METHOD AND APPARATUS FOR eSIM DEVICE AND PROFILE SERVER TO REUSE POST QUANTUM CRYPTOGRAPHY ONE TIME KEY PAIR IN A WIRELESS COMMUNICATION SYSTEM

Abstract

The present disclosure relates to a 5G or 6G communication system for supporting higher data transmission rates. A method performed by a terminal of a wireless communication system is provided. The present disclosure discloses a method and apparatus for installing and managing an embedded universal integrated circuit card (eUICC) profile.

Description

Technology Field

[0001] The present disclosure relates to a terminal and a profile server in a wireless communication system. Specifically, the present disclosure relates to a method and apparatus for installing and managing an embedded universal integrated circuit card (eUICC) profile in a wireless communication system. Background Technology

[0002] 5G mobile communication technology defines a wide frequency band to enable fast transmission speeds and new services, and can be implemented not only in frequency bands below 6 GHz ('Sub 6 GHz'), such as 3.5 gigahertz (3.5 GHz), but also in ultra-high frequency bands called millimeter waves (mmWave), such as 28 GHz and 39 GHz ('Above 6 GHz'). In addition, for 6G mobile communication technology, which is referred to as a system beyond 5G, implementation in the terahertz band (e.g., the 3 terahertz (3 THz) band at 95 GHz) is being considered to achieve transmission speeds 50 times faster and ultra-low latency reduced to one-tenth compared to 5G mobile communication technology.

[0003] In the early stages of 5G mobile communication technology, aiming to satisfy service support and performance requirements for enhanced Mobile BroadBand (eMBB), Ultra-Reliable Low-Latency Communications (URLLC), and massive Machine-Type Communications (mMTC), technologies such as beamforming and Massive MIMO to mitigate path loss and increase transmission distance in ultra-high frequency bands, support for various numerologies (such as the operation of multiple subcarrier spacings) and dynamic operation of slot formats for the efficient utilization of ultra-high frequency resources, initial access techniques to support multi-beam transmission and broadband, definition and operation of Band-Width Parts (BWP), Low Density Parity Check (LDPC) codes for high-volume data transmission, new channel coding methods such as Polar Codes for the reliable transmission of control information, and L2 pre-processing (L2 Standardization has been carried out for pre-processing, network slicing which provides a dedicated network specialized for specific services, and other methods.

[0004] Currently, discussions are underway to improve and enhance the performance of the initial 5G mobile communication technology, taking into account the services that the 5G mobile communication technology was intended to support. Additionally, standardization of the physical layer is in progress for technologies such as V2X (Vehicle-to-Everything), which helps autonomous vehicles make driving decisions and enhance user convenience based on their own location and status information transmitted by the vehicle; NR-U (New Radio Unlicensed), which aims for system operation in unlicensed bands to comply with various regulatory requirements; NR terminal low power consumption technology (UE Power Saving); Non-Terrestrial Network (NTN), which is direct terminal-satellite communication for securing coverage in areas where communication with the terrestrial network is impossible; and positioning.

[0005] In addition, standardization is underway in the field of wireless interface architecture / protocols for technologies such as the Industrial Internet of Things (IIoT) for supporting new services through linkage and convergence with other industries, Integrated Access and Backhaul (IAB) which provides nodes for expanding network service areas by integrating wireless backhaul links and access links, Mobility Enhancement including Conditional Handover and Dual Active Protocol Stack (DAPS) Handover, and 2-step Random Access (2-step RACH for NR) which simplifies random access procedures. Standardization is also underway in the field of system architecture / services for 5G baseline architectures (e.g., Service based Architecture, Service based Interface) for incorporating Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies, and Mobile Edge Computing (MEC), which provides services based on the location of the terminal.

[0006] When such 5G mobile communication systems are commercialized, connected devices, which are increasing explosively, will be connected to communication networks. Accordingly, it is expected that there will be a need to enhance the functionality and performance of 5G mobile communication systems and to integrate the operation of connected devices. To this end, new research is planned to be conducted on 5G performance improvement and complexity reduction, support for AI services, support for metaverse services, and drone communication using eXtended Reality (XR), Artificial Intelligence (AI), and Machine Learning (ML) to efficiently support Augmented Reality (AR), Virtual Reality (VR), and Mixed Reality (MR).

[0007] Furthermore, the advancement of these 5G mobile communication systems encompasses multi-antenna transmission technologies such as new waveforms to guarantee coverage in the terahertz band of 6G mobile communication technology, Full Dimensional MIMO (FD-MIMO), array antennas, and large-scale antennas; metamaterial-based lenses and antennas to improve terahertz band signal coverage; high-dimensional spatial multiplexing technology using OAM (Orbital Angular Momentum); and Reconfigurable Intelligent Surface (RIS) technology; as well as Full Duplex technology for enhancing frequency efficiency and system networks in 6G mobile communication technology; AI-based communication technologies that realize system optimization by utilizing satellites and AI from the design stage and internalizing end-to-end AI support functions; and the realization of services of complexity exceeding the limits of terminal computing capabilities by utilizing ultra-high-performance communication and computing resources. It could serve as a foundation for the development of next-generation distributed computing technologies.

[0008] Meanwhile, as quantum computing technology advances, the risk of malicious attackers eavesdropping on communications between a terminal and a profile server to decrypt encrypted information and steal user profiles or network security keys is increasing, raising the need to enhance security in remote SIM provision operations. The problem to be solved

[0009] One objective of the present disclosure is to provide a method for remotely downloading a profile using quantum-resistant encryption technology.

[0010] In addition, one objective of the present disclosure is to provide an apparatus and method capable of effectively providing services in a mobile communication (or wireless communication) system through a security-enhanced profile download procedure.

[0011] The technical problems to be solved in this disclosure are not limited to those mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art to which this disclosure belongs from the description below. means of solving the problem

[0012] A method performed by a terminal in a wireless communication system according to an example of the present disclosure for solving the above-mentioned problems may include the step of transmitting a first message to a profile server; and the step of receiving a second message from the profile server. Effects of the invention

[0013] According to one example of the present disclosure, by using quantum-resistant encryption technology, security for downloading a profile can be further enhanced compared to existing encryption systems, and the profile can be downloaded more efficiently through the method of reusing encryption keys in the procedure for downloading a profile proposed in the present disclosure.

[0014] Accordingly, the present disclosure can provide an apparatus and method capable of effectively providing services in a wireless communication system.

[0015] The effects obtainable from the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art to which the present disclosure belongs from the description below. Brief explanation of the drawing

[0016] FIG. 1 is a diagram illustrating a method for a terminal to connect to a mobile communication network using a UICC equipped with a fixed profile according to one embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of a connection between a terminal, an activation intermediary server, a profile providing server, and a service provider according to one embodiment of the present disclosure. FIG. 3 is a flowchart of a procedure in which a terminal according to one embodiment of the present disclosure performs function negotiation with a profile server to download a profile and downloads the profile by reusing an encryption key used in a previous session. FIG. 4 is a flowchart of a procedure in which a terminal according to one embodiment of the present disclosure performs a function negotiation with a profile server to download a profile, and if the current session is terminated without being completed, exchanges information to download the profile by reusing the encryption key used in the current session in another session. FIG. 5 is a flowchart of a procedure in which a terminal according to one embodiment of the present disclosure performs a function negotiation with a profile server to download a profile, and if the current session is terminated without being completed, the encryption key used in the current session is reused in another session to download the profile. FIG. 6 is a block diagram illustrating the functional configuration of a terminal according to one embodiment of the present disclosure. FIG. 7 is a block diagram illustrating the functional configuration of a profile server according to one embodiment of the present disclosure. Specific details for implementing the invention

[0017] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0018] In describing the embodiments, technical details that are well known in the technical field to which this disclosure belongs and are not directly related to this disclosure are omitted. This is intended to convey the essence of this disclosure more clearly without obscuring it by omitting unnecessary explanations.

[0019] For the same reason, some components in the attached drawings have been exaggerated, omitted, or schematically depicted. Additionally, the size of each component does not entirely reflect its actual dimensions. Identical or corresponding components in each drawing have been assigned the same reference numbers.

[0020] The advantages and features of the present disclosure and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below but may be implemented in various different forms. The embodiments provided are merely to ensure that the disclosure is complete and to fully inform those skilled in the art of the scope of the disclosure, and the disclosure is defined only by the scope of the claims. Throughout the disclosure, the same reference numerals refer to the same components.

[0021] At this point, it will be understood that each block of the process flow diagrams and combinations of the flow diagrams can be executed by computer program instructions. Since these computer program instructions can be loaded into the processor of a general-purpose computer, a computer for special purposes, or other programmable data processing equipment, the instructions executed through the processor of the computer or other programmable data processing equipment create means to perform the functions described in the flow diagram block(s). Since these computer program instructions can also be stored on a computer-available or computer-readable storage medium that can be oriented toward the computer or other programmable data processing equipment to implement the function in a specific way, the instructions stored on the computer-available or computer-readable storage medium can also produce a manufactured item containing means of instruction to perform the function described in the flow diagram block(s). Since computer program instructions can be loaded onto a computer or other programmable data processing equipment, instructions that perform a series of operation steps on the computer or other programmable data processing equipment to create a process executed by the computer can also provide steps for executing the functions described in the flowchart block(s).

[0022] Additionally, each block may represent a module, segment, or part of code containing one or more executable instructions for executing a specified logical function(s). It should also be noted that in some alternative execution examples, the functions mentioned in the blocks may occur out of order. For instance, two blocks described in succession may actually be executed substantially simultaneously, or the blocks may be executed in reverse order according to their corresponding functions.

[0023] In this embodiment, the term "part" refers to a software or hardware component, such as an FPGA or ASIC, and the "part" performs certain roles. However, the meaning of "part" is not limited to software or hardware. The "part" may be configured to reside in an addressable storage medium or configured to operate one or more processors. Accordingly, as an example, the "part" includes components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functions provided within the components and "parts" may be combined into a smaller number of components and "parts" or further separated into additional components and "parts." Furthermore, the components and "parts" may be implemented to operate one or more CPUs within a device or secure multimedia card.

[0024] With the advancement of mobile communication systems, it has become possible to provide various services, and thus measures are required to effectively provide the aforementioned services.

[0025] A UICC (Universal Integrated Circuit Card) is a smart card inserted into devices such as mobile communication terminals, and is also referred to as a UICC card. A UICC may include a connection control module for the terminal to connect to a mobile carrier's network. Examples of such connection control modules include the USIM (Universal Subscriber Identity Module), SIM (Subscriber Identity Module), and ISIM (IP Multimedia Service Identity Module). A UICC containing a USIM is commonly referred to as a USIM card. Similarly, a UICC containing a SIM module is commonly referred to as a SIM card.

[0026] Among UICC cards, those fixed to a terminal are called eUICC (embedded UICC). Typically, an eUICC refers to a UICC card that is fixed to a terminal and allows for the remote download and selection of a SIM module. Additionally, the downloaded SIM module information is collectively referred to as an eUICC profile, or more simply, a profile.

