Key derivation

摘要

To facilitate a change in network authentication key (Ki) for use by a smart card (SIM) during authentication on a cellular telecommunications network, there is provided a smart card management scheme that combines key derivation with over the air (OTA) provisioning. This scheme ensures both that the Ki is never transmitted OTA and that the Ki is stored in two locations only: on the SIM and at an authentication center (AuC).

主权项

1. A method for managing subscription information stored on a microprocessor card, the card being pre-provisioned with an associated unique card number, at least one predefined unique master key (K_master) and at least one number generating means, the method comprising:
receiving at the microprocessor card a derivation value (SEED) from one of a plurality of trusted parties (TSM), said derivation value (SEED) associated with an identification number (Ki); storing the derivation value (SEED) on the microprocessor card; and generating at the microprocessor card the identification number (Ki) using the number generating means, the derivation value (SEED) and the at least one predefined unique master key (K_master); wherein the identification number (Ki) is configured for authorizing a subscription to a telecommunications network and is provided for provisioning the card with said subscription, wherein the microprocessor card is pre-provisioned with a plurality of predefined unique master keys (K_master), wherein the microprocessor card is further pre-provisioned with root key identifiers corresponding to the respective predefined unique master keys (K_master) and at least two number generating means, thereby providing at least a main number generating means and a back-up number generating means, each number generating means identifying a different one of the predefined unique master keys by said master key identifiers.