(19)
(11)EP 3 495 974 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
16.02.2022 Bulletin 2022/07

(21)Application number: 19153102.9

(22)Date of filing:  30.03.2011
(51)International Patent Classification (IPC): 
H04W 12/069(2021.01)
G06F 21/12(2013.01)
(52)Cooperative Patent Classification (CPC):
H04W 12/069; G06F 21/123

(54)

ENABLING A SOFTWARE APPLICATION TO BE EXECUTED ON A MOBILE STATION

AKTIVIERUNG EINER SOFTWAREANWENDUNG, DIE AUF EINER MOBILEN STATION AUSGEFÜHRT WERDEN SOLL

ACTIVATION D'UNE APPLICATION LOGICIELLE À EXÉCUTER SUR UNE STATION MOBILE


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(43)Date of publication of application:
12.06.2019 Bulletin 2019/24

(62)Application number of the earlier application in accordance with Art. 76 EPC:
11160423.7 / 2506175

(73)Proprietor: Irdeto B.V.
2132 LS Hoofddorp (NL)

(72)Inventor:
  • DOUMEN, Jeroen Mathias
    2132 LS Hoofddorp (NL)

(74)Representative: Boult Wade Tennant LLP 
Salisbury Square House 8 Salisbury Square
London EC4Y 8AP
London EC4Y 8AP (GB)


(56)References cited: : 
EP-A1- 1 901 192
WO-A2-2005/084107
  
  • MIN-SHIANG HWANG ET AL: "An efficient authentication protocol for GSM networks", EUROCOMM 2000. INFORMATION SYSTEMS FOR ENHANCED PUBLIC SAFETY AND SECU RITY. IEEE/AFCEA 17 MAY 2000, PISCATAWAY, NJ, USA,IEEE, 1 January 2000 (2000-01-01), pages 326-329, XP010515094, ISBN: 978-0-7803-6323-6
  
Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


Description

FIELD OF THE INVENTION



[0001] The present invention relates to protecting software applications. More specifically, the invention relates to enabling a software application to be executed on a mobile station.

BACKGROUND



[0002] The GSM mobile telecommunication standard describes a network infrastructure that is adopted globally. It provides various security measures to protect the integrity of communicated data and makes sure that only authentic users can make calls and get charged only for calls that they initiated. The following abbreviations are adopted from the GSM specification ETSI TS 100 929 V8.0.0 (2000-10):
A3
authentication algorithm
A5
signalling data and user data encryption algorithm
A8
ciphering key generating algorithm
AuC
Authentication Centre
BSS
Base Station System
CKSN
Ciphering Key Sequence Number
HLR
Home Location Register
IMSI
International Mobile Subscriber Identity
Kc
ciphering key
{M}Kc
message M encrypted with ciphering key Kc
Ki
individual subscriber authentication key
LAI
Location Area Identity
ME
Mobile Equipment
MS
Mobile Station
MSC
Mobile services Switching Centre
R
Random number (also referenced as RAND)
S
Signed response (also referenced as SRES)
SIM
Subscriber Identity Module
TMSI
Temporary Mobile Subscriber Identity
VLR
Visitor Location Register


[0003] Fig.1 shows the main system components involved in the security measures of a GSM network. A MS 1 contains a SIM 10 and a ME 11, which are communicatively connected. The SIM 10 is typically implemented on a detachably connectable SIM card. The SIM 10 is configured to perform an A8 and an A3 algorithm and stores the Ki and IMSI data elements. The ME 11 is configured to perform an A5 algorithm and stores Kc, CKSN, LAI and TMSI data elements. A visitor network 2 contains a MSC/BSS 20 and a VLR 21, which are communicatively connected. The MSC/BSS 20 is configured to perform an A5 algorithm and stores Kc and CKSN data elements. The VLR 21 stores IMSI, Kc, LAI, R, S, CKSN and TMSI data elements. A home network 3 contains a HLR 30 and an AuC 31, which are communicatively connected. The HLR 30 stores Kc, IMSI, R and S data elements. The AuC 31 is configured to perform an A3 and an A8 algorithm and stores IMSI and Ki data elements. The ME 11 is communicatively connected to the MSC/BSS 20. The VLR 21 is communicatively connected to the HLR 30. If the MS 1 is located in its home network 3, then the home network 3 and visitor network 2 are one and the same.

[0004] The security data elements CKSN, IMSI, Kc, Ki, LAI, R, S and TMSI and the algorithms A3, A5 and A8 are used for protecting data communications and to authenticate a user to the network.

[0005] In general, the MS 1 is a consumer electronics device with a SIM 10. Typically the SIM 10 is embedded on a SIM card, but the SIM 10 may be integrated into the MS 1 otherwise. An end user interacts with the MS 1 to make telephone calls and/or data communications in a mobile telecommunications network. Examples of MSs 1 are mobile phones, smartphones and tablet PCs. Other examples are energy metering devices and computing nodes in automotive devices.

[0006] Newer generations of MSs 1 leverage increased computing power to implement advanced mobile applications with sophisticated user interfaces.

[0007] The visitor network 2 is any network different from the home network 3 and is e.g. a network abroad. An important feature of the GSM standard is the ability for a consumer to use a MS 1 in any visitor network 2 if the home network 3 for that MS 1 has acquired a roaming agreement for cooperation with the visitor network 2. A MS 1 in a visitor network 2 typically operates as if it is located in the home network 3. Security protocols are available to support the concept of a visitor network 2 and facilitate the information exchange between the visitor network 2 and the home network 3.

[0008] The GSM mobile telecommunication standard is also known as the 2nd generation mobile telecommunication standard or 2G in short. Later mobile telecommunication standards, such as e.g. UMTS/WCDMA, which is also known as the 3rd generation mobile telecommunication standard or 3G in short, and LTE, which is also known as the 4th generation mobile telecommunications standard or 4G in short, have adopted the GSM security protocol with some extensions. Alternative mobile telecommunication standards, such as e.g. CDMA and CDMA2000, use a security protocol similar to the GSM security protocol.

[0009] The extensions to the GSM security protocol as present in the later standards provide additional security capabilities.

[0010] With reference to Fig.2, MSs 1 such as smartphones and tablet PCs enable consumers to adapt the functionality of the MS 1 by installing an application (or app in short) from a so called application distribution server 4. Such application distribution servers 4 typically contain many installable applications for a particular brand and/or type of smartphone or tablet PC. The installation of an application generally is implemented using an internet connection between the MS 1 and the application distribution server 4. The internet connection can use any suitable data network 5, such as e.g. a mobile telecommunication network or WiFi network.

