WO2015124317A1

WO2015124317A1 - Method for remotely managing a data element stored on a security element

Info

Publication number: WO2015124317A1
Application number: PCT/EP2015/000402
Authority: WO
Inventors: Bernhard Inderst; Tobias Beschnidt; Alexander SUMMERER
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2014-02-24
Filing date: 2015-02-20
Publication date: 2015-08-27
Also published as: DE102014002603A1; EP3111679A1

Abstract

The invention relates to a method for remotely managing a data element (D) stored on a security element (SE), wherein a change request for the data element (D) originating at least partially from a server (S) is transferred to the security element (SE), whereupon the data element (D) stored in the security element is changed in the security element (SE), wherein the change comprises a first changing memory access (AC1) and a second changing memory access (AC2) to the security element (SE). The first memory access (AC1) and the second memory access (AC2) occur in partial steps of the change that are decoupled from each other, wherein a first partial step comprises the transfer of a first partial change request (CR1) from the change request to the security element (SE) by the server (S) and the first memory access (AC1) and wherein a second partial step comprises the transfer of a second partial change request (CR2) from the change request to the security element (SE) and the second memory access (AC2).

Description

C o n n e c o m p o n t i o n c e m e n t i o n c e m e n t i o n s w o rk e n t i o n s w o rk e n t i o n s w o rk e n t i o n s w o rk e n t i o n s

The invention relates to a method and a system for the remote management of a data element stored on a security element.

Security elements can be used for different purposes for the secure storage of data elements. Often, security elements have user identification data, such as e.g. a password or a PIN, deposited. A user can authorize functions of the security element by entering the password or the PIN, preferably via a device connected to the security element.

The prior art discloses methods for remotely managing data elements and in particular PINs on a security element. The document WO 2007/036341 A1 describes a method for unlocking a mobile radio card locked by means of an access code of a user in which, after authentication of the user to a service device, an access for the user on the mobile radio card is established automatically. This can be done by informing the user of a valid or new access code or by prompting the user to enter a new access code.

Conventional methods for the remote management of data elements on a security element have the disadvantage that only certain information of the data elements can be changed centrally by a server. Furthermore, there is a security risk since for the management of the data elements communication channels between the security element and used by the server, which can be intercepted by third-party attacks.

The object of the invention is to provide a simple and secure method or system for the remote administration of a data element stored on a security element.

This object is solved by the subject matter of the independent claims. Further developments of the invention are defined in the dependent claims.

In the context of the inventive method, a change request for the data element to be changed, which originates at least in part from a server, is transmitted to the security element, whereupon in the security element the data element stored therein is changed. The change includes a first changing memory access and a second changing memory access to the security element.

The method according to the invention is characterized in that the first memory access and the second memory access occur in mutually decoupled substeps of the change of the data element. A first sub-step comprises transmitting a first partial change request from the change request from the server to the security element and the first changing memory access, whereas a second partial step comprises transmitting a second partial change request from the change request to the security element and the second memory access. In contrast to the transmission of the first partial change request, the second partial change request does not necessarily have to originate from the server. The inventive method has the advantage that the security of the method is increased by the division of the memory accesses in mutually decoupled sub-steps and flexible different information of the data element can be changed independently.

The decoupling of the sub-steps just described can be realized in various ways in the method according to the invention. In a variant, the decoupling is achieved in that the first sub-step is carried out at a different time than the second sub-step. Likewise, the first sub-step may use a different connection type for transmitting the first partial change request than the second sub-step for transmitting the second partial change request. Furthermore, the first sub-step can use another local application (ie a software application or a software agent) on a terminal communicating with the security element as the second sub-step. The terminal is in particular a mobile terminal, such as a mobile phone. The security element can be used for example in the terminal or be an integral part of the terminal. The local application does not run directly on the security element, but on the end device. Nevertheless, in addition to processing the partial change requests, an application or an applet may also run on the security element. For decoupling the first and second substeps, the first substep may also output another feedback for confirming the first memory access than the second substep for confirming the second memory access. Likewise, only the first or second sub-step (ie not both sub-steps) output a response to confirm the first or second memory access.

In a further preferred variant of the invention, the first partial change request is transmitted directly from the server to the security element without the interposition of a local application on a terminal communicating with the security element. The direct communication between the security element and the server does not preclude an application or an applet running on the security element for processing the partial change requests.

In a further, particularly preferred embodiment, the second partial change request is also transmitted from the server to the security element. Preferably, the transmission of the second partial change request takes place with the interposition of a local application on a terminal communicating with the security element. Alternatively or additionally, the transmission of the second partial change request can also be transmitted without involvement of the server from a local application on a terminal communicating with the security element.

