands for carrying out file management operations on the SE. In a further step, a security level authentication between the OCE and SE based on the secure file update script is performed. If the security level authentication is successful, in a subsequent step a secure channel session between the OCE and the SE is established through the OfflineRFMAgent. Finally, the plurality of remote management commands is processed to remotely manage a file system on the SE.