SIM provisioning for mobile devices

Abstract

A device is provided, the device comprising a key request module and a key receiving module. The key request module is configured to transmit a key request to a provisioning server, and the key receiving module is configured to receive a device root key associated with the device from the provisioning server. The device also includes an authentication request transmission module, which is configured to transmit an authentication request including an international mobile subscriber identity (IMSI) and a device identifier identifying the device to a first home subscriber server (HSS). The device also includes an authentication under key agreement (AKA) module, which is configured to perform an AKA procedure using a device root key. The key request module, the key receiving module, the authentication request transmission module, and the AKA module thereby authenticate the device for provisioning of a subscriber identity module (SIM) of the device.

Description

[0001] This application is a divisional application of an application with application date: 2015 / 10 / 9, application number 201580071437.7 (international application number PCT / CN2015 / 091552), and name “SIM provisioning for mobile devices”. background

[0002] When a mobile device with an embedded subscriber identity module (SIM) is purchased by a consumer, it must first be provisioned using a cellular network before it can provide full functionality. During the first provisioning, the device communicates with the network operator over the cellular network in order to authenticate the device. The authentication procedure uses the International Mobile Subscriber Identity (IMSI) associated with the device, which the operator stores in the Home Location Register (HLR).

[0003] As the number of mobile consumer devices increases, the burden on operators to store device-specific IMSIs and other provisioning data for one-time provisioning over the cellular network also increases. This burden is particularly onerous because operators are required to store this data for several years after the device is activated. Thus, there is an ever-increasing cost associated with each IMSI for the mobile operator.

[0004] This scenario is also burdensome for OEMs because if an embedded Subscriber Identity Module (SIM) device is pre-provisioned in the factory, the manufacturer must request a device-specific IMSI from the operator.

[0005] A solution is required that maintains a good end-user experience including convenient access to a cellular network upon first device use. The current Group Mobile Association (GSMA) specification for provisioning an embedded SIM uses a provisioning profile, also referred to as a non-operational profile. The current proposal for managing the increasing number of consumer devices is to use non-cellular provisioning, which requires non-cellular network availability at the time of provisioning. Non-cellular network availability may not always be accessible, and some low-cost devices lack non-cellular network functionality.

[0006] The embodiments described below are not limited to implementations that address any or all of the shortcomings of known SIM provisioning techniques.

[0007] Overview

[0008] A brief summary of the invention is presented below to provide the reader with a basic understanding. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Its sole purpose is to present selected concepts disclosed herein in a simplified form as a prelude to a more detailed description presented later.

[0009] A device is provided, the device comprising a key request module and a key receiving module. The key request module is configured to transmit a key request to a provisioning server, and the key receiving module is configured to receive a device root key associated with the device from the provisioning server. The device also includes an authentication request transmission module, which is configured to transmit an authentication request including an international mobile subscriber identity (IMSI) and a device identifier identifying the device to a first home subscriber server (HSS). The device also includes an authentication under key agreement (AKA) module, which is configured to perform an AKA procedure using a device root key. The key request module, the key receiving module, the authentication request transmission module, and the AKA module thereby authenticate the device for provisioning of a subscriber identity module (SIM) of the device.

[0010] A method of performing SIM provisioning at a device is also provided. The method includes transmitting a key request to a provisioning server; receiving a device root key associated with the device from the provisioning server; transmitting an authentication request including an IMSI and a device identifier identifying the device to a first HSS; and performing an AKA procedure using the device root key.

[0011] Also provided is a tangible device-readable medium having device-executable instructions which, when executed by a computing system, instruct the computing system to perform a method comprising: transmitting a key request to a provisioning server; receiving a device root key associated with the device from the provisioning server; transmitting an authentication request including an IMSI and a device identifier identifying the device to a first HSS; and performing an AKA procedure using the device root key.

