RU2574844C2 - Apparatus and method for authentication in wireless network - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to methods and an apparatus for authentication and granting a client device access to a network. A network service provider such as a cellular communication company may distribute user access (e.g., universal subscriber identity module or "USIM") credentials to a services manager via a USIM vendor. The services manager may maintain a list of authorised users. A user may be authenticated at the services manager, after which a set of USIM credentials is sent to the user. When the user desires to use wireless network services, the user equipment may establish a wireless link between the user equipment and the network service provider. During authentication operations, the user equipment may use the USIM credentials to authenticate at the network service provider. Following successful authentication, the network service provider may provide the user equipment with wireless services.

EFFECT: enabling provision of services from a provider in a wireless device without using a SIM card.

16 cl, 9 dwg

Description

Priority and related applications

This application claims the priority of also pending US patent application No. 12/952,082, filed by the same applicant on November 22, 2010 and entitled "DEVICE AND METHOD OF AUTHENTICATION IN A WIRELESS NETWORK", which claims the priority of provisional patent application US No. 61/330,856, filed May 3, 2010 and entitled “WIRELESS AUTHENTICATION SYSTEM”, each of the above applications is hereby incorporated by reference in their entirety.

This application also relates to concurrently considered and owned by the same applicant provisional patent applications US No. 61/354,653, filed June 14, 2010 and entitled "METHODS FOR PROVIDING USER IDENTIFICATION DATA IN A WIRELESS NETWORK", No. 61/366,505, filed July 21, 2010 SYSTEM OF DESCRIPTION OF THE VIRTUAL MODULE OF USER IDENTIFICATION ”, No. 61/407,858, filed October 28, 2010 and entitled“ METHOD AND DEVICE FOR GETTING ACCESS TO MANAGEMENT SUPPORTED BY CUSTOMER ROAMING No. 61, October 28, October 7, ” 2010 and entitled “MANAGEMENT SYSTEMS FOR MULTIPLE ACCESS MANAGEMENT FACILITIES”, No. 61 / 407,862, filed October 28, 2010 and entitled “METHOD AND DEVICE FOR TRANSMITTING ELECTRONIC IDENTIFICATION COMPONENTS FOR WIRELESS NETWORK NO. AND DEVICE FOR STORING AND PERFORMING ACCESS MANAGEMENT CLIENTS ”, No. 61/408,504, filed October 29, 2010 and entitled“ METHOD FOR ACCESSING ACCESS DATA ”, No. 61 / 409,891, filed November 3, 2010 and entitled“ METHOD FOR USING ACCESS REMOVER DEVICES ”, No. 61/410,298, filed November 4, 2010 and entitled“ MODEL OF THE PHYSICAL SAFETY DEVICE AND METHOD ”, and No. 61 / 413,317, filed November 12, 2010 and entitled“ DEVICE AND METHOD FOR REGISTRATION OF HISTORICAL DATA OF THE DEVICE each of the aforementioned applications is hereby incorporated by reference in its entirety.

FIELD OF THE INVENTION

The present invention generally relates to the field of communication systems and, more specifically, in one exemplary aspect, to wireless systems that provide authentication of user devices in wireless networks (e.g., cellular networks, wireless local area networks (WLAN), wireless urban networks (WMAN), and etc.) using access control clients.

State of the art

Wireless systems are used to provide, among others, voice and data communications services for user equipment such as cell phones and computers.

The user equipment is traditionally equipped with a Subscriber Identity Module (SIM) card. The SIM card contains security information, such as private key information, which can be used to authenticate user equipment in a cellular network.

The requirement to use a SIM card may not always be desirable. For example, the need to provide a slot for a SIM card in user devices leads to the fact that the devices become bulky and have an increased cost. It also necessitates the management of inventory and distribution of SIM cards by the manufacturer or service provider.

The user may also be interested in acquiring wireless services, even if the user is not able to easily obtain a SIM card.

Thus, it is desirable to propose improved solutions whereby a user can acquire and use wireless network services.

