Method of replacing at least one authentication parameter for authenticating a security element and corresponding security element

1. A method of replacing at least one authentication parameter for authenticating a security element co-operating with a terminal, said authentication parameter enabling an authentication system of a mobile network to authenticate said security element, said mobile network being operated by a mobile network operator, said method comprising:

A—Having an entity store in said security element a plurality of authentication parameters that form a circular ranked list of authentication parameters;

B—Having said entity transmit to said mobile network operator a first authentication parameter, of the plurality of authentication parameters, so that said mobile network operator can record it in its authentication system for authenticating said security element;

C—On occurrence of an event, having a remote platform transmit to said security element an indicator informing said security element that it is authorized to replace said first authentication parameter with a second authentication parameter if its authentication fails with said authentication system the next time it attempts to connect to said mobile network, wherein the second authentication parameter is a next authentication parameter after the first authentication parameter in the circular ranked list of authentication parameters, and wherein if the first authentication parameter is a last authentication parameter in the circular ranked list of authentication parameters, then the next authentication parameter is a head authentication parameter in the circular ranked list of authentication parameters;

D—On occurrence of said event, having said entity transmit to said mobile network operator a second authentication parameter so as to enable said mobile network operator to replace said first authentication parameter by said second authentication parameter in its authentication system, wherein the transmitted second authentication parameter is unique to said security element;

E—In the event of subsequent failure of said security element to connect to said mobile network and if said indicator is present at said security element, replacing said first authentication parameter with said second authentication parameter at said security element so that said security element can authenticate itself with said mobile network by means of said second authentication parameter.

2. A method according to claim 1 , further comprising storing in said security element a plurality of authentication parameters and in that step C further comprises transmitting to said security element a rank in said circular ranked list of said second authentication parameter to be used at the next attempt to connect to said mobile network, if said indicator is present.

3. A method according to claim 1 , wherein said second authentication parameter is computed by said security element on the basis of a seed and of a diversifier.

4. A method according to claim 3 , wherein said diversifier is transmitted to said security element.

5. A method according to claim 1 , wherein said second authentication parameter is computed by said security element on the basis of said first authentication parameter and of an identifier of said security element.

6. A method according to claim 1 , wherein said entity is a manufacturer of said security element.

7. A method according to claim 1 , wherein said indicator is transmitted to said security element via said mobile network operator.

8. A method according to claim 1 , wherein said security element is constituted by any one of the following elements:

A Subscriber Identity Module (SIM) card;

A Universal Integrated Circuit Card (UICC); or

An embedded UICC (eUICC).

9. Security element comprising a first authentication parameter to a mobile network, said first authentication parameter enabling an authentication system of said mobile network to authenticate said security element, comprising:

Means for storing a plurality of authentication parameters that form a circular ranked list of authentication parameters, wherein the first authentication parameter is from the circular ranked list of authentication parameters;

Means for storing an indicator informing said security element that it is authorized to replace said first authentication parameter by a second authentication parameter if its authentication fails with said authentication system the next time it attempts to connect to said mobile network, wherein the second authentication parameter is transmitted from an entity to a mobile network operator and is unique to the security element, wherein the second authentication parameter is a next authentication parameter after the first authentication parameter in the circular ranked list of authentication parameters, and wherein if the first authentication parameter is a last authentication parameter in the circular ranked list of authentication parameters, then the next authentication parameter is a head authentication parameter in the circular ranked list of authentication parameters;

Means for replacing said first authentication parameter by said second authentication parameter if said security element fails to connect to said mobile network with said first authentication parameter, said means for replacing being activated if said indicator is present at said security element, so that said security element can authenticate itself with said mobile network by means of said second authentication parameter.

10. Security element according to claim 9 , further comprising a memory storing said second authentication parameter.

11. Security element according to claim 10 , wherein said memory stores the plurality of authentication parameters.

12. Security element according to claim 9 , further comprising computing means for computing said second authentication parameter.