Method for establishing a bidirectional NAS signaling channel between a secure element cooperating with a terminal and a remote platform

Abstract

The present invention proposes a method for establishing a bidirectional NAS signaling channel between a secure element (10) cooperating with a terminal (12) and a remote platform (11) through a network exposure function (30) according to a request of the secure element (10) or a remote platform (11), the method comprising exchanging data containers (51) between the remote platform (11) and the secure element (10) through the network exposure function (30).

Description

[0001] The present invention relates to the field of telecommunications and more particularly to establishing a bidirectional channel between a secure element cooperating with a terminal and a remote platform.

[0002] The secure element is for example a UICC (Universal Integrated Circuit Card), an iUICC (Integrated UICC) or an eUICC (Embedded UICC).The terminal is typically a portable terminal such as a mobile phone, a smartphone or a PDA (Personal Digital Assistant).

[0003] The secure element is not necessarily physically connected to the terminal, but can communicate with the terminal through a short-range connection, where the secure element is offset and communicates with the terminal via a short-range channel (such as Bluetooth or Wi-Fi).

[0004] For example, establishing a bidirectional channel between the secure element and the remote platform is necessary to manage the secure element over the air (when the platform is an OTA platform) or to download a complete subscription in the secure element (in this case, the platform is an RPS platform as defined by GSMA).

[0005] Secure elements can be managed in two ways:

[0006] The first way consists in transferring data or programs from the OTA platform to the target secure element, for example during an update activity. This type of management is called "push" and is based on transmission in SMS mode. The problem is that this method is not suitable for new generation networks that do not support SMS (they are purely http), such as LTE networks.

[0007] The second way consists in querying the OTA platform, for example periodically or when an event occurs, in order to know if an update is available. Such a query is initiated by the secure element and is called "polling" or "pulling" (the secure element checks if the platform has something to transfer to it). The query is implemented in http mode.

[0008] Figure 1 Represents the two over-the-air channels available today for data exchange between secure elements and remote servers (SMS and HTTP / S).

[0009] The figure shows:

[0010] - security element 10,

[0011] -Remote platform 11 (here is the OTA platform),

[0012] - A terminal 12 (User Equipment or UE) with which the secure element 10 cooperates.

[0013] In any case, the terminal 12 communicates with the server 11 via the base station 13 (gNodeB of the 5G network 14 ).

[0014] The 5G core network 14 includes:

[0015] - AMF (Access and Mobility Management Function) 15, whose function is to handle the mobility of UE 12. Its main tasks include: registration management, connection management, reachability management, mobility management and various functions related to security and access management and authorization;

[0016] - SMSF (SMS Function) 16, whose function is to handle SMS sent by or to be sent to the UE 12;

[0017] - UPF (User Plane Function) 17, which plays a role similar to that played by the Serving / Packet Gateway in 4G LTE systems. The UPF supports features and capabilities that facilitate user plane operations. Examples include: packet routing and forwarding, interconnection with data networks, policy enforcement, and data buffering.

[0018] The 5G Core Network 14 communicates via the Internet with the OTA Platform 11. On this side we have the Internet SMSC 18.

[0019] The first over-the-air channel available today for data exchange between the secure element 10 and the server 11 is referenced 20. It is a bidirectional SMS channel (push mode) involving the AMF 15, SMSF 16 and SMSC 18. SMS is bidirectional, but has a very low bandwidth.

[0020] The second currently available air channel is marked as 21. It is an http / s channel involving the Internet and (on the 5G core network 14 side) UPF 17. The http / s channel has good bandwidth, but the client server is one-way: always the UE 12 should open the channel, driving the need to have push SMS or non-optimized polling mechanisms.

[0021] The proposed method provides a third bidirectional communication channel with sufficient bandwidth between the secure element 10 and the remote server 11. This channel can be used upon request of the secure element 10 or the remote platform 11, for example for downloading a list of preferred PLMNs for roaming purposes (SoR - Steering of Roaming). In particular, this channel can be used for management use cases of all remote secure elements.