Disclosure of invention

The present invention addresses the aforementioned needs by presenting, inter alia, devices and authentication methods in a wireless network.

In one aspect of the invention, a network service provider, such as a cellular telephone company, can transmit access client credentials (e.g., Universal Subscriber Identity Module) to a trusted service manager through a USIM provider or directly.

A trusted service manager can maintain a list of authorized users. These users may be, for example, clients of a trusted service manager or relevant persons. Registration data can be stored by a trusted service manager for each of the authorized users.

A user through a user device can authenticate with a trusted service manager using a set of user credentials. By authenticating, a trusted service manager can provide the user with a set of USIM credentials. USIM credentials can be stored in a secure element in a user device.

When the user wishes to use the services of a wireless network, the user device can establish a wireless communication line between the user device and the network service provider. During authentication operations, the user device may use the USIM credentials stored in the secure element in the user device to authenticate with the network service provider. After successful authentication, the network service provider can provide the user equipment with wireless services (for example, voice communications using a cell phone and data exchange).

In another aspect of the invention, a method for providing wireless service to a user device of a user is disclosed. In one embodiment, the method includes transmitting access client data to a first entity; data transfer of the access client from the first object to the second object on the first communication line; using user credentials to authenticate a user device; data transfer of the access client from the second object to the user device on the second communication line after authentication of the user device.

In one embodiment of the method, the first entity includes a USIM provider, and the second entity includes a trusted service manager.

In another embodiment of the method, the access client includes a universal SIM (USIM), and a trusted service manager authenticates.

In a further embodiment, transmitting access client data causes the user device to store access client data in a secure element.

In yet another embodiment, the second communication line includes a secure wireless connection.

In yet another embodiment, the first communication line further includes delivering a physical storage device containing USIM data.

In yet another embodiment, the user credentials include account information specific to the user.

In another aspect of the invention, a wireless device is disclosed. In one embodiment, the device comprises one or more communication lines configured to communicate with a service provider; a secure element configured to save an access client; CPU; a storage device configured to communicate with a processor, the storage device comprising computer-executable instructions. Commands, when executed by the processor, provide authentication at the service provider, said successful authentication leading to the provision by the service provider of the client access; storing the access client in the secure element in response to receiving the access client.

In one embodiment, the device comprises a system of long-range and / or short-range wireless communication schemes.

In another embodiment, the device further comprises a system of near contactless communications (NFC, Near Field Communications).

In an additional embodiment, the protected element is an integrated chip protected from unauthorized interference, which is built into the device on an ongoing basis.

In another embodiment, the secure element is configured to authenticate a user device for network service based at least in part on access client data.

In another aspect of the invention, a method for securely storing access client data in a user device is disclosed. In one embodiment, the method includes transmitting one or more user credentials to a service provider, the transfer providing authentication of a user device by a service provider based at least in part on one or more user credentials; receiving data access client over the communication line after the successful authentication of the user device; and storing the access client data in the secure element.

In one embodiment, the communication line comprises a short-range wireless communication circuit system, such as a near proximity communication (NFC) system.

In another embodiment, the protected element is an integrated chip protected from unauthorized interference, which is built into the device on an ongoing basis.

In an additional aspect of the invention, an auxiliary device for a user identification module (SIM) is disclosed. In one embodiment, the device comprises one or more communication lines configured to communicate with a cellular device; receiving socket;

CPU; and a storage device configured to communicate with the processor, the storage device comprising computer-executable instructions. Computer-executed instructions, when executed by the processor, provide for:

notifying the cellular device of the presence of the SIM device with the first SIM data stored on it in the receiving slot; providing access to the SIM device through one or more communication lines in response to receiving a request for performing SIM operations.

In one embodiment, the cellular device comprises a security element, the security element being configured to store one or more second SIM data elements.

In yet another aspect of the invention, a computer-readable storage medium is disclosed. In one embodiment, the storage medium comprises a secure element (e.g., a secure integrated circuit) with access client data (e.g., virtual USIM) stored on it, the data, when accessing them, provide the user with access to one or more network services.