[0011] The application distribution server 4 enables a user to find and select an application for installation on the MS 1. The application distribution server 4 may charge a fee for the installation of the application onto the MS 1. An operator of the application distribution server 4 typically compensates a developer or any other rights holder of the application from the charged fee. To support this application distribution server business model, it should be hard for a consumer to obtain an installable application from a 'rogue' application distribution server that has no business relationship with the rights holder. Hereto the operating system (OS) of the MS contains application protection facilities that can secure the application. In order for an illegal distributor, hereinafter also referred to as attacker, to be able to redistribute the secured application, the protection measures of the OS need to be compromised. As these application protection facilities rely on privileges managed by the OS, an attacker will typically try to mount an attack to obtain the privilege level(s) for read/write access to all kernel files and storage locations. Having kernel level privileges also allows the attacker to modify other restrictions in the MS, such as e.g. a SIM operator lock. In practice, this so-called jail-break attack has been shown to be possible. A jail-broken MS allows the user to install applications from rogue application distribution servers.

[0012] Applications distributed by an application distribution server are dependent on the security features in the kernel of the OS and/or other applications in a MS that might be used for privilege escalation. Typically, if these security features are compromised, all applications in the application distribution server are compromised.

[0013] Applications from the application distribution server can be made resistant against a whitebox attack environment, wherein the application is executed in a non-secure environment and protected using software obfuscation techniques. The application is adapted to protect confidential information such as keys.

[0014] Software obfuscation is a known technology for implementing software programs such that they are hard to reverse engineer and resistant against a whitebox attack. This technology typically includes the replacing of software functions with a sequence of table lookup operations and merging the function lookup with transform functions that make it substantially infeasible to discover the function and the function parameters. The resulting secured software program performs input and/or output operations that consist of transformed parameters. These transformed parameters may require specific adaptations in modules interfacing with the secured software program.

[0015] Data and software obfuscation techniques make use of transformation functions to obfuscate intermediate results. The concept of transformation functions differs from encryption, which is clarified in general with reference to Fig.3.

[0016] Assume that there exists an input domain ID with a plurality of data elements in a non-transformed data space. An encryption function E using some key is defined that is configured to accept the data elements of input domain ID as an input to deliver a corresponding encrypted data element in an output domain OD. By applying a decryption function D using a key that corresponds to the key used by the encryption function E, the original data elements of input domain ID can be obtained by applying the decryption function D to the data elements of output domain OD. In a non-secure environment (typically referred to as "whitebox"), an adversary is assumed to know input and output data elements and have access to internals of encryption function E during execution. Unless extra precautions are taken in this environment, the key can be derived.

[0017] Additional security can be obtained in a non-secured environment by applying transformation functions to the input domain ID and output domain OD, i.e. the transformation functions are input- and output operations. Transformation function T1 maps data elements from the input domain ID to transformed data elements of transformed input domain ID' of a transformed data space. Similarly, transformation function T2 maps data elements from the output domain OD to the transformed output domain OD'. Transformed encryption and decryption functions E' and D' can now be defined between ID' and OD'. In case inverse transformations are to be performed, e.g. when results are to be communicated to the non-transformed space, T1 and T2 are injections.

[0018] Using transformation functions T1, T2, together with encryption techniques implies that, instead of inputting data elements of input domain ID to encryption function E to obtain encrypted data elements of output domain OD, transformed data elements of domain ID' are input to transformed encryption function E' by applying transformation function T1. Transformed encryption function E' combines the inverse transformation function T1-1 and the transformation function T2 in the encryption operation to protect the confidential information, such as the key. Then transformed encrypted data elements of domain OD' are obtained. Keys for encryption functions E or decryption function D cannot be retrieved when analyzing input data and output data in the transformed data space.

[0019] One of the transformation functions T1, T2 should be a non-trivial function. In case, T1 is a trivial function, the input domains ID and ID' are typically the same domain. In case, T2 is a trivial function, the output domains are typically the same domain.

[0020] In general, secured software applications use transformed intermediate results which are unusable when intercepted. This property enables the protection of confidential data in secured software applications.

[0021] There is a need for an improved technology for enabling the execution of a general purpose software application in a MS, while preventing the execution of the application or a binary copy of the application in another MS, without the above identified drawbacks of the prior art.

[0022] WO2005/084107 discloses a method of protecting an element such as an object, a piece of equipment or a program, using a SIM card.

SUMMARY OF THE INVENTION



[0023] It is an object of the invention to provide for a technology enabling a software application to be executed in a MS, while preventing the execution of the application or a binary copy of the application in another MS.

[0024] Various aspects and embodiments of the invention are set out in the appended claims.

[0025] Hereinafter, embodiments of the invention will be described in further detail. It should be appreciated, however, that these embodiments may not be construed as limiting the scope of protection for the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS



[0026] Aspects of the invention will be explained in greater detail by reference to exemplary embodiments shown in the drawings, in which:

Fig.1 is a schematic illustration of components in a prior art GSM mobile telecommunications network;

Fig.2 is a schematic illustration of a MS connected to an application distribution server;

Fig.3 is a diagram clarifying transformation functions and encryption in general terms;

Fig.4 is a schematic illustration of a prior art A8+A3 module;

Fig.5 is a schematic illustration of a mobile station according to an exemplary embodiment of the invention;

Fig.6 is a schematic illustrations of a software application and a SIM in offline mode according to an exemplary embodiment of the invention;

Fig.7 is a schematic illustrations of a pre-install application, a SIM and a verification server according to and exemplary embodiment of the invention;

Fig.8 is a schematic illustrations of a mobile equipment, a verification server and a home network according to and exemplary embodiment of the invention;

Fig.9, Fig.10 and Fig.11 are schematic illustrations of a mobile station, a verification server and a home network according to exemplary embodiments of the invention.



[0027] In all figures arrows indicate data flows.

DETAILED DESCRIPTION OF THE DRAWINGS



[0028] The invention enables a software application to be executed in a particular MS, while preventing the execution of the application or a binary copy of the application in another MS. During runtime of the application, challenge data originating from the application is input to a SIM of the MS and response data generated by the SIM in response to the challenge data is verified by the application and/or processed by a verification server which output is used by the application for further processing. The verification server is typically implemented in an application distribution server. The SIM processes the challenge data using an authentication algorithm and a ciphering key generation algorithm and returns response data.