In a further embodiment of the method according to the invention, the first partial change request comprises a change instruction and specifies the data content of the data element to be changed. Similarly, the second partial change request may include a change instruction and specify the data content of the data item to be changed. As a result, the partial change requirements can be easily distinguished from each other. In a further embodiment of the method according to the invention, the first partial change request has a larger or a smaller data volume than the second partial change request. In this way, an asymmetrical distribution of the data volume is effected. For example, a minimum data content may be included in the first or second partial change request, whereas a larger volume of data is communicated with the other partial change request.

In a further preferred embodiment, the data element to be changed comprises both management data (in particular a header) and payload data, i. the actual data content. Preferably, the payload includes confidential information, and in particular user identification data, e.g. a password to be entered by the user for activating one or more functions of the security element. The term of the password is to be understood broadly and may include any string. In particular, the term password also includes a PIN. The method according to the invention is thus also particularly suitable for managing passwords for protecting functions of the security element.

In a further embodiment of the method according to the invention, the first partial change request specifies a first memory access for invalidating the above-mentioned user identification data. This ensures that current user identification data can no longer be used and must be replaced by new user identification data within the scope of the administration according to the invention.

In a further preferred embodiment, the management data specifies one or more specifications for the structure and / or use user identification data. Such specifications may in particular include one or more of the following specifications:

a minimum length and / or a maximum length for the user identification data;

a misoperation counter indicating how often user input data may be entered incorrectly by a user;

Encoded information about the structure of the user identification data, e.g. whether the data must or may be alphanumeric and / or numeric and / or whether the data must include a certain number of special characters and / or uppercase letters and / or whether the data must be alphanumeric and / or numeric;

Data must include a minimum number of different characters and / or whether the data may only include a maximum number of equal characters in a row;

a lifetime of the user identification data for a certain maximum number of accesses to the security element.

In a particularly preferred embodiment, the first and / or second partial change request specifies a first or second memory access for changing at least part of the management data, wherein the change is preferably smaller than 1 byte.

In a further preferred variant, the second partial change request specifies a second memory access for changing the user identification data and / or one or more specifications for the structure and / or use of the user identification data.

The inventive method can be used in combination with any security elements. The security element may be a hardware security module which is reversible (SIM card) or fixed (em- bedded SIM, TP module) is inserted into a terminal, or a software security module (virtual SIM in TEE). A security element can comprise one or more of the following components:

a SIM / Subscriber Identity Module (USIM) card, a microSD card, a USB token (USB = Universal Serial Bus), a smart card, an RFID module (RFID = Radio Fre - Quency Identification), a TPM module (TPM = Trusted Platform Module), an NFC module (NFC = Near Field Communication), an embedded SIM module, a TEE environment (TEE = Trusted Execution Environment in terms of the GlobalPlatform specification ).

In addition to the method described above, the invention further relates to a system for the remote administration of a data element stored on a security element, the system being designed for carrying out the method according to the invention or one or more preferred variants of the method according to the invention. The system comprises the server used in the method according to the invention as well as the corresponding security element. In the implementation of preferred variants, the system may further include the local application described above on a communicating with the security element terminal, if the corresponding embodiment uses a local application.

An embodiment of the invention will be described below in detail with reference to the accompanying FIG. This figure shows a schematic representation of the sequence of a variant of the method according to the invention.

The method according to the invention is explained by way of example with reference to a security element in the form of a SIM module. This module is one Card inserted in a mobile device. Optionally, the SIM module may also be a so-called. Embedded SIM element, which is an integral part of the mobile device. However, the invention is not limited to SIM modules, but can also be used for any other security elements, examples of such security elements having been mentioned above.

The aim of the method described below is to manage the PIN stored in the security element via a remote server and thereby to change the PIN and corresponding specifications for the structure or use of the PIN by communication of the SIM module with the server. The PIN is a code that is confidential and can be entered by the user of the mobile device when needed via an appropriate user interface on the device, for example, to enter. enable the SIM module as a whole or, if necessary, activate only certain cryptographic keys. In other words, if necessary, several PINs for different cryptographic keys can also be stored in the SIM module, which are all managed via a remote server. In the sequence diagram shown in Fig. 1, the reference numeral designates

SE is the security element in the form of the SIM module, the reference symbol S is a remote from the security module server, which is used to manage the data of the module, and the reference LA a local agent, ie a software application that on the mobile device behind is set, in which the security element SE is located. According to FIG. 1, the server S first receives a command CO, which instructs it to change a data element on the security element SE. This data element is denoted D in FIG. 1 and comprises administration data in the form of a header H as well as payload data P relating to the actual data content. These In the embodiment of FIG. 1, user data represents a corresponding PIN for the SIM module. The header H comprises the above-mentioned specifications for the structure or use of the PIN. The command CO can be triggered, for example, by the user of the SIM module or the mobile device, preferably via a telephone app, a web portal or a call from the user to a call center. In each case, a security query of the server is carried out at the user for authentication. Possibly. For example, the server S can also initiate a change to the PIN if, for example, the rules for the structure of the PIN (eg five-digit PIN instead of four-digit PIN) have changed. In the embodiment of the invention described here, on the one hand, the PIN stored in the security element SE is reset and, on the other hand, the specification for a new PIN to be defined is modified such that the PIN must comprise five digits instead of four digits.

