Local trusted service manager
A method for managing a secure element which is embedded into a host unit. The described method comprises (a) transmitting a request for a management script from the host unit to a program element of the secure element, (b) at the program element, generating a management script in accordance with the request and encrypting the generated management script, (c) transmitting the encrypted management script from the program element to the host unit, (d) transmitting the encrypted management script from the host unit to a secure domain of the secure element, and (e) at the secure domain, decrypting and executing the management script.
1. A method for managing a secure element which is embedded into a host unit, the method comprising:
transmitting a request for a management script from the host unit to a program element of the secure element;
at the program element, generating a management script in accordance with the request and encrypting the generated management script;
transmitting the encrypted management script from the program element to the host unit;
transmitting the encrypted management script from the host unit to a secure domain of the secure element; and
at the secure domain, decrypting and executing the management script, wherein the request comprises a parameter value which is to be used to generate the management script, the host unit is a mobile communication unit, and the parameter value is an International Mobile Equipment Identity of the mobile communication unit.
2. The method according to claim 1 , wherein the program element and the secure domain comprise corresponding key sets for encrypting and decrypting.
3. The method according to claim 1 , wherein the request comprises an identification of the management script.
4. The method according to claim 1 , wherein the management script is configured to perform a secure element management operation selected from a group consisting of a secure element lock operation, a secure element unlock operation, a secure element reset operation, a key modification operation, a program element delete operation, and a program element modification operation.
5. A secure element for a host unit, the secure element comprising:
a management applet configured to locally manage the secure element which is embedded into the host unit, the management applet comprising instructions which, when executed by a secure element processor, cause the secure element processor to receive a request for a management script from the host unit, generate a management script in accordance with the received request, encrypt the generated management script, and transmit the encrypted management script to the host unit;
a processing unit configured to execute the management applet; and
a secure domain configured to receive the encrypted management script from the host unit and to decrypt and execute the management script, wherein the received request comprises a parameter value used to generate the management script, the host unit is a mobile communication unit, and the parameter value is an International Mobile Equipment Identity of the mobile communication unit.
6. A mobile communications device comprising the embedded secure element according to claim 5 .
7. The secure element according to claim 5 , wherein the step of encrypting uses a set of cryptographic keys corresponding to a set of cryptographic keys which is stored in a secure domain of the secure element.
8. The secure element of claim 5 , wherein the request further comprises an identification of the management script.
9. A non-transitory computer-readable medium comprising instructions which, when executed by a computer, cause the computer to perform a method for managing a secure element, the non-transitory computer-readable medium comprising:
instructions for transmitting a request for a management script from the host unit to a program element of the secure element;
instructions for, at the program element, generating a management script in accordance with the request and encrypting the generated management script;
instructions for transmitting the encrypted management script from the program element to the host unit;
instructions for transmitting the encrypted management script from the host unit to a secure domain of the secure element; and
instructions for, at the secure domain, decrypting and executing the management script, wherein the request comprises a parameter value which is to be used to generate the management script, the host unit is a mobile communication unit, and the parameter value is an International Mobile Equipment Identity of the mobile communication unit.
10. The non-transitory computer-readable medium of claim 9 , wherein the request further comprises an identification of the management script.