[0029] A plurality of challenge data and corresponding response data is preconfigured in the application. If the MS is able to make a connection to the verification server from which the application originates, i.e. when the MS is online, the challenge data may be processed by the verification server in combination with an AuC to thereby generate the response data for the application.

[0030] Both secured and non-secured software applications can benefit from the invention, but for optimal results the software application is secured using e.g. software obfuscation techniques as non-secured software applications could be modified to ignore the challenge and response operation.

[0031] The invention uses the existing GSM security protocols or equivalent security protocols of other mobile communication standards to secure an application, as an alternative or additional and independent protection layer to the security features in the kernel of the OS. The invention makes the execution of the application dependent on secrets contained in the secured hardware environment of the SIM in the MS.

[0032] Fig.4 shows an A8+A3 module 101 as implemented in a SIM card conforming to the GSM standard. The A8+A3 module 101 is configured to perform a combined A8 and A3 algorithm using Ki and R as inputs and giving communication key Kc and signed response S as outputs. The ME 11 sends the input R to the SIM 10 and receives the resulting Kc and S. The secret key Ki is typically preconfigured in the SIM card. Input R can have any binary value.

[0033] Each SIM card is further preconfigured with a unique IMSI value to identify the SIM 10 to the network. In the network a similar A8+A3 module is available in the AuC 31 of the home network 3. On the basis of the IMSI value the GSM infrastructure is able to determine the correct home network 3 that has the ability to request its AuC 31 to calculate a Kc using the random input R and its locally stored key Ki as input to its A8+A3 module.

[0034] In normal GSM operation a random input R can be generated in the VLR 21 and then be used to send a request to the MS 1 to generate the signature S and the session key Kc. A similar request is sent to the home network 3 to verify that it knows the MS 1 as identified by its IMSI. Knowledge of the IMSI and Ki, and possession of the A8+A3 module 101 together prove that the MS 1 is authentic.

[0035] The invention provides a new way to enable a software application to be executed on a MS 1 in dependence of a specific SIM 10 in the MS 1.

[0036] In a first scenario the software application is enabled to be executed in a MS without having a network connection, i.e. the MS is offline. Instead of relying on the application protection facilities provided by the OS of the MS 1, the invention verifies that it operates in a MS 1 that contains a particular SIM 10. It uses the unique operation that the SIM 10 provides with the A8+A3 module 101.

[0037] With reference to Fig.5, the SIM 10 uses the A8+A3 module 101 and a secret key Ki to prove its identity. The activation of the A8+A3 module 101 is performed by the ME 11 by sending a command containing a value R to the SIM card. The SIM 10 provides the signed response S and a session key Kc as the result of execution of the A8+A3 module 101.

[0038] The combination of Kc and S by a function f 102 can be regarded as a unique response Ri=f(Kc,S) of the SIM 10 to a challenge Ci. Herein the function f 102 can be any mathematical function.

[0039] With reference to Fig.6, an application 12 installed in the MS 1 is secured and personalised. During execution the application 12 tests if a particular SIM 10 is present in the MS 1 in order to continue its intended operation. The application 12 achieves this by sending a challenge Ci to the SIM 10 and verifying that the SIM 10 returns the expected response Ri to the challenge Ci. The secured application 12 may perform this test in an obscured way, e.g. by delaying the comparison and/or by a sequence of partial comparisons.

[0040] The generation of a secured and personalised application 12 for execution in offline mode is performed by an application generator in the verification server 4. The application generator obtains a set of challenge-response pairs (Ci,Ri) for embedding into the application during a personalisation step prior to downloading the application to the MS 1. Two variants of securing and personalising the application 12 in the verification server 4 will be described.

[0041] In a first variant of the first scenario, which is shown in Fig.7, a set of challenge-response pairs is obtained in the verification server from the SIM 10 during a personalisation phase. The set of challenge-response pairs is obtained by executing a pre-install application 13 on the MS 1. The pre-install application 13 typically generates a number of challenges Ci and obtains the responses Ri from the SIM 10. Alternatively, the pre-install application 13 monitors and stores the challenges and responses that occur during regular GSM usage prior to the request from the application generator and communicates these challenges and responses to the application generator. The pre-install application 13 returns the set of challenge-response pairs (Ci,Ri) to the application generator in the verification server 4, which uses the data to personalise the application for execution in offline mode. After the personalisation step, the verification server 4 installs the secured and personalized application in the MS 1.

[0042] The pre-install application can be a part of the personalised application, wherein the personalisation step provides a set of challenge-response pairs for use by the already installed software application. Alternatively the pre-install application can be a stand-alone application or a part of another application such as e.g. application installation software.

[0043] As a further personalisation step the application can optionally be configured to perform checks on the IMSI value in the SIM 10 and/or other information stored in the SIM 10 or in the MS 1, such as e.g. telephone numbers. The method disclosed in co-pending PCT patent application titled "Change-tolerant method of generating an identifier for a collection of assets in a computing environment using an error-correction code scheme" of applicant Irdeto Canada Corporation and having applicant's reference number 110587CA07, which is herewith incorporated by reference in its entirety, may be used to create challenge data from any information stored in the SIM 10.

[0044] In a second variant of the first scenario, which is shown in Fig.8, the challenge-response pairs are obtained in the verification server 4 from the AuC 31 associated with the SIM 10 during a personalisation phase. First the application generator in the verification server 4 obtains the subscriber identity as indicated by e.g. its IMSI value from the ME 11. The IMSI might be obtained from the OS or from another existing application in the MS 1. Alternatively, a dedicated pre-install application can be executed in the MS 1 to obtain the IMSI value from the SIM. After obtaining the IMSI value, the application generator uses standardised GSM protocols to request from the AuC 31 the generation of a signed response S and a ciphering key Kc for a given random number R with the value Ci and a given IMSI value. The home network 3 systems returns the response with Kc and S which the verification server 4 combines in a function similar to function f 102 shown in Fig.5 to form a response Ri that corresponds to the challenge Ci. Repeating this process with different challenges provides the application generator with a set of challenge-response pairs (Ci,Ri) which it uses to personalise the application. The personalised and secured application is installed in the MS 1. The benefit of this variant is that an attacker who has access to the MS 1 cannot observe the generation of the set of challenge-response pairs (Ci,Ri) .

