WO2016207532A1

WO2016207532A1 - Cellular-radio data processing method implemented by a sim card, especially for security purposes

Info

Publication number: WO2016207532A1
Application number: PCT/FR2016/051506
Authority: WO
Inventors: Yann COLLET
Original assignee: Orange
Priority date: 2015-06-26
Filing date: 2016-06-21
Publication date: 2016-12-29
Also published as: FR3038200A1

Abstract

The invention relates to a method for processing cellular-radio data, which method is implemented by information-processing means including a UICC card and allows the remote configuration of a parameter of the UICC card, which parameter is associated with a first list of values, to be secured, characterised in that: the UICC card of a mobile terminal receives a configuration request, said request asking for the first list of values to be replaced by a second list of values; and a current value of the parameter is found in a memory of the UICC card, and characterised in that: if the second list does not include the current value of the parameter and the first list comprises values of the parameter that are authorised, or if the second list includes the current value of the parameter and the first list comprises values of the parameter that are forbidden, then the configuration request asking for the first list of values to be replaced by a second list of values is ignored.

Description

Processing of radio-cellular data implemented by a SIM card, in particular for security purposes

GENERAL TECHNICAL FIELD

The present invention relates to a processing of radio-cellular data, implemented by computer means of a SIM card, in particular to improve the security of remote configuration procedures of the SIM card.

STATE OF THE ART

It should first be pointed out that the terms "SIM card" (SIM for Subscriber Identity Module) are commonly used to designate a "UICC" card (for "Universal Integrated Circuit Card" as defined by the ETSI organization) comprising at least one of the SIM, USIM, ISIM and HPSIM applications (defined by the 3GPP standard). It will thus be understood that the terms "SIM card" here designate such a UICC card, and that more generally the terms "SIM card" and "UICC card" are used interchangeably.

The terminal may for example be a device communicating with a server via a radio-cellular network, such as a terminal embedded in a vehicle for geolocation purposes. This may be a terminal comprising a radio module and a GPS location module (Global Positioning System). The terminal regularly collects the position of the vehicle in which it is embarked and regularly reports this position to a server by connecting via the wireless network. The terminal can be configured remotely by sending a request via the wireless network. The sending of requests can be done from another terminal or from a configuration server, such as downloading data to the SIM card via SMS, known from the 3GPP document TS 31.111 Universal Subscriber Identity Module (USIM) Application Toolkit (USAT). This is particularly useful for terminals that do not necessarily have a configuration interface, or a minimum interface. The use of an on-board terminal also means that the persons competent for its configuration are generally at a distance, the terminal being at best used or close to an end user who does not have the necessary knowledge to configure the terminal. More generally, the context of such terminals is that of the machine-to-machine (M2M) machine.

The possibility of configuring a terminal remotely, if it offers advantages, however, have disadvantages. Thus, a configuration error may make the terminal unable to communicate via the radio-cellular network. In this case, only a physical intervention on the terminal will recover access to the terminal and restore a suitable configuration. The terminal may also be vulnerable to malicious acts, aimed at disrupting its operation. Two examples are described below to illustrate the problem. The first example concerns the possibility of remotely configuring the roaming parameters of a terminal, ie the possibility for a terminal to connect to radio-cellular networks. operators of different radio-cellular networks, roaming being particularly relevant during a change of country. These roaming parameters can be for example the authorization for a terminal to proceed or not to roam, and, if yes, the list of countries for which it is authorized. It should be noted that roaming communications are often associated with higher call costs than the non-roaming communication cost. Thus, a manager of a fleet of terminals used in a static way in a country, without vocation to be used outside this country, will have every interest to block the possibility of roaming to avoid any possibility of fraudulent use - and expensive - terminal or its SIM card abroad. Conversely, the manager of a fleet of on-board terminals for example in vehicles (trucks, boats, ...), and traveling in a given geographical area, will have every interest in authorizing roaming in the only countries corresponding to this geographical area.

Problems can arise if the manager, by mistake, or a malicious person remotely modifies the configuration of a terminal, for example prohibiting roaming while this terminal is abroad. Similarly, if roaming in a given country is removed at the terminal while in the same country, the user will no longer be able to use it. In both cases, the terminal is cut off access to the radio-cellular network. In addition, without the possibility of communication with the terminal, it will be understood that it is no longer possible to remotely configure it to solve the problem. A physical intervention on the terminal to reconfigure or move the terminal in a country without roaming is necessary for the terminal to reconnect to a radio-cellular network.

The second example is a simple mechanism for protecting the remote configuration of a terminal that can be used to guard against malicious acts. It is thus wise to allow remote configurations of a terminal only from certain equipment, typically configuration servers managed by the terminal fleet manager. The mechanism set up is for example to accept configuration requests only if they come from address (es) corresponding to the configuration servers managed by the fleet manager. Since it is also possible to remotely configure these addresses, it is understood that a configuration error has the effect of prohibiting any subsequent configuration request from its servers. A physical intervention on the terminals is then necessary to reconfigure the terminals. These two examples illustrate the need to provide a mechanism for securing the remote configuration of terminals with radio module including a SIM card.