[0022] In this regard, the present invention proposes a method for establishing a bidirectional NAS (Non-Access Stratum) signaling channel between a secure element cooperating with a terminal and a remote platform through NEF (Network Exposure Function) according to a request of the secure element or the remote platform, the method comprising exchanging data containers between the remote platform and the secure element through NEF.

[0023] In a first embodiment, the remote platform is an OTA platform.

[0024] In a second embodiment, the remote platform is an RSP platform as defined by the GSMA.

[0025] Preferably, the container is exchanged between the secure element and the terminal via the BIP.

[0026] In another embodiment, the container is exchanged between the secure element and the terminal via a file written in the secure element.

[0027] The present invention will be better understood by reading the following description of the accompanying drawings, which show:

[0028] - Figure 1 are two over-the-air channels available today for data exchange between secure elements and remote servers;

[0029] - Figure 2 is a third bidirectional communication channel between the secure element according to the invention and the remote server;

[0030] - Figure 3 and Figure 4 These are two different ways of exchanging data between a secure element and a user's terminal.

[0031] Figure 1 The description has been made with respect to the prior art.

[0032] Figure 2 A third bidirectional communication channel between the secure element and the remote server according to the invention is represented.

[0033] In this figure, a bidirectional communication channel 50 is established between the secure element 10 and the remote server 11 through 5G network signaling.

[0034] T8 is an interface / reference point for exposing framework services as a RESTful API for M2M applications between the NEF 30 (Network Exposure Function) and the server 11.

[0035] The signaling channel 50 is a NAS (Non Access Stratum) channel that can be used upon request of the secure element 10 or the remote platform 11 .

[0036] NAS is a functional layer in the UMTS and LTE wireless telecommunications protocol stack between the core network and user equipment. [1]This layer is used to manage the establishment of communication sessions and to maintain continuous communication with user equipment when the user equipment moves. NAS is defined in contrast to the access layer, which is responsible for carrying information through the wireless part of the network. A further description of NAS is that it is a protocol for messages transmitted between user equipment (also known as mobile devices) and core nodes (such as mobile switching centers, service GPRS support nodes, or mobility management entities), which are transmitted transparently over the radio network. Examples of NAS messages include update or attachment messages, authentication messages, service requests, etc. Once the user equipment (UE) establishes a radio connection, the UE uses the radio connection to communicate with the core node to coordinate services. The difference is that the access layer is explicitly used for conversations between mobile equipment and the radio network, and NAS is used for conversations between mobile equipment and core network nodes. For LTE, the technical standard for NAS is 3GPP TS 24.301.

[0037] On this channel, containers 51 are exchanged between the remote platform 11 and the secure element 10 through the NEF 30 constituting the interface between the 5G network 14 and the Internet 19. This means that the container 51 can be sent by the remote server 11 or by the secure element 10.

[0038] These containers are dedicated to the exchanges between the secure element 10 and the server 11 .

[0039] The present invention includes a generic "UICC container" which should be attached to any downlink and uplink signaling message, and a local way to exchange the UICC container between the SIM and the UE. On the core network side, the present invention also makes use of a remote server / UDM connection.

[0040] Preferably, the downlink container (sent from the remote server 11 to the secure element 10) includes a list of PLMNs that the secure element 10 should use. This allows the remote server 11 to have control over the behavior of the secure element 10 when roaming. But the container may contain any type of message, instruction, applet, ... to be sent to the secure element 10. For uplink (messages sent by the secure element 10 to the server 11), the same comments apply.

[0041] The different packets may be identified by a default defined IARI (IMS Application Reference Identifier) ​​corresponding to messages that are not IMS messages between the UE 12 and the secure element 10. This IARI is used only between the secure element 10 and the UE 12.

[0042] In a first embodiment, the remote platform is an OTA platform.

[0043] In a second embodiment, the remote platform is an RSP platform as defined by the GSMA.

[0044] At the exchange level between the secure element 10 and the UE 12, containers may be exchanged via the BIP.

[0045] The data exchange Figure 3 Indicated in.