[0045] In a second scenario the software application is enabled to be executed in a MS having a network connection, i.e. the MS is online.

[0046] In a first variant of the second scenario, which is shown in Fig.9, during execution of an application 14 a first secured software part 141 of the application 14 sends challenge data Ci in the form of runtime data to the SIM 10 with a request to calculate a response Kc,S. This means that the SIM 10 treats the runtime data Ci as a random value R for input to the A8+A3 module 101. The application 14 uses the SIM interface to obtain the IMSI or any other identifier, Kc, and S values. Preferably a function f 102 is used to combine the values Kc and S into a single value Ri, similar to the function f 102 shown in Fig.5.

[0047] The values Ci, the IMSI or any other identifier, and Ri are transmitted to the verification server 4. The verification server 4 processes the challenge data Ci using a preferably unique function 41, such as a cryptographic function using a unique key Km. The resulting processed challenge data is sent as response data {Ci}Km to an inverse module 143 of the software application 14 to perform an inverse operation of the function 41 to undo its effects and enable a second secured software part 142 of the software application 14 to operate as intended.

[0048] Preferably, the key Km is linked to the IMSI value and the application. It may be stored securely in the verification server 4, but it can also be stored in encrypted form in the MS 1 in the form of a key loading message. The key loading message preferably takes the form as disclosed in applicant's co-pending European patent application titled "Key Transport Protocol" and having applicant's reference number 15464, which is herewith incorporated by reference in its entirety.

[0049] After receiving the parameters from the application 14, the verification server 4 can optionally verify the presence of the correct SIM card by requesting the home network 3 as identified by the IMSI value to process Ci in an A8+A3 module of the AuC 31 and return the values for S and Kc. Hereto the verification server 4 sends the IMSI and Ci values to the AuC 31 to obtain Kc,S. The Kc,S response from the AuC 31 may be converted into a authentic response Qi using a function f(Kc,S) denoted by 45, which is typically identical to the function f 102. Ri and Qi or the Kc,S values received from the software application 14 and the AuC 31 are compared by comparison function 42. If Qi and Ri or the Kc,S values do not match, it is concluded that a verification error occurred, e.g. due to the presence of an incorrect SIM 10. In this case, instead of {Ci}Km needed by the application 14 to be correctly executed, a random value generated by a random number generator 44 is transmitted from the verification server 4 to the MS 1. A selection module 43 may be used to output either {Ci}Km or the random value in dependence of the result of the comparison function 42.

[0050] In a second variant of the second scenario, which is shown in Fig.10, during execution of an application 14 a first secured software part 141 of the application 14 sends challenge data Ci in the form of runtime data to the SIM 10 with a request to calculate a response Kc,S. This means that the SIM 10 treats the runtime data Ci as a random value R for input to the A8+A3 module 101. The application 14 uses the SIM interface to obtain the IMSI or any other identifier, Kc, and S values. Preferably a function f 102 is used to combine the values Kc and S into a single value Ri, similar to the function f 102 shown in Fig.5.

[0051] The values Ci and the IMSI (or any other identifier) are transmitted to the verification server 4. The verification server 4 processes the challenge data Ci using a preferably unique function 41, such as a cryptographic function using a unique key Km, to obtain an intermediate response data {Ci}Km.

[0052] Preferably, the key Km is linked to the IMSI value and the application, as described in the first variant of the second scenario.

[0053] The verification server 4 requests the home network 3 as identified by the IMSI value to process Ci in an A8+A3 module of the AuC 31 and return the values for S and Kc. Hereto the verification server 4 sends the IMSI and Ci values to the AuC 31 to obtain Kc,S. The Kc,S response from the AuC 31 may be converted into a authentic response Qi using a function f(Kc,S) denoted by 45, which is identical to the function f 102.

[0054] The response data {Ci}Km is combined with Qi using a function g(Qi, {Ci}Km)=Vi, which is denoted as 46, and sends the result to the MS 1. In the MS 1, the result of function g 46 is reversed using a function h(Ri,Vi) = {Ci}Km, which is denoted as 144 and uses as input Ri received from function f 102 and Vi received from the verification server 4. If the values for Qi and Ri are equal, the result of the h() function will be the encrypted Ci, i.e. {Ci}Km.

[0055] In a third variant of the second scenario, which is shown in Fig.11, during execution of an application 14 a first secured software part 141 of the application 14 sends challenge data Ci in the form of runtime data and the IMSI (or any other identifier) to the verification server 4. The verification server 4 processes the challenge data Ci using a preferably unique function 41, such as a cryptographic function using a unique key Km, to obtain an intermediate response data {Ci}Km.

[0056] For each IMSI value the verification server 4 has stored a secret key Km that corresponds to the same key value that is securely embedded in the secured and personalised application 14 in the MS 1. The securely embedded key Km makes the application 14 unique.

[0057] A random number generator 44 in the verification server 4 generates random data Ni. The verification server 4 requests the home network 3 as identified by the IMSI value to process the random data Ni in an A8+A3 module of the AuC 31 and return the values for S and Kc. Hereto the verification server 4 sends the IMSI and Ni values to the AuC 31 to obtain Kc,S. The Kc,S response from the AuC 31 may be converted into a authentic response Qi using a function f(Kc,S) denoted by 45, which is identical to the function f 102.

[0058] The response data {Ci}Km is combined with Qi using a function g(Qi,{Ci}Km)=Vi, which is denoted as 46, and sends the resulting Vi together with the random data Ni to the MS 1.

[0059] The application 14 sends the random data Ni to the SIM 10 with a request to calculate a response Kc,S. This means that the SIM 10 treats the random data Ni as a random value R for input to the A8+A3 module 101. The application 14 uses the SIM interface to obtain the IMSI or any other identifier, Kc, and S values. Preferably a function f 102 is used to combine the values Kc and S into a single value Ri, similar to the function f 102 shown in Fig.5.

[0060] In the MS 1, the result of function g 46 is reversed using a function h(Ri,Vi)= {Ci}Km, which is denoted as 144 and uses as input Ri received from function f 102 and Vi received from the verification server 4. If the values for Qi and Ri are equal, the result of the h() function will be the encrypted Ci, i.e. {Ci}Km.

