Encrypted streaming of SIM data between regional and edge networks

Abstract

A plurality of computing devices are configured to communicate over a mobile communications network operated by an edge computing network. An edge computing network is associated with a customer of a computing service provider. An edge computing network includes computing and storage devices configured to extend computing resources of a computing service provider to customers of the computing service provider. A selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network is received. SIM data corresponding to a number of SIM profiles is received. The SIM data is encrypted and received over an encryption channel.

Description

Background Art

[0001] The service provider of the communication device typically requires the communication device to have appropriate credentials to access and enable the use of services. These credentials securely and uniquely identify the subscription or account of the service provider and enable the communication device to access and use the services associated with the subscription. When the communication device is a mobile communication device, the service provider may be referred to as a mobile network operator (MNO), and the services may include, for example, mobile voice calls, text messaging, or Internet data services.

[0002] The credentials may reside in a secure container called a Universal Integrated Circuit Card (UICC) or "SIM card". The UICC may support remote configuration of credentials, in which case it may be referred to as an eUICC or eSIM. The credentials may be configured to the eUICC / eSIM when it is manufactured, or may be remotely configured to the eUICC / eSIM when the eUICC / eSIM resides in the communication device. However, large-scale deployment of such devices and configuring these devices may be difficult and complex to implement.

[0003] It is with these considerations and others that the disclosure presented herein is made. Summary of the invention

[0004] Communication devices typically require credentials that securely and uniquely identify a subscription or account to enable the communication device to access and use services on a network. Such communication devices may include mobile phones, IoT devices, PCs, or any other device with a secure container for storing credentials, which may be generally referred to as a Subscriber Identity Module (SIM). Such devices typically do not have SIM data when shipped from the factory and must be provided with valid SIM data to access the appropriate network.

[0005] However, large-scale deployment of such devices may be difficult and complex to implement. For example, an enterprise may wish to deploy a private network with a large number of enterprise-provided communication devices at an enterprise site that communicate over a 5G network. In order to provide the desired connectivity, each device must be configured with a SIM profile using a provider-specific process of the 5G service provider in order to access the 5G network. The SIM data of the SIM profile must be securely received from the SIM provider and securely stored and managed at the deployed location. This can be a cumbersome and complex process, which can significantly increase the cost and complexity of deployment.

[0006] The disclosed embodiments describe techniques for allowing a cloud service provider to facilitate the acquisition, deployment, and management of SIM data for customers of the cloud service provider. The present disclosure includes a system that provides:

[0007] SIM keys (e.g., Ki and OPc) are securely transmitted between the cloud service provider and the customer's edge site.

[0008] Securely store SIM keys in the cloud service provider area.

[0009] Securely store SIM keys at the customer's edge (locally).

[0010] In one example, the encrypted flow of SIM data between a cloud service provider region and the edge can allow an enterprise customer to efficiently deploy a private network in an industrial park at a customer site. The customer site connects multiple IoT devices that have SIM cards installed, and the associated profiles are under the management and control of the customer and facilitated by the cloud service provider. An infrastructure layer is provided for the edge communications stack at the customer site, which implements the encrypted flow of SIM data via 5G dedicated multi-access edge computing (MEC). The customer site may include a radio access network (RAN) unit that connects the customer's device to the 5G private MEC. The cloud service provider network implements the encrypted flow of SIM data between the region and the private MEC, and provides secure storage of SIM data at these sites.

[0011] The technology disclosed herein can improve security and privacy when configuring mobile devices for enterprise users. In addition, by providing a standardized method for more securely transmitting SIM data, various systems can operate more efficiently by avoiding repeated and inefficient attempts to identify devices and manage SIM data, thereby saving the use of memory, processing resources, network resources, etc. Other technical effects besides those mentioned herein can also be achieved from the implementation of the technology disclosed herein.

[0012] This summary is provided to introduce a series of concepts in a simplified form, which will be further described in the detailed description below. This summary is not intended to identify all key features or essential features of the claimed subject matter, nor is it intended that this summary be used to limit the scope of the claimed subject matter. Furthermore, the claimed subject matter is not limited to implementations that solve any or all disadvantages mentioned in any part of this disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The detailed description is described with reference to the accompanying drawings. In the description detailed herein, reference is made to the accompanying drawings which form a part of this document and which illustrate specific embodiments or examples by way of illustration. The drawings herein are not drawn to scale. In the multiple drawings, the same reference numerals represent the same elements.

[0014] Figure 1 Example processes illustrating embodiments of the present disclosure are depicted.

[0015] Figure 2 An example of a networking environment is depicted in which aspects of the present disclosure may be implemented.

[0016] Figure 3 An example of a computing device is depicted in which aspects of the present disclosure may be implemented.

[0017] Figure 4 An example environment for configuring a mobile device is depicted.

[0018] Figure 5 An example system for configuring a mobile device is depicted.