[0027] Post-Quantum Cryptography (PQC) is an asymmetric key-based encryption technology utilizing public-private key pairs, designed to replace existing cryptographic systems that are susceptible to decryption by quantum computers and specific algorithms. Consequently, it is attracting attention as a new cryptographic system because it is expected to remain undecipherable within polynomial time by quantum computers, which demonstrate superior performance in integer-based problems. Types of PQC include multivariate-based, code-based, lattice-based, isogeny-based, and hash-based cryptographic algorithms.

[0028] Meanwhile, due to the advancement of quantum computing technology, the risk has increased where malicious attackers can eavesdrop on communications between terminals and profile servers, decrypt encrypted information, and steal user profiles and network security keys. To effectively counter these threats, it is necessary to enhance the security of remote SIM provision operations via eSIM.

[0029] The present disclosure aims to provide a method and apparatus for a terminal in a communication system to select a communication service and connect to a network.

[0030] In addition, the present disclosure aims to provide a method and apparatus for a terminal in a communication system to download, install, and manage a profile online for connecting to a network.

[0031] Specific terms used in the following description are provided to aid in understanding the present disclosure, and the use of such specific terms may be modified in other forms without departing from the technical spirit of the present disclosure.

[0032] In the present disclosure, the UICC (Universal Integrated Circuit Card) is a smart card used by inserting it into a mobile communication terminal, etc., and may also be referred to as a UICC card.

[0033] UICC may refer to a chip that stores personal information such as network access authentication information, phonebooks, and SMS (Short Message Service) of mobile communication subscribers, and enables secure mobile communication by performing subscriber authentication and traffic security key generation when connecting to mobile communication networks such as GSM (Global System for Mobile Communication), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution) / NR (New Radio).

[0034] The UICC may include communication applications or access control modules for the terminal to connect to a mobile carrier's network. Examples of such communication applications or access control modules may include USIM (Universal Subscriber Identity Module), SIM (Subscriber Identity Module), and ISIM (IP Multimedia Service Identity Module). Additionally, the UICC may provide high-level security functions for the installation of various applications, such as electronic wallets, ticketing, and electronic passports.

[0035] A UICC containing a USIM is commonly referred to as a USIM card. Similarly, a UICC containing a SIM module is commonly referred to as a SIM card.

[0036] In this disclosure, "SIM card," "UICC card," "USIM card," and "UICC including ISIM" may be used interchangeably. For example, the contents of this disclosure may apply equally to SIM cards, USIM cards, ISIM cards, or general UICC cards.

[0037] SIM cards store the personal information of mobile subscribers and enable secure mobile communication by performing subscriber authentication and generating traffic security keys when connecting to a mobile communication network.

[0038] Generally, SIM cards are manufactured as dedicated cards for specific mobile carriers at the request of those carriers. Authentication information for accessing the carrier's network, such as the USIM (Universal Subscriber Identity Module) application, IMSI (International Mobile Subscriber Identity), K value, and OPc value, may be pre-loaded onto the card before shipment. Consequently, mobile carriers receive the SIM cards and provide them to subscribers; subsequently, if necessary, they can utilize technologies such as OTA (Over The Air) to manage the installation, modification, and deletion of applications within the UICC. Subscribers can use the carrier's network and application services by inserting the UICC card into their mobile devices. When replacing devices, the authentication information, mobile phone numbers, and personal contact lists stored on the UICC card can be transferred and inserted into the new device, allowing them to use the new device as is.

[0039] However, SIM cards present an inconvenience for mobile device users seeking services from other mobile carriers. Users face the inconvenience of having to physically acquire a SIM card to receive services from a mobile carrier. For example, when traveling to another country, users face the inconvenience of having to obtain a local SIM card to receive local mobile services. While roaming services alleviate this inconvenience to some extent, the rates are relatively high, and there is also the issue of being unable to receive service if there is no contract between the carriers.

[0040] Meanwhile, this inconvenience can be largely resolved by remotely downloading and installing a SIM module onto a UICC card. For example, a user can download the SIM module of the mobile communication service they wish to use onto the UICC card at a desired time. Such a UICC card can be used by downloading and installing multiple SIM modules and selecting only one of them. Such a UICC card may or may not be fixed to the terminal. In particular, a UICC that is fixed to the terminal is called an eUICC (embedded UICC); typically, eUICC refers to a UICC card that is fixed to the terminal and allows for the remote downloading and selection of a SIM module. In this disclosure, a UICC card that allows for the remote downloading and selection of a SIM module may be referred to as an eUICC. For example, among UICC cards that allow for the remote downloading and selection of a SIM module, a UICC card that is fixed to the terminal or not fixed may be collectively referred to as an eUICC. Furthermore, the downloaded SIM module information may be collectively referred to as an eUICC profile, or more simply, a profile.

[0041] In the present disclosure, the eUICC may be a security module in the form of a chip embedded in the terminal, rather than a detachable type that can be inserted into and removed from the terminal. Typically, the eUICC may be used by being fixed to the terminal. Meanwhile, the eUICC can download and install a profile using OTA technology. The eUICC may be referred to as a UICC capable of downloading and installing a profile.

[0042] The method of downloading and installing a profile on an eUICC using OTA technology in the present disclosure may also be applied to a detachable UICC that can be inserted into and removed from a terminal. For example, the embodiments of the present disclosure may be applied to a UICC capable of downloading and installing a profile using OTA technology.

[0043] In the present disclosure, "UICC" may be used interchangeably with "SIM", and "eUICC" may be used interchangeably with "embedded SIM (eSIM)".

[0044] In the present disclosure, "Profile" may refer to an application, file system, authentication key value, etc. stored within the UICC packaged in the form of software.

[0045] In the present disclosure, "USIM Profile" may have the same meaning as "profile" or may refer to information included in a USIM application within the profile packaged in the form of software.

[0046] In the present disclosure, the operation of enabling a profile by a terminal may mean an operation of changing the state of the profile to an enabled state so that the terminal can receive communication services through the telecommunications carrier that provided the profile. A profile in an enabled state may be expressed as an "enabled profile."

[0047] In the present disclosure, the operation of a terminal disabling a profile may mean changing the state of the profile to a disabled state, thereby configuring the terminal so that it cannot receive communication services through the telecommunications carrier that provided the profile. A profile in a disabled state may be expressed as a "disabled profile."

[0048] In the present disclosure, the operation of a terminal deleting a profile may mean an operation of changing the status of the profile to a deleted state so that the terminal can no longer activate or deactivate the profile. A profile in a deleted state may be expressed as a "deleted profile."

[0049] In the present disclosure, the operation of enabling, disabling, or deleting a profile by a terminal may mean an operation in which, without immediately changing the state of each profile to an enabled, disabled, or deleted state, each profile is first marked as to be enabled, to be disabled, or to be deleted, and then the terminal or the terminal’s UICC changes each profile to an enabled, disabled, or deleted state after performing a specific operation (e.g., the execution of a refresh or reset command). The action of marking a specific profile as a scheduled state (e.g., to be enabled, to be disabled, or to be deleted) is not necessarily limited to marking one scheduled state for a single profile; it is also possible to mark one or more profiles as having the same or different scheduled states, mark one profile as having one or more scheduled states, or mark one or more profiles as having one or more scheduled states.

[0050] Additionally, if the terminal displays one or more scheduled states for any profile, the two scheduled state indications may be combined into one. For example, if any profile is displayed as "to be disabled" and "to be deleted," the profile may be displayed as a combined "to be disabled and deleted" state.

[0051] Additionally, the operation of the terminal displaying a scheduled state for one or more profiles may be performed sequentially or simultaneously. Additionally, the operation of the terminal displaying a scheduled state for one or more profiles and subsequently changing the state of the actual profile may be performed sequentially or simultaneously.

[0052] In the present disclosure, the "profile providing server" may include functions for creating a profile, encrypting a created profile, creating a profile remote management command, or encrypting a created profile remote management command. The profile providing server may be represented as SM-DP (Subscription Manager Data Preparation), SM-DP+ (Subscription Manager Data Preparation plus), off-card entity of Profile Domain, profile encryption server, profile creation server, profile provisioner (PP), profile provider, and PPC (Profile Provisioning Credentials) holder.

[0053] In the present disclosure, the "profile management server" may include a function for managing profiles. The profile management server may be represented as SM-SR (Subscription Manager Secure Routing), SM-SR+ (Subscription Manager Secure Routing Plus), off-card entity of eUICC Profile Manager or PMC (Profile Management Credentials) holder, EM (eUICC Manager), PM (Profile Manager), etc.

[0054] In the present disclosure, the profile providing server may refer to a combination of the functions of a profile management server. Accordingly, in various embodiments of the present disclosure, the operation of the profile providing server may be performed on the profile management server. Likewise, the operation of the profile management server or SM-SR may be performed on the profile providing server.

[0055] In the present disclosure, the "activation intermediary server" may be represented as SM-DS (Subscription Manager Discovery Service), DS (Discovery Service), Root activation intermediary server (Root SM-DS), and Alternative activation intermediary server (Alternative SM-DS). An activation intermediary server may receive an Event Register Request (Event Register Request) from one or more profile providing servers or activation intermediary servers. Additionally, one or more activation intermediary servers may be used in combination, in which case the first activation intermediary server may receive an Event Register Request from a second activation intermediary server as well as a profile providing server.

[0056] In the present disclosure, the profile providing server and the activation brokerage server may be referred to as the 'RSP (Remote SIM Provisioning) server'. The RSP server may be represented as SM-XX (Subscription Manager XX).

[0057] In the present disclosure, the term "terminal" may be referred to as a Mobile Station (MS), User Equipment (UE), User Terminal (UT), wireless terminal, Access Terminal (AT), terminal, Subscriber Unit, Subscriber Station (SS), wireless device, wireless communication device, Wireless Transmit / Receive Unit (WTRU), mobile node, mobile, or other terms. In one embodiment, the terminal may include a cellular telephone, a smartphone having wireless communication capabilities, a Personal Digital Assistant (PDA) having wireless communication capabilities, a wireless modem, a portable computer having wireless communication capabilities, a shooting device such as a digital camera having wireless communication capabilities, a gaming device having wireless communication capabilities, a music storage and playback appliance having wireless communication capabilities, an internet appliance capable of wireless internet access and browsing, as well as portable units or terminals integrating combinations of such capabilities. Additionally, the terminal may include, but is not limited to, M2M (Machine to Machine) terminals and MTC (Machine Type Communication) terminals / devices. In this disclosure, the terminal may also be referred to as an electronic device.

[0058] In the present disclosure, the "electronic device" may have a UICC embedded that can download and install a profile. If the UICC is not embedded in the electronic device, a UICC that is physically separated from the electronic device may be inserted into the electronic device and connected to the electronic device. For example, the UICC may be inserted into the electronic device in the form of a card. The electronic device may include a terminal. In this case, the terminal may be a terminal that includes a UICC that can download and install a profile. The UICC may not only be embedded in the terminal, but if the terminal and the UICC are separated, the UICC may be inserted into the terminal and connected to the terminal. A UICC that can download and install a profile may be referred to, for example, as an eUICC.

[0059] In the present disclosure, a terminal or electronic device may include software or an application installed within the terminal or electronic device to control a UICC or an eUICC. Software or an application installed within the terminal or electronic device to control a UICC or an eUICC may be referred to, for example, as a Local Profile Assistant (LPA).