After the generation of the command CO, the server S sends a first partial change request CR1 to the security element SE. This first partial change request is used to specify the invalidity of the current PIN and is transmitted from the remote server via a so-called OTA channel

(OTA = Over the Air) to the security element directly (i.e., without interposition of the local agent LA). To protect the first partial change request, in the embodiment described here, the secure SCP protocol of the GlobalPlatform Card specification 2.1.1 is used (SCP = Secure Channel Protocol).

In the variant described here, the first partial change request CR1 represents a binary SMS which, after being transmitted via the OTA channel to the security element SE, has a first memory access AC1 thereon. security element, which invalidates the current PIN by setting the header H of the data element D to a status indicating the invalidity of the PIN. The functions secured by the PIN, primarily cryptographic functions and / or an application, are then locked and no longer usable.

After the first memory access has been carried out, the security element SE sends an acknowledgment ("ok") to the server S. At this point in time, a first sub-step for changing the data element D is concluded based on the first partial change request a separate sub-step, in which the default for the PIN is changed by means of a second sub-change request such that the PIN must comprise at least five digits In the second substep of the first substep, the second partial change request is preferably transmitted to the security element via an OTA channel other than the one described above For example, the transmission via a (secure) Internet connection or HTTP-based by the intermediate circuit de s local agents LA done, as indicated in Fig. 1. Nevertheless, if necessary, the OTA channel described above may also be used to transmit the second partial change request. In this case, the decoupling of the first and second substep can be ensured only by performing the two substeps at different times.

According to FIG. 1, the second change request CR2 is first transmitted together with a PUK to the local agent LA in the context of the second substep. The known from the prior art PUK provides a confidential information of the security element SE, which is required to be able to initiate a change of a PIN. The second partial change request CR2 contains an identifier that this is a PIN reset command, whereby depending on the embodiment the command can only relate to one key in the security element or also to the entire security element. In addition, the second partial change request now contains the new specification for the structure or use of the PIN, ie it is stipulated that the PIN must have a length of at least five digits.

Possibly. The second partial change request can also contain further specifications for the PIN and its use, which can also be changed if necessary compared with the original specifications for the PIN. Corresponding specifications can specify, in addition to a minimum PIN length, also a maximum PIN length and a misoperation counter which indicates how often a PIN may be incorrectly entered by a user before the security element is blocked. The specifications may also concern encoded information about the quality of the PIN. For example, it can be specified whether the PIN may or must include numeric and / or alphanumeric characters. Furthermore, the specifications can specify whether the PIN must include a certain number of special characters or uppercase letters or to what extent the PIN must contain a certain minimum number of different characters. Furthermore, it can be determined by the specifications how many identical characters in the PIN may follow at most one behind the other. Possibly. The specifications can also specify the lifetime of the PIN for a maximum number of accesses to the security element. Upon receipt of the second partial change request CR2 and the PUK P 'in the local agent LA, the change of the PIN is initiated in the context of the second partial step. This can be done immediately or at the next use of the security element or the corresponding PIN-protected key (for example, requesting a cryptographic operation). In this case, the SIM toolkit of the SIM module or a similar software instance is triggered on the mobile device, whereupon the second partial change request CR2 (without PUK) is transmitted to the security element SE. Subsequently, the header H of the data element D is changed by means of a second memory access AC2 to the security element SE in accordance with the new specifications from the second partial change request CR2.

In the context of the second sub-step, a dialog is also triggered on the display of the mobile device, which is shown in FIG. 1 is designated DI. The user is prompted to enter a new five-digit PIN for the SIM module. After entering the new PIN designated with NP is transmitted together with the PUK P ¹ to the security element SE. The SIM toolkit or a corresponding software instance then triggers a so-called APDU (APDU = Application Protocol Data Unit), which means that the new PIN is set. The PUK is checked to see if it is assigned to the security element. Only in this case will the old PIN be replaced by the new PIN. The storage of the new PIN can be regarded as a component of the second memory access AC2 for changing the payload data P of the data element D.