PRESENTATION OF THE INVENTION

The present invention improves the situation. To this end, it proposes a method for processing radio-cellular data, implemented by computer means including a UICC-type card, making it possible to secure the remote configuration of a parameter of the UICC-type card, which parameter is associated with a first list of values, characterized in that the UICC type card of a terminal in a mobility situation receives a configuration request, which request requesting the replacement of the first list by a second list of values, found in a memory of the UICC type card a current value of the parameter and characterized in that, if the second list does not include, respectively includes, the current value of the parameter, the first list comprising authorized values, respectively prohibited, for the parameter, then the configuration request to replace the first list with a second list of values is ignored.

Thus, for a parameter associated with a list of authorized values ("whitelist" operation), it is not possible to configure this parameter of the UICC type card with a new list of values that does not include the current value or current parameter. In the case of roaming configuration, it is therefore not possible to change the list of authorized roaming countries if the new list (i.e. the second list) does not contain the country currently used in roaming.

For a parameter associated with a list of unauthorized values ("black list" operation), the method prevents any possibility of adding the current or current value to the list of unauthorized values for the parameter. Otherwise, in both cases and without this process, the card would lose its ability to connect to the network.

In a particular embodiment, the method is characterized in that, in a subsequent step, the first list is replaced by a combination of the second list and the current value of the parameter. Advantageously, rather than totally ignoring the configuration request, the current value of the parameter is taken into account to modify the new list.

In the case of whitelist operation, the current value can be added to the second list to ensure that this current value is still allowed after the configuration request is taken into account.

In the case of a black list operation, the current value can instead be removed from the second list to ensure that this current value does not become prohibited after taking into account the configuration.

In a particular embodiment, the method is characterized in that, if the second list includes, respectively does not include, the current value of the parameter, then the first list is replaced by the second list of values.

Advantageously, in cases where either the current value is included in the new list of authorized values, or it is not included in the second list of unauthorized (forbidden) values, then the configuration request can be satisfied without any particular precaution . The invention finds an advantageous application in the case of a terminal corresponding to an equipment such as a terminal embedded in a vehicle, the SIM card then implementing a safe method in the context of a machine-to-machine application (of the English "machine to machine"). Thus, in one embodiment, the terminal is adapted to receive configuration requests from a remote server, in machine-to-machine mode, and to implement the security method previously described.

The present invention also provides a SIM card comprising means including a memory programmed to perform the steps of the above method. The present invention is also directed to a computer program comprising instructions for implementing the above method when this program is executed by a processor.

PRESENTATION OF FIGURES

Other features and advantages of the invention will appear on examining the detailed description below, and the attached drawings in which:

FIG. 1 illustrates the material elements involved in the implementation of the method, according to an exemplary embodiment, FIG. 2 illustrates the steps of a method according to the invention according to an exemplary embodiment. DETAILED DESCRIPTION

With reference to FIG. 1, the SIM card typically comprises a microcontroller (including, for example, a PROC processor) and a MEM memory unit with, for example:

a working memory, for storing, for example, current values of parameters,

a non-volatile memory for storing:

* computer program instructions, the execution of which makes it possible to implement the above method, and

* lists of values associated with parameters.

The SIM card further includes an INT connection interface with the TER terminal that hosts it. In use, the SIM card can communicate via the radio cellular network RES with a configuration server SER. The configuration server SER can send configuration requests to the SIM card of the terminal TER. It will be understood that the computer program can typically have an algorithm whose flow chart can be represented by FIG. 2 commented below.

With reference to FIG. 2, the method making it possible to secure the remote configuration of a parameter of the UICC type card included in the TER terminal, which parameter is associated with a first list of values, begins with a first step S0. initializing. This phase corresponds to the power-up of the TER terminal comprising a SIM card (or UICC type card), and the launch of the operating system comprising either directly integrated or in the form of a computer program subsequently installed, the computer program instructions whose execution makes it possible to implement the method described in this document. This initialization step comprises a step of connecting the TER terminal, via the SIM card and its connection interface INT, to the radio cellular network RES. This connection is established, the terminal TER is able to communicate with the SER server in particular, that is to say either to receive messages or requests from the SER server, or to send messages or requests to the server. SER server. In particular, if the TER terminal is in a roaming situation, the terminal will check the values of the parameters associated with roaming to allow roaming or not. For example, a roaming parameter may correspond to a first list of values corresponding to countries authorized for roaming. If the current value of the parameter corresponding to the country in which the terminal TER is located is included in the list of authorized or unauthorized values, then the connection to the network RES will be authorized, respectively prohibited, by the SIM card. We speak of whitelist operation (exhaustive list of allowed values of a parameter) or black list (exhaustive list of forbidden values of a parameter).