[0061] The functions g() 46 and h() 144 are related by the property h(a,g(a,b)) = b. A simple example for g() and h() is an XOR function. The same relation for g() and h() exists in secret key encryption and decryption functions. In that case, g(a,b) would represent the encryption of 'b' using the key 'a'. The resulting ciphertext 'c' can be decrypted using the key 'a' to obtain the cleartext 'b'. This is represented by the function call h(a,c). The functions g() 46 and h() 144 are typically implemented as software modules.

[0062] The function h() 144 may be executed in the verification server 4 instead of the mobile station 1.

[0063] In the three variants of the second scenario, the software application 14, or a part of the software application 14, is implemented as a sequence of secured software modules, i.e. the first secured software module 141 and the second secured software module 142. Each secured software module 141,142 exchanges parameters and/or state information in a transformed domain. By the procedure outlined above, the secured software application 14 is effectively anchored to the SIM 10.

[0064] The verification server 4 is configured with a preferably unique function 41 or preferably unique secret data that drives a common function that corresponds to an inverse function implemented in the inverse secured software module 143. The secret data is e.g. a personalized key Km linked to the IMSI value of the SIM 10. As the interfaces between the secured software modules are protected by transformations, the secured software application will not operate correctly if the output of first secured software module 141 is input directly into the inverse secured software module 143. In other words, bypassing the verification server interface is not possible as it results in a non-functional secured software application 14.

[0065] The inverse secured software module 143 and the second secured software module 142 can be implemented as a single module combining the functionalities of the two. The function 102 is typically a part of the software application 14, but may be implemented as a separate software module.

[0066] The inverse secured module 143, together with the key Km, is preferably implemented as a secure software module that is integrated with secure software module 142.

[0067] The key Km is not necessarily unique per application 14, as the challenge can be generated at run time. If the challenge contains elements of a local execution state, the challenge will be unique to a particular execution instance of the application 14. Sharing the Km encrypted challenge, i.e. {Ci}Km, will be of little value as each application will have a different local execution state. This reduces the need to have a unique key Km in all applications.

[0068] The verification server 4 may use a key loading message, e.g. containing an encrypted version of the key Km receive from an external source, to load the key Km for use in the encryption function 41. One such mechanism could use the key loading mechanism as disclosed in applicant's co-pending European patent application titled "Key Transport Protocol" and having applicant's reference number 15464, which is herewith incorporated by reference in its entirety.

[0069] The verification server 4 uses the authorised response Qi to generate a return value. Only when the authorised response Qi equals the response Ri generated by the SIM, the return value contains a result that can be used successfully in the later execution of the software application 14 in the MS 1. This effectively locks the application to the SIM 10.

[0070] In an alternative exemplary embodiment, which is not shown in Fig.9 or Fig.10, the order of the function 41 and the inverse secured software module 143 is reversed. In this embodiment the inverse secured software module performs the function 41 of the verification server 4 and the verification server performs the function of the inverse secured software module 143. In this embodiment the inverse secured software module and the first secured software module 141 can be implemented as a single module combining the functionalities of the two.

[0071] Responses from the authentication centre 31 may be cached in the verification server 4 for later use. It this manner is possible to receive multiple responses to multiple challenges from the authentication centre 31 and store the challenge and response pairs for later use.

[0072] A combination of the first and second scenario enables the verification server 4 to link the secured application 14 to the local SIM 10 for both online and offline situations. The online check of the first and second variant of the second scenario is more secure and can be used to add security to the offline checking of the first and second variant of the first scenario by replacing the used challenge-response pairs (Ci,Ri) with newly generated ones.

[0073] It is to be understood that the invention is not limited to securing and personalizing software applications in a GSM MS, but that it can also be use in conjunction with other mobile telecommunication standards, such as in e.g. an UMTS/WCDMA MS, a LTE MS, a CDMA MS and a CDMA2000 MS.

[0074] One embodiment of the invention may be implemented as a program product for use with a computer system. The program(s) of the program product define functions of the embodiments (including the methods described herein) and can be contained on a variety of non-transitory computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state nonvolatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., flash memory, floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory) on which alterable information is stored.


Claims

1. A method for enabling a software application (12) to be executed on a mobile station (1) in dependence of a subscriber identity module (10) of the mobile station, the method comprising:

inputting first challenge data originating from the software application (12) to the subscriber identity module (10), wherein a plurality of challenge data and corresponding response data are preconfigured in the software application (12), the first challenge data being from the plurality of challenge data;

generating first response data in the subscriber identity module (10), wherein the subscriber identity module (10) is configured to perform a first security function (101) and wherein the first response data is generated using the first security function (101) using a) data which is uniquely associated with the subscriber identity module and b) the first challenge data;

verifying if the first response data corresponds with the preconfigured response data corresponding to the first challenge data in the software application (12) to obtain a verification result; and

enabling the software application (12) to be further executed in dependence of the verification result.


 
2. The method according to claim 1, wherein the first security function (101) comprises a first combined cipher key generation and authentication algorithm and wherein the first response data comprises at least one of a first cipher key and a first signed response.
 
3. The method according to claim 2, further comprising combining the first cipher key and the first signed response using a first combining function (102) to obtain the first response data.
 
4. A method for generating a software application (12) to be executed in dependence of a given subscriber identity module (10), wherein the given subscriber identity module is arranged to generate response data by performing a security function using a) data which is uniquely associated with the given subscriber identity module and b) challenge data, the method comprising:

obtaining a plurality of challenge data and corresponding first response data in a server (4), wherein, for each of the plurality of challenge data, the corresponding first response data originates from the security function using said challenge data and the data which is uniquely associated with the given subscriber identity module as input; and

embedding by the server (4) the plurality of challenge data and corresponding first response data in the software application (12) to enable the software application (12), when installed in a mobile station (1) having a subscriber identity module, to be executed, execution of the software application comprising:

inputting first challenge data to the subscriber identity module to obtain second response data, the first challenge data being from the plurality of challenge data,

verifying if the first response data that corresponds to the first challenge data corresponds with the second response data to obtain a verification result, and

enabling the software application (12) to be further executed depending on the verification result.


 
5. The method according to claim 4, the method further comprising:

generating the plurality of challenge data in a pre-install software application (13) in a mobile station (1);

inputting the plurality of challenge data from the pre-install software application (13) to the given subscriber identity module (10); and

generating the corresponding first response data in the given subscriber identity module (10).


 
6. The method of claim 4 or 5, wherein the security function comprises a combined cipher key generation and authentication algorithm and wherein response data generated by the security function comprises at least one of a cipher key and a signed response.
 