It should be noted that therefore also two rules are observed. The PUK is transmitted securely, especially without the user seeing it. The PIN is assigned by the user and not transmitted via the network. The PUK is another on the security element stored data element, which is the PIN P, usually assigned via a header H contained reference and / or an access condition. The embodiment of the method according to the invention described above has a number of advantages. In particular, a remote administration of the PIN of a security element is achieved without the user having to visit a service facility. In doing so, the security of the remote administration is increased by carrying out the corresponding change of the PIN or of the administration data of the PIN in a two-step procedure. In particular, in addition to the actual PIN and corresponding specifications for the PIN can be changed.

Claims

P a n t a n s p r e c h e

Method for the remote administration of a data element (D) stored on a security element (SE), in which a change request for the data element (D), which originates at least in part from a server (S), is transmitted to the security element (SE), whereupon in the security element (SE) the data element (D) stored therein is changed, the change comprising a first changing memory access (ACI) and a second changing memory access (AC2) to the security element (SE), characterized in that

the first memory access (ACI) and the second memory access (AC2) are performed in mutually decoupled substeps of the change, wherein a first substep is the transmission of a first partial change request (CR1) from the change request from the server (S) to the security element (SE) and the first memory access (ACI) and wherein a second substep comprises transmitting a second partial change request (CR2) from the change request to the security element (SE) and the second memory access (AC2).

A method according to claim 1, characterized in that the partial steps are decoupled from one another in that:

- The first sub-step is performed at a different time than the second sub-step, and / or

the first sub-step uses a different connection type for transmitting the first sub-change request (CR1) than the second sub-change request te substep for transmitting the second partial change request (CR2), and / or

- The first sub-step uses another local application (LA) on a communicating with the security element (SE) terminal as the second sub-step, and / or

the first sub-step issues a different acknowledgment for confirming the first memory access (AC1) than the second sub-step for confirming the second memory access (AC2) or only the first or second sub-step a confirmation for confirming the first or second memory access (AC1, AC2) outputs.

Method according to Claim 1 or 2, characterized in that the first partial change request (CR1) is transmitted directly from the server (S) to the security element (SE) on a terminal communicating with the security element (SE) without the interposition of a local application (LA) ,

Method according to one of the preceding claims, characterized in that the second partial change request (CR2) from the server (S), preferably with the interposition of a local application (LA) on a communicating with the security element (SE) terminal to the security element (SE) is transmitted and / or without participation of the server (S) from a local application (LA) on a communicating with the security element (SE) terminal to the security element (SE) is transmitted.

5. The method according to any one of the preceding claims, characterized in that the first partial change request (CR1) comprises a change instruction and the data content to be changed of the Data element (D) specified and / or the second partial change request (CR2) comprises a change instruction and specifies the data content of the data element (D) to be changed.

Method according to one of the preceding claims, characterized in that the first partial change request (CRI) has a larger or smaller data volume than the second partial change request (CR2).

Method according to one of the preceding claims, characterized in that the data element (D) to be changed comprises management data (H) and payload data (P).

A method according to claim 7, characterized in that the user data (P) confidential information and in particular user identification data, preferably a password to be entered by the user for enabling one or more functions of the security element (SE) include.

A method according to claim 8, characterized in that the first partial change request (CRI) specifies a first memory access for the validation of the user identification data.

Method according to one of claims 7 to 9, characterized in that the management data (H) specify one or more specifications for the structure and / or use of user identification data. Method according to one of claims 7 to 10, characterized in that the first and / or second partial change request (CR2) specifies a first or second memory access for changing at least part of the management data (H).

Method according to one of the preceding claims, characterized in that the second partial change request (CR2) specifies a second memory access for changing user identification data and / or one or more specifications for the structure and / or use of the user identification data.

Method according to one of the preceding claims, characterized in that the security element is a SIM / USIM card and / or an ikroSD card and / or a USB token and / or a chip card and / or an RFID module and / or a TPM - Module and / or an NFC module and / or an embedded SIM module and / or a TEE environment includes.

System for the remote management of a data element (D) stored on a security element (SE), the system being set up to carry out a method in which a change request for the data element (D) originating at least in part from a server (S) is transmitted to the security element (SE), whereupon in the security element (SE) the data element (D) stored therein is changed, the change being a first changing memory access (AC1) and a second changing memory access (AC2) to the security element (SE) includes,

characterized in that the first memory access (ACI) and the second memory access (AC2) are performed in mutually decoupled substeps of the change, wherein a first substep is the transmission of a first partial change request (CR1) from the change request from the server (S) to the security element (SE) and the first memory access (ACI) and wherein a second substep comprises transmitting a second partial change request (CR2) from the change request to the security element (SE) and the second memory access (AC2).

System according to claim 14, characterized in that the system is arranged to carry out a method according to one of claims 2 to 13.