Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication

Definitions

• the field of the invention is that of telecommunications in networks of 3G or IMS (IP Multimedia Subsystem) type.
• the present invention relates to a method and a system for pairing a security element to a telecommunications terminal in a telecommunications network, the security element being removable from the telecommunications terminal.
• removable security element refers to a card, for example of SD or micro-SD format, which can be extracted and inserted into a telecommunications terminal, such as a mobile phone or a microcomputer.
• the invention applies in particular to the security elements comprising payment functionalities, for example of the NFC type.
• the mobile phone also comprises, conventionally, a SIM card, a UICC or e-UICC (soldered circuit fulfilling the same function as a UICC).
• SIM SIM card
• UICC universal integrated circuit card
• e-UICC e-UICC
• This SIM or UICC feature is tied to the user's subscription.
• a security element must be remotely administrable by the operator to which the user has subscribed. This administration may consist of updates, verifications, etc., for example carried out via OTA. However, such a security element has no address and the operator administers the security element by contacting the mobile terminal, for example through its IMPU in an IMS network or its MSISDN in a 3G network.
• An IMS network is an IP network connected to an access network, for example 3G or
• the IMS network provides a dynamic combination of transport of voice, video, messages, data, etc. during the same session.
• IMS uses the protocol Session Initiation Protocol (SIP) for establishing and controlling communications or sessions between user terminals (called endpoints) or between endpoints and application servers.
• SIP Session Initiation Protocol
• endpoints user terminals
• UAS SIP User Agents
• IMS IMS Subscriber Identity Module
• UICC integrated circuit card
• Each IMPU is associated with a so-called service profile.
• the service profile is a set of services and related data, which includes, among other things, the initial filtering criteria that provide a simple service logic for the user (for example, it defines a set of IMS services that the public identity IMPU will be able to use).
• the network access network IMS is for example a UMTS network, LTE, WLAN and / or Internet.
• FIG. 1 represents such an IMS network connected to different access networks.
• An IMS network 10 as defined by 3GPP TS 23.228, is connected to application servers 11, 12 by SIP links 13, 14.
• the servers 11 and 12 host IMS applications representing services such as the instant messaging, presence management (user present, absent, meeting, 7), call filtering and real-time sessions such as voice over IP (VoIP), videoconferencing, video to demand, video sharing, network games or IPTV.
• VoIP voice over IP
• the IMS network includes a proxy 28 connected by SIP links 29 to 31 to interconnection gateways, such as a GGSN gateway (Gateway GPRS Support Node) 32 in particular responsible for providing an IP address at the terminal point 15 constituted by a terminal.
• GGSN gateway Gateway GPRS Support Node
• GPRS for the entire duration of its connection to the IMS network
• a Packet Data Network Gateway (PDG) PDN 33 providing the same service for the LTE terminals 16 and 17, and a Packet Data Serving Node (PDSN) gateway 34 providing a connection via the 3GPP2 network 23 of the terminal 18 of the CDMA 2000 type.
• PDG Packet Data Network Gateway
• PDSN Packet Data Serving Node
• Access to the services of the IMS network 10 by the users of the end points 15 to 20 is obtained after these users have connected to their access networks and have requested an IP connection to this IMS network 10.
• the end points may also be communicate with each other via the IMS network, for example via VoIP.
• the authentication of the endpoints by the IMS network 10 is obtained thanks to an IMPI private identity, generally included in a USIM or ISIM application embedded in the endpoints 15 to 20. Each endpoint has its own private identity.
• an endpoint sends its IMPI to the network 10 and, if it is authenticated (in a registration server called HSS), access rights are granted to it in depending on his profile and his subscription.
• the IMS network includes billing the user and controlling the session.
• Each endpoint 15 to 20 also contains at least one public address
• IMPU (thus not secret) IMPU which allows its user to request and receive communications with other users or to access a service.
• IMPUs are in the form of a SIP URI (Unified Resource Identifier) as defined in the IETF RFC 3261 and IETF RFC 2396 recommendations.
• SIP URI Unified Resource Identifier
• an IMPU address could be in the form of:
• the IMPU and ⁇ are typically stored in the ISIM application of an endpoint.
• the endpoint may include software that can register IMPUs or the user is allowed to register IMPUs.
• the IMPUs and ⁇ s are stored in a memory of the endpoint.
• riSIM is stored in a secure element, for example on a UICC chip card extractable from the endpoint.