[0019] Figure 6 Describes an operational process for configuring a mobile device. DETAILED DESCRIPTION

[0020] Communication devices typically require credentials that securely and uniquely identify a subscription or account to enable the communication device to access and use services on a network. Such communication devices may include mobile phones, IoT devices, PCs, or any other device with a secure container for storing credentials, which may generally be referred to as a Subscriber Identity Module (SIM). Such devices typically do not have SIM data when shipped from the factory and must be provided with valid SIM data to access the appropriate network.

[0021] Devices that are capable of communicating on a mobile network but have not yet been configured typically obtain their configuration information by obtaining information describing the credentials to be configured, such as an activation code for an eSIM profile. Typical eSIM specifications define a variety of ways for a device to determine this configuration information. In some cases, the information may be provided from the operator to the user of the device, who then enters the information (e.g., scans a QR code containing the information). In another example, the device may use a global discovery server (e.g., SM-DS) to determine the configuration information, which may also be referred to as a discovery server. The device finds the eSIM download server (e.g., SM-DP+) that it needs to contact in order to configure its eSIM, and communicates with the server. The eSIM download server may also be referred to as an eSIM server or a download server.

[0022] A mobile operator can request that an eSIM profile be associated with a specific eUICC card. Each card has a permanent unique identifier called an eUICC ID (EID). The EID is disclosed to the end user in various ways, including device interfaces. When ordering a new subscription and associated eSIM profile, the end user can share the EID with the mobile operator. When the end user shares the EID with the mobile operator, the operator can link the profile to the EID. The eSIM download process performs mutual authentication of the eUICC card and the download server. The card can authenticate the download server, and if the authentication is successful, the download server can authenticate the card.

[0023] However, large-scale deployment of such devices may be difficult and complex to implement. For example, an enterprise may wish to deploy a private network with a large number of enterprise-provided communication devices at an enterprise site that communicate over a 5G network. In order to provide the desired connectivity, each device must be configured with SIM provisioning using a provider-specific process of the 5G service provider in order to access the 5G network. In addition, the SIM data of the SIM profile must be securely received from the SIM provider and securely stored and managed at the deployed location. This can be a cumbersome and complex process, which can significantly increase the cost and complexity of deployment.

[0024] The present disclosure provides a method for a cloud service provider to facilitate secure acquisition, deployment and management of SIM data of customers of the cloud service provider, in particular for delivering SIM data to 5G MEC devices. In various embodiments, a system is described that provides secure transmission of SIM keys (e.g., Ki and OPc) between a cloud service provider and a customer's edge site. Ki is a unique encryption key associated with a device's SIM, and OPc is a derived operator code unique to each SIM.

[0025] Also described are systems that provide secure storage of SIM keys at the cloud service provider region, and systems that provide secure storage of SIM keys at the customer's edge (locally).

[0026] In one example, the encrypted flow of SIM data between a cloud service provider region and the edge can allow an enterprise customer to efficiently deploy a private network in an industrial park at a customer site. The customer site connects multiple IoT devices that have SIM cards installed, and the associated profiles are under the management and control of the customer and facilitated by the cloud service provider. An infrastructure layer is provided for the edge communication stack at the customer site, which implements the encrypted flow of SIM data via a 5G dedicated MEC. The customer site may include a radio access network (RAN) unit that connects the customer's device to the 5G private MEC. The cloud service provider network implements the encrypted flow of SIM data between the region and the private MEC, and provides secure storage of SIM data at these sites.

[0027] Figure 1 An example workflow according to one embodiment is shown. In an embodiment, an enterprise customer 101 may select 140 a SIM provider 120 to order a certain number of SIM profiles. The certain number of SIM profiles may be ordered from a cloud provider 110. The cloud service provider 110 may send 141 a notification of the order to the SIM provider 120 and receive SIM data over an encrypted channel. The cloud service provider 110 may provide 142 a service key to the enterprise customer 101. The enterprise customer 101 may complete 143 a SIM purchase from the SIM provider 120.

[0028] In operation 144, the customer transaction may be authenticated. The SIM operation details may be encrypted 145 and sent to the cloud service provider 110. The SIM operation details may be re-encrypted 146 and securely stored. In an embodiment, the re-encrypted operation details may be stored in a database. The cloud service provider 110 may re-encrypt 147 the operation details during transmission and send the re-encrypted operation details to the customer edge 130. In an embodiment, the re-encrypted operation details may be sent to the packet core of the customer edge 130.

[0029] In an example, customer-managed keys and service-managed keys may be used to encrypt SIM data. When secure transmission is required, a Representational State Transfer (REST) ​​API operation may be called over HTTPS. The cloud service provider 110 may send the encrypted SIM data to the database service using the service-managed keys and the customer master key (CMK). The SIM data may be encrypted using transport layer security (TLS) during transmission to the database service. TLS may also be used to send the SIM data to the application environment.