7. The method according to claim 6, wherein the security function is arranged to combine the cipher key and the signed response using a combining function (102) to obtain response data.
 
8. The method according to any one of the claims 4-7, wherein the server (4) is an application distribution server, and wherein the method further comprises installing the software application (12) on the mobile station (1) from the application distribution server (4).
 
9. A server (4) for generating a software application (12) to be executed in dependence of a given subscriber identity module (10), wherein the given subscriber identity module is arranged to generate response data by performing a security function using a) data which is uniquely associated with the given subscriber identity module and b) challenge data, wherein the server (4) is configured to:

obtain a plurality of challenge data and corresponding first response data, wherein, for each of the plurality of challenge data, the corresponding first response data originates from the security function using said challenge data and the data which is uniquely associated with the given subscriber identity module as input; and

embed the plurality of challenge data and corresponding first response data in the software application (12) to enable the software application (12), when installed in a mobile station (1) having a subscriber identity module, to be executed, execution of the software application comprising:

inputting first challenge data to the subscriber identity module to obtain second response data, the first challenge data being from the plurality of challenge data,

verifying if the first response data that corresponds to the first challenge data corresponds with the second response data to obtain a verification result, and

enabling the software application (12) to be further executed depending on the verification result.


 
10. The server (4) according to claim 9, wherein the plurality of challenge data is generated in a pre-install software application (13) in a mobile station (1) and input from the pre-install software application (13) to the given subscriber identity module (10) for generating the corresponding first response data, and wherein the server (4) is configured to obtain the plurality of challenge data and corresponding first response data from the mobile station (1).
 
11. The server (4) according to claim 9 or 10, wherein the security function comprises a combined cipher key generation and authentication algorithm and wherein response data generated by the security function comprises at least one of a cipher key and a signed response.
 
12. The server (4) according to claim 11, wherein the security function is arranged to combine the cipher key and the signed response using a combining function (102) to obtain response data.
 
13. The server (4) according to any one of the claims 9-11, wherein the server (4) is an application distribution server, and wherein the software application (12) is installable on the mobile station (1) from the application distribution server (4).
 
14. A computer program which, when executed by one or more processors, causes the one or more processors to carry out a method according to any one of claims 1-8.
 


Ansprüche

1. Verfahren, welches es einer Software-Anwendung (12) ermöglicht, auf einer Mobilstation (1) in Abhängigkeit von einem Teilnehmer-Identitätsmodul (10) der Mobilstation ausgeführt zu werden, wobei das Verfahren umfasst:

Eingabe erster Aufforderungsdaten, welche von der Software-Anwendung (12) stammen, in das Teilnehmeridentitätsmodul (10), wobei eine Vielzahl von Auffforderungsdaten und entsprechender Antwortdaten in der Software-Anwendung (12) vorkonfiguriert sind, wobei die ersten Aufforderungsdaten aus der Vielzahl von Aufforderungsdaten stammen;

Erzeugung von ersten Antwortdaten in dem Teilnehmer-Identitätsmodul (10), wobei das Teilnehmer-Identitätsmodul (10) derart konfiguriert ist, dass es eine erste Sicherheitsfunktion (101) ausführt und wobei die ersten Antwortdaten unter Verwendung der ersten Sicherheitsfunktion (101) erzeugt werden, indem a) Daten verwendet werden, welche einzig dem Teilnehmer-Identifikationsmodul zugehörig sind, und b) die ersten Aufforderungsdaten verwendet werden;

Überprüfung, ob die ersten Antwortdaten mit den vorkonfigurierten Antwortdaten, welche den ersten Aufforderungsdaten in der Software-Anwendung (12) entsprechen, übereinstimmen, um ein Prüfergebnis zu erhalten; und

Freigabe der Software-Anwendung (12), damit diese in Abhängigkeit von dem Prüfergebnis weiter ausgeführt wird.


 
2. Verfahren nach Anspruch 1, wobei die erste Sicherheitsfunktion (101) einen ersten gemeinsamen Chiffrierschlüsselerzeugungs- und Authentifizierungsalgorithmus umfasst und wobei die ersten Antwortdaten zumindest entweder einen ersten Chiffrierschlüssel oder eine erste signierte Antwort umfassen.
 
3. Verfahren nach Anspruch 2, welches des Weiteren die Kombination des ersten Chiffrierschlüssels und der ersten signierten Antwort unter Verwendung einer ersten Kombinierfunktion (102) umfasst, um die ersten Antwortdaten zu erhalten.
 
4. Verfahren zur Erzeugung einer Software-Anwendung (12), welche in Abhängigkeit von einem vorgegebenen Teilnehmer-Identitätsmodul (10) ausgeführt werden soll, wobei das vorgegebene Teilnehmer-Identitätsmodul derart angeordnet ist, dass es Antwortdaten durch Ausführen einer Sicherheitsfunktion erzeugt, welche verwendet:

a) Daten, welche einzig dem vorgegebenen Teilnehmer-Identifikationsmodul zugehörig sind, und b) Aufforderungsdaten, wobei das Verfahren umfasst:

Erhalt einer Vielzahl von Aufforderungsdaten und entsprechender erster Antwortdaten in einem Server (4), wobei für jede der Vielzahl von Aufforderungsdaten die entsprechenden ersten Antwortdaten von der Sicherheitsfunktion stammen, welche diese Aufforderungsdaten und die Daten als Eingabe verwenden, die einzig dem vorgegebenen Teilnehmer-Identifikationsmodul zugehörig sind; und

Einbau, durch den Server (4), der Vielzahl von Aufforderungsdaten und entsprechender erster Antwortdaten in die Software-Anwendung (12), um es der Software-Anwendung (12) zu ermöglichen, sobald sie in einer Mobilstation (1) mit einem Teilnehmer-Identitätsmodul installiert wird, ausgeführt zu werden, wobei die Ausführung der Software-Anwendung umfasst:

Eingabe erster Aufforderungsdaten in das Teilnehmer-Identifikationsmodul zum Erhalt von zweiten Antwortdaten, wobei die ersten Aufforderungsdaten aus der Vielzahl von Aufforderungsdaten stammen,

Überprüfung, ob die ersten Antwortdaten, welche den ersten Aufforderungsdaten entsprechen, mit den zweiten Antwortdaten übereinstimmen, um ein Prüfergebnis zu erhalten, und

Freigabe der Software-Anwendung (12), damit diese in Abhängigkeit von dem Prüfergebnis weiter ausgeführt wird.