[0060] In the present disclosure, "profile identifier" may be referred to as an argument matching a profile identifier (Profile ID), ICCID (Integrated Circuit Card ID), Matching ID, Event ID, Activation Code, Activation Code Token, Command Code, Command Code Token, Signed Command Code, Unsigned Command Code, ISD-P (Issuer Security Domain - profile), or Profile Domain (PD). The profile identifier (Profile ID) may represent a unique identifier for each profile. The profile identifier may further include the address of a profile provider server (SM-DP+) capable of indexing the profile. Additionally, the profile identifier may further include the signature of the profile provider server (SM-DP+).

[0061] In the present disclosure, the "eUICC identifier (eUICC ID)" may be a unique identifier of the eUICC embedded in the terminal and may be referred to as an EID (eUICC Identifier). Additionally, if a provisioning profile is pre-loaded on the eUICC, the eUICC identifier (eUICC ID) may be the identifier of the corresponding provisioning profile (Provisioning Profile's Profile ID). Furthermore, in one embodiment of the present disclosure, if the terminal and the eUICC chip are not separated, the eUICC identifier (eUICC ID) may be the terminal ID. Additionally, the eUICC identifier (eUICC ID) may refer to a specific secure domain of the eUICC chip.

[0062] In the present disclosure, "Profile Container" may be referred to as a Profile Domain. A Profile Container may be a Security Domain.

[0063] In the present disclosure, "APDU (application protocol data unit)" may be a message for a terminal to interact with an eUICC. Additionally, APDU may be a message for a PP (Profile Provider) or PM (Profile Manager) to interact with an eUICC.

[0064] In the present disclosure, "Profile Provisioning Credentials (PPC)" may be a means used for mutual authentication, profile encryption, and signing between a profile provisioning server and an eUICC. A PPC may include one or more of a symmetric key, an RSA (Rivest Shamir Adleman) certificate and private key, an ECC (elliptic curved cryptography) certificate and private key, a Root certification authority (CA), and a certificate chain. Additionally, if there are multiple profile provisioning servers, different PPCs may be stored or used in the eUICC for each profile provisioning server.

[0065] In the present disclosure, "PMC (Profile Management Credentials)" may be a means used for mutual authentication, encryption of transmitted data, and signing between a profile management server and an eUICC. A PMC may include one or more of a symmetric key, an RSA certificate and private key, an ECC certificate and private key, a Root CA, and a certificate chain. Additionally, if there are multiple profile management servers, different PMCs may be stored or used in the eUICC for each profile management server.

[0066] In the present disclosure, "AID" may be an Application Identifier. This value may be a distinguisher that separates different applications within the eUICC.

[0067] In the present disclosure, "Event" may be a collective term for Profile Download, Remote Profile Management, or other management / processing commands of a profile or eUICC. An Event may be named a Remote SIM Provisioning Operation (or RSP Operation) or an Event Record, and each Event may be referred to as data comprising at least one of the following: a corresponding Event Identifier (Event ID, EventID) or Matching Identifier (Matching ID, MatchingID), the address (FQDN, IP Address, or URL) of the Profile Provider Server (SM-DP+) or Activation Broker Server (SM-DS) where the event is stored, the signature of the Profile Provider Server (SM-DP+) or Activation Broker Server (SM-DS), and the digital certificate of the Profile Provider Server (SM-DP+) or Activation Broker Server (SM-DS).

[0068] Data corresponding to an Event may be referred to as a "Command Code." Part or all of the procedure utilizing the Command Code may be referred to as a "Command Code Processing Procedure," a "Command Code Procedure," or an "LPA API (Local Profile Assistant Application Programming Interface)." Profile Download may be used interchangeably with Profile Installation.

[0069] Additionally, "Event Type" may be used as a term indicating whether a specific event is a profile download, remote profile management (e.g., deletion, activation, deactivation, replacement, update, etc.), or other profile or eUICC management / processing commands, and may be named as Operation Type (or OperationType), Operation Class (or OperationClass), Event Request Type, Event Class, Event Request Class, etc. For any event identifier (EventID or MatchingID), the path through which the terminal obtained the event identifier (EventID or MatchingID) or the intended use (EventID Source or MatchingID Source) may be specified.

[0070] In this disclosure, "Profile Package" may be used interchangeably with "profile" or as a term representing a data object of a specific profile, and may be named Profile TLV or Profile Package TLV. If the profile package is encrypted using encryption parameters, it may be named Protected Profile Package (PPP) or Protected Profile Package TLV (PPP TLV). If the profile package is encrypted using encryption parameters that can be decrypted only by a specific eUICC, it may be named Bound Profile Package (BPP) or Bound Profile Package TLV (BPP TLV). A profile package TLV may be a data set representing information constituting a profile in the TLV(Tag, Length, Value) format.

[0071] In the present disclosure, "Local Profile Management (LPM)" may be referred to as Profile Local Management, Local Management, Local Management Command, Local Command, Local Profile Management Package, Profile Local Management Package, Local Management Package, Local Management Command Package, or Local Command Package. LPM may be used to change the status (Enabled, Disabled, Deleted) of a specific profile or to update the contents of a specific profile (e.g., Profile Nickname, Profile Metadata, etc.) through software installed on a terminal. LPM may include one or more local management commands, in which case the profiles targeted by each local management command may be the same or different for each local management command.

[0072] In the present disclosure, "Remote Profile Management (RPM)" may be referred to as Profile Remote Management, Remote Management, Remote Management Command, Remote Command, Remote Profile Management Package (RPM Package), Profile Remote Management Package, Remote Management Package, Remote Management Command Package, or Remote Command Package. An RPM may be used to change the status (Enabled, Disabled, Deleted) of a specific profile or to update the contents of a specific profile (e.g., Profile Nickname, Profile Metadata, etc.). An RPM may include one or more remote management commands, in which case the profiles targeted by each remote management command may be the same or different for each remote management command.

[0073] In the present disclosure, "Certificate" or "Digital Certificate" may refer to a digital certificate used for asymmetric key-based mutual authentication consisting of a pair of a public key (PK) and a secret key (SK). Each certificate may include one or more public keys (PK), a public key identifier (PKID) corresponding to each public key, a certificate issuer ID of the certificate issuer (CI) that issued the certificate, and a digital signature.

[0074] In addition, the "Certificate Issuer" may be referred to as the Certification Issuer, Certificate Authority (CA), or Certification Authority.

[0075] In the present disclosure, "Public Key (PK)" and "Public Key ID (PKID)" may be used interchangeably with the same meaning to refer to a specific public key or a certificate containing the said public key, or a part of a specific public key or a part of a certificate containing the said public key, or a result of an operation (e.g., hash) of a specific public key or a result of an operation (e.g., hash) of a certificate containing the said public key, or a result of an operation (e.g., hash) of a part of a specific public key or a result of an operation (e.g., hash) of a part of a certificate containing the said public key, or a storage space where data is stored.

[0076] In the present disclosure, when certificates issued by one Certificate Issuer (first certificates) are used to issue other certificates (second certificates), or when second certificates are used to issue third or higher certificates in a linked manner, the correlation of said certificates may be referred to as a Certificate Chain or Certificate Hierarchy, and in this case, the CI certificate used for the initial certificate issuance may be referred to as the Root of Certificate, top certificate, Root CI, Root CI Certificate, Root CA, Root CA Certificate, etc.

[0077] In this disclosure, "mobile operator" may refer to a business entity that provides telecommunication services to a terminal, and may collectively refer to the mobile operator's business supporting system (BSS), operational supporting system (OSS), point of sale terminal, and other IT systems. Furthermore, in this disclosure, "mobile operator" is not limited to representing a single specific business entity that provides telecommunication services, but may also be used as a term referring to a group or association or consortium of one or more business entities, or a representative representing said group or consortium. Additionally, in this disclosure, "mobile operator" may be named as an operator (OP, or Op.), a mobile network operator (MNO), a mobile virtual network operator (MVNO), a service provider (or SP), a profile owner (PO), etc., and each mobile operator may set or be assigned at least one name and / or unique identifier (OID). If a telecommunications business operator refers to a group or association of one or more business entities or an agency, the name or unique identifier of any group or association or agency may be a name or unique identifier shared by all business entities belonging to said group or association or all business entities cooperating with said agency.

[0078] In the present disclosure, "AKA" may represent Authentication and Key agreement and may represent an authentication algorithm for accessing 3GPP and 3GPP2 networks.

[0079] In the present disclosure, "K" may be a cryptographic key value stored in an eUICC used in an AKA authentication algorithm.

[0080] In the present disclosure, "OPC" may be a parameter value that can be stored in an eUICC used in an AKA authentication algorithm.

[0081] In the present disclosure, "NAA" is a Network Access Application, and may be an application such as a USIM or ISIM stored in a UICC for connecting to a network. NAA may be a network access module.

[0082] In this disclosure, the "indicator" may be used to indicate whether any function, setting, or operation is required or not, or to indicate the function, setting, or operation itself. Additionally, in this disclosure, the indicator may be expressed in various forms such as a string, an alphanumeric string, a true / false operator (Boolean - TRUE or FALSE), a bitmap, an array, or a flag, and other expressions having the same meaning may be used in combination.

[0083] Hereinafter, a method and apparatus for installing and managing an eUICC profile according to various embodiments of the present disclosure will be described in detail with reference to FIGS. 1 to 7.

[0084] FIG. 1 illustrates a method for connecting a terminal to a mobile communication network using a UICC equipped with a fixed profile on the terminal according to one embodiment of the present disclosure.

[0085] Referring to FIG. 1, according to one embodiment of the present disclosure, a UICC (120) may be inserted into a terminal (110). For example, the UICC (120) may be detachable, but is not limited thereto. For example, the UICC (120) may be pre-embedded in the terminal (110).

[0086] A fixed profile mounted on the UICC (120) may mean that the 'connection information' that allows access to a specific carrier is fixed. For example, the connection information may be an IMSI that is a subscriber identifier and a K or Ki value that is required to authenticate to the network along with the subscriber identifier.

[0087] According to various embodiments of the present disclosure, a terminal (110) may perform authentication with an authentication processing system of a mobile carrier using a UICC (120). The authentication processing system of a mobile carrier may include a home location register (HLR) or an AuC, but is not limited thereto.

[0088] According to one embodiment, the authentication process of a terminal (110) using a UICC (120) may include an AKA (Authentication and Key Agreement) process.

[0089] According to one embodiment, when the terminal (110) succeeds in authentication, it can use mobile communication services such as telephone or mobile data usage by using the mobile carrier network (130) of the mobile communication system.

[0090] FIG. 2 illustrates an example of a connection between a terminal, an activation intermediary server, a profile providing server, and a service provider according to one embodiment of the present disclosure.

[0091] Referring to FIG. 2, an eUICC (211) may be installed in the terminal (210). A profile may be installed in the eUICC (211). Additionally, an LPA (212) may be installed in the terminal (210). The eUICC (211) may be controlled by the LPA (212). A user (200) can install a profile in the eUICC (211) of each terminal or control the installed profile through the LPA (212).

[0092] According to one embodiment, a profile of a service provider (hereinafter referred to as "communication operator" or "operator", 240) may be installed on a terminal (210). As a result, the user (end user) (200) of the terminal (210) may receive communication services from the operator.

