Remote secure element policy management
A policy server that is associated with a secure element owner receives a request, from a service provider, to provision access, by an application, to the secure element. The policy server creates, in response to the request, a policy ticket, for the service provider, that defines privileges for the service provider to create a security domain or a new profile within the secure element. The policy server provides, to a service provider trusted service manager (TSM), the policy ticket and a signed certificate, the signed certificate corresponding to a root certificate that is inserted into a Controlling Authority Security Domain (CASD) portion of the secure element prior to receiving the request. When the CASD receives the policy ticket and signed certificate from the service provider TSM, the CASD validates based on the root certificate and provisions access to the secure element based on information in the policy ticket.
1. A method, comprising:
receiving, by a policy server device that is associated with a secure element owner, a request from a service provider for a client application to provision access, by the client application, to a secure element residing on a communication device, wherein the service provider is different than the secure element owner and the communication device;
creating, by the policy server device and in response to the request from the service provider, a policy ticket, wherein the policy ticket defines privileges, to be enforced by the secure element, for the service provider to create a security domain or a new profile within the secure element;
providing, by the policy server device and to a service provider trusted service manager (TSM) device, the policy ticket and a signed certificate, wherein the signed certificate corresponds to a root certificate that is inserted, prior to receiving the request from the service provider, into a Controlling Authority Security Domain (CASD) portion of the secure element;
receiving, by the CASD portion and from the service provider TSM device, the policy ticket and the signed certificate;
verifying, by the CASD portion, the policy ticket and the signed certificate based on the root certificate;
provisioning, based on information in the policy ticket, access by the application to the secure element, wherein the provisioning includes creating, on the secure element, a new security domain;
creating, by the service provider TSM device, a secure channel protocol (SCP) key for the new security domain;
personalizing the new security domain with the SCP key;
receiving, by the CASD portion and from the service provider TSM device, the SCP key;
receiving, by the CASD portion and from another service provider TSM device, another policy ticket and another signed certificate for the new security domain;
verifying, by the CASD portion, the other policy ticket and the other signed certificate based on the SCP key; and
modifying, on the secure element, the new security domain based on information in the other policy ticket.
2. The method of claim 1 , further comprising:
inserting, onto a memory card and as part of an original equipment manufacturer (OEM) process, the root certificate into the CASD portion of the secure element.
3. The method of claim 1 , further comprising:
adding the signed certificate to a chain of trust in the CASD portion.
4. The method of claim 1 , wherein the privileges defined in the policy ticket identify an amount of memory space allocated for the new security domain, and the method further comprising:
establishing, by the service provider TSM device and with the secure element, an over-the-air session to provide the policy ticket and the signed certificate to the CASD portion on the secure element.
5. The method of claim 1 , wherein provisioning access, by the application, to the secure element includes:
creating, on the secure element, a new profile container.
6. The method of claim 1 , wherein providing the policy ticket and a signed certificate further comprises:
embedding the policy ticket in the signed certificate.
7. The method of claim 1 , wherein the secure element comprises a Universal Integrated Circuit Card (UICC) card.
8. The method of claim 1 , wherein the secure element comprises a removable card.
9. The method of claim 2 , further comprising:
adding, after verifying the policy ticket and the signed certificate, the signed certificate to a chain of trust in the CASD portion.
10. The method of claim 1 , wherein the policy ticket includes:
a unique identifier for the service provider receiving the policy ticket, and
a security domain identifier associated with the client application for which the security domain is intended.
11. A system, comprising:
a policy server device associated with a secure element owner, the policy server device including:
a communication interface connected to an external network,
a memory configured to store instructions, and
a processor configured to execute the instructions stored in the memory to:
receive a request from a service provider device for a client application to provision access, by the client application, to a secure element residing on a communication device, wherein the service provider device is different than the secure element owner and the communication device,
create, in response to the request from the service provider device, a policy ticket, wherein the policy ticket defines privileges, to be enforced by the secure element, for a service provider to create a security domain or a new profile within the secure element, and
provide, to a service provider trusted service manager (TSM) device, the policy ticket and a signed certificate, wherein the signed certificate corresponds to a root certificate inserted into a Controlling Authority Security Domain (CASD) portion of the secure element prior to receiving the request from the service provider device;
a device including:
a secure element with the root certificate in the CASD portion of the secure element, and
a processor within the secure element to:
receive, from the service provider TSM device, the policy ticket and the signed certificate,
verify the policy ticket and the signed certificate based on the root certificate, and
provision, based on information in the policy ticket, access by the application to the secure element, wherein the provisioning includes creating, on the secure element, a new security domain; and
the service provider TSM device including another processor to:
create a secure channel protocol (SCP) key for the new security domain, and
personalize the new security domain with the SCP key, wherein the processor within the secure element is further to:
receive, from the service provider TSM device, the SCP key,
receive, from another service provider TSM device, another policy ticket and another signed certificate for the new security domain,
verify the other policy ticket and the other signed certificate based on the SCP key, and
modify, on the secure element, the new security domain based on information in the other policy ticket.
12. The system of claim 11 , wherein the root certificate is inserted into the CASD portion of the secure element as part of a manufacturing process.
13. The system of claim 11 , wherein the processor in the policy server device is further configured to execute the instructions stored in the memory to:
add the signed certificate to a chain of trust in the CASD portion.
14. The system of claim 11 , further comprising:
the service provider TSM device to:
establish, with the secure element on the device, an over-the-air session to provide the policy ticket and the signed certificate to the CASD portion.
15. The system of claim 11 , wherein the secure element comprises a removable card.
16. The system of claim 11 , wherein the other policy ticket includes:
a unique identifier for the service provider receiving the other policy ticket, and
a security domain identifier associated with another client application for which the new security domain is intended.
17. The system of claim 11 , wherein, provisioning access by the application to the secure element, the processor in the policy server device is further configured to execute the instructions stored in the memory to:
create, on the secure element, a new profile container.