[0030] In one scenario, an API can be implemented to enable the exchange of SIM order information and SIM data. The cloud service provider can also provide processes for managing the lifecycle and operation of SIM data, including the addition and removal of SIM data and the collection of SIM metrics. In addition, 5G network slicing can be implemented to provide differentiation for functions and services at customer sites. The integrity and security of SIM data is maintained throughout the process.

[0031] In an embodiment, an interface may be implemented that is configured to allow a user of a cloud service provider to select a 5G network operator and request a certain number of SIM profiles for customer-owned devices. The interface may enable the user to monitor and manage the lifecycle and operation of the SIM profiles during deployment.

[0032] In some embodiments, the interface may facilitate the process of acquiring, deploying, and managing SIM data for users of the cloud service provider. In an embodiment, the process may include sending a notification by the cloud service provider to the network operator of a request for a SIM profile for the 5G network operator. The cloud service provider may receive the requested SIM profile from the 5G network operator over an encrypted channel that can only be accessed by the 5G network operator.

[0033] The cloud service provider can provide the security service key to the users of the cloud service. The security service key can enable the users of the cloud service provider to obtain the SIM profile from the 5G network operator.

[0034] The cloud service provider can securely receive and decrypt SIM data corresponding to the SIM profile from the 5G network operator. The cloud service provider can re-encrypt and securely store the SIM data. The cloud service provider can then send the re-encrypted SIM data to the user's edge site.

[0035] In some embodiments, an interface may be provided for users of a cloud service provider to manage subscriptions to SIM profiles on a SIM-enabled device at a user site.

[0036] The techniques described herein can be used for devices communicating with various wireless communication systems (e.g., CDMA, TDMA, FDMA, OFDMA, and SC-FDMA). CDMA systems can implement radio technologies such as CDMA2000, Universal Terrestrial Radio Access (UTRA). TDMA systems can implement radio technologies such as Global System for Mobile Communications (GSM). OFDMA systems can implement radio technologies such as Ultra Mobile Broadband (UMB), Evolved UTRA (E-UTRA), IEEE802.11 (Wi-Fi), IEEE802.16 (WiMAX), IEEE802.20, Flash-OFDMA, etc. The techniques described herein can be used for the above-mentioned systems and radio technologies as well as other systems and radio technologies. However, the following description describes a cellular system for the purpose of example, although these techniques are applicable to applications outside of cellular.

[0037] Figure 2 2 is a block diagram conceptually illustrating an example of a wireless communication system 200 according to one aspect of the present disclosure. The wireless communication system 200 includes a base station (or cell) 205 and a mobile device 215. The base station 205 can communicate with the mobile device 215 under the control of a base station controller (not shown), which can be part of a core network or the base station 205. The wireless communication system 200 can support operations on multiple carriers. A multi-carrier transmitter can transmit modulated signals on multiple carriers simultaneously. For example, each communication link 225 can be a multi-carrier signal modulated according to the various radio technologies described above.

[0038] The base station 205 can wirelessly communicate with the mobile device 215 via one or more base station antennas. The base station 205 site can provide communication coverage for the corresponding coverage area. The mobile device 215 can be located in the entire wireless communication system 200 and can be stationary or mobile. The mobile device 215 can also be referred to as a user equipment (UE), a mobile station, a mobile unit, a subscriber unit, a remote unit, a mobile device, a wireless communication device, a remote device, a mobile terminal, a wireless terminal, a handset, a mobile client, a client, or other suitable terms. The mobile device 215 can be a cellular phone, a wireless modem, a wireless communication device, a handheld device, a tablet computer, a laptop computer, etc. The communication link 225 shown in the wireless communication system 200 may include an uplink (UL) transmission from the mobile device 215 to the base station 205 and / or a downlink (DL) transmission from the base station 205 to the mobile device 215.

[0039] In at least some embodiments, a computing device implementing part or all of one or more of the techniques described herein may include a general-purpose computer system that includes or is configured to access one or more computer-accessible media. Figure 3Such a general purpose computing device 300 is shown. In the illustrated embodiment, the computing device 300 includes one or more processors 310a, 310b, and / or 310n (which may be referred to herein as "processor 310" in the singular or "processors 310" in the plural) coupled to a system memory 330 via an input / output (I / O) interface 330. The computing device 300 also includes a network interface 340 coupled to the I / O interface 330.

[0040] In various embodiments, computing device 300 may be a uniprocessor system including one processor 310 or a multiprocessor system including a plurality of processors 310 (e.g., two, four, eight, or other suitable number). Processor 310 may be any suitable processor capable of executing instructions. For example, in various embodiments, processor 310 may be a general-purpose or embedded processor that implements any of a variety of instruction set architectures (ISAs), such as an x86, ARM, PowerPC, SPARC, or MIPS ISA, or any other suitable ISA. In a multiprocessor system, each of the plurality of processors 310 may typically, but not necessarily, implement the same ISA.

[0041] System memory 330 may be configured to store instructions and data accessible to processor 310. In various embodiments, system memory 330 may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), non-volatile / flash type memory, or any other type of memory. In the illustrated embodiment, program instructions and data that implement one or more desired functions (such as those methods, techniques, and data described above) are shown as stored in system memory 330 as code 335 and data 336.