• a UICC card can carry one or more ISIM or USIM applications.
• the secure element can also be an integral part of the endpoint.
• the endpoint After or during the authentication of a terminal point by recognizing its IMPI and checking the secrets it has, the endpoint sends one of its IMPU addresses to the HSS of the IMS network 10 in order to register and benefit an IMS service.
• a removable security element as mentioned above is that it can be inserted in another terminal thus having an IMPU (in the case of an IMS network) or a MSISDN (in a 3G network) different from the one registered by the operator.
• the operator will no longer be able to address the security element because the terminal comprising it corresponds to another subscription (IMPU or MSISDN different). It is the same if another SIM card or UICC is inserted in the terminal comprising this security element.
• the security element is unmanageable by the operator or by an OTA platform capable of managing this security element.
• the present invention proposes to be able to administer an extractable security element of a terminal even if this security element has been inserted into another terminal or if the SIM or UICC card of this terminal has been replaced by another corresponding to another subscription. .
• the present invention aims to overcome this disadvantage.
• the present invention proposes a method of pairing a security element with a telecommunications terminal in a telecommunications network, the security element being removable from the telecommunications terminal, this method consisting in:
• the method according to the invention also consists in transmitting from the security element to the telecommunications terminal the IARIs of the applications carried by the security element, the IARIs being transmitted to the element cooperating with the telecommunications network.
• the security element is an SD or micro-SD type card.
• the security element advantageously comprises an NFC payment application.
• the identifier of the user subscription corresponding to the telecommunications terminal in which the security element is inserted is preferably its MSISDN.
• the identifier of the user subscription corresponding to the telecommunications terminal in which the security element is inserted is its IMPU.
• the identifier of the security element and the identifier of the user subscription corresponding to the telecommunications terminal in which the security element is inserted are stored in an OTA platform.
• the invention also relates to a system for pairing a security element with a telecommunications terminal in a telecommunications network, the security element being removable from the telecommunications terminal, this system comprising:
• FIG. 1 represents an IMS network connected to different access networks
• FIG. 2 represents a system according to the present invention
• FIG. 3 represents a method according to the present invention implemented in an IMS type network.
• FIG. 2 shows a system according to the present invention.
• a security element 40 for example of SD or micro-SD format, is intended to be inserted into a telecommunication terminal 41, here constituted by a mobile phone.
• the terminal 41 is able to communicate via a telecommunications network 42 with an element 43 of the network 42 or connected thereto, by means of a SIM or UICC card, or e-UICC it contains.
• this card is of the R-UIM type.
• the element 43 is typically an OTA server capable of transferring data to the security element 40.
• the security element 40 comprises for example an NFC application for making payments to merchants or exchange data between two terminals capable of communicating in NFC. It also comprises an element 45 making it possible to transmit on command 46 an identifier of the security element 40.
• This identifier is unique for the security element 40, that is to say that for each security element 40 an identifier it is associated with it (for example an ICCID, ie a serial number). This makes it possible to uniquely identify each security element 40.
• the command 46 can be the power up of the terminal 41 or the detection of the insertion of the security element 40 in the terminal 41 (if the latter is already on and in operating mode - before or after entering the PIN code on the keyboard of the terminal 41). The identity of the secure element 40 is thus transmitted to the terminal 41.
• the terminal 41 comprises in a 3G network an identifier called MSISDN (Mobile Station ISDN Number) which is the number "known to the public" of the GSM or UMTS user as opposed to the IMSI number. It is this identifier, commonly called the telephone number, which will be dialed in order to reach the subscriber. Only the HLR knows the correspondence between the MSISDN and the IMSI.
• MSISDN Mobile Station ISDN Number
• the identifier from the terminal 41 is called IMPU. More specifically, the invention applies to an IMS network for setting up services over an IP (LTE) or 3G access network.
• the terminal 41 comprises, according to the invention, a program 47 (for example an applet) adapted to receive the identity of the secure element 40 and to transmit this identity, accompanied by an identifier of the user subscription corresponding to the terminal 41 in which is inserted the security element 40.