[0012] Many of the attendant features may be readily appreciated and better understood by referring to the following detailed description taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The present invention will be better understood by reading the following detailed description in accordance with the accompanying drawings, in which:

[0014] Figure 1 is a schematic diagram illustrating elements of a communication network for provisioning an embedded SIM of a device;

[0015] Figure 2 It is explained in Figure 1 A signalling diagram for a series of communications between elements of a communications network for provisioning an embedded SIM of a device;

[0016] Figure 3 It is explained in Figure 1 A signalling diagram for another series of communications between elements of a communications network for provisioning an embedded SIM of a device;

[0017] Figure 4 is a series of state diagrams of a device at different stages of provisioning the device's embedded SIM;

[0018] Figure 5 is another series of state diagrams of a mobile device at different stages of provisioning the device's embedded SIM;

[0019] Figure 6 is a flow chart of a method performed at a device for provisioning an embedded SIM at the device;

[0020] Figure 7 is a flow chart of a method performed at a first HSS for provisioning an embedded SIM at a device;

[0021] Figure 8 is a flow chart of a method performed at a second HSS for provisioning an embedded SIM at a device;

[0022] Fig. 9 is a flow chart of a method performed at a provisioning server for provisioning an embedded SIM at a device; and

[0023] Fig.10 is a schematic diagram illustrating an exemplary computing-based device in which various embodiments of the device, the first HSS, the second HSS, and the provisioning server may be implemented.

[0024] The same reference numbers are used throughout the various drawings to refer to the same parts. Detailed Description

[0025] The detailed description provided below in conjunction with the accompanying drawings is intended to be a description of an example of the present invention and is not intended to represent the only form in which an example of the present invention can be constructed or used. This description sets forth the functions of the example of the present invention, and the sequence of steps for constructing and operating the example of the present invention. However, the same or equivalent functions and sequences can be implemented by different examples.

[0026] Although examples of the present invention are described and shown herein as being implemented in an example telecommunication system, the described example telecommunication system is provided by way of example only and not limitation. Those skilled in the art will appreciate that examples of the present invention are suitable for application in a variety of different types of telecommunication systems.

[0027] Traditionally, a unique IMSI is required to provision each embedded SIM device. In this approach, the device is provisioned through an authentication procedure that uses the subscriber root key associated with the embedded SIM. Since the SIM is embedded, the subscriber root key is uniquely associated with the device and it can be established that the device can be trusted.

[0028] In an example of the present invention, a shared IMSI is used to provision a cluster of embedded SIM devices and derive the keys required to authenticate the devices in the network attach procedure. By using a shared IMSI for a cluster of devices, pre-provisioning of embedded SIM devices in the factory is straightforward because the same provisioning profile can be used for the cluster of devices. Cellular remote provisioning is enabled without the costs associated with the current provisioning profile solutions defined in the GSMA Embedded SIM (ESIM) specification.

[0029] Since the shared IMSI is used for different devices, the subscriber root key associated with the embedded SIM is no longer uniquely associated with the device. As a result, the subscriber root key cannot be used in the authentication procedure to determine that the device can be trusted.

[0030] Examples of the present invention use a different approach. In examples of the present invention, devices with a shared IMSI can be provisioned using a device-specific key derived for an authentication procedure. This approach exploits the observation that it is not necessary to have two unique identifiers (such as a unique IMSI and a unique device identifier) ​​to provision a device with an embedded SIM.

[0031] Figure 1 A communication network 100 is shown in which various examples may be implemented. The communication network 100 includes a first HSS 102, a second HSS 104, and a cellular network 106 of a mobile network operator. Each of the first HSS 102 and the second HSS 104 includes an HSS defined in the 3GPP standard. The first HSS 102 includes a key derivation module 108, a key transmission module 110, an authentication request receiving module 112, and an authentication request transmission module 114, and is connected to the cellular network 106. The second HSS 104 includes a key receiving module 116, an authentication request receiving module 118, and an AKA module 120.

[0032] The communication network 100 also includes a device 122 with cellular connectivity. The device 122 is connected to the cellular network 106 and to a provisioning server 124 for remote embedded SIM provisioning via local connectivity 126. The device 122 includes a key request module 128, a key receiving module 130, an authentication request receiving module 132, and an AKA module 134. The provisioning server 124 includes a key derivation module 136, a key request receiving module 138, and a key delivery module 140. The provisioning server 124 is also connected to the cellular network 106. In various examples, the provisioning server 124 includes a subscription manager data provisioning server (SM-DP server).

[0033] The provisioning server 124 , the device 122 , the first HSS 102 , and the second HSS 104 are configured to execute procedures for provisioning a SIM at the device 122 .