[0042] In one embodiment, the I / O interface 330 may be configured to coordinate I / O traffic between the processor 310, the system memory 330, and any peripheral devices in the device (including the network interface 340 or other peripheral device interfaces). In some embodiments, the I / O interface 330 may perform any necessary protocol, timing, or other data transformations to convert data signals from one component (e.g., the system memory 330) into a format suitable for use by another component (e.g., the processor 310). In some embodiments, the I / O interface 330 may include support for devices connected through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard. In some embodiments, the functionality of the I / O interface 330 may be divided into two or more separate components, such as a north bridge and a south bridge. In addition, in some embodiments, some or all of the functionality of the I / O interface 330, such as an interface to the system memory 330, may be directly incorporated into the processor 310.

[0043] The network interface 340 can be configured to allow the computing device 300 to connect to one or more other devices 360 (such as other computer systems or devices shown herein) of one or more networks 350 to exchange data. In various embodiments, the network interface 340 can support communication via any suitable wired or wireless general data network (e.g., an Ethernet type network). In addition, the network interface 340 can support communication via a telecommunications / telephone network (such as an analog voice network or a digital fiber optic communication network), via a storage area network (such as a Fiber Channel SAN, a cellular voice and / or data network), or via any other suitable type of network and / or protocol. When the network interface 340 provides cellular communications, its operation can be supported by a credential device 380, which can provide authentication, authorization, and other related information and services.

[0044] In some embodiments, system memory 330 may be configured to store Figure 17 to 7 to implement one embodiment of a computer-accessible medium for implementing the corresponding method and system embodiments. However, in other embodiments, the program instructions and / or data may be received, sent, or stored on different types of computer-accessible media. In general, computer-accessible media may include non-transitory storage media or memory media, such as magnetic or optical media, such as a disk or DVD / CD coupled to the computing device 300 via the I / O interface 330. Non-transitory computer-accessible storage media may also include any volatile or non-volatile media, such as RAM (e.g., SDRAM, DDR SDRAM, RDRAM, SRAM, etc.), ROM, etc., which in some embodiments may be included as system memory 330 or another type of memory of the computing device 300. Part or all of multiple computing devices (such as Figure 3 ) can be used to implement the described functionality in various embodiments; for example, software components running on a variety of different devices and servers can collaborate to provide functionality. In some embodiments, in addition to or instead of using a general-purpose computer system, storage devices, network devices, or special-purpose computer systems can be used to implement portions of the described functionality. As used herein, the term "computing device" refers to at least all of these types of devices and is not limited to these types of devices. For purposes of this specification and claims, the phrase "computer-readable storage medium" and its variants do not include waves, signals, and / or other transient and / or intangible communication media.

[0045] As used herein, a communication device may refer to devices including, but not limited to, smartphones, cellular-enabled tablets and laptops, companion devices (e.g., smart watches), and non-consumer devices (telematics devices in cars, cellular-connected utility meters, any of which may include some number of credential devices 380), etc. Figure 4 , a credential device 380 such as a UICC or eUICC may be included in the communication device 300 to ensure the integrity and security of personal data and to enable communication with a mobile communication provider. Such a communication device 300 may embody Figure 2 , and in some embodiments may incorporate one or more network interfaces 240 that communicate via a cellular network.

[0046] For communication devices that comply with various specifications (such as 5G specifications), their related credentials are usually embedded in a SIM card. A SIM card can be a removable physical smart card that complies with the UICC specification ETSI TS102 221. The SIM card can be installed when the communication device is manufactured or at the point of sale. Alternatively, the SIM card can be purchased from a mobile operator for use with a communication device that is obtained separately and has a physical slot that complies with the UICC specification.

[0047] The credentials for accessing the communication services provided by the MNO 430 may include both data and instructions. When the instructions are executed on a processor (such as a processor of the credential device 380 within the mobile communication device 300), the instructions may be configured to cause communication between the processor and a communication service server so that the communication service server can authenticate the credentials and enable the communication service. A set of credentials may be associated with a subscription to a communication service from a particular communication service provider. Multiple sets of credentials may be provided for multiple subscriptions.

[0048] The eUICC may enable service subscriptions used by a communication device to be securely reconfigured without physically adding or removing the eUICC from the communication device. The eUICC may store one or more eUICC profiles, typically only one of which is active at a time. As used herein, an eUICC profile generally refers to client information associated with a network subscription, and embodiments are not limited to any particular eUICC system. An eUICC profile may include a combination of file structures, data, and applications that are associated with service credentials configured onto a credential device and that enable a communication device to use a subscription service associated with the profile.

