GIESECKE+DEVRIENT MOBILE SECURITY GERMANY GMBH

A method in a processing entity, is for calculating, in a Security Domain, SD, included in the processing entity, related to an SCP11c Secure Channel between an Off-Card Entity, OCE, and a Security Domain, SD, SCP11c session keys, the calculating made based on: a) an SD static public key PK.SD.ECKA; b) an OCE static secret key SK.OCE.ECKA; c) an OCE ephemeral secret key eSK.OCE.ECKA; and d) key diversification data. The key diversification data is used to effect that more than one SCP11c session keys calculated with the same keys a), b) and c) are different from each other. The SCP11c session keys are calculated for different Card Group IDs and/or different Hosts, in that the key diversification data comprise the following SCP11c parameters: —HostID (Tag 84); and Card Group ID (e.g. Subject Identifier (Tag 5F20) from CERT.SD.ECKA certificate).

A method for personalizing an integrated secure element, which is permanently installed in a mobile end device. The method involves the agreement of a shared secret between the secure element and an HSM, encrypting an operating system, and possibly personalization data and/or one or several profiles, in the HSM based on the shared secret and transferring the encrypted operating system to the secure element, and re-encrypting the operating system in the secure element for storage in the NVM memory of the mobile end device.

Methods and systems for transferring application data of at least one application of a first device is provided. A method includes determining, via the operating system and by a corresponding one of the at least one application, application data to be transferred, formatting, by the at least one application, the determined application data and sending the formatted application data to a storage module, saving the application data within the storage module, retrieving the saved application data from the storage module, and restoring the retrieved application data within at least one application by the at least one application.

A method is for computer-aided personalization of a secure element onto which an image is loaded. An operating system of the secure element is integrated into the imageOne or more data sets provided individually for the secure element are written to a special memory area of the secure element. A sequence in which the data sets to be written are personalized is defined with a configuration command in the personalization of the secure element.

A system and method are provided for enabling generation of Subscription Concealed Identifier (SUCI) in 5G network. The system performs encryption of a plain text associated with Subscription Permanent Identifier (SUPI) based on an Authenticated Encryption with Associated Data (AEAD)-Advanced Encryption Standard in Galois/Counter Mode (AES-GCM), an Initialization Vector (IV), and Additional authenticated data (AAD). The system obtains public key, cipher text and Message Authentication Code (MAC) tag in parallel process by the AEAD AES-GCM and Elliptic Curve Integrated Encryption Scheme (ECIES) process along with one or more parameters for enabling generation of the SUCI in the 5G network. The one or more parameters comprise at least one of a SUPI type, a Mobile Country Code (MCC), a Mobile Network Code (MNC), or/and a protection scheme ID. Finally, system transmits the generated SUCI in response to GET IDENTITY command received by the UICC.

A secure element includes an SE application implemented therein or configured to implement an SE application therein. The secure element includes: an SE terminal interface to a terminal, in conjunction with which the secure element is able to be operated; an ARA application (ARA-X) and ARA access rules, by way of which access operations from applications implemented in the terminal to SE applications implemented or able to be implemented in the secure element via the SE terminal interface are controlled. The secure element is: an ARA user interface (ARA-UI), which is configured: to receive user commands that are input by a user on a user interface provided on the terminal or on the secure element; to forward received user commands to the ARA application; and to prompt the ARA application to apply forwarded user commands to the ARA application.

An update agent, a secure element containing the update agent, and a method for loading and personalizing a software in the secure element are provided. In a first step, an update agent is loaded into the se-cure element. In a further step, software personalization data is loaded into the secure element, and stored in the update agent. Subsequently, the software is loaded into the secure element and personalized using the software personalization data stored in the update agent.