[0034] Figure 2 A signaling procedure 200 is shown for provisioning a SIM at the device 122 in various examples, implemented in various examples by the device 122, the provisioning server 124, the first HSS 102, and the second HSS 104. In action 202, the provisioning server 124 derives a device root key KD uniquely associated with the device 122. In action 204, the first HSS 102 also derives the device root key KD, and in action 206, transmits it to the second HSS 104. In various examples, the provisioning server 124 and the first HSS 102 derive the device root key using a device identifier and a subscriber root key associated with the IMSI of the device 122.

[0035] At act 208, device 122 transmits the key request to the provisioning server

[0036] 124, at act 210, provisioning server 124 receives the key request. In response to receiving the key request at act 210, provisioning server 124 transmits the device root key to device 122 at step 212. Device 122 receives the device root key at step 214 and subsequently uses the device root key in the AKA procedure. In various examples, device 122 transmits a request for a non-operational profile (NOP request) to provisioning server 124, and receives a non-operational profile for the device, device NOP, from provisioning server 124. In such examples, provisioning server 124 receives the NOP request from device 122 and transmits the NOP to device 122.

[0037] The AKA procedure will be performed between the device 122 and the second HSS 104. Thus, the second HSS 104 receives the device root key from the first HSS 102 in action 216 and thereafter uses the device root key in the AKA procedure. In various examples, the second HSS 104 stores the device root key in a device root key store indexed by the corresponding device identifier.

[0038] To initiate the AKA procedure, the device 122 transmits an authentication request to the first HSS 102 at step 218. The authentication request includes the IMSI and a device identifier identifying the device. In various examples, the device identifier includes an International Mobile Equipment Identity (IMEI) of the device 122.

[0039] The first HSS 102 receives the authentication request at act 220 and transmits the authentication request to the second HSS at act 222. In various examples, the first HSS 102 identifies that the authentication request includes a device identifier and forwards the authentication request to the second HSS 104 in response to identifying that the authentication request includes the device identifier.

[0040] In action 224, the second HSS 104 receives the authentication request and then prepares for the AKA procedure. In action 226, the device 122 and the second HSS 104 perform the AKA procedure using the device root key. The AKA procedure may be suitably accomplished as defined in the 3GPP TS 33.401 or TS 33.102 telecommunications standards.

[0041] In various examples, device 122 receives an operational profile of the device, device OP, after successfully performing the AKA procedure.

[0042] Figure 3 A signaling procedure 300 for provisioning a SIM at the device 122 is shown, implemented in various examples by the device 122, the provisioning server 124, the first HSS 102, and the second HSS 104. In these examples, the provisioning server comprises an SM-DP server.

[0043] In action 302, the first HSS 102 transmits the subscriber root key KI and the IMSI to the SM-DP server. In action 304, the SM-DP server receives the subscriber root key and uses it to derive the device root key KD. In action 306, the SM-DP server derives the device root key using the subscriber root key and the IMEI uniquely associated with the device 122. The device root key is derived by applying a key derivation function (KDF) to the subscriber root key and the IMEI. KDF may refer to Annex A of 3GPP TS33.401.

[0044] In action 308, the SM-DP server transmits the IMEI to the first HSS 102. In action 310, the first HSS 102 receives the IMEI and is then also able to derive the device root key. In the same manner as the SM-DP, the first HSS 102 derives the device root key by applying the KDF to the subscriber root key and the IMEI in action 312. Since the IMEI is uniquely associated with the device 122, the device root key is also uniquely associated with the device 122. In step 314, the first HSS 102 transmits the device root key and the IMEI to the second HSS 104, which stores the device root key in a storage of device root keys in action 316, where the device root key is indexed by the corresponding IMEI uniquely associated with the same device. This completes the preliminary phase of the signaling procedure 300.

[0045] In action 318, device 122 transmits the key request, NOP request, and IMEI to the SM-DP server. The SM-DP server receives these in step 320 and responds in step 322 by transmitting the device root key, NOP, and IMSI to device 122. In action 324, device 122 receives the device root key, NOP, and IMSI. The IMSI is now available at device 122 to request authentication, and the device root key is available at device 122 to perform AKA procedures. Communications between the device and the SM-DP of actions 318, 320, 322, and 324 are performed using Subscriber Manager Secure Routing (SM-SR).

