Obtaining and using time information on a secure element (SE)
A secure element (SE) with a notion of time useful for checking secure items is disclosed herein. Use of Public Key Infrastructure (PKI) with secure elements is improved by verifying secure items used by an SE. Methods of obtaining time information by the SE include push, pull, opportunistic, local interface, and multi-check methods. The SE uses the time information to evaluate arriving and stored public key certificates and to discard those which fail the evaluation. The SE, in some embodiments, uses the time information in cooperation with certificate revocation lists (CRLs) and/or online certificate status protocol (OCSP) stapling procedures. A multi-check architecture is provided herein by which more than entity is involved in checking a time value before the time value reaches the SE. The multi-check architecture uses both PKI and blockchain techniques.
1. A device comprising:
a secure element (SE);
wireless circuitry; and
a processor communicatively coupled to the SE, the wireless circuitry, and a memory storing instructions, that when executed by the processor, cause the device to perform operations comprising:
receiving a blockchain (BC) block from a BC ledger, wherein the BC block includes a second hash value and a time value,
when a content of the BC block and a BC state value are not consistent with a first hash value stored in the memory:
discarding the BC block, and
when the content of the BC block and the BC state value are consistent with the first hash value stored in the memory:
replacing, in the memory, the first hash value with the second hash value,
parsing the time value from the BC block,
providing a first indication of the time value on a user interface of the device,
receiving a second indication from the user interface,
when the second indication indicates that the time value is rejected:
sending, to the SE, a message indicating that the time value in the BC block is rejected; and
when the second indication indicates that the time value is not rejected:
sending, to the SE, the BC block and a message indicating that the time value in the BC block is not rejected.
2. The device of claim 1 , wherein the operations further comprise:
obtaining a plurality of BC blocks;
verifying each BC block in the plurality of BC blocks;
dividing the plurality of BC blocks into a plurality of batches; and
when the second indication indicates that the time value is not rejected:
sending a first batch of the plurality of batches to the SE, wherein a size of the first batch is chosen to not exceed a memory capacity of the SE.
3. The device of claim 2 , wherein the plurality of batches is ordered in time such that the plurality of batches includes a most recent batch in time.
4. The device of claim 3 , wherein the first batch is the most recent batch in time.
5. The device of claim 3 , wherein the first batch is not the most recent batch in time.
6. The device of claim 1 , wherein the time value originates from a network time source.
7. The device of claim 1 , wherein the time value is posted by a network server as a transaction for placement in the BC block.
8. An apparatus configurable for operation in a device, the apparatus comprising:
a processor; and
a memory storing instructions, that when executed by the processor, cause the device to perform operations comprising:
receiving a blockchain (BC) block from a BC ledger, wherein the BC block includes a second hash value and a time value,
when a content of the BC block and a BC state value are not consistent with a first hash value stored in the memory:
discarding the BC block, and
when the content of the BC block and the BC state value are consistent with the first hash value stored in the memory:
replacing, in the memory, the first hash value with the second hash value,
parsing the time value from the BC block,
providing a first indication of the time value on a user interface of the device,
receiving a second indication from the user interface,
when the second indication indicates that the time value is rejected:
sending, to a secure element (SE) housed in the device, a message indicating that the time value in the BC block is rejected;
when the second indication indicates that the time value is not rejected:
sending, to the SE, the BC block and a message indicating that the time value in the BC block is not rejected.
9. The apparatus of claim 8 , wherein the operations further comprise:
obtaining a plurality of BC blocks;
verifying each BC block in the plurality of BC blocks;
dividing the plurality of BC blocks into a plurality of batches; and
when the second indication indicates that the time value is not rejected:
sending a first batch of the plurality of batches to the SE, wherein a size of the first batch is chosen to not exceed a memory capacity of the SE.
10. The apparatus of claim 9 , wherein the plurality of batches is ordered in time such that the plurality of batches includes a most recent batch in time.
11. The apparatus of claim 10 , wherein the first batch is the most recent batch in time.
12. The apparatus of claim 10 , wherein the first batch is not the most recent batch in time.
13. The apparatus of claim 8 , wherein the time value originates from a network time source.
14. The apparatus of claim 8 , wherein the time value is posted by a network server as a transaction for placement in the BC block.
15. A method performed by a device, the method comprising:
by the device:
receiving a blockchain (BC) block from a BC ledger, wherein the BC block includes a second hash value and a time value,
when a content of the BC block and a BC state value are not consistent with a first hash value stored in a memory of the device:
discarding the BC block, and
when the content of the BC block and the BC state value are consistent with the first hash value stored in the memory:
replacing, in the memory, the first hash value with the second hash value,
parsing the time value from the BC block,
providing a first indication of the time value on a user interface of the device,
receiving a second indication from the user interface,
when the second indication indicates that the time value is rejected:
sending, to a secure element (SE) housed in the device, a message indicating that the time value in the BC block is rejected;
when the second indication indicates that the time value is not rejected:
sending, to the SE, the BC block and a message indicating that the time value in the BC block is not rejected.
16. The method of 15 , further comprising:
by the device:
obtaining a plurality of BC blocks;
verifying each BC block in the plurality of BC blocks;
dividing the plurality of BC blocks into a plurality of batches; and
when the second indication indicates that the time value is not rejected:
sending a first batch of the plurality of batches to the SE, wherein a size of the first batch is chosen to not exceed a memory capacity of the SE.
17. The method of claim 16 , wherein the plurality of batches is ordered in time such that the plurality of batches includes a most recent batch in time.
18. The method of claim 17 , wherein the first batch is the most recent batch in time.
19. The method of claim 17 , wherein the first batch is not the most recent batch in time.
20. The method of claim 15 , wherein the time value originates from a network time source.