Embedded Universal Integrated Circuit Card Supporting Two-Factor Authentication

What is this patent about?

’094 is related to the field of embedded universal integrated circuit cards (eUICCs) and their use in wireless communication systems. The background involves the increasing need for remote management of subscriber credentials in machine-to-machine (M2M) and Internet of Things (IoT) devices, where physical SIM card swapping is impractical. Existing eUICC solutions face challenges in securely transferring network access credentials, particularly the pre-shared secret key K, without relying on potentially insecure third-party channels.

The underlying idea behind ’094 is to enhance the security of eUICC-based authentication by employing two-factor authentication and key derivation techniques . The system uses an initial, potentially less secure, connection to authenticate the device and user, then establishes a more secure connection using a derived key. This approach allows for remote key rotation and control over credential usage, even when the initial profile distribution is outside the mobile network operator's direct control.

The claims of ’094 focus on a method comprising generating a first message including an eUICC identity, a nonce, and a first digital signature using a first eUICC private key, sending the first message to a subscription manager system, deriving a second eUICC private key and a corresponding second eUICC public key using a first random number generator and a first set of cryptographic algorithms, storing a subscription manager public key, deriving a profile key using a key exchange algorithm, receiving from the subscription manager system, an encrypted profile comprising a ciphertext including a key K encrypted with a symmetric key, receiving the symmetric key, decrypting at least a portion of the encrypted profile using the profile key, decrypting at least a portion of the ciphertext using the symmetric key, and storing at least the key K in the embedded universal integrated circuit card for use in future communications.

In practice, the invention involves a module with an eUICC first connecting to a network and authenticating using initial credentials. After this initial authentication, the module and the mobile network operator (MNO) engage in a key exchange process, leveraging public-key cryptography and a key derivation algorithm. This process results in both the module and the MNO independently deriving a new shared secret key K, which is then used for subsequent, more secure communication.

This approach differentiates itself from prior solutions by avoiding the need to transmit the secret key K directly, even in encrypted form. Instead, the key is derived independently at both ends, enhancing security and reducing the risk of interception. Furthermore, the two-factor authentication ensures that only authorized users or devices can access the network, even if the initial profile distribution is compromised. This system also allows for periodic key rotation , further strengthening security over time without requiring physical intervention or complete profile replacement.