WO2002045446A1

WO2002045446A1 - Method and device to transfer a software application written in high level language between the subscribers of a telecommunication network

Info

Publication number: WO2002045446A1
Application number: PCT/IB2001/002266
Authority: WO
Inventors: Pierre Fargues
Original assignee: Schlumberger Systèmes; Schlumberger Malco, Inc
Priority date: 2000-11-30
Filing date: 2001-11-29
Publication date: 2002-06-06
Also published as: FR2817430A1; FR2817430B1

Abstract

By the telecommunication operator (OP), supply, initially, and to respectively the first and second subscribers (AB1 and AB2), a right to transmit a software application (30) written in high level language, and a right to receive a software application (30) written in high level language. Concerning the first subscriber identification module (SIM1), if the initial right to transmit has been supplied, set up a communication with the second subscriber (AB2) and send the said software application written in high level language via the communication network (RS).Concerning the second subscriber identification module (SIM2), if the initial right to receive has been supplied, receive the software application so sent and process it.

Description

METHOD AND DEVICE TO TRANSFER A SOFTWARE APPLICATION WRITTEN IN HIGH LEVEL LANGUAGE BETWEEN THE SUBSCRIBERS OF A TELECOMMUNICATION NETWORK

This invention concerns the transfer of a software application written in high level language between the subscribers of a telecommunication network.

In this case "software application written in high level language" means any software, application or computer program written in advanced language as compared with a low level computer language such as object language as compared with machine code. For example, one such software application is an applet written in "JAVA" (registered trade mark) language by the company SUM MICROSYSTEMS.

This invention finds a general application in telecommunication, and more particularly in mobile telecommunication, in which the mobile terminals of the subscribers communicate according to

GSM, UMTS standards or similar, and in which the communication networks require a subscriber identification module in each terminal .

Generally, the Subscriber Identification Module, or SIM, is an integrated circuit card of type smartcard which can autonomously perform data protection operations .

The Applicant therefore decided to study the problem of downloading simply, interactively, and with a certain degree of security, a software application written in high level language between mobile terminals each equipped with a subscriber identification module.

This invention provides a solution to this problem.

Firstly, it concerns a method to transfer a software application written in high level language between first and second mobile terminals connected to a telecommunication network managed by a telecommunication operator, and each equipped with a subscriber identification module.

According to a general definition of the invention, the method includes the following steps:

- a) by the telecommunication operator, supply, initially, to respectively the first and second subscriber identification modules, a right to transmit a software application written in high level language, and a right to receive a software application written in high level language;

- b) concerning the first subscriber identification module, if the initial right to transmit has been supplied, set up a communication with the mobile terminal of the second subscriber via the communication network and send the said software application written in high level language; and

- c) concerning the second subscriber identification module, if the initial right to receive has been supplied, receive the said application so sent in order to be able to process it.

In such a method according to the invention, a first degree of transfer security results from the initial supply of the rights to transmit and receive in the subscriber identification modules .

The transfer of the application can therefore be made in unencrypted or encrypted form between the subscribers' mobile terminals .

It is simple and easy to implement such a method.

In addition, other degrees of security may result from the use of subscriber identification modules ' which can autonomously perform data protection operations. Preferably, step a) also includes the following steps:

- al) equip the first subscriber identification module with a first cryptographic function;

- a2) equip the second subscriber identification module with a second cryptographic function;

- a3) transmit the right to transmit to the first subscriber identification module in a secured way according to the first cryptographic function; and

- a4) transmit the right to receive to the second subscriber identification module in a secured way according to the second cryptographic function.

Consequently, according to the invention the supply of the rights to transmit and receive is secured.

In practice, step a) also includes the authentication of the first and second modules before the secured, or not, supply of the rights to transmit or receive.

Preferably, step b) includes the following steps;

- bl) equip the first subscriber identification module with a memory to store an interpreter and at least one applet, a processor which can use the interpreter to interpret the applet in order to execute it, and an input/output interface which can co-operate with the mobile terminal of the first subscriber; and

- b2) if the initial right to transmit has been supplied, look for the applet to be transferred in the memory of the first subscriber identification module and send it to the second subscriber via the communication network.

Step c) includes the following steps: - cl) equip the second subscriber identification module with a memory to store an interpreter and at least one applet, a processor which can use the interpreter to interpret the applet in order to execute it, and an input/output interface which can co-operate with the mobile terminal of the second subscriber; and

- c2) if the initial right to receive has been supplied, permit the reception of the applet so transferred via the communication network and store it in the memory of the second subscriber identification module in order to process it.