[0046] At act 328, device 122 transmits an authentication request including the IMSI and IMEI to first HSS 102. At act 330, first HSS 102 receives the authentication request. First HSS 102 recognizes that the authentication request includes the IMEI and in response forwards the authentication request to second HSS 104 at step 332.

[0047] The second HSS 104 receives the authentication request in action 334 and thereafter initiates an AKA procedure between the device 122 and the second HSS 104. Since the authentication request includes the IMEI, the second HSS 104 is able to match the IMEI uniquely associated with the device with the device root key that is also uniquely associated with the device 122 and stored in the device root key store. Thus, the second HSS 104 is able to retrieve the device root key uniquely associated with the device 122 for the purpose of performing the AKA procedure with the device 122.

[0048] At step 336, device 122 and second HSS 104 perform an AKA procedure to authenticate device 122. When the AKA procedure has been successfully completed, second HSS 104 then derives another key KASME at action 338 and transmits it to a network node such as a mobility management entity (MME) of a mobile network operator for further action.

[0049] Figure 4 A series of state diagrams of a device 400 are shown in different states 402, 404 and 406 during SIM provisioning of the device 400 according to various examples of the invention. After being manufactured, the device 400 is in state 402 with a SIM chip embedded but no profile installed.

[0050] In order for the device 400 to change from state 402 to state 404, the device 400 receives from the SM-DP server a non-operational profile (NOP) 410 including a shared IMSI 412 and a device root key KD 414 uniquely associated with the device 400. The device receives the NOP 410, the shared IMSI 412, and the device root key 414 through a subscription manager secure routing (SM-SR) using local connectivity, such as a universal serial bus (USB) connection or a wireless local area network (WLAN) or other suitable method of local connectivity. The NOP 410 is installed at the device 400, for example, in a factory or a retail store, and the customer receives the device in state 404. In state 404, the NOP 410 enables the device 400 to access limited services from a cellular network, such as a service for downloading a full operational profile.

[0051] In order for the device to change from state 404 to state 406, the device performs an AKA procedure using device root key 414 and uses the cellular network to download an operating profile (OP) 416. In state 406, device 400 is fully functional in the cellular network.

[0052] In other examples, the NOP 410 and the shared IMSI 412 are received before the device root key 414 is received, such as Figure 5 Before the device root key 414 is received, the device 400 is in state 500, where the NOP 410 and the shared IMSI 412 have been received by the device 400. In order for the device to change from state 500 to state 404, the device root key 414 is retrieved from the SM-DP server via the SM-SR to update the NOP 410.

[0053] Figure 6 Shown in a device such as Figure 1 Method 600 for SIM provisioning at a device 122). The method 600 is performed at the device and uses Figure 2 The device transmits a key request to a provisioning server at block 208 and receives a device root key associated with the device from the provisioning server at block 214. The device transmits an authentication request including an IMSI and a device identifier identifying the device to the first HSS at block 218. The device performs an AKA procedure using the device root key at block 226.

[0054] Figure 7 It is shown that in a first HSS (such as Figure 1 Method 700 for SIM provisioning at a first HSS 102). The method 700 is performed at the first HSS and uses Figure 2The signaling procedure 200 of FIG. 204. At block 206, the first HSS derives a device root key associated with the device and transmits the device root key to the second HSS. At block 220, the first HSS receives an authentication request from the device including an IMSI and a device identifier associated with the device. At block 222, the first HSS transmits the authentication request to the second HSS.

[0055] Figure 8 It is shown that in the second HSS (such as Figure 1 Method 800 for SIM provisioning at a second HSS 104). Method 800 is performed at the second HSS and uses Figure 2 The signaling procedure 200 of FIG. 216 . At block 216 , the second HSS receives a device root key associated with the device from the first HSS . At block 224 , the second HSS receives an authentication request including an IMSI and a device identifier associated with the device from the first HSS . At block 226 , the second HSS performs an AKA procedure using the device root key .

[0056] Fig. 9 shows that in the provisioning server (such as Figure 1 Method 900 for SIM provisioning at a provisioning server 124 of a device. Method 900 is performed at the provisioning server and uses Figure 2 Signaling procedure 200 of FIG. 202. At block 202, a provisioning server derives a device root key associated with a device. At block 210, a provisioning server receives a key request from the device and, at block 212, transmits the device root key to the device.