• This identifier is for example MSISDN in the case of a 3G network and IMPU in an IMS network.
• the platform or OTA server 43 then receives these two identities which are then associated and recorded in a database 44 forming part of this OTA platform 43.
• the database 44 therefore associates with each ICCID of a security element 10 an IMPU (or a MSISDN) corresponding to the user subscription corresponding to the terminal 41 in which this security element 40 is inserted.
• Elements 43 and 44 are or are not managed by the operator from which the subscriber has subscribed.
• the operator of the OTA platform 43 can thus communicate with the security element 40 via the identifier of the user subscription corresponding to the terminal 41 without the user of this terminal 41 having notified the insertion of the security element 40 in another terminal or the replacement of the SIM card (UICC) by another in the terminal comprising this security element 40.
• the invention therefore makes it possible to contact a security element 40 regardless of the terminal in which it is inserted.
• the invention also relates to a system for pairing a security element 40 with a telecommunications terminal 41 in a telecommunications network 42, the security element 40 being removable from the telecommunications terminal 41.
• This system includes:
• the invention can be implemented in a conventional 3G type network or in an IMS network.
• the transmission of identifiers between the terminal 41 and the OTA platform 43 can be performed using an SMS.
• FIG. 3 represents a method according to the present invention implemented in an IMS type network.
• FIG. 3 shows the elements previously described with reference to FIG. 2: the security element 40, the terminal 41 and the OTA platform 43.
• the security element 40 comprises the means 45 for transmitting security element 40 at the terminal 41 an identifier of this security element 40 at the occurrence of an event 46 (for example start or boot (boot) of the terminal or detection of the insertion of the security element in the terminal 41).
• an event 46 for example start or boot (boot) of the terminal or detection of the insertion of the security element in the terminal 41.
• the OTA platform 43 declares by an application server 60 its PSI address which can be considered as a SIP URL (for example sip: service @ operator) or a telephone number. This declaration is made through the HSS of the operator.
• the 3GPP group defined the ISP in Chapters 4.3.6 and 5.4.12 of TS 23.228.
• a user SIP agent 61 then communicates with the S-CSCF 62 of the platform 43 to transmit its IMPU (and also its IMPI) during exchanges 63.
• the terminal 41 is then connected to the OTA platform 43, managed either by the operator of the network from which the subscriber has subscribed, or by an OTA administrator managing the application embedded on the security element 40 (banking establishment for example).
• These exchanges make it possible to use the services of the IMS domain, such as establishing a multimedia session or receiving a session request. They therefore correspond to the registration of the user to the IMS network.
• the application 47 loaded at the terminal 41 registers as an application to the SIP agent 61 (step 64).
• the security element 40 transmits its unique identifier (step 65) to the application 47.
• the latter then generates a message (step 66) indicating to the agent 61 that it is going to transmit him his identifier IMPU and the identifier of the security element 40, which it realizes immediately after (step 67).
• the two identifiers are then retransmitted (step 68) to the S-CSCF 62 (Serving Call Session Control Function) which retransmits it to the application server 60 (step 69).
• An extraction of the IMPU is then performed and this IMPU is associated with the identifier of the security element 40 in the database 44 (fig.2).
• Acknowledgment messages 70 and 71 are then sent to agent 61 and application 47.
• the application server 60 included in the OTA platform is then able to contact the security element 40 thanks to the knowledge of the IMPU corresponding to the subscription subscribed by the subscriber in which the element is inserted. security 40.
• the telecommunications network (the application server 60) knows the various applications carried by the security element, their version, ... and can administer them remotely (update, add, delete) one or more applications, ).

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)

Priority Applications (1)

Applications Claiming Priority (3)

Publications (1)

Family

ID=48325606

Family Applications (2)

Family Applications Before (1)

Country Status (2)

Citations (1)

Family Cites Families (2)

• 2012
  • 2012-04-13 EP EP12305444.7A patent/EP2651093A1/de not_active Withdrawn
• 2013
  • 2013-04-12 WO PCT/EP2013/057745 patent/WO2013153222A1/fr not_active Ceased
  • 2013-04-12 EP EP13720826.0A patent/EP2837155A1/de not_active Withdrawn

Patent Citations (1)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events