Authentication Provisioning via Secure OTA Operator Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automatic authentication systems face challenges in securely and efficiently provisioning devices with authentication capabilities over a standard wireless communication network, particularly due to the lack of a secure channel for transmitting sensitive information and maintaining control over Issuer Security Domain keys.
Innovation Solution
A secure over-the-air deployment channel is established using a cellular network operator's backend system, integrating Subscription Manager Discovery Service (SM-DS) and Local Profile Assistant (LPA) to remotely provision authentication applications to devices, ensuring secure installation in a trusted execution environment or secure element, and managing encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If devices are manually configured with authentication information, then security is maintained, but provisioning costs increase significantly for large authentication systems
Solution Approach 1:
The patent replaces manual mechanical configuration processes with automated electronic provisioning through a secure over-the-air deployment channel. The system uses a profile management entity to electronically distribute authentication applications and security domain information to devices, eliminating the need for manual configuration while maintaining security through encrypted transmission and secure installation in trusted execution environments.
2Reliability
If a secure channel is established for transmitting sensitive authentication information, then security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a profile management entity as an intermediary between the authentication system operator and target devices. This intermediary handles the complex tasks of securing authentication applications, managing encryption keys, and establishing secure transmission channels. By centralizing these security functions in a dedicated intermediary component, the overall system complexity is managed more effectively while maintaining high security standards.
Solution Approach 2:
The system implements self-service mechanisms where devices automatically receive and install authentication applications through the secure over-the-air deployment channel without requiring manual intervention. The profile management entity automatically provisions devices with appropriate security domains and authentication credentials, reducing operational complexity while maintaining security through automated secure processes.
3Productivity
If authentication applications are remotely provisioned over standard wireless networks, then deployment efficiency is improved, but security risks increase due to lack of controlled transmission channels
Solution Approach 1:
The patent implements preliminary security measures by establishing a secured transmission channel before deploying authentication applications over wireless networks. The profile management entity prepares and protects authentication applications and security domain information before transmission, using encryption and secure protocols. This preliminary securing action enables remote deployment over standard wireless infrastructure while maintaining security that would otherwise require dedicated secure hardware channels.
Data Source
AI summary
A method of provisioning an authentication device of an authentication system comprises sending an authentication application from an authentication system backend server to a backend network of a cellular network operator; verifying, by the backend network of the cellular operator, the authentication application and including the authentication application in an operator profile; sending the authentication application with the operator profile from the backend network of the cellular network operator to a local profile assistant (LPA) of the authentication device; and installing the authentication application in a secure zone of the authentication device using the LPA.