Method for delivering esim profile data

Abstract

The invention relates to a method for transferring eSIM profile data from a first wireless communication device (D1) having a first eUICC device to a second wireless communication device (D2) having a second eUICC device, comprising the following steps: a. Providing encrypted eSIM profile data on the first eUICC device together with encrypted confidential user data (CD1... CDn), the encrypted eSIM profile data has been encrypted by means of a profile encryption key, wherein the encrypted confidential user data (CD1... CDn) has been encrypted at least partially by means of a user key (UK); b. Passing the encrypted eSIM profile data along with the encrypted confidential user data (CD1... CDn) from the first eUICC device to the second eUICC device; and c. Decrypting and installing the encrypted eSIM profile data on the second wireless communication device (D2), wherein the confidential user data (CD1... CDn) is decrypted at least partially by means of the user key (UK) and installed on the second wireless communication device (D2).

Description

Technical Field

[0001] The present disclosure relates to a method for transferring eSIM profile data. Furthermore, the present disclosure relates to a wireless communication unit for performing the proposed method. Furthermore, the present disclosure relates to a system for performing the proposed method. Background Art

[0002] The current security protocol defined by the GSM Association (GSMA) for downloading and installing eSIM profiles is defined according to the "one-way street" principle. This means that once the eSIM profile is delivered (which is encrypted only for a single eUICC (embedded Universal Integrated Circuit Card)), it is required that the eUICC never leaks any data from the profile unless required and defined by the relevant telecommunication specifications (e.g. ETSI, 3GPP, etc.). The disadvantage brought about by this is that the scenario of removing a plastic SIM card from one device and putting it in another and in this way keeping all modifications made to date to the SIM is not possible today in the eSIM ecosystem. On the plastic SIM card, confidential and / or secret data owned by the subscriber (e.g. data privacy related data) or his business partners (IDs and secret keys) can never be read outside the plastic SIM card / secure element.

[0003] According to the format and security of the eSIM profile defined by the GSMA, the mobile network operator (MNO) that owns the profile will be able to decrypt the exported profile within its server (e.g., "SM-DP+" (Subscription Manager Data Preparation System), as per GSMA SGP.22), since only one layer of encryption / security is defined today. Through this profile decryption, the MNO can also extract other confidential and / or secret data from the subscriber or one of its business partners as described above. JavaCard applets can be located within the MNO profile (loaded during profile download or after release), but after the initial applet download, they are in a non-personalized state. Personalization (ID, keys, user data) can then be performed between the subscriber and its business partner with limited or no involvement of the MNO. Exporting the profile after these personalization steps to the MNO profile storage server (e.g., SM-DP+ acc. to GSMA SGP.22) without any added security layer will make it possible for the MNO to decrypt and read the personalized data.

[0004] Likewise, the export to another eUICC / eSE without any further protection of confidential user data is only protected by the security protocols defined by the GSMA. No additional user knowledge is required to retrieve this confidential user data from the exported profile during import into the new eUICC.

[0005] A conventional eUICC does not have the resources to fully store an encrypted profile before decryption and processing. Therefore, the profile data is sent to the eUICC in fragments in a "streaming" mode and decrypted / processed by the eUICC. Additionally, the export will be an "export stream" where the eUICC assembles, encrypts and sends the exported profile in fragments.

[0006] US 10 061 942 B2 discloses secure storage of an electronic subscriber identity module on a wireless communication device. Summary of the invention

[0007] It is an object of the present invention to provide an improved method for transfer of eSIM profile data.

[0008] According to a first aspect, the present disclosure proposes a method for transferring eSIM profile data from a first wireless communication device having a first eUICC device to a second wireless communication device having a second eUICC device, the method comprising the following steps:

[0009] a. providing, on the first eUICC device, encrypted eSIM profile data together with encrypted confidential user data, the encrypted eSIM profile data having been encrypted by means of a profile encryption key, wherein the encrypted confidential user data has been encrypted at least in part by means of a user key;

[0010] b. passing the encrypted eSIM profile data together with the encrypted confidential user data from the first eUICC device to the second eUICC device; and

[0011] c. decrypting and installing the encrypted eSIM profile data on the second wireless communication device, wherein the confidential user data is decrypted at least in part with the aid of a user key and installed on the second wireless communication device (D2).

[0012] In this way, when preparing and performing the eSIM profile data export, a specific user key or user secret is used, which represents a confidential personal key. Therefore, confidential user data that does not involve other people can be effectively protected. Therefore, advantageously, the use of confidential user data is only at the discretion of the user.