This invention also concerns a device to transfer a software application written in high level language between first and second subscribers each having a mobile terminal equipped with a subscriber identification module, the said subscriber terminals being connected to at least one telecommunication network managed by a telecommunication operator.

According to a important characteristic of the invention, the telecommunication operator has the processing means to supply initially, to respectively the first and second subscriber identification modules, a right to transmit a software application written in high level language, and a right to receive a software application written in high level language, the first subscriber identification module also including the means to set up a communication with the second subscriber identification module and the means, if the initial right to transmit has been supplied, to send the said software application written in high level language, and the second subscriber module also including the means, if the initial right to receive has been supplied, to receive the software application so sent and the means to process the software application so received.

In practice, each subscriber identification module has a memory to store an interpreter and at least one software application written in high level language, a processor which can use the interpreter to interpret the application in order to execute it, and an input/output interface which can co-operate with the subscriber's mobile terminal.

This invention also concerns a computer program product to transfer an applet as mentioned above.

Other features and advantages of the invention will appear on reading the detailed description below and the drawings in which:

figure 1 is a diagrammatic representation of a mobile telecommunication terminal with its subscriber identification module;

- figure 2 is a diagrammatic representation of the component means of a subscriber identification module;

- figure 3 is a diagrammatic representation of the relations between the operator and the first and second subscriber identification modules according to the invention;

- figure 4 is a diagrammatic representation of the main steps of the method according to the invention;

figure 5 is a diagrammatic representation of the steps concerning the initial supply of the rights to transmit and receive according to the invention;

- figure 6 is a diagrammatic representation of the steps to transfer the software application according to the invention; and

- figure 7 is a diagrammatic representation of an example of implementing the method according to the invention.

Figure 1 represents a mobile telecommunication terminal TE1 for a subscriber AB1. The terminal includes, generally, a screen 2, a keyboard 4, an input/output interface 6, of integrated circuit card reader type, processing means 8, audio means 11 and means

10 for radio communication with at least one telecommunication network RS .

The terminal TE1 includes a subscriber identification module SIM1.

The subscriber identification module SIM1 includes an input/output interface 12, a central processing unit or CPU 14, a random access memory or RAM 16, a read only memory or ROM 18, and a non-volatile memory of type EEPROM (rewritable) or flash EPROM .

A bus 22 connects together the various parts of the identification module mentioned above.

Generally, the input/output interface 12 of the subscriber identification module SIM1 co-operates with the input/output interface 6 of the terminal TE1 for bi-directional data exchange .

The interface 6 of the terminal TE1 and the interface 12 of the module SIM1 may be of type contact, contactless, or mixed.

The processing unit 14 of the SIM module is known to be able to autonomously perform data protection operations with the memories 16 and 20. These operations can provide security services of type authentication, integrity, confidentiality, non repudiation or similar.

The identification module of figure 1 is built to supply an environment which can execute and program applets written in high level language, such as JAVA language by the company SUN MICROSYSTEMS.

In reference to figure 2, the environment of a subscriber identification module SIM includes the following parts. Firstly, the environment includes a HARDWARE interface 24, containing parts 12, 14, 16, 18, 20 and 22 described in reference to figure 1.

This interface 24 is a so-called "hardware" layer.

The environment of the SIM module includes a layer 26, of type processor. This layer 26 is called the OS (Operating System) .

For example, the identification module includes a layer 28 called JVM (JAVA Virtual Machine) , which executes the codes of the^' applets 30 written in JAVA language, the said code being called BYTECODE. Of course, this layer 28 may contain another machine than tihe JVM machine.

The tools or functions of the module are stored in layer 34, called the API (Application Programming Interface) layer.

The applets 30 are stored in the memory 20 and called individually here APPLET1, APPLET2 and APPLET3. An interface 32 controls the SIM module and its communication between the applets and the codes of the environment external to the module according to the application protocol 36 APDU (Application Protocol Data Unit) . This protocol 36 is used to exchange data between the outside and the SIM module.

In this application protocol, we identify the APDU commands which are sent from the outside to the module and the APDU responses which are sent from the module to the outside, in response to the commands. The APDU protocol is defined in the document ISO 7816-4.

The Applicant therefore decided to study the problem of downloading simply, interactively, and with a certain degree of security, a software application written in high level language between terminals each equipped with a subscriber identification module . Figure 3 shows two subscribers ABl and AB2 whose respective identification modules SIMl and SIM2 can communicate via a telecommunication network RS. A communication operator OP manages the telecommunication network RS . The operator OP can set up a dialogue with the module SIMl and the module SIM2 via two selected channels 40 and 50.

These two channels 40 and 50 can be realised according to the same means or according to different means.