In a step S1, the terminal TER receives a configuration request from the server SER. This request corresponds to a request to replace the first list of values associated with a parameter by a second list of values. The request may include data corresponding to an identification number associated with the SER server sending the request. For example, in the event that the request takes the form of a SMS (Short Message Service), the identification number of the request associated with the SER server would correspond to the calling number. The data corresponding to the request is typically stored in the working memory of the SIM card. These data may include the second list of values, or the values of the second list may be provided to the SIM card via another request. A request may also include data for retrieving a second list previously stored in the memory of the SIM card or terminal TER.

By list of values, we can hear a list with one or more values of a parameter.

In a step S2, the terminal TER finds in a memory of the SIM card a current value of the parameter corresponding to the configuration request received during the step S1. This is referred to as nonvolatile memory or RAM, depending on the embodiment. It is more generally any memory accessible by the TER terminal or the SIM card. For example, the current value may correspond to the country in which the TER terminal is connected to a roaming parameter. Since this is an authorization parameter, the current value may correspond to the identification number of the received request. In a step S3, the terminal TER checks whether the second list includes or does not include the current value of the parameter found in the previous step. The process works symmetrically depending on whether the parameter is associated with a list that functions as a whitelist or blacklist. In the case of a whitelist operation, the first list including permissible values for the parameter, if the second list does not include the current value of the parameter, then the configuration request requesting the replacement of the first list by a second list of values is ignored in step S4. This prevents the SIM card from working with a list of values for a parameter whose current value is excluded, which could cause malfunctions. In the present example of roaming, the TER terminal would no longer be allowed to operate in the country where it is located.

In the case of a black list operation, the first list including forbidden values for the parameter, if the second list includes the current value of the parameter, then the configuration request requesting the replacement of the first list by a second list of parameters. values is ignored in step S4.

Similarly, we have: In the case of a whitelist operation, if the second list includes the current value of the parameter, then the first list is replaced by the second list of values in a step S6. In the case of blacklist operation, if the second list does not include the current value of the parameter, then the first list is replaced by the second list of values in a step S6.

According to one embodiment, in a step S5 subsequent to S4, or concomitantly, the first list is replaced by a combination of the second list and the current value of the parameter. This step S5 is optional. It allows to take into account the configuration request while securing the configuration by adapting it to the context, that is to say the current value of a parameter.

In the case of whitelist operation, the current value is added to the second list. In the case of a black list operation, the current value is instead removed from the second list.

In these two cases, the combination of the current value and the second list makes it possible to satisfy the configuration request while ensuring that the implementation of the configuration has no negative effect on the operation of the terminal TER.

Thus, for a whitelist operation of the countries authorized to roam, for a terminal TER connected roaming in a country A, it is no longer possible thanks to the present method to cut the communication to the terminal TER by sending a configuration request, for example malicious, including a second list of countries not including country A.

In a step S7, once the configuration is completed, either directly by replacing the first by a second list (S 6), or by replacing the first list by a combination of the current value of the parameter and the second list. (S5) (or the simple rejection of the configuration request of step S4), TER terminal is then ready to receive any other configuration request, or more generally to send or receive any request.

Of course, the present invention is not limited to the embodiments described above by way of example; it extends to other variants.

Thus, the steps S4 or S5 can comprise steps of stopping the terminal TER, recording the requests received during the step S1, then considered as malicious, or sending a notification request to the server SER or to another server, which query indicates the attempted configuration considered malicious.

Claims

(1) Method for processing radio-cellular data, implemented by computer means including a UICC type SIM card, allowing the securing of the remote configuration of a parameter of the UICC type card, which parameter is associated to a first list of values, characterized in that the UICC type card of a terminal in a mobile situation:

- receives a configuration request, which request requests the replacement of the first list by a second list of values,

- finds in a memory of the UICC type card a current value of the parameter,

characterized in that, if the second list does not include, respectively includes, the current value of the parameter, the first list comprising authorized, respectively prohibited values, for the parameter, then the configuration request requesting the replacement of the first list by a second list of values is ignored.

(2) Method according to the preceding claim, characterized in that, in a subsequent step, the first list is replaced by a combination of the second list and the current value of the parameter.

(3) Method according to one of the preceding claims, characterized in that, if the second list includes, respectively does not include, the current value of the parameter, then the first list is replaced by the second list of values.

(4) Method according to one of the preceding claims, characterized in that the parameter represents a parameter associated with the operation of the roaming of the UICC type card.

(5) Method according to one of claims 1 to 3, characterized in that the parameter represents an authorization parameter of a configuration request. (6) A TER mobile terminal comprising a radio module allowing connection to a RES operator network, the radio module comprising a UICC type SIM card, the terminal being adapted for:

- receive a configuration request, which request requests the replacement of the first list by a second list of values,

- find a current value of the parameter in a memory of the UICC type card, - ignore the configuration request in the case where the second list does not include, respectively includes, the current value of the parameter, the first list comprising authorized, respectively prohibited, values for the parameter. (7) Computer program comprising program instructions for implementing the steps of the method according to one of claims 1 to 5 when this program is executed by a processor of a mobile terminal TER comprising a radio module allowing connection to a RES operator network.