 
5. Verfahren nach Anspruch 4, wobei das Verfahren weiter umfasst:

Erzeugung der Vielzahl von Aufforderungsdaten in einer vorinstallierten Software-Anwendung (13) in einer Mobilstation (1);

Eingabe der Vielzahl von Aufforderungsdaten von der vorinstallierten Software-Anwendung (13) in das vorgegebene Teilnehmer-Identifikationsmodul (10); und

Erzeugung der entsprechenden ersten Antwortdaten in dem vorgegebenen Teilnehmer-Identifikationsmodul (10).


 
6. Verfahren nach Anspruch 4 oder 5, wobei die Sicherheitsfunktion einen gemeinsamen Chiffrierschlüsselerzeugungs- und Authentifizierungsalgorithmus umfasst und wobei Antwortdaten, welche durch die Sicherheitsfunktion erzeugt werden, zumindest entweder einen Chiffrierschlüssel oder eine signierte Antwort umfassen.
 
7. Verfahren nach Anspruch 6, wobei die Sicherheitsfunktion derart ausgelegt ist, dass sie den Chiffrierschlüssel und die signierte Antwort unter Verwendung einer Kombinierfunktion (102) kombiniert, um Antwortdaten zu erhalten.
 
8. Verfahren nach einem der Ansprüche 4 bis 7, wobei der Server (4) ein Anwendungs-Distributionsserver ist, und wobei das Verfahren des Weiteren die Installation der Software-Anwendung (12) auf der Mobilstation (1) von dem Anwendungs-Distributionsserver (4) umfasst.
 
9. Server (4) zur Erzeugung einer Software-Anwendung (12), welche in Abhängigkeit von einem vorgegebenen Teilnehmer-Identifikationsmodul (10) ausgeführt werden soll, wobei das vorgegebene Teilnehmer-Identifikationsmodul derart ausgelegt ist, dass es Antwortdaten erzeugt, indem es eine Sicherheitsfunktion ausführt, welche verwendet: a) Daten, welche einzig dem vorgegebenen Teilnehmer-Identifikationsmodul zugehörig sind, und b) Aufforderungsdaten, wobei der Server (4) konfiguriert ist zum:

Erhalt einer Vielzahl von Aufforderungsdaten und entsprechender erster Antwortdaten, wobei für jede der Vielzahl von Aufforderungsdaten die entsprechenden ersten Antwortdaten von der Sicherheitsfunktion stammen, welche diese Aufforderungsdaten und die Daten als Eingabe verwendet, die einzig dem vorgegebenen Teilnehmer-Identifikationsmodul zugehörig sind; und

Einbau der Vielzahl von Aufforderungsdaten und entsprechender erster Antwortdaten in die Software-Anwendung (12), um es der Software-Anwendung (12) zu ermöglichen, sobald sie in einer Mobilstation (1) mit einem Teilnehmer-Identifikationsmodul installiert wird, ausgeführt zu werden, wobei die Ausführung der Software-Anwendung umfasst:

Eingabe erster Aufforderungsdaten in das Teilnehmer-Identifikationsmodul zum Erhalt von zweiten Antwortdaten, wobei die ersten Aufforderungsdaten aus der Vielzahl von Aufforderungsdaten stammen,

Überprüfung, ob die ersten Antwortdaten, welche den ersten Aufforderungsdaten entsprechen, mit den zweiten Antwortdaten übereinstimmen, um ein Prüfergebnis zu erhalten, und

Freigabe der Software-Anwendung (12), damit diese in Abhängigkeit von dem Prüfergebnis weiter ausgeführt wird.


 
10. Server (4) nach Anspruch 9, wobei die Vielzahl von Aufforderungsdaten in einer vorinstallierten Software-Anwendung (13) in einer Mobilstation (1) erzeugt wird und von der vorinstallierten Software-Anwendung (13) in das vorgegebene Teilnehmer-Identifikationsmodul (10) eingegeben wird, um die entsprechenden ersten Antwortdaten zu erzeugen, und wobei der Server (4) zum Erhalt der Vielzahl von Aufforderungsdaten und entsprechender erster Antwortdaten von der Mobilstation (1) ausgelegt ist.
 
11. Server (4) nach Anspruch 9 oder 10, wobei die Sicherheitsfunktion einen gemeinsamen Chiffrierschlüsselerzeugungs- und Authentifizierungsalgorithmus aufweist, und wobei Antwortdaten, welche von der Sicherheitsfunktion erzeugt werden, zumindest entweder einen Chiffrierschlüssel oder eine signierte Antwort umfassen.
 
12. Server (4) nach Anspruch 11, wobei die Sicherheitsfunktion derart ausgelegt ist, dass sie den Chiffrierschlüssel und die signierte Antwort unter Verwendung einer Kombinierfunktion (102) kombiniert, um Antwortdaten zu erhalten.
 
13. Server (4) nach einem der Ansprüche 9 bis 11, wobei der Server (4) ein Anwendungs-Distributionsserver ist, und wobei die Software-Anwendung (12) auf der Mobilstation (1) von dem Anwendungs-Distributionsserver (4) installierbar ist.
 
14. Computerprogramm, welches bei Ausführung durch einen oder mehrere Prozessoren, den einen oder die mehreren Prozessoren veranlasst, ein Verfahren nach einem der Ansprüche 1 bis 8 auszuführen.
 


Revendications

1. Procédé pour autoriser une application logicielle (12) à être exécutée sur une station mobile (1) en fonction d'un module d'identité d'abonné (10) de la station mobile, le procédé comprenant les étapes consistant à :

entrer des premières données de défi provenant de l'application logicielle (12) dans le module d'identité d'abonné (10), où une pluralité de données de défi et des données de réponse correspondantes sont préconfigurées dans l'application logicielle (12), les premières données de défi provenant de la pluralité de données de défi ;

générer des premières données de réponse dans le module d'identité d'abonné (10), où le module d'identité d'abonné (10) est configuré pour effectuer une première fonction de sécurité (101) et où les premières données de réponse sont générées en utilisant la première fonction de sécurité (101) utilisant a) des données qui sont associées de manière unique au module d'identité d'abonné et b) les premières données de défi ;

vérifier si les premières données de réponse correspondent aux données de réponse préconfigurées correspondant aux premières données de défi dans l'application logicielle (12) pour obtenir un résultat de vérification ; et

autoriser l'application logicielle (12) à être davantage exécutée en fonction du résultat de vérification.