[0057] Fig.10 Illustrated are various components of an exemplary computing-based device 1000 that may be implemented as any form of computing and / or electronic device, and in which at least some components of various embodiments of the first HSS 102, the second HSS 104, the device 122, and the provisioning server 124 may be implemented.

[0058] The computing-based device 1000 includes one or more processors 1002, which may be microprocessors, controllers or any other suitable type of processor for processing computer-executable instructions to control the operation of the device so as to perform SIM provisioning as defined in the claims. Platform software including an operating system or any other suitable platform software may be provided at the computing-based device to enable execution of application software on the device.

[0059] Computer executable instructions may be provided using any computer-readable medium accessible by the computing-based device 1000. Computer-readable media may include, for example, computer storage media such as memory 1004 and communication media. Computer storage media such as memory 1004 include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage, cassettes, tapes, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information for access by a computing device. In contrast, communication media may embody computer-readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms. As defined herein, computer storage media do not include communication media. Therefore, computer storage media should not be interpreted as essentially propagating signals. Propagating signals may exist in computer storage media, but propagating signals themselves are not examples of computer storage media. Although computer storage media (memory 1004 ) is shown within computing-based device 1000 , it will be appreciated that the storage may be distributed or remotely located and accessed via a network or other communications link (eg, using communications interface 1006 ).

[0060] The device 1000 based on calculation also includes an input / output controller 1008, which is arranged to output display information to a display device, which can be separated or integrated from the device 1000 based on calculation. The display information can provide a graphical user interface. The input / output controller 1008 is also arranged to receive and process input from one or more devices, such as a user input device (e.g., a mouse, keyboard, camera, microphone, or other sensors). In some examples, the user input device can detect voice input, user gestures, or other user actions, and a natural user interface (NUI) can be provided. In one embodiment, if the display device is a touch-sensitive display device, it can also serve as a user input device. The input / output controller xxx can also output data to devices other than the display device, such as a locally connected printing device.

[0061] Any of the input / output controller 1008, the display device, and the user input device may include NUI technology that enables the user to interact with the computing-based device in a natural manner, free from the artificial constraints imposed by input devices such as mice, keyboards, remote controls, etc. Examples of NUI technology that may be provided include, but are not limited to, those that rely on speech and / or voice recognition, touch and / or stylus recognition (touch-sensitive displays), gesture recognition on and near the screen, air gestures, head and eye tracking, speech and voice, vision, touch, gestures, and machine intelligence. Other examples of NUI technology that may be used include intent and purpose understanding systems, motion gesture detection systems using depth cameras (such as stereo camera systems, infrared camera systems, rgb camera systems, and combinations of these), motion gesture detection using accelerometers / gyroscopes, facial recognition, 3D displays, head, eye, and gaze tracking, immersive augmented reality and virtual reality systems, and technologies for sensing brain activity using electric field sensing electrodes (EEG and related methods).

[0062] In various examples of the present invention, a device is provided, including: a key request module configured to transmit a key request to a provisioning server; a key receiving module configured to receive a device root key associated with the device from the provisioning server; an authentication request transmission module configured to transmit an authentication request including an IMSI and a device identifier identifying the device to a first HSS; and an AKA module configured to perform an AKA procedure using the device root key, whereby the key request module, the key receiving module, the authentication request transmission module, and the AKA module authenticate the device for SIM provisioning of the device. The device may be configured to transmit a device identifier to the provisioning server; to transmit a NOP request to the provisioning server and to receive a device NOP from the provisioning server; to perform the AKA procedure by communicating with a second HSS; and / or to receive a device OP after performing the AKA procedure. The device root key may be derived using the device identifier and a subscriber root key associated with the IMSI. The device identifier may include an IMEI. The provisioning server may include an SM-DP server.

[0063] In various examples of the present invention, a method for SIM provisioning at a device is provided, comprising: transmitting a key request to a provisioning server; receiving a device root key associated with the device from the provisioning server; transmitting an authentication request including an IMSI and a device identifier identifying the device to a first HSS; and performing an AKA procedure using the device root key. The method may include: transmitting a device identifier to the provisioning server; and / or transmitting a NOP request to the provisioning server and receiving a device NOP from the provisioning server. The AKA procedure may be performed by communicating with a second HSS. The method may include receiving a device OP after performing the AKA procedure. The device root key may be derived using the device identifier and a subscriber root key associated with the IMSI. The device identifier may include an IMEI. The provisioning server may include an SM-DP server.