Additional features of the invention, its nature and various advantages will be more apparent from the accompanying drawings and the following detailed description of preferred embodiments.

Brief Description of the Drawings

The features, objectives and advantages of the invention will become more apparent due to the detailed description set forth below, presented using the drawings, in which:

Figure 1 presents a diagram of the authentication procedure and key agreement (AKA, Authentication and Key Agreement) from the prior art.

Figure 2 shows a diagram of AKA operations performed by USIM from the prior art.

Figure 3 shows a diagram of the hardware architecture of user identification modules (SIM) from the prior art.

4 is a diagram illustrating a wireless system in accordance with an embodiment of the present invention.

FIG. 5 a shows a functional block diagram of a first example embodiment of a hardware architecture for “virtual” user identification modules (SIMs) in accordance with the present invention.

FIG. 5b shows a functional block diagram of a second example embodiment of a hardware architecture for “virtual” user identification modules (SIMs) in accordance with the present invention.

FIG. 6 is a diagram of one example embodiment of the present invention, operating in conjunction with a SIM accessory in accordance with the present invention.

7 shows a diagram of a method for delivering USIM to a prior art cellular device.

8 is a diagram illustrating one example of a method for delivering USIM information to a cellular device in accordance with the present invention.

The implementation of the invention

Designations with the same numbers refer to the same parts throughout the drawings.

One of ordinary skill in the art can conclude that various embodiments of the present invention are useful both for prior art architectures (e.g., USIM data placed in a physical SIM card) and new architectures (e.g. USIM data, stored in the protected item). In some embodiments, the present invention may further relate to combinations of operations of both a prior art card and a secure element, providing support for existing SIM cards that are not stored in the secure element.

In one example embodiment of the present invention, the SIM data contains highly secure data applicable, inter alia, for authentication (e.g., keys and encryption algorithms, etc.) For example, highly secure data may contain an authentication key (Ki) and all encryption algorithms (e.g. F1, F2, F3, F4, and F5, as described in 3GPP TS 35.205 V9.0.0, published December 31, 2009, entitled "MILENAGE Algorithm Set Specification: An Example Algorithm Set for Authentication of 3GPP Key Generation Functions f1, f1 * , f2, f3, f4, f5 and f5 * '', in all contents of which are hereby incorporated by reference in their entirety.) In another embodiment, the SIM data comprises information of a group of operators and / or information of user data. Examples of such information include network selection parameters, identification information, operator data, application data, etc.

Well-known examples of network selection parameters include, without limitation: public land mobile network selector (PLMNSel, Public Land Mobile Network Selector), prohibited PLMN (FPLMN, Forbidden PLMN), home PLMN (HPLMN, Home PLMN), etc.

Well-known examples of identification information include, without limitation: International Mobile Subscriber Identity (IMSI), Integrated Circuit Card ID (ICCID), Temporary Mobile Subscriber Identity (TMSI) , Packet TMSI (P-TMSI, Packet TMSI) and Mobile Subscriber Integrated Services Digital Network Number (MSISDN).

Typical operator data may include, for example, a list of Service Provider Names (SPNs) for operator-controlled PLMNs (OPLMNs, Operator controlled PLMNs), PLMNs (PNNs, PLMNs Network Names) for the displayed names, emergency control centers (ЕСС, Emergency Control Center) for emergency call management and other categories, etc.

Examples of these applications include, without limitation, a set of SIM applications (STK, SIM Application Toolkit) (for example, Roaming Broker), advanced network selection (HNS, Enhanced Network Selection), applications changing the international identifier of mobile equipment (IMEI, International Mobile Equipment Identity), etc.)