For example, channel 40 is set up with a local point of sale including a computer and a SIM card reader and channel 50 is set up with another local point of sale. Obviously the same local point of sale can be used to set up channel 40 and channel 50.

As a variant, the channel is set up via the operator's switching network (for example by microwave in the case of the GSM network) .

Another solution may consist of using the Internet.

In reference to figure 4, according to step a) of the method according to the invention, the telecommunication operator OP supplies to the first subscriber identification module SIMl a right to transmit a software application written in high level language. This supply takes place via channel 40. It may be secured, if the operator and/or the user so wish, or not .

The telecommunication operator supplies (transmission secured or not) to the second subscriber identification module SIM2 a right to receive a software application written in high level language. This supply takes place via channel 50.

According to step b) of the method according to the invention, if the initial right to transmit has been supplied, the identification module SIMl sets up a communication via the communication network RS and sends to the second subscriber AB2 a software application written in high level language.

According to step c) of the method according to the invention, concerning the second subscriber AB2, if the initial right to receive has been supplied, the identification module SIM2 receives the software application so sent in order to process it

(store, install or use) .

In reference to figure 5, the initial supply of the rights to send and receive can be secured preferably by using cryptographic functions.

In this secured context, according to step al) , the terminal of the first subscriber - ABl is equipped with a subscriber identification module SIMl with a first cryptographic function.

According to step a2) , the terminal of the second subscriber AB2 is equipped with a subscriber identification module SIM2 with a second cryptographic function.

According to step a3) ', the right to send is transmitted to the said first subscriber in a secured manner according to the first cryptographic function.

According to step a4) , the right to receive is transmitted to the said second subscriber in a secured manner according to the second cryptographic function.

In practice, the first and second modules SIMl and SIM2 are also authenticated before the supply, secured or not, of the rights to transmit and receive. This authentication may be implemented classically by the operator.

The cryptographic functions use to advantage the security components inherent to the integrated circuit card of the SIM module. The cryptographic functions may use a secret key or public key, or possibly another cryptography algorithm. For example, the cryptographic functions used may be triple DES (Data Encryption System) type. In this case, the right to transmit may correspond to a secret key and the right to receive may correspond to the said secret key.

In an example of cryptography with private/public key, for example RSA type, the right to transmit may correspond to a public key whereas the right to receive may correspond to the associated private key.

In another non secured example, the transfer function according to the invention does not use cryptographic functions.

In a further example of realisation, the right to transmit may correspond to a secret and/or public key accompanied by the transfer application as such.

In reference to figure 6, the transfer of an applet includes the following steps:

- bl) equip the module SIMl of the first subscriber ABl with a memory 16, 18, 20 to store an interpreter 28 (virtual machine) and an applet 30, a processor 26 using the interpreter 28 to interpret the applet 30, in order to execute it, and an input/output interface 32 co-operating with the outside of the module SIMl of the first subscriber ABl;

- b2) if the initial right to transmit has been supplied, look for the applet 30 to be transferred in the memory of the module and send it to the second subscriber AB2 via the telecommunication network RS;

- cl) equip the module SIM2 of the second subscriber AB2 with a memory to store an interpreter 28 and an applet 30, a processor 14, 26 using the interpreter to interpret the applet 30 in order to execute it and an input/output interface 32 co-operating with the outside of the module SIM2 of the second subscriber AB2; and - c2) if the initial right to receive has been supplied, receive the applet 30 to be transferred via the communication network RS and store it in the memory of the module SIM2 of the second subscriber AB2 in order to process it .

Figure 7 shows a mode of implementation of the method according to the invention with two mobile telecommunication terminals working according to the GSM 11.11 or GSM 11.14 standards.

Preferably, in the SIM modules, it is planned to save the applets in the form of EFs (Elementary File) . Such elementary files are used to separate the data of the various applets 30. Each applet 30 is known by its own EF.

In practice, the right to transmit may correspond to a function which can build messages in SMS format using APDU commands contained in an elementary file EF1 and which can download an applet, and send SMS messages to a chosen recipient. If necessary, the transmission function is secured using a suitable cryptographic key.

The right to receive may correspond to a function which can execute APDU commands capable of downloading an applet and which are contained in SMS messages sent by the originator. If necessary, the reception function is secured using a suitable cryptographic key.

As will be seen in greater detail below, the APDU commands used to download an applet include the INSTALL LOAD, LOAD LOAD/n times and INSTALL INSTALL commands.

The download applet 100 may also be an elementary file.

For example, three applets 30 could be downloaded, APPLET1, APPLET2 and APPLET3.