[0049] Figure 4 An example environment for configuring profiles is depicted. The MNO 430 may own or otherwise control one or more MNO servers 452 via an interface 421. The MNO server may include an SM-DP+. The communication device (also referred to as a user equipment (UE) 300) may be, for example, a mobile communication device that includes a credential device 380. The credential device 380 may refer to a physically removable device that includes an electronic credential, such as a removable eUICC, or a non-removable device that may be electronically configured with subscription credentials, such as a soldered eUICC, etc. The credential device 380 may also refer to a software container that may include one or more electronic profiles and may be electronically configured with subscription credentials according to some embodiments.

[0050] Once credentials are configured on credential device 380, UE 300 may be configured to access MNO subscription services using the configured credentials via network connection 414. Network connection 414 may also enable UE 300 to access enterprise services or resources. Network connection 414 may be any type of computer network connection, including wired, WiFi, cellular data connections, etc.

[0051] In some embodiments, credential device 380 may be a removable or non-removable eUICC, which may be provided by MNO 430 or other manufacturer.

[0052] When a profile download is requested, the connection between the download server and the eUICC may be strongly authenticated, such as using a Transport Layer Security (TLS) channel. The eUICC may send the EID to the download server through an authenticated channel. In order for the correct profile to be downloaded to the eUICC, the activation code of the download request from the mobile operator may be linked to a specific EID. If the profile is pre-arranged by the mobile operator and the device has or can obtain the address of the download server, the activation code may not be sent to the mobile device. By transmitting a hash value, the transmission of the EID between the eUICC and the mobile operator and between the mobile operator and the download server may be avoided. In other words, the derived hash value may be associated with the profile download order instead of the actual EID.

[0053] refer to Figure 5 , showing an example embodiment of the present disclosure. In an embodiment, an enterprise customer 501 may use API 560 to select a SIM provider 530 to order a certain number of SIM profiles. A certain number of SIM profiles may be ordered via a cloud provider 540. The cloud service provider 540 may send a notification of the order to the SIM provider 530 and receive the SIM data over an encrypted channel 545. The cloud provider 540 may provide a service key 505 to the enterprise customer 501. The enterprise customer 501 may complete the SIM purchase from the SIM provider 530.

[0054] The SIM provider 530 may authenticate the customer transaction. The SIM provider 530 may encrypt the SIM operational details and send the encrypted SIM operational details to the cloud service provider 540. The cloud service provider 540 may re-encrypt the SIM operational details and securely store the re-encrypted SIM operational details in the database 550. The cloud provider 540 may re-encrypt the operational details during transmission and send the re-encrypted operational details to the customer edge 520. In an embodiment, the re-encrypted operational details may be sent to the packet core at the customer edge 520. The operational details may be used to configure the UE 525 at the customer edge 520.

[0055] In an embodiment, API 560 may enable the exchange of SIM order information and SIM data. Cloud provider 540 may also provide processes for managing the lifecycle and operation of SIM data, including the addition and deletion of SIM data and the collection of SIM metrics.

[0056] Figure 6 An example operation process of one embodiment of configuring multiple computing devices according to the present disclosure is shown. In an embodiment, multiple computing devices are configured to communicate on a mobile communication network, which is operated in part by an edge computing network associated with customers of a computing service provider. In an embodiment, the edge computing network includes computing and storage devices configured to extend computing resources of a computing service provider to customers of the computing service provider. The computing devices and systems may have a memory having computer executable instructions stored thereon, which, when executed, cause the computing device to perform operations as described.

[0057] refer to Figure 6 , operation 600 begins the operational process. Operation 600 may be followed by operation 602. Operation 602 illustrates receiving, by a computing service provider from a customer of the computing service provider, a selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network.

[0058] Operation 602 may be followed by operation 604. Operation 604 illustrates sending, by the computing service provider, a notification of the selection of a SIM provider and a number of SIM profiles to the SIM provider.

[0059] Operation 604 may be followed by operation 606. Operation 606 illustrates receiving, by the computing service provider from the SIM provider, SIM data corresponding to a number of SIM profiles. In an embodiment, the SIM data is encrypted and received over an encrypted channel.

[0060] Operation 606 may be followed by operation 608. Operation 608 illustrates decrypting the SIM data using the first set of decryption credentials by the computing service provider.

[0061] Operation 608 may be followed by operation 610. Operation 610 illustrates re-encrypting the SIM data using the second set of encryption credentials by the computing service provider. In an embodiment, the decryption credentials for the re-encrypted SIM data are stored at the edge computing network.

[0062] Operation 610 may be followed by operation 612. Operation 612 illustrates storing the re-encrypted SIM data in a data store communicatively coupled to the computing service provider to maintain a secure copy of the re-encrypted SIM data at the computing service provider.

[0063] Operation 612 may be followed by operation 614. Operation 614 illustrates sending the re-encrypted SIM data by the computing service provider to the edge computing network. In an embodiment, the re-encrypted SIM data may be operable to be decrypted by the edge computing network using a decryption credential managed by the computing service provider. In an embodiment, the decrypted SIM data may be used as a subscription credential for accessing a mobile communication network by a plurality of computing devices using a number of SIM profiles.