Prior Art Authentication Procedures

As a brief digression, FIG. 1 is a diagram of a typical prior art authentication and key agreement (AKA) procedure 100 in an example context of a UMTS cellular system. During normal authentication procedures, the device (terminal) of the UE 102 receives from the USIM 104 an International Mobile Subscriber Identifier (IMSI). The UE transmits it to a serving network (SN, Serving Network) 106 of a network operator or a visited core network. The SN sends an authentication request to the AuC 108 of the home network (HN, Home Network). The HN network compares the received IMSI with the AuC record and obtains the corresponding K. The HN network generates a random number (RAND) and signs it with K, using the algorithm for generating the expected response (XRES). The HN network additionally generates an encryption key (CK, Cipher Key) and an integrity key (IK, Integrity Key) for use in encryption and integrity protection, as well as an authentication token (AUTN, Authentication Token) using various algorithms. The HN network transmits to the SN network an authentication vector consisting of RAND, XRES, SC, and AUTN. The SN network stores the authentication vector for use in a single authentication procedure only. The SN network transmits RAND and AUTN to the UE.

After the UE 102 receives RAND and AUTN, USIM 104 checks the validity of the received AUTN. If so, then the UE uses the received RAND to determine its own response (RES) using stored K and the same algorithm that generates XRES. The UE sends the RES back to the SN network. The SN 106 compares the XRES with the received RES and, if they match, the SN authorizes the UE to use the service in the operator’s wireless network.

Figure 2 graphically shows the operations 200 AKA from the prior art performed by USIM to verify the received AUTN. USIM uses the cryptographic functions F1, F2, F3, F4 and F5 (see 3GPP TS 3.5.205 V9.0.0, previously fully incorporated by reference), the saved key K, and accepted by AUTN and RAND. Using RAND and K as input to F5, USIM calculates an anonymity key (AK, Anonymity Key). Using the XOR operation (exclusive OR) on the AK with the first AUTN field, the sequence number (SQN, Sequence Number) is formed. Using RAND, K, SQN, and AMF as input for F1, F2, F3, and F4, USIM calculates the Expected Message Authentication Code, RES, CK, and IK. Next, the UE compares the KhMAS with the MAC of AUTN; if they are different, then the UE sends back an authentication error message indicating the reason and terminates the procedure to the visitor location register / GPRS service support node (VLR / SGSN, Visitor Location Register / Serving GPRS Support Node) and aborts the procedure.

In one implementation, in the event that the HMAC matches the MAC, the UE checks to see if the SQN is in the valid range and sends back an authentication response message that contains the calculated RES result to the VLR / SGSN. Alternatively, if the SQN is invalid, then the UE performs a resynchronization procedure and sends a synchronization error message back to the VLR / SGSN.

Upon successful completion of the above procedure, the UEs and UTRANs are in agreement with the SK and IK and can activate encryption encryption and integrity protection. Next, with reference to FIG. 3, a typical architecture 300 of a prior art user identification module (SIM) is shown. As shown, USIM is stored on a universal integrated circuit card (UICC, Universal Integrated Circuit Card) configured to be placed in cellular device 304. USIM implements the software procedures necessary for the AKA procedure (as shown in FIGS. 1 and 2). The secure UICC stores secret keys known only to USIM and networks, and supports internal counters (such as states) related to secure transactions. The physical form of USIM execution can be physically transmitted, for example, through mailboxes, mail, kiosks, etc.

Examples of embodiments

An example embodiment of a wireless system 400 in which a user using a user device 430 can receive wireless network services from a network service provider 412 in accordance with the present invention is shown in FIG. The user device 430 may be, for example, a cell phone or smartphone, desktop computer, laptop, or other appropriate computing equipment. In the case of authorization, the user device 430 can communicate with the network service provider 412 via a wireless communication line 432.

User device 430 may have a wireless communication circuit system. For example, user device 430 may use a long-range wireless communication system system, such as a cellular communication system, to communicate via a communication line 432 using cellular telephony bands at 850 MHz, 900 MHz, 1800 MHz, and 1900 MHz (e.g., basic cellular ranges telephony of the global system for mobile communications or GSM (Global System for Mobile Communications). The long-range wireless communication system in user device 430 may also be configured to operate in the 2100 MHz band. If necessary, the user device can also use short-range wireless links to communicate effectively with nearby equipment. For example, electronic devices can communicate using the 2.4 GHz and 5 GHz WiFi® (IEEE 802.11) bands and the 2.4 GHz Bluetooth® band.