In a menu 102 displayed on terminal TE1, the user can choose applet 30 to be downloaded. Then, using command 104 "GET INPUT", the user enters (directly or indirectly) the number of the receiving subscriber AB2, thereby setting up a communication 106 with the said receiving terminal TE2.

After connection 106, the "DISPLAY TEXT" command displays the "connection" message on the transmitting terminal TE1. The download function according to the invention, for example the download applet 100, then sends an invitation message 108 to accept the download to the receiving terminal module TE2.

The message 108 is an SMS (Short Message Service) type message, for example in OTAC (Over The Air Customization) format according to the ETSI standard 0348.

On reception of the invitation message 108, the receiving terminal module TE2 receives the message 110 "Do you want to receive the applet X from telephone number 06 09 10 99 111 Yes, No".

In case of acceptance 112 the receiving terminal module TE2 sends a download acceptance message, whereas ,in case of refusal it sends a download refusal message.

On the transmitting terminal TE1, the DISPLAY TEXT command displays message 114 "Connection OK" in case of acceptance, whereas in case of refusal by the receiving terminal TE2, the DISPLAY TEXT command displays the message "Download refused" .

If a connection is accepted, the transmitting terminal module TE1 sends a SMS message 116 to the receiving terminal module TE2 with the APDU command "INSTALL LOAD with response".

In this example, the SMS message includes the recipient number , built according to the GSM standard "0340", the key built according to the GSM standard "0348" if necessary, and the APDU command "INSTALL LOAD", if necessary with response. On reception of the SMS message 116 containing the APDU command "INSTALL LOAD with response", the status of the said message is checked. If the check results in the message Status = 9000, then it is indicated that the transfer is in progress 120, whereas if the status is not 9000, it is indicated in response that the transfer has failed.

Then, the transfer procedure 121 is set up with a SMS message containing an APDU command of type "LOAD LOAD" .

This procedure 121 is reiterated as many times as there are "LOAD LOAD" commands in the SMS message 121. Then, the SMS message is routed from the transmitting terminal module TE1 to the receiving terminal module TE2 with the message 122 containing the "INSTALL INSTALL" command.

In response to this SMS message 122 for which the APDU command is "INSTALL INSTALL", the terminal module TE2 executes the command and sends a status 124. If the status equals 9000, the response is given that the transfer is successful 126, whereas in the absence of a status equal to 9000, it is indicated that the transfer has failed.

In the presence of a successful transfer message 126, the transmitting terminal module TE1 sends a message 128 whose purpose is to indicate that the transfer is finished successfully and this message is displayed on the receiving terminal TE2.

The transfer of the applet may be synchronised or not .

If there is no synchronisation, the SMS message is sent without status response. However, if there is synchronisation, the SMS message containing the "LOAD LOAD" command is sent with a response requested and each status returned is checked. The choice between these two possibilities depends on the desired performance. The second possibility (i.e. with synchronisation) is safer and is used to synchronise the last SMS message containing the "INSTALL INSTALL" command. Is the status received is not 9000, then it is planned to display on the module the message "Transfer failed" .

Preferably, to avoid any synchronisation problem, the "INSTALL LOAD" command precedes the "LOAD LOAD" command and the transfer applet ends with the "INSTALL INSTALL" command.

Obviously, when subscriber AB2 who has received the applet from subscriber ABl, also wants to transfer the applet to another subscriber, he sets up the method described above, on condition that he has a right to transmit and on condition that his recipient also has a right to receive.

In this case, the right to transmit also includes the APDU command "CREATE FILE EF1" concerning the creation of the file EF1 in the module SIMl, and the APDU command "LOAD RECORD EF1" concerning the saving of file EF1.

These two APDU commands are therefore transferred, after the INSTALL INSTALL command described above, from the module SIMl to the module SIM2.

The module SIM2 executes the commands "CREATE FILE EF1" and "LOAD RECORD EF1" in order to create the file EF1 in the module SIM2, and in order to save the file EF1. Through these two commands, the module SIM2 can then in turn play the role of transmitter of applet to another module.

Claims

1. Method to transfer a software application written in high level language between first and second mobile terminals (TE1, TE2) connected to at least one telecommunication network (RS) managed by a telecommunication operator, and each equipped with a subscriber identification module (SIMl and SIM2) ,

the said method being characterised by the following steps:

- a) by the telecommunication operator (OP) , supply, initially, and to respectively the first and second subscribers (ABl and AB2) , a right to transmit a software application (30) written in high level language, and a right to receive a software application (30) written in high level language,

- b) concerning the first subscriber identification module (SIMl) , if the initial right to transmit has been supplied, set up a communication with the second subscriber (AB2) and send the said software application written in high level language via the communication network (RS) , and

c) concerning the second subscriber identification module (SIM2) , if the initial right to receive has been supplied, receive the software application so sent and process it.