[0064] In various examples of the present invention, a tangible device-readable medium having device-executable instructions is provided, which, when executed by a computing system, instructs the computing system to perform a method, the method comprising: transmitting a key request to a provisioning server; receiving a device root key associated with the device from the provisioning server; transmitting an authentication request including an IMSI and a device identifier identifying the device to a first HSS; and performing an AKA procedure using the device root key. The method may further include transmitting the device identifier to the provisioning server. The AKA procedure may be performed by communicating with a second HSS. The device root key may be derived using the device identifier and a subscriber root key associated with the IMSI.

[0065] In various examples of the present invention, a first HSS is provided, comprising: a key derivation module configured to derive a device root key associated with a device; a key delivery module configured to deliver the device root key to a second HSS; an authentication request receiving module configured to receive an authentication request including an IMSI and a device identifier associated with the device from the device; and an authentication request delivery module configured to deliver the authentication request to the second HSS, whereby the key derivation module, the key delivery module, the authentication request receiving module, and the authentication request delivery module authenticate the device for SIM provisioning of the device. The first HSS may be configured to derive the device root key from the device identifier and a subscriber root key associated with the IMSI; receive the device identifier from a provisioning server; receive the device identifier as part of a batch device identifier; and identify that the authentication request includes the device identifier, and deliver the authentication request to the second HSS in response to identifying that the authentication request includes the device identifier. The device identifier may include an IMEI.

[0066] In various examples of the present invention, a second HSS is provided, comprising: a key receiving module configured to receive a device root key associated with a device from a first HSS; an authentication request receiving module configured to receive an authentication request including an IMSI and a device identifier associated with the device from the first HSS; and an AKA module configured to perform an AKA procedure using the device root key, whereby the key receiving module, the authentication request receiving module, and the AKA module authenticate the device for SIM provisioning of the device. The second HSS may be configured to store the device root key in a device root key storage; index each device root key in the storage according to the corresponding device identifier of each device root key; and perform the AKA procedure by communicating with the device. The device root key may be derived using the device identifier and a subscriber root key associated with the IMSI. The device identifier may include an IMEI.

[0067] In various examples of the present invention, a provisioning server is provided, comprising: a key derivation module configured to derive a device root key associated with a device; a key request receiving module configured to receive a key request from the device; and a key delivery module configured to deliver the device root key to the device, whereby the key derivation module, the key request receiving module, and the key delivery module authenticate the device for SIM provisioning of the device. The provisioning server may include an SM-DP server; may be configured to derive the device root key using a key derivation function; may be configured to deliver a device identifier to an HSS as part of a batch device identifier; and may be configured to receive a NOP request from the device and deliver a device NOP to the device. The key derivation function may use the IMSI and the device identifier as input parameters.

[0068] In various examples of the present invention, a method of SIM provisioning at a first HSS is provided, comprising: deriving a device root key associated with a device; transmitting the device root key to a second HSS; receiving an authentication request from the device including an IMSI and a device identifier associated with the device; and transmitting the authentication request to the second HSS. The method may include deriving the device root key from the device identifier and a subscriber root key associated with the IMSI; may include receiving the device identifier from a provisioning server; may include receiving the device identifier as part of a batch device identifier; and may include identifying that the authentication request includes the device identifier, and wherein in response to identifying that the authentication request includes the device identifier, transmitting the authentication request to the second HSS. The device identifier may include an IMEI.

[0069] In various examples of the present invention, a method for SIM provisioning at a second HSS is provided, comprising: receiving a device root key associated with a device from a first HSS; receiving an authentication request including an IMSI and a device identifier associated with the device from the first HSS; and performing an AKA procedure using the device root key. The method may include storing the device root key in a device root key storage; and may include indexing each device root key in the storage according to its corresponding device identifier. The AKA procedure may be performed by communicating with the device. The device root key may be derived using the device identifier and a subscriber root key associated with the IMSI. The device identifier may include an IMEI.

