Key derivation for a module using an embedded universal integrated circuit card
A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.
1. A module with an embedded Universal Integrated Circuit Card (eUICC) comprising:
(a) at least one processor; and
(b) a memory operatively connected to the at least one processor, the memory including processor executable code that, when executed by the at least one processor, performs the steps of:
(1) recording, in the memory of the module, (i) a module public key and a corresponding module private key, (ii) a pre-shared secret key, (iii) a set of cryptographic parameters, and (iv) a module identity,
(2) generating, by the module, module encrypted data associated with a first set of servers using the pre-shared secret key which is also separately accessible by the first set of servers, wherein the module encrypted data includes at least a portion of the set of cryptographic parameters;
(3) storing, by the module in the memory, a network public key, wherein the network public key is associated with (i) a second set of servers and (ii) a network private key;
(4) generating, by the module in the memory, a mutually derived shared key using Elliptical Curve Diffie Hellman, wherein the mutually derived shared key is derived by the module based on at least:
(i) the module private key; and
(ii) the network public key,
wherein the mutually derived shared key can be derived by the second set of servers based on at least:
(A) the module public key associated with the module private key; and
(B) the network private key associated with the network public key;
(5) receiving from the second set of servers an encrypted profile for the eUICC; and
(6) decrypting the encrypted profile with the mutually derived shared key in order to store network access credentials.
2. The module of claim 1 ,
wherein the memory is a nonvolatile memory.
3. The module of claim 1 ,
wherein the memory is a volatile memory.
4. The module of claim 1 ,
wherein the processor executable code, when executed by the at least one processor, performs a step of sending the module encrypted data to the first set of servers.
5. The module of claim 1 ,
wherein the module comprises a wireless module adapted to communicate over a wireless network using a radio and an antenna.
6. The module of claim 1 ,
wherein the module comprises a sensor configured to collect data regarding a monitored unit.
7. The module of claim 1 ,
wherein the module comprises a controller configured to change a state of an actuator associated with a monitored unit.
8. The module of claim 1 ,
wherein the module comprises a wired communication module adapted to connect to a network over a wired connection.
9. The module of claim 1 ,
wherein the set of cryptographic parameters comprise settings for one or more cryptographic algorithms.
10. The module of claim 9 ,
wherein the one or more cryptographic algorithms includes an Elliptic Curve Integrated Encryption Scheme.
11. The module of claim 1 ,
wherein the module encrypted data includes only the portion of the set of cryptographic parameters.
12. The module of claim 1 ,
wherein the module encrypted data includes all cryptographic parameters of the set of cryptographic parameters.
13. The module of claim 1 ,
wherein the second set of servers comprises one server.
14. The module of claim 1 ,
wherein the second set of servers comprises a plurality of servers.
15. The module of claim 1 ,
wherein the processor executable instructions, when executed by the at least one processor, perform a step of:
(h) connecting to a wireless network using a decrypted profile for the eUICC,
wherein the decrypted profile is provided in step (b)(6) and includes the network access credentials, and
wherein the network access credentials include at least a key K and a network module identity.