Secure element operating system update notification
An operating system (OS) update to a secure element (SE) may be commanded, for example, in order to fix a security bug, upgrade a version of an OS, provide mobile network operator (MNO) specific extensions such as to an application programming interface (API) or to cause OS/profile switching. Many of these OS updates will affect one or more profiles present on the SE. An MNO associated with a given profile will benefit in some instances by being provided with a notification of the OS update, since the OS update may affect SE capabilities and thus affect what a given profile can or cannot do after the OS update occurs. Embodiments provided herein create notification entries that will appropriately inform the concerned MNO. In some embodiments, a capability linking variable (“linkedcapability”) is used to determine whether an SE capability change should trigger transmission of a notification to the concerned MNO.
1. A secure element (SE) of a cellular wireless communication device, the SE storing one or more profiles, the SE comprising:
at least one processor; and
a memory storing instructions that, when executed by the at least one processor, cause the SE to perform operations that include, for each profile of the one or more profiles managed by the SE:
comparing (1) a first set of SE capabilities associated with the profile for which a notification should be sent, as indicated in a linked capability value included in the profile, when any of the SE capabilities are updated with (2) a second set of SE capabilities that are affected by an operating system (OS) update that targets the SE;
for each SE capability included in both the first and second sets of SE capabilities:
adding the SE capability to a respective notification list for the profile; and
in response to determining that the respective notification list includes at least one SE capability:
causing at least one notification based on the respective notification list to be provided to a server of a respective Mobile Network Operator (MNO) associated with the profile,
wherein each profile comprises MNO data and applications provisioned to the cellular wireless communication device for access to cellular communication services of the respective MNO, the MNO data including an address for the server of the MNO to which notifications are to be sent.
2. The SE of claim 1 , wherein the operations further comprise, for each profile of the one or more profiles managed by the SE, and prior to the operation of comparing:
determining, based on notification configuration information indicated in a profile management operation value included in the profile, that notifications should be provided to the respective MNO.
3. The SE of claim 1 , wherein:
the linked capability value comprises a binary value, each bit of the binary value indicating whether an associated SE capability requires a notification to be sent.
4. The SE of claim 1 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO over a bearer independent protocol (BIP) channel established between the SE and the server of the MNO.
5. The SE of claim 1 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO by a local profile assistant (LPA) implemented on the cellular wireless communication device in which in the SE is included.
6. The SE of claim 5 , wherein the operations performed by the SE further comprise, for at least one profile of the one or more profiles:
sending a refresh command to the LPA to cause the LPA to obtain the respective notification list and to provide the at least one notification to the server of the respective MNO.
7. The SE of claim 6 , wherein the server of the MNO comprises a network-based profile server of the respective MNO associated with the at least one profile.
8. A method implemented by a secure element (SE) of a cellular wireless communication device, the SE storing one or more profiles, the method comprising, for each profile of the one or more profiles managed by the SE:
comparing (1) a first set of SE capabilities associated with the profile for which a notification should be sent, as indicated in a linked capability value included in the profile, when any of the SE capabilities are updated with (2) a second set of SE capabilities that are affected by an operating system (OS) update that targets the SE;
for each SE capability included in both the first and second sets of SE capabilities:
adding the SE capability to a respective notification list for the profile; and
in response to determining that the respective notification list includes at least one capability:
causing at least one notification based on the respective notification list to be provided to a server of a respective Mobile Network Operator (MNO) associated with the profile,
wherein each profile comprises MNO data and applications provisioned to the cellular wireless communication device for access to cellular communication services of the respective MNO, the MNO data including an address for the server of the MNO to which notifications are to be sent.
9. The method of claim 8 , further comprising, for each profile of the one or more profiles managed by the SE, and prior to comparing:
determining, based on notification configuration information indicated in a profile management operation value included in with the profile, that notifications should be provided to the respective MNO.
10. The method of claim 8 , wherein:
the linked capability value comprises a binary value, each bit of the binary value indicating whether an associated SE capability requires a notification to be sent.
11. The method of claim 8 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO over a bearer independent protocol (BIP) channel established between the SE and the server of the MNO.
12. The method of claim 8 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO by a local profile assistant (LPA) implemented on the cellular wireless communication device in which in the SE is included.
13. The method of claim 12 , further comprising, for at least one profile of the one or more profiles:
sending a refresh command to the LPA to cause the LPA to obtain the respective notification list and to provide the at least one notification to the server of the respective MNO.
14. An apparatus configurable for operation in a cellular wireless communication device, the apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause a secure element (SE) of the cellular wireless communication device to, for each profile of the one or more profiles is stored in and managed by the SE:
compare (1) a first set of SE capabilities associated with the profile for which a notification should be sent, as indicated in a linked capability value included in the profile, when any of the SE capabilities are updated with (2) a second set of SE capabilities that are affected by an operating system (OS) update that targets the SE;
for each SE capability included in both the first and second sets of SE capabilities:
add the SE capability to a respective notification list for the profile; and
in response to determining that the respective notification list includes at least one SE capability:
cause at least one notification based on the respective notification list to be provided to a server of a respective Mobile Network Operator (MNO) associated with the profile,
wherein each profile comprises MNO data and applications provisioned to the cellular wireless communication device for access to cellular communication services of the respective MNO, the MNO data including an address for the server of the MNO to which notifications are to be sent.
15. The apparatus of claim 14 , wherein the instructions further cause the SE to, for each profile of the one or more profiles managed by the SE, and prior to comparing:
determining, based on notification configuration information indicated in a profile management operation value included in with the profile, that notifications should be provided to the respective MNO.
16. The apparatus of claim 14 , wherein:
the linked capability value comprises a binary value, each bit of the binary value indicating whether an associated SE capability requires a notification to be sent.
17. The apparatus of claim 14 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO over a bearer independent protocol (BIP) channel established between the SE and the server of the MNO.
18. The apparatus of claim 14 , wherein, for at least one profile of the one or more profiles, the at least one notification is provided to the server of the respective MNO by a local profile assistant (LPA) implemented on the cellular wireless communication device in which in the SE is included.
19. The apparatus of claim 18 , wherein the instructions further cause the SE to, for at least one profile of the one or more profiles:
sending a refresh command to the LPA to cause the LPA to obtain the respective notification list and to provide the at least one notification to the server of the respective MNO.
20. The apparatus of claim 19 , wherein the server of the MNO comprises a network-based profile server of the respective MNO associated with the at least one profile.