[0070] In various examples of the present invention, a method of SIM provisioning at a provisioning server is provided, comprising: deriving a device root key associated with a device; receiving a key request from the device; and transmitting the device root key to the device. The provisioning server may include an SM-DP server. Exporting the device root key may include using a key derivation function. The method may include transmitting a device identifier to an HSS as part of a batch device identifier; and may include receiving a NOP request from the device and transmitting the device NOP to the device. The key derivation function may use the IMSI and the device identifier as input parameters.

[0071] In other examples, one or more tangible device-readable media having device-executable instructions are provided that, when executed by a computing system, instruct the computing system to perform any of the above methods.

[0072] As used herein, the term 'computer' or 'computing-based device' refers to any device with processing capabilities so that instructions can be executed. Those skilled in the art will appreciate that such processing capabilities are incorporated into many different devices, and thus the terms 'computer' and 'computing-based device' each include personal computers, servers, mobile phones (including smart phones), tablet computers, set-top boxes, media players, game consoles, personal digital assistants, and many other devices.

[0073] The methods described herein may be performed by software in a machine-readable form on a tangible storage medium, such as in the form of a computer program including computer program code means adapted to perform all the steps of any method described herein when the program is run on a computer and wherein the computer program may be included on a computer-readable medium. Examples of tangible storage media include computer storage devices, which include computer-readable media such as disks, thumb drives, memories, etc. but not propagated signals. A propagated signal may be present in a tangible storage medium, but a propagated signal itself is not an example of a tangible storage medium. The software may be adapted to be executed on a parallel processor or a serial processor so that the method steps may be performed in any suitable order or simultaneously.

[0074] This recognizes that software can be a valuable, individually exchangeable commodity. It is intended to include software that runs on or controls "dumb" or standard hardware to achieve desired functions. It is also intended to include software that "describes" or defines the configuration of hardware to achieve desired functions, such as HDL (Hardware Description Language) software used to design silicon chips, or software used to configure general-purpose programmable chips.

[0075] Those skilled in the art will recognize that storage devices for storing program instructions can be distributed on a network. For example, a remote computer can store examples of processes described as software. A local or terminal computer can access the remote computer and download part or all of the software to run the program. Alternatively, the local computer can download fragments of the software as needed, or execute some software instructions on a local terminal and execute other software instructions on a remote computer (or computer network). Those skilled in the art will also recognize that all or part of the software instructions can be implemented by dedicated circuits such as DSPs, programmable logic arrays, etc., by utilizing conventional techniques known to those skilled in the art.

[0076] Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. For example, but not limitation, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and graphics processing units (GPUs).

[0077] It will be apparent to one skilled in the art that any range or device value given herein may be expanded or altered without losing the effect sought.

[0078] Although the subject matter of the present invention has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0079] It is understood that the advantages described above may relate to one embodiment or may relate to multiple embodiments. The embodiments are not limited to those embodiments that solve any or all of the stated problems or have any or all of the stated advantages. It is further understood that reference to "a" item refers to one or more of those items.

[0080] The steps of the methods described herein may be implemented in any suitable order, or simultaneously, where appropriate. In addition, individual blocks may be deleted from any one method without departing from the spirit and scope of the subject matter described herein. Aspects of any of the examples described above may be combined with aspects of any of the other examples described to form further examples without losing the effects sought.

[0081] The term 'comprising' as used herein is intended to include the identified method blocks or elements, but such blocks or elements do not comprise an exclusive list and the method or apparatus may contain additional blocks or elements.

[0082] It will be appreciated that the above description is given as an example only and that various modifications may be made by those skilled in the art. The above description, examples and data provide a comprehensive description of the structure and use of various exemplary embodiments. Although the above describes various embodiments with a certain degree of detail or with reference to one or more individual embodiments, many changes may be made to the disclosed embodiments by those skilled in the art without departing from the spirit or scope of this specification.

Claims

1. A method for subscriber identity module (SIM) provisioning at a mobile device, the method comprising: obtaining a first device profile, wherein the first device profile corresponds to a shared International Mobile Subscriber Identity IMSI and allows restricted cellular communications for the mobile device, wherein the IMSI is shared among a device cluster of multiple mobile devices having an embedded SIM; sending a device identifier of the mobile device to a server via the restricted cellular communication; as well as In response to the sending, a second device profile is obtained via the restricted cellular communication, wherein the second device profile allows additional cellular communication for the mobile device as compared to the first device profile.

