Secure Element OS Updates With Installation State Supervision
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure elements in user devices, such as eUICCs, are difficult and costly to update due to their soldered nature, necessitating a method to ensure future-proof functionality, safety, and security while maintaining deployability and data integrity without compromising existing data.
Innovation Solution
A method involving an operating system dataset and update data subsets is provided, allowing secure elements to be updated over-the-air, with supervision and control mechanisms to ensure data integrity and security during the update process, including an installation state machine to manage the update process and prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure elements are soldered into user devices, then security and tamper resistance are improved, but updateability and ease of repair deteriorate
Solution Approach 1:
The patent divides the secure element system into separable components: a boot loader stored in read-only memory, an operating system stored in reconfigurable memory, and application profiles. This segmentation allows the OS to be updated independently while the secure hardware remains intact, resolving the contradiction between soldered security and updateability.
Solution Approach 2:
The patent changes the state of the secure element from a static soldered component to a dynamically updatable system by implementing over-the-air update capabilities. The system transitions between different operational states (booting, updating, verifying) to maintain security while enabling remote updates without physical access.
2Productivity
If over-the-air updates are implemented, then update efficiency and productivity are improved, but risk of unauthorized changes and data integrity issues increases
Solution Approach 1:
The patent implements preliminary verification actions before applying updates. The boot loader verifies the integrity of received update packages using cryptographic signatures before installation, and the system enters a supervised state during updates to prevent unauthorized modifications. This preliminary verification resolves the contradiction by enabling efficient remote updates while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where the boot loader continuously monitors the state of the secure element, verifies update integrity, and can rollback to previous states if verification fails. This feedback loop ensures that productivity gains from remote updates do not compromise security.
3Adaptability or versatility
If operating system updates are performed, then functionality and adaptability are improved, but risk of compromising existing user data increases
Solution Approach 1:
The patent implements beforehand cushioning by creating and verifying cryptographic checksums of existing data before updates, and maintaining the ability to rollback to previous states. The supervised state during updates acts as a protective buffer that prevents unauthorized changes to user data, resolving the contradiction between functionality improvement and data integrity.
4Reliability
If supervision state is implemented during updates, then security control is improved, but operational time and complexity increase
Solution Approach 1:
The patent implements periodic action by transitioning the system through distinct operational states (normal operation, supervised update state, verification state) rather than continuous monitoring. The boot loader periodically verifies update integrity and system state, providing strong security control while minimizing the time spent in high-overhead supervisory modes.
Data Source
AI summary
A method, as well as a corresponding configuration program, an operating system dataset, a computer-readable data carrier, a user device, and a server device are provided for configuring the user device. A secure element of the user device with an operating system dataset enables an operating instance for operating the secure element. At least one update data subset to the secure element is sent for updating the operating system dataset. The operating instance is notified of the ongoing installation process of the at least one update data subset when updating the operating system dataset.