Key derivation for a module using an embedded universal integrated circuit card
A module with an embedded universal integrated circuit card (eUICC) can include a received eUICC profile and a set of cryptographic algorithms. The received eUICC profile can include an initial shared secret key for authentication with a wireless network. The module can receive a key K network token and send a key K module token to the wireless network. The module can use the key K network token, a derived module private key, and a key derivation function to derive a secret shared network key K that supports communication with the wireless network. The wireless network can use the received key K module token, a network private key, and the key derivation function in order to derive the same secret shared network key K derived by the module. The module and the wireless network can subsequently use the mutually derived key K to communicate using traditional wireless network standards.
1. A mobile device comprising:
(a) an embedded Universal Integrated Circuit Card (eUICC);
(b) at least one processor; and
(c) a memory operatively connected to the at least one processor, the memory including processor executable code that, when executed by the at least one processor, causes the at least one processor to perform steps of:
(1) recording, in the memory of the mobile device, (i) a mobile device public key and a mobile device private key, (ii) a pre-shared secret key, (iii) cryptographic parameters, and (iv) a mobile device identity;
(2) generating a message authentication code (MAC) using the pre-shared secret key for authentication with a first set of servers;
(3) receiving server encrypted data from the first set of servers, wherein the server encrypted data includes a set of the cryptographic parameters;
(4) decrypting the server encrypted data using the pre-shared secret key;
(5) storing a network public key, wherein the network public key is associated with (i) a second set of servers and (ii) a network private key;
(6) generating a mutually derived shared key using Elliptical Curve Diffie Hellman, wherein the mutually derived shared key is derived by the mobile device based on at least: (i) the mobile device private key; (ii) the network public key; and (iii) the set of the cryptographic parameters, wherein the mutually derived shared key is derived by the second set of servers based on at least:
(A) the mobile device public key associated with the mobile device private key;
(B) the network private key associated with the network public key; and
(C) the set of the cryptographic parameters;
(7) receiving from the second set of servers an encrypted profile for the eUICC; and
(8) decrypting the encrypted profile using the mutually derived shared key in order to store network access credentials.
2. The mobile device of claim 1 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to generate module encrypted data associated with the first set of servers using the pre-shared secret key.
3. The mobile device of claim 2 , wherein the module encrypted data includes at least a portion of the set of cryptographic parameters.
4. The mobile device of claim 1 , wherein the set of the cryptographic parameters comprise a base point G.
5. The mobile device of claim 1 , wherein the eUICC comprises a package soldered to a circuit board of the mobile device, and wherein the eUICC includes the at least one processor.
6. The mobile device of claim 1 , wherein the network access credentials include at least a key K and a network module identity.
7. The mobile device of claim 1 , wherein a module identity is stored in a protected nonvolatile memory.
8. The mobile device of claim 1 , wherein the cryptographic parameters comprise values for defining an elliptic curve.
9. The mobile device of claim 1 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to record a server identity and a port number for the first set of servers as part of element (c)(1).
10. The mobile device of claim 9 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to generate a domain name system query for the first set of servers using the server identity after the recording in element (c)(1) and before the generating in element (c)(2).
11. The mobile device of claim 1 , wherein the second set of servers (i) does not store the pre-shared secret key, and (ii) queries other servers for a certificate that includes a module public key.
12. The mobile device of claim 1 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to perform steps of (i) receiving a server digital signature and (ii) verifying the server digital signature using a server public key prior to the generating in element (c)(6).
13. The mobile device of claim 12 , wherein the server encrypted data includes the server digital signature.
14. The mobile device of claim 1 , wherein the pre-shared secret key comprises a secret key that is shared between the mobile device and the first set of servers before the mobile device communicates with the first set of servers.
15. The mobile device of claim 1 , wherein the mobile device performs a mutual authentication with the first set of servers using the pre-shared secret key.
16. The mobile device of claim 1 , wherein the first set of servers is associated with an eUICC subscription manager.
17. The mobile device of claim 1 , wherein the second set of servers is associated with a mobile network operator.
18. The mobile device of claim 1 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to record a certificate for a module public key as part of the recording in element (c)(1), wherein the second set of servers receives the certificate using a module identity.
19. The mobile device of claim 1 , wherein the processor executable code, when executed by the at least one processor, further causes the at least one processor to decrypt the encrypted profile using the mutually derived shared key in order to store network parameters as part of the decrypting in element (c)(8) wherein the network parameters include values for allowed radio frequency bands.
20. The mobile device of claim 1 , wherein the eUICC includes the memory and the at least one processor.
21. The mobile device of claim 1 , wherein the eUICC includes the at least one processor, and wherein the at least one processor comprises a separate cryptographic processing unit.
22. The mobile device of claim 1 , wherein the memory comprises a nonvolatile memory connected to a system bus in the mobile device.