 
2. Procédé selon la revendication 1, dans lequel la première fonction de sécurité (101) comprend un premier algorithme combiné de génération de clé de chiffrement et d'authentification et dans lequel les premières données de réponse comprennent au moins l'une d'une première clé de chiffrement et d'une première réponse signée.
 
3. Procédé selon la revendication 2, comprenant en outre la combinaison de la première clé de chiffrement et de la première réponse signée en utilisant une première fonction de combinaison (102) pour obtenir les premières données de réponse.
 
4. Procédé de génération d'une application logicielle (12) à exécuter en fonction d'un module d'identité d'abonné (10) donné, dans lequel le module d'identité d'abonné donné est conçu pour générer des données de réponse en effectuant une fonction de sécurité utilisant a) des données qui sont associées de manière unique au module d'identité d'abonné donné et b) des données de défi, le procédé comprenant les étapes consistant à :

obtenir une pluralité de données de défi et des premières données de réponse correspondantes dans un serveur (4), où, pour chacune de la pluralité de données de défi, les premières données de réponse correspondantes proviennent de la fonction de sécurité utilisant lesdites données de défi et les données qui sont associées de manière unique au module d'identité d'abonné donné en tant qu'entrée ; et

incorporer par le serveur (4) la pluralité de données de défi et les premières données de réponse correspondantes dans l'application logicielle (12) pour autoriser l'application logicielle (12), lorsqu'elle est installée dans une station mobile (1) ayant un module d'identité d'abonné, à être exécutée, l'exécution de l'application logicielle comprenant les étapes consistant à :

entrer des premières données de défi dans le module d'identité d'abonné pour obtenir des deuxièmes données de réponse, les premières données de défi provenant de la pluralité de données de défi,

vérifier si les premières données de réponse qui correspondent aux premières données de défi correspondent aux deuxièmes données de réponse pour obtenir un résultat de vérification, et

autoriser l'application logicielle (12) à être davantage exécutée en fonction du résultat de vérification.


 
5. Procédé selon la revendication 4, le procédé comprenant en outre les étapes consistant à :

générer la pluralité de données de défi dans une application logicielle de pré-installation (13) dans une station mobile (1) ;

entrer la pluralité de données de défi provenant de l'application logicielle de pré-installation (13) dans le module d'identité d'abonné (10) donné ; et

générer les premières données de réponse correspondantes dans le module d'identité d'abonné (10) donné.


 
6. Procédé selon la revendication 4 ou 5, dans lequel la fonction de sécurité comprend un algorithme combiné de génération de clé de chiffrement et d'authentification et dans lequel les données de réponse générées par la fonction de sécurité comprennent au moins l'une d'une clé de chiffrement et d'une réponse signée.
 
7. Procédé selon la revendication 6, dans lequel la fonction de sécurité est conçue pour combiner la clé chiffrement et la réponse signée en utilisant une fonction de combinaison (102) pour obtenir des données de réponse.
 
8. Procédé selon l'une quelconque des revendications 4 à 7, dans lequel le serveur (4) est un serveur de distribution d'applications, et où le procédé comprend en outre l'installation de l'application logicielle (12) sur la station mobile (1) à partir du serveur de distribution d'applications (4).
 
9. Serveur (4) pour générer une application logicielle (12) à exécuter en fonction d'un module d'identité d'abonné (10) donné, où le module d'identité d'abonné donné est conçu pour générer des données de réponse en effectuant une fonction de sécurité utilisant a) des données qui sont associées de manière unique au module d'identité d'abonné donné et b) des données de défi, où le serveur (4) est configuré pour :

obtenir une pluralité de données de défi et des premières données de réponse correspondantes, où, pour chacune de la pluralité de données de défi, les premières données de réponse correspondantes proviennent de la fonction de sécurité utilisant lesdites données de défi et les données qui sont associées de manière unique au module d'identité d'abonné donné en tant qu'entrée ; et

intégrer la pluralité de données de défi et les premières données de réponse correspondantes dans l'application logicielle (12) pour autoriser l'application logicielle (12), lorsqu'elle est installée dans une station mobile (1) ayant un module d'identité d'abonné, à être exécutée, l'exécution de l'application logicielle comprenant les étapes consistant à :

entrer des premières données de défi dans le module d'identité d'abonné pour obtenir des deuxièmes données de réponse, les premières données de défi provenant de la pluralité de données de défi,

vérifier si les premières données de réponse qui correspondent aux premières données de défi correspondent aux deuxièmes données de réponse pour obtenir un résultat de vérification, et

autoriser l'application logicielle (12) à être davantage exécutée en fonction du résultat de vérification.


 
10. Serveur (4) selon la revendication 9, où la pluralité de données de défi est générée dans une application logicielle de pré-installation (13) dans une station mobile (1) et entrée depuis l'application logicielle de pré-installation (13) dans le module d'identité d'abonné (10) donné pour générer les premières données de réponse correspondantes, et où le serveur (4) est configuré pour obtenir la pluralité de données de défi et les premières données de réponse correspondantes de la station mobile (1).
 
11. Serveur (4) selon la revendication 9 ou 10, où la fonction de sécurité comprend un algorithme combiné de génération de clé de chiffrement et d'authentification et où les données de réponse générées par la fonction de sécurité comprennent au moins l'une d'une clé de chiffrement et d'une réponse signée.
 
12. Serveur (4) selon la revendication 11, où la fonction de sécurité est conçue pour combiner la clé de chiffrement et la réponse signée en utilisant une fonction de combinaison (102) pour obtenir des données de réponse.
 
13. Serveur (4) selon l'une quelconque des revendications 9 à 11, où le serveur (4) est un serveur de distribution d'applications, et où l'application logicielle (12) peut être installée sur la station mobile (1) à partir du serveur de distribution d'applications (4).
 
14. Programme informatique qui, lorsqu'il est exécuté par un ou plusieurs processeurs, amène les un ou plusieurs processeurs à mettre en Ĺ“uvre un procédé selon l'une quelconque des revendications 1 à 8.
 




Drawing




















Cited references

REFERENCES CITED IN THE DESCRIPTION



This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

Patent documents cited in the description




Non-patent literature cited in the description