[0093] According to one embodiment, the operator (240) may be connected to the profile server (230). Additionally, the LPA (212) of the terminal (210) may be connected to the profile server (230) and the activation intermediary server (220). In FIG. 2, for convenience of explanation, the profile server (230) and the activation intermediary server (220) are each configured as a single server, but the specific implementation method of the profile server (230) and the activation intermediary server (220) is not limited to the example shown in FIG. 2. For example, depending on the implementation and embodiment, the profile server (230) may be configured with one or more profile servers (SM-DP+), and the activation intermediary server (220) that assists in creating a connection between a specific profile server and a terminal may also be configured with one or more activation intermediary servers (SM-DS). Hereinafter, for convenience of explanation in this disclosure, "single profile server" is referred to; however, it is obvious to those skilled in the art that the profile server mentioned below may include a plurality of server configurations as described above.

[0094] The operation and message exchange procedures of the user (200), operator (240), terminal (210), eUICC (211), LPA (212), profile server (230), and activation intermediary server (220) according to various embodiments of the present disclosure will be described in detail with reference to the drawings to be described later.

[0095] FIG. 3 illustrates a flowchart of a procedure in which a terminal according to one embodiment of the present disclosure performs a function negotiation with a profile server to download a profile and downloads the profile by reusing an encryption key used in a previous session.

[0096] The configuration of the terminal (310) and profile server (330) described in FIG. 3 can be understood in correspondence with each configuration described in FIG. 2. For example, the terminal (310) and profile server (330) shown in FIG. 3 may correspond to the terminal (210) and profile server (230) of FIG. 2, respectively.

[0097] According to one embodiment, in step 3001, the LPA of the terminal (310) requests eUICC first information (euiccInfo1) from the eUICC of the terminal (310), and the eUICC may reply to the LPA with the eUICC first information. The request for eUICC first information may be transmitted from the LPA of the terminal (310) to the eUICC of the terminal (310) using the ES10b.GetEUICCInfo message, and the eUICC first information may be transmitted from the eUICC to the LPA as a reply to the ES10b.GetEUICCInfo message. The above step is optional and may not be performed if the LPA has obtained the eUICC first information in advance.

[0098] According to one embodiment, in step 3001, the LPA of the terminal (310) may request an eUICC Challenge to be used in the mutual authentication process with the profile server (330) thereafter from the eUICC of the terminal (310). The request for the eUICC Challenge may be transmitted from the LPA of the terminal (310) to the eUICC of the terminal (310) using the ES10b.GetEUICCCchallenge message. The above step is optional and may not be performed if the LPA has already obtained the eUICC Challenge in advance. Additionally, if the eUICC that receives the request has a session (RSP Session) established between a specific profile server and the eUICC prior to receiving the request and the session has not been completed, the eUICC may optionally store at least one of the following information along with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the profile server.

[0099] ● A temporary key pair generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair may be the eUICC's temporary key agreement public key (otPK.EUICC.KA) and temporary key agreement private key (otSK.EUICC.KA).

[0100] ● Temporary key pair information generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the temporary key agreement secret key (otSK.EUICC.KA) corresponding to the said eUICC temporary public key information.

[0101] ● A temporary key pair generated between the eUICC and the profile server for quantum-resistant cryptography (PQC)-based key establishment in the relevant session. In this case, the said temporary key pair may be the eUICC KEM public key (otPK.EUICC.KEM) and the eUICC KEM private key (otSK.EUICC.KEM) for the quantum-resistant cryptography-based key encapsulation mechanism (KEM).

[0102] ● Temporary key pair information generated for quantum-resistant cryptography (PQC)-based key establishment between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the eUICC KEM private key (otSK.EUICC.KEM) corresponding to the said eUICC temporary public key information.

[0103] ● eUICC temporary public key information corresponding to the eUICC temporary key pair. For example, if it was decided in the previous session to use a hydration method that simultaneously employs existing key consensus based on elliptic curve cryptography and quantum-resistant encryption with the profile server, eUICC may store the temporary key pair for key consensus and the temporary key pair generated for PQC-based key setup together.

[0104] According to one embodiment, when an eUICC receives a request for an eUICC Challenge, if a session (RSP session) established between a specific profile server and the eUICC exists, the eUICC may delete the previous session context and create new session context. Additionally, the eUICC may create an eUICC Challenge and connect the eUICC Challenge to the newly created session (RSP Session).

[0105] According to one embodiment, eUICC can pass an eUICC challenge to LPA as a reply to an ES10b.GetEUICCInfo message.

[0106] According to one embodiment, in step 3003, the LPA of the terminal (310) can establish a TLS (Transport Layer Security) connection with the profile server (330).

[0107] According to one embodiment, in step 3005, the terminal (310) may initiate a mutual authentication process with the profile server (330). Here, the mutual authentication may include certificate-based mutual authentication in which the eUICC (not shown) of the terminal (310) and the profile server (330) authenticate each other using an asymmetric key consisting of a pair of a public key (PK) and a secret key (SK). A mutual authentication start request may be transmitted by the terminal (310) to the profile server (330) using an ES9+.InitiateAuthentication message as in step 3005. The mutual authentication start request may optionally include at least one of the first information (euiccInfo1) of the eUICC installed on the terminal (310) or the information (lpaRspCapability) of the LPA.

[0108] According to one embodiment, the mutual authentication start request may include at least one Post Quantum Cryptography (PQC) function support information supported by an eUICC installed in the terminal (310). For example, the Post Quantum Cryptography function support information may include at least one of the following information.

[0109] ● eUICC Quantum-Resistant Cryptography Support Indicator (euiccPqcSupport)

[0110] ● Information on Key Establishment Methods supported by eUICC

[0111] ● Quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport): The eUICC installed on the terminal (310) stores a temporary key pair that was generated prior to the current session (RSP session) for quantum-resistant cryptography (PQC) based key establishment with a specific profile server, along with the profile server's unique identifier (SM-DP+ object identifier, SM-DP+ OID) (corresponding to step 3001), and indicates whether it can be reused.

[0112] According to one embodiment, the eUICC quantum-resistant cryptography support indicator may include an eUICC quantum-resistant cryptography key establishment support indicator (euiccPqcKeyEstablishmentSupport or pqcKeyEstablishmentSupport) indicating that it supports a key establishment function using quantum-resistant cryptography.

[0113] According to one embodiment, KeyEstablishmentMethods supported by the eUICC may include KeyEstablishmentOperationalMode supported by the eUICC. The KeyEstablishmentOperationalMode supported by the eUICC is information indicating the method of establishing a session key with a profile server supported by the eUICC, and may include, for example, at least one of the following information.

[0114] ● Support for legacyKeyEstablishment based on Elliptical Curve Cryptography (ECC)

[0115] ● Support for a hydration method (hybridKeyEstablishment) that simultaneously uses existing elliptic curve cryptography-based key consensus and quantum-resistant encryption methods

[0116] ● Supports single quantum-resistant encryption method (pqcKeyEstablishmentOnly, additionalKeyEstablishmentOnly)

[0117] The session key setting method supported by the above eUICC can be expressed in the form of a BIT STRING.

[0118] According to one embodiment, the key establishment method information supported by the eUICC may include quantum-resistant cryptographic key establishment algorithm information supported by the eUICC (KeyEstablishmentIdLists, KeyEstablishmentId, supportedKeyEstablishmentMethods, supportedPqcKeyEstablishmentMethods, PQCSupportedAlgo, supportedPqcAlgo, or supportedPqcKeyEstablishmentAlgo). Additionally, the quantum-resistant cryptographic key establishment algorithm information supported by the eUICC may indicate one or more quantum-resistant cryptographic algorithms supported by the eUICC. Here, the one or more quantum-resistant cryptographic algorithms supported by the eUICC may include at least one of a session key establishment algorithm using quantum-resistant cryptography, a key encapsulation mechanism (KEM), and a key agreement protocol. For example, the key encapsulation mechanism may be at least one of the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM 512, ML-KEM 768, ML-KEM 1024) or the Ctystal-Kyber algorithm. Information on quantum-resistant cryptographic key setting algorithms supported by eUICC may be expressed in the form of an object identifier (OID) or bit string that designates the algorithm.

[0119] According to one embodiment, at least one of an eUICC quantum-resistant encryption support indicator, key setting method information supported by the eUICC, quantum-resistant encryption key setting method information supported by the eUICC, or quantum-resistant encryption key reuse function support indicator may be included in the first information (euiccInfo1) of an eUICC (not shown) installed in a terminal (310) or the information (lpaRspCapability) of an LPA, and transmitted to a profile server (330).

[0120] According to one embodiment, an eUICC quantum-resistant cryptography support indicator or a quantum-resistant cryptography key reuse support indicator may be included in eUICC function support information (euiccRspCapability), and the eUICC function support information may be included in eUICC first information (euiccInfo1) or second information (euiccInfo2).

[0121] According to one embodiment, a quantum-resistant cryptographic key reuse function support indicator may be included in the key setting method information supported by the eUICC.

[0122] According to one embodiment, in step 3007, the profile server (330) may review the mutual authentication start request of the terminal (310). Additionally, the profile server (330) may generate a mutual authentication start response corresponding to the mutual authentication start request of the terminal (310) and transmit it to the terminal (310).

[0123] According to one embodiment, in the process of the profile server (330) reviewing a mutual authentication start request and generating a response corresponding to the mutual authentication start request, if at least one of the eUICC quantum-resistant encryption support indicator or eUICC quantum-resistant encryption key setting support indicator of the eUICC installed in the terminal, information on the key setting method supported by the eUICC, the session key setting method supported by the eUICC, or information on the quantum-resistant encryption key setting algorithm supported by the eUICC exists within the mutual authentication start request transmitted by the terminal (310), the profile server (330) may review whether at least one of the key setting methods supported by the eUICC is supported. Additionally, if the eUICC of the terminal (310) and the profile server (330) support at least one of the single quantum-resistant encryption method or a hybrid method (hybridKeyEstablishment) that simultaneously uses existing key consensus based on elliptic curve cryptography and a quantum-resistant encryption method among the key setting methods, the profile server (330) may review whether at least one of the quantum-resistant encryption key setting algorithm methods supported by the eUICC is supported. Additionally, the profile server (330) can select at least one of the quantum-resistant cryptographic key setting algorithms supported by eUICC and the common quantum-resistant cryptographic key setting algorithms it supports.

[0124] According to one embodiment, the profile server (330) may generate a data object containing a selected Key Establishment method based on a selection in the process. The selected Key Establishment method may include at least one of the following information.

[0125] ● Selected session key setting method (selectedMode) that is commonly supported by the eUICC of the profile server (330) and the terminal (310)

[0126] ● Selected quantum-resistant cryptographic key establishment algorithm (selectedAdditionalAlgo, selectedKeyEstablishmentId, KeyEstablishmentId) that is commonly supported by the eUICC of the profile server (330) and the terminal (310)

[0127] For example, the selected quantum-resistant cryptographic algorithm or quantum-resistant cryptographic key setting algorithm may be included in the serverSigned1 data object transmitted by the profile server to the terminal. As another example, the selected quantum-resistant cryptographic algorithm or quantum-resistant cryptographic key setting algorithm may be included in the sessionContext data object. Additionally, for example, the selected quantum-resistant cryptographic algorithm or the selected quantum-resistant cryptographic key setting algorithm may be represented in the form of a unique identifier (object identifier, OID), INTEGER, or BIT STRING referring to the algorithm.