2. Method according to claim 1, characterised in that step a) also includes the following steps :

- al) equip the first subscriber identification module (SIMl) with a first cryptographic function,

- a2) equip the second subscriber identification module (SIM2) with a second cryptographic function,

- a3) transmit the right to transmit to the first subscriber in a secured way according to the first cryptographic function; and - a4) transmit the right to receive to the second subscriber in a secured way according to the second cryptographic function.¹

3. Method according to claim 1 or claim 2 , characterised in that step 'a) also includes the authentication of the first module (SIMl) and the second module (SIM2) before the supply, secured or not, of rights to transmit and receive.

4. Method according to claim 1, characterised in that step b) includes the following steps:

- bl) equip the first subscriber identification module with a memory to store an interpreter (28) and at least one software application (30) written in high level language, a processor (26) which can use the interpreter to interpret the application in order to execute it, and an input/output interface (32) which can co-operate with the outside of the first subscriber's module, and

- b2) if the initial right to transmit has been supplied, look for the software application (30) to be transferred in the memory of the first subscriber identification module (SIMl) and send it to the second subscriber (AB2) via the communication network (RS) .

5. Method according to claims 1 and 4, characterised in that step c) includes the following steps:

- cl) equip the second subscriber identification module (SIM2) with a memory to store an interpreter (28) and at least one software application (30) written in high level language, a processor (26) which can use the interpreter (28) to interpret the application in order to execute it, and an input/output interface (32) which can co-operate with the outside of the module, and

- c2) if the initial right to receive has been supplied, receive the software application (30) so transferred via the communication network and store it in the memory of the second subscriber identification module (SIM2) .

6. Method according to one of the above claims, characterised in that it also includes the following steps:

i) set up a first channel (40) between the operator (OP) and the first subscriber identification module (SIMl) and supply initially the right to transmit via the said first channel (40) , and

ii) set up a second channel (50) between the operator (OP) and the second subscriber identification module (SIM2) and supply initially the right to receive via the said second channel (50) .

7. Method according to claim 6, characterised in that the initial supply of the rights to transmit and receive via the channels (40 and 50) is secured.

8. Method to transfer a software application written in high level language between first and second mobile terminals connected to at least one telecommunication network (RS) managed by a telecommunication operator (OP) and each equipped with a subscriber identification module (SIMl, SIM2) , characterised in that it includes:

- concerning the telecommunication operator (OP) , processing means to supply, to respectively the first and second subscriber identification modules (SIMl and SIM2) , a right to transmit a software application written in high level language, and a right to receive a software application written in high level language,

- concerning the first subscriber identification module (SIMl) , means to set up a communication with the second subscriber (AB2) and means to send the said software application written in high level language, and - concerning the second subscriber identification module (SIM2) , means to receive the software application so sent and processing means to process it .

9. Method according to claim 8, characterised in that it includes a first channel (40) between the telecommunication operator (OP) and the first subscriber identification module (SIMl) , via which the right to transmit is sent to the first subscriber (ABl), using a secured transmission or not.

10. Method according to claim 8, characterised in that it includes a second channel (50) between the telecommunication operator and the second subscriber identification module (SIM2) , via which the right to receive is sent to the second subscriber, using a secured transmission or not.

11. Method according to claim 8, characterised in that each subscriber identification module (SIMl or SIM2) includes a memory to store an interpreter (28) and at least one software application (30) written in high level language, a processor (26) which can use the interpreter to interpret the application in order to execute it, and an input/output interface (32) which can co-operate with the outside of the module.

12. Subscriber identification module intended to co-operate with a mobile communication terminal which can communicate via a communication network managed by a communication operator,

characterised in that the module (SIM) includes security means which can set up a channel (40 or 50) with the telecommunication operator (OP) through which the module can receive from the operator a right to transmit and/or receive a software application written in high level language, and in that the said module thereby initially having a right to transmit and/or receive, can send and/or receive a software application written in high level language to and/or from another module.

13. Module according to claim 12, characterised in that the module (SIM) includes a memory to store an interpreter (28) and at least one software application (30) written in high level language, a processor (26) which can use the interpreter to interpret the application in order to execute it, and an input/output interface (32) which can co-operate with the terminal .

14. Module according to claim 12 or claim 13, characterised in that the said module is an integrated circuit card which can autonomously perform data protection operations.

15. Computer program including instruction codes saved on a medium or- distributed via a communication system, the said instruction codes being executable in a computer to perform the steps of the method according to any of the claims 1 to 7.