[0064] The various features and processes described above can be used independently of each other, or can be combined in various ways. All possible combinations and sub-combinations are intended to fall within the scope of the present disclosure. In addition, in some embodiments, certain method or process blocks may be omitted. The methods and processes described herein are also not limited to any particular order, and the blocks or states associated therewith may be performed in other appropriate orders. For example, the blocks or states described may be performed in an order different from that specifically disclosed, or multiple blocks or states may be combined in a single block or state. Example blocks or states may be performed serially, in parallel, or in some other manner. Frames or states may be added to or removed from the disclosed example embodiments. The example systems and components described herein may be configured differently from those described. For example, elements may be added, deleted, or rearranged to the disclosed example embodiments.

[0065] It should also be understood that various items are shown as being stored in memory or on a storage device when in use, and that these items or portions thereof may be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments, some or all of the software modules and / or systems may be executed in memory on another device and communicate with the illustrated computing system via inter-computer communication. In addition, in some embodiments, some or all of the systems and / or modules may be implemented or provided in other ways, such as at least partially in firmware and / or hardware, including but not limited to one or more application specific integrated circuits (ASICs), standard integrated circuits, controllers (e.g., by executing appropriate instructions, and including microcontrollers and / or embedded controllers), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), etc. Some or all of the modules, systems, and data structures may also be stored (e.g., as software instructions or structured data) on a computer-readable medium, such as a hard disk, memory, network, or portable media article to be read by an appropriate drive or via an appropriate connection. Systems, modules, and data structures may also be transmitted as generated data signals (e.g., as part of a carrier wave or other analog or digital propagation signal) on various computer-readable transmission media, including wireless-based and wire / cable-based media, and may take various forms (e.g., as part of a single or multiplexed analog signal, or as multiple discrete digital packets or frames). In other embodiments, such a computer program product may also take other forms. Therefore, the present disclosure may be practiced with other computer system configurations.

[0066] Conditional language used herein, such as "can," "could," "might," "may," "eg," and the like, unless expressly stated otherwise or otherwise understood in the context of use, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements, and / or steps. Thus, such conditional language is generally not intended to imply that features, elements, and / or steps are in any way required for one or more embodiments, or that one or more embodiments must include logic for determining, with or without author input or prompting, whether such features, elements, and / or steps are included or will be performed in any particular embodiment. The terms "comprising," "including," "having," and the like are synonymous and are inclusive in an open-ended manner and do not exclude additional elements, features, actions, operations, and the like. Furthermore, the term "or" is used in its inclusive sense (rather than its exclusive sense) such that when used, for example, to connect a list of elements, the term "or" means one, some, or all of the elements in the list.

[0067] Although certain exemplary embodiments have been described, these embodiments are presented by way of example only and are not intended to limit the scope of the invention disclosed herein. Therefore, nothing in the foregoing description is intended to imply that any particular feature, characteristic, step, module, or block is necessary or indispensable. In fact, the novel methods and systems described herein may be embodied in a variety of other forms; in addition, various omissions, substitutions, and changes in the form of the methods and systems described herein may be made without departing from the spirit of the invention disclosed herein. The attached claims and their equivalents are intended to cover such forms or modifications that fall within the scope and spirit of certain inventions disclosed herein.

[0068] The disclosure set forth herein also includes the subject matter set forth in the following clauses:

[0069] Clause 1: A method of configuring a plurality of computing devices, the plurality of computing devices being configured to communicate over a mobile communications network, the mobile communications network being operated in part by an edge computing network associated with a customer of a computing service provider, the edge computing network comprising computing and storage devices configured to extend computing resources of the computing service provider to the customers of the computing service provider, the method comprising:

[0070] receiving, by a computing service provider from a customer of the computing service provider, a selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network;

[0071] sending, by the computing service provider, a notification of selection of the SIM provider and a number of SIM profiles to the SIM provider;

[0072] receiving, by a computing service provider, SIM data corresponding to a certain number of SIM profiles from a SIM provider, wherein the SIM data is encrypted and received via an encrypted channel;

[0073] Decrypting the SIM data by the computing service provider using the first set of decryption credentials;

[0074] re-encrypting the SIM data using a second set of encryption credentials by the computing service provider, wherein decryption credentials for the re-encrypted SIM data are stored at the edge computing network;

[0075] storing the re-encrypted SIM data in a data store communicatively coupled to the computing service provider to maintain a secure copy of the re-encrypted SIM data at the computing service provider; and

[0076] The re-encrypted SIM data is sent by a computing service provider to an edge computing network, wherein the re-encrypted SIM data is operable to be decrypted by the edge computing network using a decryption credential managed by the computing service provider, and wherein the decrypted SIM data can be used as a subscription credential for multiple computing devices to access a mobile communication network using a certain number of SIM profiles, wherein the SIM data includes Ki and OPc keys.

[0077] Clause 2: A method according to clause 1, wherein the SIM data comprises Ki and OPc keys.