[0128] In one embodiment, the profile server (330) may transmit a mutual authentication start response to the terminal (310). The mutual authentication start response may be transmitted via an ES9+.InitiateAuthentication response message, as illustrated in step 3007. The mutual authentication start response may include a selected Key Establishment method. For example, the selected Key Establishment method may be included in a serverSigned1 data object transmitted by the profile server (330) to the terminal (310), or in a sessionContext data object. Additionally, the mutual authentication start response may include at least one of a signature (serverSignature1) of the profile server (330) generated based on serverSigned1, a digital certificate of the profile server (330) capable of verifying the same, and a certificate chain.

[0129] According to one embodiment, if the profile server (330) has not completed the use of the eUICC KEM public key (otPK.EUICC.KEM) of the eUICC received for quantum-resistant cryptography (PQC)-based key establishment in a session with a specific eUICC, and has stored the public key and provides a function to reuse it, the mutual authentication start response may optionally include a quantum-resistant cryptography key reuse support indicator (pqcKemKeyReuseSupport). For example, the quantum-resistant cryptography key reuse support indicator may be included in the selected key establishment method (selectedKeyEstablishment), serverSigned1, sessionContext, or serverRspCapability.

[0130] According to one embodiment, in step 3009, the terminal (310) can verify the mutual authentication start response transmitted by the profile server (330). The LPA of the terminal (310) can verify the information included in the response transmitted by the profile server (330) through the eUICC installed in the terminal. The ES10b.AuthenticateServer message may be used for verification here. For example, the eUICC of the terminal (310) can verify the digital certificate and certificate chain of the profile server (330) and verify the signature (serverSignature1) of the profile server.

[0131] According to one embodiment, the terminal (310) may transmit a client verification request to the profile server (330). As illustrated in step 3009, the client verification request of the terminal (310) may include an ES9+.AuthenticateClient request message. For example, the client verification request may include an indicator (Activation Code Token or Event Id) indicating the profile package requested by the terminal (310). The indicator may be included in the matchingId, and there may be no corresponding value (empty). Additionally, the client verification request may include at least one of the signature (euiccSignature1) of the eUICC installed on the terminal (310), the digital certificate of the eUICC capable of verifying it, and the certificate chain thereof.

[0132] According to one embodiment, in step 3011, the profile server (330) can search for a profile package for the eUICC of the terminal (310). The search can find a matching profile package by using at least one of the eUICC identifier (EID) transmitted in the client authentication request and an indicator indicating the profile package, or by combining them.

[0133] According to one embodiment, the profile server (330) can determine whether the retrieved matching profile package is in the state of a bound profile package linked to the corresponding eUICC identifier (EID) in a previous session performed between the terminal (310)'s eUICC and the profile server (330). If a bound profile package linked to the corresponding eUICC identifier exists, the profile server (330) may include the eUICC temporary public key information used to create the bound profile package in the subsequent client verification response. The eUICC temporary public key information (bppEuiccOtpk, bppEuiccOtpkInfo, bppEuiccOtpkPqcInfo, bppEuiccOtpkKemInfo, etc.) may include, for example, at least one of the following information.

[0134] ● The public key of the eUICC temporary key consensus (otPK.EUICC.KA) transmitted from the terminal (310) in the previous session, the Public Key Identifier (PKID) of the key, or a value that can identify the key (e.g., the value may be identified in the form of an integer or a string)

[0135] ● The eUICC KEM public key (otPK.EUICC.KEM) for the quantum-resistant cryptography-based key encapsulation mechanism (KEM) transmitted from the terminal (310) in the previous session, the Public Key Identifier (PKID) of the said key, or a value that can identify the said key (e.g., said value may be in the form of an integer or a string)

[0136] ● A value derived from the above eUICC Temporary Key Consensus Public Key (otPK.EUICC.KA). For example, the derived value may be the result of a hash function that takes the eUICC Temporary Key Consensus Public Key as input, or a function that the eUICC and the profile server have previously recognized in common, and may include only a portion of such result. Additionally, the derived value may optionally be derived by including at least one additional input value (e.g., SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc.).

[0137] ● A value derived from the eUICC KEM public key (otPK.EUICC.KEM) for the above quantum-resistant cryptography-based key encapsulation mechanism (KEM). For example, it may be the result of a hash function that takes the eUICC KEM public key as input, or a function that the eUICC and the profile server are mutually aware of in advance, and may include only a portion of such result. Additionally, it may be derived by optionally including at least one of additional input values ​​(e.g., SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc.).

[0138] ● A value derived by using the above-mentioned eUICC Provisional Consensus Public Key and eUICC KEM Public Key together. For example, it may be the result of a hash function that takes the eUICC Provisional Consensus Public Key and the eUICC KEM Public Key as inputs, or a function that the eUICC and the profile server are mutually aware of in advance, and may include only a portion of such result values. Additionally, it may be derived by optionally including additional input values ​​(e.g., at least one of values ​​such as SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc., some of which may be values ​​known to the eUICC in advance).

[0139] ● At least one of the additional input values ​​of the above function

[0140] ● An indicator that the eUICC temporary consensus public key or eUICC KEM public key (or all) transmitted from the terminal (310) in the previous session is reusable

[0141] The above eUICC temporary public key information can be generated by the profile server (330) when the terminal (310) and the profile server (330) each transmit the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) to each other in steps 3005 and 3007. Alternatively, it may be generated regardless of whether the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) is transmitted between the terminal (310) and the profile server (330).

[0142] According to one embodiment, in step 3013, the profile server (330) may perform subsequent processes using information provided by the terminal (310) and send a client verification response to the terminal (310). For example, the profile server (330) may use ES9+.AuthenticateClientResponse as the client verification response, as illustrated in step 3013. The client verification response here may include eUICC temporary public key information. For example, the eUICC temporary public key information may be included in the serverSigned2 data object transmitted by the profile server (330) to the terminal (310). Additionally, the client verification response may include at least one of the signature (serverSignature2) of the profile server (330) generated based on serverSigned2, a digital certificate of the profile server (330) capable of verifying it, and the certificate chain thereof.

[0143] The above eUICC temporary public key information may be transmitted through the client verification response when the terminal (310) and the profile server (330) each transmit the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) to each other in steps 3005 and 3007. Alternatively, it may be transmitted regardless of whether the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) is transmitted between the terminal (310) and the profile server (330).

[0144] According to one embodiment, in step 3015, the terminal (310) may review the information provided by the profile server (330) in step 3013 and generate information for a profile download request. Although not illustrated in the drawing, the LPA of the terminal (310) may request the eUICC of the terminal (310) using ES10b.PrepareDownloadRequest for the above steps.

[0145] According to one embodiment, the eUICC of the terminal (310) can check whether there exists an eUICC temporary key pair corresponding to the eUICC temporary public key information provided by the profile server (330). The eUICC temporary key pair may be a temporary key pair (eUICC temporary key agreement public key (otPK.EUICC.KA), temporary key agreement private key (otSK.EUICC.KA)) generated for Key Agreement stored together with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the profile server (330), or a temporary key pair (eUICC KEM public key (otPK.EUICC.KEM), eUICC KEM private key (otSK.EUICC.KEM)) generated for Quantum-Resistant Cryptography (PQC) based Key Establishment.

[0146] For example, if the eUICC temporary public key information provided by the profile server (330) to the terminal (310) in step 3013 is the eUICC temporary key consensus public key (otPK.EUICC.KA), the eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), both values, or a combination thereof, the eUICC can perform a comparison with the public key of the eUICC temporary key pair stored together with the unique identifier of the profile server (330).

[0147] For example, if the eUICC temporary public key information provided by the profile server (330) in step 3013 is the PKID of the eUICC temporary key consensus public key (otPK.EUICC.KA), the PKID of the eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), both values, or a combination thereof, the eUICC can perform a comparison by converting the public key of the eUICC temporary key pair stored together with the unique identifier of the profile server (330) into a PKID.

[0148] For example, if the eUICC temporary public key information provided by the profile server (330) in step 3013 is a value that can indicate the eUICC temporary key consensus public key (otPK.EUICC.KA), a value that can indicate the eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), both values, or a combination thereof, the eUICC can convert the public key of the eUICC temporary key pair stored together with the unique identifier of the profile server (330) into a PKID and perform a comparison.

[0149] For example, if the eUICC temporary public key information provided by the profile server (330) in step 3013 is a value derived from the eUICC temporary key consensus public key (otPK.EUICC.KA), a value derived from the eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), both values, or a combination thereof, the eUICC can perform a comparison by converting the public key of the eUICC temporary key pair stored with the unique identifier of the profile server (330) using a hash function or a function that the eUICC and the profile server have previously recognized in common. Additionally, if the profile server (330) provides additional input values, the eUICC can derive a value including those values ​​and values ​​that the eUICC has previously known and perform a comparison.

[0150] For example, if the eUICC temporary public key information provided by the profile server (330) in step 3013 indicates that the eUICC temporary key consensus public key (otPK.EUICC.KA) or the eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM) can be reused, the eUICC can select a temporary key pair stored with the unique identifier of the profile server (330).

[0151] If, during the verification process above, there exists a temporary key pair corresponding to the eUICC temporary public key information provided by the profile server (330), the eUICC of the terminal (310) selects the corresponding temporary key pair and can use the selected temporary key pair for profile download with the profile server (330). For example, the selected temporary key pair may be the eUICC temporary key consensus public key (otPK.EUICC.KA) and temporary key consensus private key (otSK.EUICC.KA) or the eUICC KEM public key (otPK.EUICC.KEM) and eUICC KEM private key (otSK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), and both may be selected.

[0152] If, during the verification process, there is no temporary key pair corresponding to the eUICC temporary public key information provided by the profile server (330), the eUICC of the terminal (310) generates a new temporary key pair and can use the generated temporary key pair for profile download with the profile server (330). For example, the generated temporary key pair may be the eUICC temporary key consensus public key (otPK.EUICC.KA) and temporary key consensus private key (otSK.EUICC.KA) or the eUICC KEM public key (otPK.EUICC.KEM) and eUICC KEM private key (otSK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), and both may be generated.

[0153] According to one embodiment, the eUICC of the terminal (310) may transmit to the LPA of the terminal (330) an eUICC temporary public key to be used for profile downloading with the profile server (330). For example, the eUICC temporary public key may be an eUICC temporary key consensus public key (otPK.EUICC.KA), an eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), or both. Additionally, the eUICC may generate and store eUICC public key information corresponding to the eUICC temporary public key, and may optionally delete the eUICC temporary public key.

[0154] According to one embodiment, the eUICC of the terminal (310) may transmit eUICC temporary public key information referring to the temporary public key to the LPA of the terminal (310) instead of the eUICC temporary public key to be used for profile download with the profile server (330). For example, the eUICC temporary public key information may be the same as the value transmitted by the profile server (330) to the terminal (310) in step 3013.

[0155] According to one embodiment, in step 3017, the LPA of the terminal (310) may request a profile package from the profile server (330). The profile package request may use an ES9+GetBoundProfilePackage request as illustrated in step 3017. The profile package request may include at least one of the eUICC temporary public key or eUICC temporary public key information described above in step 3015.