The network service provider 412 may require that the user authenticate appropriately before providing the service. For example, the network service provider 412 may support universal user identification module (USIM) information 414, which is used to determine whether a given user is authorized to use the service of the provider 412. Unauthorized users (eg, users who do not have active accounts) in the service will be refused. Authorized users will be allowed to establish communication lines (such as communication line 432) for making and receiving voice telephone calls, for downloading and downloading data, or for other receiving services available from a network service provider 412.

Traditionally, USIM data 414 is transmitted to authorized users in the form of user identification module (SIM) cards. This approach usually requires a SIM card slot in the user device.

With the circuit shown in FIG. 4, it is not necessary for the user device to receive USIM data 414 as a retrievable SIM card. In contrast, USIM data may be distributed using wired and / or wireless network connections.

As an example, USIM data 414 may be transmitted to a user device 430 from a network service provider 412 directly or using one or more intermediate entities, such as a USIM provider 422 and / or a trusted service manager 424.

In one embodiment, the network service provider 412 may transmit USIM data 414 for multiple users to the USIM provider 422 over a communications link 416. The communication line 416 may be a secure wired or wireless communication line or may use the physical delivery of a storage device containing USIM data 414.

A USIM provider 422, which may be, for example, a SIM card manufacturing organization, can transfer USIM data to a trusted service manager (s) 424 via line 420 (or, alternatively, a trusted service manager can receive USIM data directly from a network service provider 412 via another communication line 418).

A trusted service manager 424, which may be, for example, an organization that sells a user device 430 or an entity associated with a vendor of a device 430, may maintain a database with user credentials 426. The user credentials can be used to determine which users are authorized clients of the trusted service manager and / or have authorization to gain access to the network from the network service provider 414. For example, user credentials 426 may include account information that users of user device 430 receive when purchasing user device 430 (or shortly thereafter). User registration data 426 may include, for example, user name and password information, credit card information, and other information that can be used to identify authorized users.

A trusted service manager 424 in one embodiment may perform account management tasks associated with servicing user accounts (i.e., servicing user credentials 426 and determining which user associated with user credentials 426 is authorized to receive 414 USIM data for authorization of his user device). The computing equipment of the trusted service manager 424 may include a website and telephone customer service representatives. A website can be used, for example, to allow a user to create an account and set up an appropriate set of user registration data, buy a wireless service (used from a provider 412), make other purchases from a trusted service manager 424, etc.

In a typical scenario, a user of a user device 430 communicates with a trusted service manager 424 over a communication link 434. Communication line 434 includes, for example, wired and wireless communication lines between device 430 and manager 424. If necessary, intermediate equipment can be included in line 434 (for example, a personal computer to which user device 430 is connected using, for example, a USB connection).

When communicating with a trusted service manager 424, the user device 430 transmits the user credentials to the trusted service manager. A trusted service manager authenticates these credentials using, in one embodiment, a database 426 with user credentials.

If the user device is successfully authenticated, the trusted service manager 424 may transmit the corresponding USIM data 414 to the user device 430 over a secure channel on the communication link 434. The user device 430, if necessary, can store USIM data received in this way, for example, in the security element 428. The security element 428 can be, for example, protected from unauthorized interference by an integrated circuit that is permanently integrated in the user device 430 or can be retrieved an element.

After storing USIM data 414 in user device 430, the user device can use the stored USIM data to request wireless service from a network service provider 412. After authenticating the user device 430 with the network service provider 412, the network service provider 412 can provide the user device 430 with wireless services such as voice and data communications using the wireless communication line 432.