[0078] Clause 3: The method of any of clauses 1 to 2, further comprising sending, by the computing service provider in response to receiving an order for a certain number of SIM profiles, a service key to a customer of the computing service provider.

[0079] Clause 4: A method according to any one of clauses 1 to 3, wherein the service key can be used to complete the purchase of a certain number of SIM profiles by a customer of the computing service provider.

[0080] Clause 5: A method according to any of clauses 1 to 4, wherein the SIM data corresponding to the number of SIM profiles is received by the computing service provider from a SIM provider in response to verification of a transaction for a customer of the computing service provider to purchase the number of SIM profiles.

[0081] Clause 6: A method according to any one of clauses 1 to 5, wherein the customer managed key and the service managed key are used to re-encrypt the SIM data.

[0082] Clause 7: The method of any of clauses 1 to 6, further comprising implementing, by a computing service provider, an API operable to receive a selection of a SIM provider and a number of SIM profiles.

[0083] Clause 8: A system comprising:

[0084] A memory having instructions stored thereon, which when executed by a processor of the system causes the system to perform operations, the operations comprising:

[0085] receiving a user selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network;

[0086] sending a notification of selection of a SIM provider and a number of SIM profiles to a SIM provider;

[0087] receiving SIM data corresponding to a number of SIM profiles from a SIM provider, wherein the SIM data is encrypted and received over an encrypted channel;

[0088] Decrypting the SIM data using the first set of decryption credentials;

[0089] re-encrypting the SIM data using a second set of encryption credentials, wherein decryption credentials for the re-encrypted SIM data are stored at the edge computing network;

[0090] communicatively coupling the re-encrypted SIM data storage to a data storage of the system to maintain a secure copy of the re-encrypted SIM data; and

[0091] The re-encrypted SIM data is sent to an edge computing network associated with a customer of a computing service provider, wherein the re-encrypted SIM data is operable to be decrypted by the edge computing network using a decryption credential, and wherein the decrypted SIM data is usable as a subscription credential for accessing a mobile communication network by a plurality of computing devices using a number of SIM profiles.

[0092] Clause 9: An edge computing network according to clause 8, wherein the SIM data includes Ki and OPc keys.

[0093] Clause 10: The edge computing network of any of clauses 8 and 9, further comprising sending, by the computing service provider, a service key to a customer of the computing service provider in response to receiving an order for a certain number of SIM profiles.

[0094] Clause 11: An edge computing network according to any of clauses 8 to 10, wherein the service key can be used to complete the purchase of a certain number of SIM profiles by a customer of the computing service provider.

[0095] Clause 12: An edge computing network according to any of clauses 8 to 11, wherein the SIM data corresponding to a certain number of SIM profiles is received from a SIM provider by the computing service provider in response to verification of a transaction for a customer of the computing service provider to purchase the certain number of SIM profiles.

[0096] Clause 13: An edge computing network according to any of clauses 8 to 12, wherein customer-managed keys and service-managed keys are used to re-encrypt SIM data.

[0097] Clause 14: The edge computing network of any of clauses 8 to 13, further comprising implementing, by the computing service provider, an API operable to receive a selection of a SIM provider and a number of SIM profiles.

[0098] Clause 15: A computer-readable storage medium having stored thereon computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to:

[0099] receiving, from a user of a computing service provider, a selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network;

[0100] sending a notification of selection of a SIM provider and a number of SIM profiles to a SIM provider;

[0101] receiving SIM data corresponding to a number of SIM profiles from a SIM provider, wherein the SIM data is encrypted and received over an encrypted channel;

[0102] Decrypt SIM data;

[0103] Re-encrypt SIM data;

[0104] storing the re-encrypted SIM data in a data store communicatively coupled to the computing device; and

[0105] sending the re-encrypted SIM data to an edge computing network associated with a customer of the computing service provider;

[0106] The re-encrypted SIM data can be used as subscription credentials for multiple computing devices to access the mobile communication network.

[0107] Clause 16: The computer readable storage medium of clause 15, wherein the SIM data comprises Ki and OPc keys.

[0108] Clause 17: The computer-readable storage medium of any of clauses 15 and 16, further comprising sending, by the computing service provider, a service key to a customer of the computing service provider in response to receiving an order for a certain number of SIM profiles.

[0109] Clause 18: The computer-readable storage medium of any of clauses 15 to 17, wherein the service key can be used to complete the purchase of a number of SIM profiles by a customer of the computing service provider.

[0110] Clause 19: A computer-readable storage medium according to any of clauses 15 to 18, wherein the SIM data corresponding to the number of SIM profiles is received from a SIM provider by a computing service provider in response to verification of a transaction for a customer of the computing service provider to purchase the number of SIM profiles.

[0111] Clause 20: The computer-readable storage medium of any of clauses 15 to 19, further comprising an API implemented by a computing service provider operable to receive a selection of a SIM provider and a number of SIM profiles.