[0156] According to one embodiment, in step 3019, the profile server (330) can generate a bundled profile package using the eUICC temporary public key or eUICC temporary public key information provided by the terminal (310). For example, if eUICC temporary public key information is transmitted, the profile server (330) can check whether there exists a bundled profile package generated with the eUICC temporary public key or eUICC temporary public key corresponding to the eUICC temporary public key information. Additionally, if an eUICC temporary public key is transmitted, the profile server (330) can check whether there exists a bundled profile package generated with the eUICC temporary public key or eUICC temporary public key. If a bundled profile package that has already been generated exists, the profile server (330) may not generate a new bundled profile package. If there is no corresponding bundled profile package, the profile server (330) can generate a bundled profile package using the transmitted eUICC temporary public key. Additionally, the profile server (330) can store at least one of the eUICC temporary public key, eUICC temporary public key information, eUICC identifier, and bundled profile package together.

[0157] According to one embodiment, in step 3021, the profile server (330) can deliver a profile package bundled to the terminal (310).

[0158] According to one embodiment, in step 3023, the LPA of the terminal (310) may request the eUICC of the terminal (310) to install a profile package. The eUICC of the terminal (310) may generate a ProfileInstallationResult containing the profile installation result and transmit it to the LPA of the terminal (310). If the eUICC of the terminal (310) succeeds in installing the profile package, it may delete the eUICC temporary key pair used for downloading the profile with the corresponding profile server (330).

[0159] According to one embodiment, if the profile package installation fails, the eUICC of the terminal (310) may optionally store at least one of the following information along with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the corresponding profile server (330).

[0160] ● A temporary key pair generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair may be the eUICC's temporary key agreement public key (otPK.EUICC.KA) and temporary key agreement private key (otSK.EUICC.KA).

[0161] ● Temporary key pair information generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the temporary key agreement secret key (otSK.EUICC.KA) corresponding to the said eUICC temporary public key information.

[0162] ● A temporary key pair generated between the eUICC and the profile server for quantum-resistant cryptography (PQC)-based key establishment in the relevant session. In this case, the said temporary key pair may be the eUICC KEM public key (otPK.EUICC.KEM) and the eUICC KEM private key (otSK.EUICC.KEM) for the quantum-resistant cryptography-based key encapsulation mechanism (KEM).

[0163] ● Temporary key pair information generated for quantum-resistant cryptography (PQC)-based key establishment between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the eUICC KEM private key (otSK.EUICC.KEM) corresponding to the said eUICC temporary public key information.

[0164] ● eUICC temporary public key information corresponding to the eUICC temporary key pair

[0165] According to one embodiment, in step 3025, the LPA of the terminal (310) may reply to the profile server (330) with the result of the profile installation. If the profile installation is successful, the profile server (330) may delete the eUICC temporary public key used for the profile download and the corresponding temporary key information of the profile server. If the profile installation fails, the profile server (330) may store at least one of the eUICC temporary public key used for the profile download, the temporary key pair of the profile server, and the bundled profile package together with the eUICC identifier, and reuse them in the future.

[0166] According to one embodiment, in step 3027, the profile server (330) may reply that the profile installation result processing is completed to the LPA of the terminal (310).

[0167] FIG. 4 illustrates a flowchart of a procedure in which a terminal according to one embodiment of the present disclosure performs a function negotiation with a profile server to download a profile, and if the current session is terminated without completion, exchanges information to download the profile by reusing the encryption key used in the current session in another session.

[0168] The configuration of the terminal (410) and the profile server (430) in FIG. 4 can be understood in correspondence with each configuration described above in FIG. 2. For example, the terminal (410) and the profile server (430) shown in FIG. 4 can correspond to the terminal (210) and the profile server (230) of FIG. 2, respectively.

[0169] According to one embodiment, in step 4001, the LPA of the terminal (410) can establish a TLS (Transport Layer Security) connection with the profile server (430).

[0170] According to one embodiment, in step 4003, the terminal (410) may initiate a mutual authentication process with the profile server (430). Here, the mutual authentication may include certificate-based mutual authentication in which the eUICC (not shown) of the terminal (410) and the profile server (430) authenticate each other using an asymmetric key consisting of a pair of a public key (PK) and a secret key (SK). As illustrated in step 4003, the terminal (410) may transmit the request to the profile server (430) using an ES9+.InitiateAuthentication message. The mutual authentication start request may optionally include at least one of the first information (euiccInfo1) of the eUICC installed on the terminal (410) or the information (lpaRspCapability) of the LPA.

[0171] According to one embodiment, a mutual authentication start request may include at least one Post Quantum Cryptography (PQC) function support information supported by an eUICC installed in a terminal (410). For example, the Post Quantum Cryptography function support information may include at least one of the following information.

[0172] ● eUICC Quantum-Resistant Cryptography Support Indicator (euiccPqcSupport)

[0173] ● Information on Key Establishment Methods supported by eUICC

[0174] ● Quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport): The eUICC installed on the terminal (410) stores a temporary key pair that was generated prior to the current session (RSP session) for quantum-resistant cryptography (PQC) based key establishment with a specific profile server, along with the profile server's unique identifier (SM-DP+ object identifier, SM-DP+ OID), and indicates whether the pair can be reused.

[0175] According to one embodiment, the eUICC quantum-resistant cryptography support indicator may include an eUICC quantum-resistant cryptography key establishment support indicator (euiccPqcKeyEstablishmentSupport or pqcKeyEstablishmentSupport) indicating that it supports a key establishment function using quantum-resistant cryptography.

[0176] According to one embodiment, KeyEstablishmentMethods supported by the eUICC may include KeyEstablishmentOperationalMode supported by the eUICC. Here, the KeyEstablishmentOperationalMode supported by the eUICC is information indicating the method of establishing a session key with a profile server supported by the eUICC, and may include, for example, at least one of the following information.

[0177] ● Support for legacyKeyEstablishment based on Elliptical Curve Cryptography (ECC)

[0178] ● Support for a hybrid Key Establishment that simultaneously uses existing elliptic curve cryptography-based key consensus and quantum-resistant encryption methods

[0179] ● Supports single quantum-resistant encryption method (pqcKeyEstablishmentOnly, additionalKeyEstablishmentOnly)

[0180] The session key setting method supported by the above eUICC can be expressed in the form of a BIT STRING.

[0181] According to one embodiment, the key establishment method information supported by the eUICC may include quantum-resistant cryptographic key establishment algorithm information supported by the eUICC (KeyEstablishmentIdLists, KeyEstablishmentId, supportedKeyEstablishmentMethods, supportedPqcKeyEstablishmentMethods, PQCSupportedAlgo, supportedPqcAlgo, or supportedPqcKeyEstablishmentAlgo). The quantum-resistant cryptographic key establishment algorithm information supported by the eUICC may indicate one or more quantum-resistant cryptographic algorithms supported by the eUICC. Additionally, one or more quantum-resistant cryptographic algorithms supported by the eUICC may include at least one of a session key establishment algorithm using quantum-resistant cryptography, a key encapsulation mechanism (KEM), and a key agreement protocol. For example, the key encapsulation mechanism may be at least one of the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM 512, ML-KEM 768, ML-KEM 1024) or the Ctystal-Kyber algorithm. Information on quantum-resistant cryptographic key setting algorithms supported by eUICC may be expressed in the form of an object identifier (OID) or bit string that designates the algorithm.

[0182] According to one embodiment, at least one of an eUICC quantum-resistant encryption support indicator, key setting method information supported by the eUICC, quantum-resistant encryption key setting method information supported by the eUICC, or quantum-resistant encryption key reuse function support indicator may be included in the first information (euiccInfo1) of the eUICC (not shown) installed in the terminal (410) or the information (lpaRspCapability) of the LPA and transmitted to the profile server (430).

[0183] According to one embodiment, an eUICC quantum-resistant cryptography support indicator or a quantum-resistant cryptography key reuse support indicator may be included in eUICC function support information (euiccRspCapability), and the eUICC function support information may be included in eUICC first information (euiccInfo1) or second information (euiccInfo2).

[0184] According to one embodiment, a quantum-resistant cryptographic key reuse function support indicator may be included in the key setting method information supported by the eUICC.

[0185] According to one embodiment, in step 4005, the profile server (430) may review the mutual authentication start request of the terminal (410). Additionally, the profile server (430) may generate a mutual authentication start response corresponding to the mutual authentication start request of the terminal (410) and, in step 4005, transmit the generated mutual authentication start response to the terminal (410). Step 4005 corresponds to step 3007 of FIG. 3.

[0186] According to one embodiment, the terminal (410) that receives the mutual authentication start response in step 4005 can verify the mutual authentication start response transmitted by the profile server (430). Additionally, the terminal (410) can transmit a client verification request to the profile server (430) in step 4007. The client verification request of the terminal (410) may include an ES9+.AuthenticateClient request message as illustrated in step 4007. Step 4007 corresponds to step 3009 of FIG. 3.

[0187] According to one embodiment, the profile server (430) performs subsequent processes using information provided by the terminal (410) and can send a client verification response to the terminal (410) in step 4009. For example, the profile server (430) may use ES9+.AuthenticateClientResponse as the client verification response as illustrated in step 4009. Additionally, the client verification response may include at least one of the signature (serverSignature2) of the profile server (430) generated based on serverSigned2, a digital certificate of the profile server (430) capable of verifying the same, and the certificate chain.

[0188] According to one embodiment, in step 4011, the terminal (410) may review information provided by the profile server (430) and generate information for a profile download request. Although not illustrated in the drawings, the LPA of the terminal (410) may request the eUICC of the terminal (410) in step 4011 using ES10b.PrepareDownloadRequest.

[0189] According to one embodiment, the eUICC of the terminal (410) may generate a new temporary key pair and use it for downloading a profile with the profile server (430). For example, the generated temporary key pair may be the eUICC temporary key consensus public key (otPK.EUICC.KA) and temporary key consensus private key (otSK.EUICC.KA) or the eUICC KEM public key (otPK.EUICC.KEM) and eUICC KEM private key (otSK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), and both may be generated. Additionally, the eUICC may generate eUICC temporary public key information (otpkKeyInfo), and the generated eUICC temporary public key information may include, for example, at least one of the following information.

[0190] ● eUICC Temporary Key Agreement Public Key (otPK.EUICC.KA), the Public Key Identifier (PKID) of the corresponding key, or a value that can identify the corresponding key (e.g., the value may be in the form of an integer or a string)

[0191] ● eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), the Public Key Identifier (PKID) of the said key, or a value capable of identifying the said key (e.g., said value may be in the form of an integer or a string)

[0192] ● A value derived from the above eUICC Temporary Key Consensus Public Key (otPK.EUICC.KA). For example, the above derived value may be the result of a hash function that takes the eUICC Temporary Key Consensus Public Key as input, or a function that the eUICC and the profile server have previously recognized in common, and may include only a portion of such result. Additionally, the above derived value may optionally be derived by including at least one additional input value (e.g., SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc.).