[0046] At step 100 , an envelope (ENVELOPE) with IARI=“UICC Access to NAS” message (Event Download: Incoming IMS Data) is sent from the UE 12 to the SE 10 .

[0047] At step 101, the SE 10 replies with a message with the "Open Channel (Open Channel for IMS, IARI="UICC Access to NAS", Buffer Size)" message.

[0048] Then, at step 102, the UE 12 responds with "TerminalResponse(Channel_Id) Come reply.

[0049] At step 103, the UE 12 replies to the response with "Envelope (Event Download: Data Available)".

[0050] Then, at step 104 , the SE 10 sends a “Receive Data (Open Channel for IMS, IARI=“UICC Access to NAS”, Buffer Size)” message to the UE 12 .

[0051] The protocol ends with steps 105 and 106, in which the SE 10 sends a "Close Channel (Channel_Id)" message to the UE 12. request, and UE 12 uses Terminal Response (OK)" message.

[0052] In another embodiment, the container is exchanged between the secure element and the terminal via a file written in the secure element.

[0053] This is Figure 4 Indicated in.

[0054] In a first step 110, the SE 10 sends an "Open Channel (Open Channel for IMS, IARI = "UICC Access to NAS", Buffer Size)" message to the terminal UE 12. This one is answered at step 111 with a "Terminal Response (Channel_Id)" message. Then, at step 112, the SE 10 sends an invitation message "Send Data (Storage, Data)" to the UE 12.

[0055] At step 113, UE 12 responds with "Terminal Response (Normal) to answer, and the process is from SE 10 to UE 12 Send data(immediately, data)" message to end.

[0056] The present invention is particularly interested in ODC (On-Demand Connectivity, where the end user can choose his MNO with embedded secure elements (eUICC or iUICC)) and OTA platforms that manage these embedded secure elements.

[0057] Therefore, as mentioned before, a Steering of Roaming (SoR) can be introduced, where a "SOR transparent container" is attached to two downlink 5G signaling NAS (Non Access Stratum) messages: Registration Accept and DL NAS. When receiving such a container, the UE shall transfer it to the Secure Element using an SMS PP Data Download Envelope. The references are: .

[0058] On the core network side, the remote server has a connection with 5G Unified Data Management (UDM, which is the HSS evolution) to provide SoR transparent container content.

[0059] It must also be mentioned that The 13th edition, entitled "Digitalcellular telecommunications system (Phase 2+) (GSM); Universal Mobiletelecommunications System (UMTS); LTE; Universal Subscriber Identity Module (USIM), Application Toolkit (USAT)", was published, which describes how the UICC accesses the IMS network in its Annex R. The present invention simply proposes to modify this Annex R in order to transfer data between the UE and the secure element.

[0060] It involves replacing incoming or outgoing IMS signaling messages with any DL NAS or UL NAS messages on the Appendix R flow chart.

[0061] To make such a replacement, we can for example define a specific IARI - namely: “UICC Access to NAS” - so that both UE and SIM know that incoming and outgoing messages are not carried over SIP for the SIM network but over 5G NAS.

[0062] Through a dedicated terminal profile value, the UE indicates to the SIM that it supports the UICC container feature on NAS.

Claims

1. A method for establishing a bidirectional NAS signaling channel between a security element (10) cooperating with a terminal (12) and the remote platform (11) through a network exposure function (30) according to a request of the security element (10) or a remote platform (11) for managing the security element (10) using a data container (51), the method comprising exchanging the data container (51) between the remote platform (11) and the security element (10) through the network exposure function (30).

2. The method according to claim 1, wherein the remote platform (11) is an OTA platform.

3. The method according to claim 1, wherein the remote platform (11) is a RSP platform as defined by GSMA.

4. The method according to any one of claims 1 to 3, wherein the container (51) is exchanged between the secure element (10) and the terminal (12) via a BIP.

5. The method according to any one of claims 1 to 3, wherein the container (51) is exchanged between the secure element (10) and the terminal (12) via a file written in the secure element (10).

Images