Claims

1. A method of configuring a plurality of computing devices, the plurality of computing devices being configured to communicate over a mobile communications network, the mobile communications network being operated in part by an edge computing network associated with a customer of a computing service provider, the edge computing network comprising computing and storage devices configured to extend computing resources of the computing service provider to the customers of the computing service provider, the method comprising: receiving, by the computing service provider from the customer of the computing service provider, a selection of a SIM provider and a number of SIM profiles for enabling the plurality of computing devices to access the mobile communications network; sending, by the computing service provider, a notification of the selection of the SIM provider and the number of SIM profiles to the SIM provider; receiving, by the computing service provider, SIM data corresponding to the certain number of SIM profiles from the SIM provider, wherein the SIM data is encrypted and received through an encrypted channel; decrypting the SIM data by the computing service provider using a first set of decryption credentials; re-encrypting the SIM data using a second set of encryption credentials by the computing service provider, wherein decryption credentials for the re-encrypted SIM data are stored at the edge computing network; storing the re-encrypted SIM data in a data store communicatively coupled to the computing service provider to maintain a secure copy of the re-encrypted SIM data at the computing service provider; as well as The re-encrypted SIM data is sent by the computing service provider to the edge computing network, wherein the re-encrypted SIM data is operable to be decrypted by the edge computing network using the decryption credentials managed by the computing service provider, and wherein the decrypted SIM data can be used as subscription credentials for the plurality of computing devices to access the mobile communication network using the certain number of SIM profiles.

2. The method of claim 1, wherein the SIM data comprises Ki and OPc keys.

3. The method of claim 1, further comprising sending, by the computing service provider in response to receiving an order for the certain number of SIM profiles, a service key to the customer of the computing service provider.

4. The method of claim 3, wherein the service key can be used to complete a purchase of the number of SIM profiles by the customer of the computing service provider.

5. The method of claim 1 , wherein the SIM data corresponding to the certain number of SIM profiles is received by the computing service provider from the SIM provider in response to verification of a transaction by the customer of the computing service provider to purchase the certain number of SIM profiles.

6. The method of claim 1, wherein customer managed keys and service managed keys are used to re-encrypt the SIM data.

7. The method of claim 1, further comprising implementing, by the computing service provider, an API operable to receive the selection of the SIM provider and the number of SIM profiles.

8. A system comprising: A memory having instructions stored thereon, which, when executed by a processor of the system, cause the system to perform operations, the operations comprising: receiving a user selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network; sending a notification of the selection of the SIM provider and the number of SIM profiles to the SIM provider; receiving SIM data corresponding to the number of SIM profiles from the SIM provider, wherein the SIM data is encrypted and received over an encrypted channel; decrypting the SIM data using a first set of decryption credentials; re-encrypting the SIM data using a second set of encryption credentials, wherein decryption credentials for the re-encrypted SIM data are stored at the edge computing network; communicatively coupling the re-encrypted SIM data storage to a data storage of the system to maintain a secure copy of the re-encrypted SIM data; and The re-encrypted SIM data is sent to an edge computing network associated with a customer of a computing service provider, wherein the re-encrypted SIM data is operable to be decrypted by the edge computing network using the decryption credential, and wherein the decrypted SIM data is usable as a subscription credential for accessing the mobile communication network by the plurality of computing devices using the certain number of SIM profiles.

9. The system of claim 8, wherein the SIM data includes Ki and OPc keys.

10. The system of claim 8, further comprising sending, by the computing service provider in response to receiving an order for the number of SIM profiles, a service key to the customer of the computing service provider.

11. The system of claim 10, wherein the service key is usable to complete a purchase of the number of SIM profiles by the customer of the computing service provider.

12. The system of claim 8, wherein the SIM data corresponding to the certain number of SIM profiles is received from the SIM provider by the computing service provider in response to verification of a transaction by the customer of the computing service provider to purchase the certain number of SIM profiles.

13. The system of claim 8, wherein customer managed keys and service managed keys are used to re-encrypt the SIM data.

14. The system of claim 8, further comprising an API implemented by the computing service provider operable to receive the selection of the SIM provider and the number of SIM profiles.

15. A computer-readable storage medium having computer-executable instructions stored thereon, wherein the computer-executable instructions, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising: receiving, from a user of a computing service provider, a selection of a SIM provider and a number of SIM profiles for enabling a plurality of computing devices to access a mobile communications network; sending a notification of the selection of the SIM provider and the number of SIM profiles to the SIM provider; receiving SIM data corresponding to the number of SIM profiles from the SIM provider, wherein the SIM data is encrypted and received over an encrypted channel; decrypting the SIM data; re-encrypting the SIM data; storing the re-encrypted SIM data in a data store communicatively coupled to the computing device; as well as sending the re-encrypted SIM data to an edge computing network associated with a customer of a computing service provider; The re-encrypted SIM data may be used as subscription credentials for the multiple computing devices to access the mobile communication network.

Images