[0193] ● A value derived from the eUICC KEM public key (otPK.EUICC.KEM) for the above quantum-resistant cryptography-based key encapsulation mechanism (KEM). For example, it may be the result of a hash function that takes the eUICC KEM public key as input, or a function that the eUICC and the profile server are mutually aware of in advance, and may include only a portion of such result. Additionally, it may be derived by optionally including at least one of additional input values ​​(e.g., SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc.).

[0194] ● A value derived by using the above-mentioned eUICC Provisional Consensus Public Key and eUICC KEM Public Key together. For example, it may be the result of a hash function that takes the eUICC Provisional Consensus Public Key and the eUICC KEM Public Key as inputs, or a function that the eUICC and the profile server are mutually aware of in advance, and may include only a portion of such result values. Additionally, it may be derived by optionally including additional input values ​​(e.g., at least one of values ​​such as SM-DP+ OID, random number, Transaction ID, eUICC Challenge, Server Challenge, etc., some of which may be values ​​known to the eUICC in advance).

[0195] ● At least one of the additional input values ​​of the above function

[0196] ● An indicator that the eUICC Provisional Consensus Public Key or eUICC KEM Public Key (or all) is reusable

[0197] The above eUICC temporary public key information can be generated by the eUICC when the terminal (410) and the profile server (430) each transmit the quantum-resistant encryption key reuse support indicator (pqcKemKeyReuseSupport) to each other in steps 4003 and 4005. However, it may be generated regardless of whether the quantum-resistant encryption key reuse support indicator (pqcKemKeyReuseSupport) is transmitted between the terminal (410) and the profile server (430).

[0198] According to one embodiment, the eUICC generates and stores eUICC public key information corresponding to the eUICC temporary public key, and can optionally delete the eUICC temporary public key.

[0199] According to one embodiment, in step 4013, the LPA of the terminal (410) may request a profile package from the profile server (430). The profile package request may use an ES9+GetBoundProfilePackage request as illustrated in step 4013. The profile package request may include at least one of the eUICC temporary public key or eUICC temporary public key information described above in step 4011.

[0200] The above eUICC temporary public key information may be transmitted to the profile server (430) when the terminal (410) and the profile server (430) each transmit the quantum-resistant cryptographic key reuse function support indicator (pqcKemKeyReuseSupport) to each other in steps 4003 and 4005. However, it may be transmitted regardless of whether the quantum-resistant cryptographic key reuse function support indicator (pqcKemKeyReuseSupport) is transmitted between the terminal (410) and the profile server (430).

[0201] According to one embodiment, the eUICC of the terminal (410) may transmit to the LPA of the terminal (410) an eUICC temporary public key to be used for profile downloading with the profile server (430). For example, the eUICC temporary public key may be an eUICC temporary key consensus public key (otPK.EUICC.KA), an eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), or both. Additionally, the eUICC of the terminal (410) may optionally transmit eUICC temporary public key information.

[0202] According to one embodiment, in step 4015, the profile server (430) may generate a bundled profile package using the eUICC temporary public key or eUICC temporary public key information provided by the terminal (410). For example, the profile server (430) may generate a bundled profile package using the transmitted eUICC temporary public key. Additionally, if eUICC temporary public key information is transmitted, the profile server (430) may store at least one of the eUICC temporary public key, eUICC temporary public key information, eUICC identifier, or bundled profile package together.

[0203] According to one embodiment, in step 4017, the profile server (430) can deliver a profile package bundled to the terminal (410).

[0204] According to one embodiment, in step 4019, the LPA of the terminal (410) may request the eUICC of the terminal (410) to install a profile package. The eUICC of the terminal (410) may generate a ProfileInstallationResult containing the profile installation result and transmit it to the LPA of the terminal (410). If the eUICC of the terminal (410) succeeds in installing the profile package, it may delete the eUICC temporary key pair used for downloading the profile with the corresponding profile server (430).

[0205] According to one embodiment, if the profile package installation fails, the eUICC of the terminal (410) may optionally store at least one of the following information along with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the profile server.

[0206] ● A temporary key pair generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair may be the eUICC's temporary key agreement public key (otPK.EUICC.KA) and temporary key agreement private key (otSK.EUICC.KA).

[0207] ● Temporary key pair information generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the temporary key agreement secret key (otSK.EUICC.KA) corresponding to the said eUICC temporary public key information.

[0208] ● A temporary key pair generated between the eUICC and the profile server for quantum-resistant cryptography (PQC)-based key establishment in the relevant session. In this case, the said temporary key pair may be the eUICC KEM public key (otPK.EUICC.KEM) and the eUICC KEM private key (otSK.EUICC.KEM) for the quantum-resistant cryptography-based key encapsulation mechanism (KEM).

[0209] ● Temporary key pair information generated for quantum-resistant cryptography (PQC)-based key establishment between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the eUICC KEM private key (otSK.EUICC.KEM) corresponding to the said eUICC temporary public key information.

[0210] ● eUICC temporary public key information corresponding to the eUICC temporary key pair

[0211] According to one embodiment, in step 4021, the LPA of the terminal (410) can reply to the profile server (430) with the result of the profile installation. If the profile installation is successful, the profile server (430) can delete the eUICC temporary public key used for the profile download and the corresponding temporary key information of the profile server (430). If the profile installation fails, the profile server (430) can store at least one of the eUICC temporary public key used for the profile download, the eUICC temporary public key information, the temporary key pair of the profile server (430), and the bundled profile package together with the eUICC identifier, and reuse them in the future.

[0212] According to one embodiment, in step 4023, the profile server (430) may reply that the profile installation result processing is completed to the LPA of the terminal (410).

[0213] FIG. 5 illustrates a flowchart of a procedure in which a terminal according to an embodiment of the present disclosure performs a function negotiation with a profile server to download a profile, and if the current session is terminated without being completed, the encryption key used in the current session is reused in another session to download the profile.

[0214] The configuration of the terminal (510) and the profile server (530) in FIG. 5 can be understood in correspondence with each configuration described in FIG. 2. For example, the terminal (510) and the profile server (530) shown in FIG. 5 can correspond to the terminal (210) and the profile server (230) of FIG. 2, respectively.

[0215] FIG. 5 assumes the operation after a profile installation failure in one embodiment disclosed in FIG. 4, and the profile server is described assuming that it has stored the eUICC temporary public key or eUICC temporary public key information provided by eUICC in step 4015.

[0216] According to one embodiment, in step 5001, the LPA of the terminal (510) requests eUICC first information (euiccInfo1) from the eUICC of the terminal (510), and the eUICC can reply to the LPA with the eUICC first information. Although not shown in the drawing, the request for eUICC first information may be transmitted from the LPA of the terminal (510) to the eUICC of the terminal (510) using the ES10b.GetEUICCInfo message, and the eUICC first information may be transmitted from the eUICC to the LPA as a reply to the ES10b.GetEUICCInfo message. The above step is optional and may not be performed if the LPA has obtained the eUICC first information in advance.

[0217] According to one embodiment, in step 5001, the LPA of the terminal (510) may request the eUICC of the terminal (510) to request an eUICC Challenge to be used in the mutual authentication process with the profile server (530). Although not shown in the drawings, the request for the eUICC Challenge may be made by the LPA of the terminal (510) to the eUICC of the terminal (510) using the ES10b.GetEUICCCchallenge message. The above step is optional and may not be performed if the LPA has already obtained the eUICC Challenge in advance. Additionally, if the eUICC that receives the request has a session (RSP Session) established between a specific profile server and the eUICC prior to receiving the request and the session has not been completed, the eUICC may optionally store at least one of the following information along with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the profile server.

[0218] ● A temporary key pair generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair may be the eUICC's temporary key agreement public key (otPK.EUICC.KA) and temporary key agreement private key (otSK.EUICC.KA).

[0219] ● Temporary key pair information generated for Key Agreement between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the temporary key agreement secret key (otSK.EUICC.KA) corresponding to the said eUICC temporary public key information.

[0220] ● A temporary key pair generated between the eUICC and the profile server for quantum-resistant cryptography (PQC)-based key establishment in the relevant session. In this case, the said temporary key pair may be the eUICC KEM public key (otPK.EUICC.KEM) and the eUICC KEM private key (otSK.EUICC.KEM) for the quantum-resistant cryptography-based key encapsulation mechanism (KEM).

[0221] ● Temporary key pair information generated for quantum-resistant cryptography (PQC)-based key establishment between the eUICC and the profile server in the relevant session. In this case, the said temporary key pair information may be the eUICC temporary public key information and the eUICC KEM private key (otSK.EUICC.KEM) corresponding to the said eUICC temporary public key information.

[0222] ● eUICC temporary public key information corresponding to the eUICC temporary key pair

[0223] For example, if it was decided in the previous session to use a hydration method that simultaneously employs the profile server, existing key consensus based on elliptic curve cryptography, and quantum-resistant cryptography, eUICC may store the temporary key pair for key consensus and the temporary key pair generated for PQC-based key setup together.

[0224] According to one embodiment, if an eUICC that receives an eUICC Challenge request exists a session (RSP session) established between a specific profile server and the eUICC, the eUICC may delete the previous session information (session context) and create new session information. Additionally, the eUICC may create an eUICC Challenge and connect the eUICC Challenge to the newly created session (RSP Session).

[0225] According to one embodiment, eUICC can pass an eUICC challenge to LPA as a reply to an ES10b.GetEUICCInfo message.

[0226] Since steps 5005, 5007, and 5009 can each correspond to 3005, 3007, and 3009 of FIG. 3, descriptions of overlapping operations will be omitted from this drawing.

[0227] According to one embodiment, in step 5011, the profile server (530) can search for a profile package for the eUICC of the terminal (510). The search may mean an operation to find a matching profile package by using or combining at least one of the eUICC identifier (EID) transmitted in the client authentication request and an indicator indicating a profile package.

[0228] According to one embodiment, the profile server (530) can determine whether the searched matching profile package is in the state of a bound profile package linked to the corresponding eUICC identifier (EID) in a previous session performed between the eUICC of the terminal (510) and the profile server (530). If a bound profile package linked to the corresponding eUICC identifier exists, the profile server (530) may include the eUICC temporary public key or eUICC temporary public key information used to create the bound profile package in a client verification response that is subsequently transmitted to the terminal (510).

[0229] The above eUICC temporary public key information may be transmitted through the client verification response when the terminal (510) and the profile server (530) each transmit the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) to each other in steps 5005 and 5007. However, it may be transmitted regardless of whether the quantum-resistant cryptographic key reuse support indicator (pqcKemKeyReuseSupport) is transmitted between the terminal (510) and the profile server (530).

[0230] According to one embodiment, the profile server (530) performs subsequent processes using information provided by the terminal (510) and may send a client verification response to the terminal (510) at step 5013. For example, the profile server (530) may use ES9+.AuthenticateClientResponse as the client verification response as illustrated in step 5013. The client verification response may include eUICC temporary public key information. For example, the eUICC temporary public key information may be included in the serverSigned2 data object transmitted by the profile server (530) to the terminal (510). Additionally, the client verification response may include at least one of the signature (serverSignature2) of the profile server (530) generated based on serverSigned2, a digital certificate of the profile server (530) capable of verifying it, and the certificate chain thereof.

[0231] According to one embodiment, in step 5015, the terminal (510) may review the information provided by the profile server (530) in step 5013 and generate information for a profile download request. Although not illustrated in the drawings, the LPA of the terminal (510) may request the eUICC of the terminal (510) using ES10b.PrepareDownloadRequest.