Next, with reference to FIGS. 5a and 5b, two examples of an embodiment of a hardware architecture (502, 504) for “virtual” user identification modules (SIMs) in accordance with the invention, respectively, are illustrated. In contrast to the prior art solution of FIG. 3, the examples of embodiments of FIGS. 5a and 5b store the USIM 506 in an integrated Secure Element 508, and not in a removable card. First shown, embodiment 502 of the present invention (FIG. 5 a) further comprises a proximity contact router (NFC) 510. The second embodiment 504 shown below (FIG. 5b) does not include an NFC router.

FIG. 6 shows a first embodiment 502 of FIG. 5a in conjunction with a SIM accessory 602. As shown, the SIM accessory 602 provides, inter alia, transitional embodiments and support for existing architectures. Embodiments for existing architectures may be of some value to those who frequently change SIM cards and / or to mobile operators who are slowly updating their existing networks or do not want to update them at all. As shown in FIG. 6, the Bluetooth SIM Access Profile (SAP) provides the necessary functions (for example, AKA protocol) typically performed by a physical SIM card inserted in the modem.

As shown, when the SIM card 302 is inserted into the slot of the auxiliary device for SIM, the auxiliary device can communicate with the cellular device using the Bluetooth transceiver and can be in a pocket, wallet, etc. During normal operation, the cellular device (communicating with the auxiliary device) asks the user whether to use an external SIM. If so, then the modem 502, if necessary, accesses the external SIM 302 via Bluetooth SAP.

With reference to FIG. 7, one prior art method for using USIM 302 is graphically illustrated. As shown, USIM data is generated from an operator 708 and transmitted to a SIM provider 706 in step 701. Next, at step 702, USIM is embedded in the UICC 302 cards for sale to users. After the UICC card has been inserted into the cellular device 304 in step 703, both the cellular device and the operator can perform activation, authentication, registration, and the like steps. (step 704).

In contrast, FIG. 8 shows one example embodiment of a method for distributing USIM information 506 in accordance with the present invention. As shown in step 801, USIM data is generated from the operator 808 and transmitted to the USIM provider 806. The USIM provider can transfer USIM in step 802 to, for example, trusted services manager (TSM). TSM transmits USIM to cellular device 502 over some secure channel (e.g., wireless or wired interface) (step 803). As shown, the secure channel is based on the issuer's Security Domain (ISD, Issuer's Security Domain) (step 804), which is flashed into the secure element (SE) during manufacture. After successfully transferring USIM to a cellular device, the cellular device and the operator may take steps to activate, authenticate, register, and the like. (step 805).

Obviously, although some aspects of the invention are described in terms of a specific sequence of steps of the method, these descriptions are merely illustrations of the broader methods of the invention and can be modified if necessary for specific applications. In addition, some steps or functionalities may be added to the disclosed embodiments, or the order of two or more steps may be changed. All of these changes are considered as included in the invention, here disclosed and claimed.

While the above detailed description shows, describes and marks the new features of the invention as applied to various embodiments, it should be understood that exceptions, replacements and changes in the form and details of the device or process shown may be made by a person skilled in the art without departing from SUMMARY OF THE INVENTION The above description is the best mode of implementation of the invention, currently presented. This description is not intended to be limiting, but rather should be used as an illustration of the basic principles of the invention. The scope of the invention should be determined with reference to the claims.

Claims (16)