2. The method according to claim 1, characterized in that The IMSI is used to provision multiple mobile devices with embedded SIMs.

3. The method according to claim 1, characterized in that The second device profile corresponds to the shared IMSI and the device identifier.

4. The method according to claim 1, characterized in that The restricted cellular communication allows access to restricted services from a cellular network to download the second device profile, wherein the first device profile includes a non-operational profile NOP and the second device profile includes an operational profile OP.

5. The method according to claim 4, characterized in that The first device profile is received from a local connection, the local connection comprising a non-cellular connection.

6. The method according to claim 5, characterized in that Also included is updating the NOP by obtaining a device root key uniquely associated with the mobile device, the device root key being derived using the device identifier and a subscriber root key with the shared IMSI, the device root key allowing the second device profile to be obtained.

7. The method according to claim 6, characterized in that The device root key is indexed by an IMSI associated with the device identifier, and the device identifier comprises an International Mobile Equipment Identity (IMEI).

8. A mobile device, comprising: Embedded Subscriber Identity Module SIM; as well as a processor configured to: obtain a first device profile, wherein the first device profile corresponds to a shared International Mobile Subscriber Identity IMSI and allows restricted cellular communication of the mobile device, wherein the IMSI is shared among a device group of multiple mobile devices with an embedded SIM; send a device identifier of the mobile device to a server via the restricted cellular communication; And in response to the sending, obtaining a second device profile via the restricted cellular communication, wherein the second device profile allows additional cellular communication for the mobile device as compared to the first device profile.

9. The mobile device according to claim 8, wherein: The IMSI is used to provision multiple mobile devices with embedded SIMs.

10. The mobile device according to claim 8, wherein: The second device profile corresponds to the shared IMSI and the device identifier.

11. The mobile device according to claim 8, wherein: The restricted cellular communication allows access to restricted services from a cellular network to download the second device profile, wherein the first device profile includes a non-operational profile NOP and the second device profile includes an operational profile OP.

12. The mobile device according to claim 11, wherein: The first device profile is received from a local connection, the local connection comprising a non-cellular connection.

13. The mobile device according to claim 12, wherein: The processor is further configured to update the NOP by obtaining a device root key uniquely associated with the mobile device, the device root key being obtained using the device identifier and a subscriber root key with the shared IMSI, the device root key allowing the second device profile to be obtained.

14. The mobile device according to claim 13, wherein: The device root key is indexed by an IMSI associated with the device identifier, and the device identifier comprises an International Mobile Equipment Identity (IMEI).

15. A computer storage medium having computer executable instructions, which when executed by a processor of a mobile device causes the processor to perform at least the following operations: obtaining a first device profile, wherein the first device profile corresponds to a shared International Mobile Subscriber Identity IMSI and allows restricted cellular communications for the mobile device, wherein the IMSI is shared among a device cluster of multiple mobile devices having an embedded SIM; sending a device identifier of the mobile device to a server via the restricted cellular communication; as well as In response to the sending, a second device profile is obtained via the restricted cellular communication, wherein the second device profile allows additional cellular communication for the mobile device as compared to the first device profile.

16. The computer storage medium of claim 15, wherein: The IMSI is used to provision multiple mobile devices with embedded SIMs.

17. The computer storage medium of claim 15, wherein: The second device profile corresponds to the shared IMSI and the device identifier.

18. The computer storage medium of claim 15, wherein: The restricted cellular communication allows access to restricted services from a cellular network to download the second device profile, wherein the first device profile includes a non-operational profile NOP and the second device profile includes an operational profile OP.

19. The computer storage medium of claim 18, wherein: The first device profile is received from a local connection, the local connection comprising a non-cellular connection.

20. The computer storage medium of claim 18, wherein: The instructions, when executed, further cause the processor to at least: update the NOP by obtaining a device root key uniquely associated with the mobile device, the device root key being obtained using the device identifier and a subscriber root key shared with the IMSI, the device root key allowing the second device profile to be obtained, the device root key being indexed by the IMSI associated with the device identifier, and the device identifier comprising an international mobile equipment identity IMEI.

Images