[0232] According to one embodiment, the eUICC of the terminal (510) can check whether there exists an eUICC temporary key pair corresponding to the eUICC temporary public key information provided by the profile server (530). The eUICC temporary key pair may be a temporary key pair (eUICC temporary key agreement public key (otPK.EUICC.KA), temporary key agreement private key (otSK.EUICC.KA)) generated for Key Agreement stored together with the unique identifier (SM-DP+ object identifier, SM-DP+ OID) of the profile server (510), or a temporary key pair (eUICC KEM public key (otPK.EUICC.KEM), eUICC KEM private key (otSK.EUICC.KEM)) generated for Quantum-Resistant Cryptography (PQC) based Key Establishment.

[0233] According to one embodiment, the eUICC of the terminal (510) may transmit an eUICC temporary public key to be used for profile downloading to the LPA of the terminal (510) and to the profile server (530). For example, the eUICC temporary public key may be an eUICC temporary key consensus public key (otPK.EUICC.KA), an eUICC KEM public key (otPK.EUICC.KEM) for a quantum-resistant cryptography-based key encapsulation mechanism (KEM), or both.

[0234] According to one embodiment, the eUICC of the terminal (510) may transmit eUICC temporary public key information referring to the temporary public key to the LPA of the terminal (510) instead of the eUICC temporary public key to be used for downloading a profile with the profile server (530). For example, the eUICC temporary public key information here may be the same as the value transmitted by the profile server (530) in step 5013. Additionally, the eUICC may generate and store eUICC public key information corresponding to the eUICC temporary public key, and may selectively delete the eUICC temporary public key.

[0235] According to one embodiment, in step 5017, the LPA of the terminal (510) may request a profile package from the profile server (530). The profile package request may be transmitted using an ES9+GetBoundProfilePackage request as indicated in step 5017. The profile package request may include at least one of the eUICC temporary public key or eUICC temporary public key information described above in step 5015.

[0236] Since steps 5019, 5021, 5023, 5025, and 5027 each correspond to steps 3019, 3021, 3023, 3025, and 3027 described in detail in FIG. 3, detailed descriptions of overlapping operations will be omitted from this drawing.

[0237] FIG. 6 illustrates the functional configuration of a terminal according to one embodiment of the present disclosure.

[0238] Referring to FIG. 6, a terminal according to various embodiments of the present disclosure may include a transceiver (610) and a control unit (or processor) (620). Additionally, the terminal may include a UICC (630). For example, the UICC (630) may be inserted into the terminal, but is not limited thereto. For example, the UICC (630) may include an eUICC embedded in the terminal.

[0239] According to one embodiment, the transmitting and receiving unit (610) can transmit and receive signals, information, data, etc. to and from the profile server.

[0240] According to one embodiment, the processor (620) may include components for overall control of the terminal. The processor (620) may control the overall operation of the terminal according to various embodiments of the present disclosure. In the present disclosure, the processor (620) may be referred to as a control unit. According to one embodiment of the present disclosure, the processor (620) may include at least one processor.

[0241] According to one embodiment of the present disclosure, at least one processor can control the transceiver (610) to transmit a first message containing functional information related to a PQC supported by the eSIM of the terminal to a profile server, and control the transceiver (610) to receive a second message containing PQC information to be used by the eSIM from the profile server in response to the first message.

[0242] According to one embodiment of the present disclosure, the UICC (630) can download a profile and install a profile. Additionally, the UICC (630) can manage a profile.

[0243] According to one embodiment, the UICC (630) may operate under the control of the processor (620). Alternatively, the UICC (630) may include a processor or controller for installing a profile, or may have an application installed. Part of the application may be installed on the processor (620).

[0244] Although not illustrated in the drawings, a terminal according to an example of the present disclosure may further include a storage unit or memory. According to one embodiment, the storage unit or memory of the terminal may store data such as a basic program, an application program, and setting information for the operation of the terminal. Additionally, the storage unit may include at least one storage medium among a Flash Memory Type, a Hard Disk Type, a Multimedia Card Micro Type, a card type memory (e.g., SD or XD memory, etc.), magnetic memory, a magnetic disk, an optical disk, a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), and an Electrically Erasable Programmable Read-Only Memory (EEPROM). Additionally, the processor (620) may perform various operations using various programs, content, data, etc. stored in the storage unit.

[0245] FIG. 7 illustrates the functional configuration of a profile server according to one embodiment of the present disclosure.

[0246] Referring to FIG. 7, a profile server according to various embodiments of the present disclosure may include a transmitting and receiving unit (710) and a control unit (or processor) (720).

[0247] According to one embodiment, the transmitting and receiving unit (710) can transmit and receive signals, information, data, etc. with a terminal, an activation intermediary server, or a business operator.

[0248] According to one embodiment, the processor (720) may include components for overall control of the profile server. The processor (720) may control the overall operation of the profile server according to various embodiments of the present disclosure. In the present disclosure, the processor (720) may be referred to as a control unit. According to one embodiment of the present disclosure, the processor (720) may include at least one processor.

[0249] According to one embodiment of the present disclosure, at least one processor can control the transceiver (710) to receive a first message from a terminal containing functional information related to a PQC supported by the terminal's eSIM, and in response to the first message, control the transceiver (710) to transmit a second message to the terminal containing PQC information to be used by the eSIM.

[0250] Although not illustrated in the drawings, a profile server according to one example of the present disclosure may further include a storage unit or memory. The storage unit or memory of the profile server may store data such as a basic program, an application program, and configuration information for the operation of the profile server. Additionally, the storage unit may include at least one storage medium selected from a Flash Memory Type, a Hard Disk Type, a Multimedia Card Micro Type, a card-type memory (e.g., SD or XD memory, etc.), magnetic memory, a magnetic disk, an optical disk, a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), and an Electrically Erasable Programmable Read-Only Memory (EEPROM). Additionally, the processor (720) may perform various operations using various programs, content, data, etc. stored in the storage unit.

[0251] According to one embodiment of the present disclosure, a method is provided to be performed by a terminal of a wireless communication system. The method comprises the steps of: transmitting a first message to a profile server containing functional information related to post-quantum cryptography (PQC) supported by an eSIM (embedded subscriber identity module) of the terminal; and receiving, in response to the first message, a second message from the profile server containing PQC information to be used by the eSIM.

[0252] According to one embodiment of the present disclosure, a method is provided to be performed by a profile server of a wireless communication system. The method comprises the steps of receiving a first message from a terminal containing functional information related to a PQC supported by the eSIM of the terminal, and transmitting a second message to the terminal containing PQC information to be used by the eSIM in response to the first message.

[0253] According to one embodiment of the present disclosure, a terminal of a wireless communication system is provided. The terminal includes a transceiver and at least one processor coupled to the transceiver. The at least one processor controls the transceiver to transmit a first message containing functional information related to a PQC supported by the eSIM of the terminal to a profile server, and controls the transceiver to receive, in response to the first message, a second message containing PQC information to be used by the eSIM from the profile server.

[0254] According to one embodiment of the present disclosure, a profile server of a wireless communication system is provided. The profile server includes a transceiver and at least one processor coupled to the transceiver. The at least one processor controls the transceiver to receive a first message from a terminal containing functional information related to a PQC supported by the eSIM of the terminal, and controls the transceiver to transmit a second message to the terminal containing PQC information to be used by the eSIM in response to the first message.

[0255] According to one embodiment of the present disclosure, when a terminal in a communication system communicates with a profile server using a quantum-resistant encryption method and wants to download a profile, the terminal provides the profile server with a quantum-resistant encryption method and parameters supported by the terminal, and can receive from the profile server a method supported identically by both the terminal and the profile server, and can generate a common session key using the simultaneously supported quantum-resistant encryption method and download and install the profile.

[0256] According to one embodiment of the present disclosure, in a communication system, a profile server receives a quantum-resistant encryption method and parameters supported by the terminal from the terminal, selects a method supported identically by the profile server and the terminal and provides it to the terminal, and generates a common session key using the simultaneously supported quantum-resistant encryption method, encrypts the profile, and transmits it to the terminal.

[0257] In the specific embodiments of the present disclosure described above, the components included in the disclosure are expressed in a singular or plural form according to the specific embodiments presented. However, the singular or plural expression is selected to suit the situation presented for convenience of explanation, and the present disclosure is not limited to singular or plural components; even if a component is expressed in the plural form, it may be composed of a singular form, and even if a component is expressed in the singular form, it may be composed of a plural form.

[0258] Meanwhile, although specific embodiments have been described in the detailed description of the present disclosure, it is understood that various modifications are possible within the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the described embodiments, but should be defined by the claims set forth below as well as equivalents thereof.

[0259] The various embodiments of the present disclosure and the terms used therein are not intended to limit the technology described in the present disclosure to specific embodiments and should be understood to include various modifications, equivalents, and / or substitutions of said embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar components. A singular expression may include a plural expression unless the context clearly indicates otherwise. In the present disclosure, expressions such as "A or B," "at least one of A and / or B," "A, B or C," or "at least one of A, B and / or C" may include all possible combinations of items listed together. Expressions such as "first," "second," "first," or "second" may modify said components regardless of order or importance and are used only to distinguish one component from another and do not limit said components. Where it is stated that a certain (e.g., 1st) component is "(functionally or telecommunicationally) connected" or "connected" to another (e.g., 2nd) component, the certain component may be directly connected to the other component or connected through the other component (e.g., 3rd component).

[0260] As used in this disclosure, the term "module" includes a unit composed of hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be a component formed integrally, or a minimum unit or part thereof that performs one or more functions. For example, a module may be composed of an application-specific integrated circuit (ASIC).

[0261] Various embodiments of the present disclosure may be implemented as software (e.g., a program) containing instructions stored in a machine-readable storage medium (e.g., internal memory or external memory) that is readable by a machine (e.g., a computer). The machine may include a terminal according to various embodiments of the present disclosure, which is a device capable of calling instructions stored from the storage medium and operating according to the called instructions. When an instruction is executed by a processor (e.g., the processor (620) of FIG. 6 or the processor (720) of FIG. 7), the processor may perform a function corresponding to the instruction directly or using other components under the control of the processor. The instruction may include code generated or executed by a compiler or an interpreter.

[0262] A device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' means only that the storage medium does not contain a signal and is tangible, and does not distinguish whether data is stored semi-permanently or temporarily in the storage medium.

[0263] Methods according to the various embodiments disclosed in this disclosure may be provided as included in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or online through an application store (e.g., Play Store™). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created in a storage medium such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0264] Each component (e.g., module or program) according to various embodiments may be composed of a singular or multiple entities, and some of the aforementioned sub-components may be omitted, or other sub-components may be additionally included in various embodiments. Generally or additionally, some components (e.g., module or program) may be integrated into a single entity to perform the functions performed by each of the respective components prior to integration in the same or similar manner. The operations performed by the module, program, or other components according to various embodiments may be executed sequentially, in parallel, iteratively, or heuristically, or at least some operations may be executed in a different order, omitted, or other operations added.

Claims

Claim 1 A method performed by a terminal in a wireless communication system, characterized by comprising the steps of: transmitting a first message to a profile server; and receiving a second message from the profile server.

Images