1. A wireless communication device comprising
one or more communication interfaces configured to communicate with a wireless service provider;
a secure element configured to save an access client, wherein the access client includes a virtual universal user identification module (USIM);
CPU; and
a storage device configured to exchange data with the processor, the storage device storing computer-executable instructions providing, when the processor executes them, the wireless communication device:
authentication from a trusted service manager using account information obtained when purchasing a wireless communication device, and successful authentication results in the provision of access by the trusted customer service manager;
storing the access client in the secure element in response to receiving the access client; and
providing the user of the wireless communication device with a request to choose from:
access to the first of the wireless service providers through an access client stored in the secure element, and
access to the second of the wireless service providers by means of a physical card of a user identification module (SIM card) inserted into the SIM card slot of an auxiliary device in communication with the wireless communication device; and
accessing either the first wireless service provider or the second wireless service provider based on a user selection. 2. The device according to claim 1, characterized in that at least one of the number of one or more communication interfaces comprises a system of long-range wireless communication schemes. 3. The device according to claim 1, characterized in that at least one of the number of one or more communication interfaces comprises a short-range wireless communication system system. 4. The device according to claim 1, characterized in that it communicates with the auxiliary device through a system of near contactless communication (NFC) circuits. 5. The device according to p. 1, characterized in that the protected element is an integrated circuit protected from unauthorized interference, integrated into the wireless communication device on an ongoing basis. 6. A method for securely storing access client data in a user device, including:
transmitting the user registration data element of the user, received upon purchase of the wireless communication device, to the trusted service manager in order to ensure authentication of the user device by the trusted service manager based at least in part on the user registration data element, while the user device does not contain an identification card slot user (SIM cards);
receiving data of the access client via the communication interface after successful authentication of the user device by a trusted service manager, wherein the access client includes a virtual universal user identification module (USIM);
saving access client data in a secure element;
providing the user of the user device with a request to choose from:
accessing the first wireless service through access client data stored in the secure element, and
access to a second wireless service through a physical card of a user identification module (SIM card) inserted into a SIM card slot of an auxiliary device in communication with the user device; and
accessing either the first wireless service or the second wireless service based on the user's choice. 7. The method according to p. 6, characterized in that the communication interface contains a system of short-range wireless communication schemes. 8. The method according to p. 6, characterized in that the communication interface communicates with the auxiliary device using a system of near contactless communication (NFC). 9. The method according to p. 6, characterized in that the protected element contains an integrated circuit protected from unauthorized interference, integrated into the user device on an ongoing basis. 10. A method of providing access to wireless services for a user device, including:
transmitting the access client data to the first entity, the first entity including a virtual universal user identity module (USIM) provider, and the access client data including virtual USIM;
transmitting access client data from a first entity to a second entity via a first communication link, the second entity including a trusted service manager;
using user credentials in a trusted service manager to authenticate the user device, while the user device does not contain a slot for physical cards of the user identification module (SIM cards), but instead contains a secure element for storing access client data;
data transfer of the access client from the second object to the user device via the second communication line after authentication of the user device, while the user device stores the data of the access client in a secure element;
providing the user of the user device with a request to choose from:
accessing the first wireless service through access client data stored in the secure element, and
access to a second wireless service through a physical SIM card inserted in the SIM card slot of an auxiliary device in communication with the user device; and
accessing either the first wireless service or the second wireless service based on the user's choice. 11. The method according to p. 10, characterized in that the second communication line includes a secure wireless connection. 12. The method according to p. 10, characterized in that the auxiliary device performs wireless communication with the user device. 13. The method according to p. 10, characterized in that the user registration data includes account information that is individual for the user. 14. The device manager service, containing
a network interface configured to transmit multiple access clients to one or more wireless devices, wherein each access client from said multiple access clients includes a virtual universal user identification module (USIM);
a storage device configured to store multiple access clients;
processing logic configured to exchange data with the network interface and the storage device, while the processing logic is configured to:
receiving an access request from a particular device from among one or more wireless devices;
in response to an access request, authorization of the specified specific device from among the one or more wireless devices and transmission of at least one access client from among the plurality of access clients, while the specified specific device from among the one or more wireless devices makes it possible to provide the user with the specified specific device request to choose from:
accessing the first wireless service through at least one access client, and
access to the second wireless service by means of a physical card of a user identification module (SIM card) inserted into the SIM card slot of an auxiliary device communicating with said specific device from among one or more wireless devices. 15. The device according to p. 14, characterized in that the transmission of at least one access client ensures that a particular device from among one or more wireless devices stores at least one access client in a secure element contained in the specified device. 16. The device according to p. 14, characterized in that the network interface is configured to transmit at least one access client to the specified specific device from among one or more wireless devices through a second wireless connection.

Images