[0013] According to another aspect, the present disclosure proposes a wireless communication device for performing the proposed method.

[0014] According to another aspect, the present disclosure provides a system including first and second wireless communication devices.

[0015] In one or more embodiments, the user key is a password.

[0016] In one or more embodiments, the user key is combined with public key material data to generate an encryption key for confidential user data.

[0017] According to one or more embodiments, wherein when the eSIM profile data has been received on the second wireless communication device, input of a user key is requested in order to decrypt the encrypted personalization data by means of the personalization key. This may be done, for example, by prompting for input of the user key.

[0018] According to one or more embodiments, when the eSIM profile data has been received by the second wireless communication device and the user does not want the confidential user data on the second wireless communication device, the confidential user data is deleted from the second wireless communication device. In this way, if the user does not want to have / use the confidential user data at all, they will simply be deleted, which corresponds to a kind of reprovisioning of said data. Thus, only parts of the imported eSIM profile are used.

[0019] According to one or more embodiments, the eSIM profile data is additionally stored on a server.

[0020] According to one or more embodiments, the key creation material and the configuration file encryption key are generated ephemeral.

[0021] In accordance with one or more embodiments, at least a single eSIM profile is transferred from a first wireless communication device to a second wireless communication device.

[0022] According to one or more embodiments, in step a, the encrypted eSIM profile data has been additionally or alternatively MAC protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above discussion / overview is not intended to describe every embodiment or every implementation of the present disclosure. The figures and the following detailed description also illustrate various embodiments. The aspects defined above and further aspects of the present disclosure are apparent from the examples of embodiments to be described below with reference to the accompanying drawings, which are illustrated with reference to the examples of embodiments. However, it goes without saying that the present disclosure is not limited to the examples of embodiments.

[0024] All illustrations in the drawings are schematic. It should be noted that in different figures, similar or identical elements or features have the same reference numerals or have reference numerals that differ from the corresponding reference numerals only within the first digit. In order to avoid unnecessary repetition, elements or features that have already been explained with respect to previously described embodiments will not be explained again at a later point in the description.

[0025] Various example embodiments may be more fully understood by considering the following detailed description in conjunction with the accompanying drawings, in which:

[0026] Figure 1 , 2 shows the conventional transfer of eSIM profile data;

[0027] Figure 3 The first part of the sequence diagram showing the proposed method;

[0028] Figure 4 is a diagram showing an embodiment of the results of the proposed method;

[0029] Figure 5 The second part of the sequence diagram showing the proposed method;

[0030] Figure 6 is a flow chart illustrating the proposed method; and

[0031] Figure 7 is the block diagram of the proposed system.

[0032] Although the various embodiments discussed herein allow for modifications and alternative forms, several aspects thereof have been shown by way of example in the drawings and will be described in detail. However, it should be understood that it is not intended to limit the present disclosure to the specific embodiments described. On the contrary, it is intended to cover all modifications, equivalents, and alternatives that fall within the scope of the present disclosure including the aspects defined in the claims. In addition, the term "example" as used throughout this application is intended to be illustrative only and not limiting. DETAILED DESCRIPTION

[0033] In order to prevent the MNO or a different user from reading confidential / secret data that is not owned by the MNO or a different user but is part of the exported profile (e.g. data about the subscriber or one of its business partners), an additional encryption and / or integrity layer is applied to this confidential data. The present disclosure proposes the following steps: firstly special data objects are marked by the owning application (e.g. JavaCard applet), and secondly those data objects are encrypted / MACed with key material derived from the user's input (e.g. a PIN or password, called "user secret" (personalized encryption key)).

[0034] The exported eSIM profile data will thus contain additional data such that user data with additional protection is stored within the exported eSIM profile and, if required, used by the key derivation function, but the user's input will not be part of the exported eSIM profile and will only be known to the respective user.

[0035] During the process of re-importing the eSIM profile to a new device / eUICC, the user will be prompted to enter his previously assigned "User Secret". Using this "User Secret" and the key derivation optional key derivation data from the exported eSIM profile, the eUICC in the new device can also decrypt and recover confidential / secret personalization data.

[0036] Figure 1 In principle, it is shown that in a conventional process, the eSIM profile data 30 is "forward encrypted" in a manner that relies on, for example, a Diffi-Hellman key derivation based on a known ephemeral key pair (ECC). First, ECC creation is performed on the server (not shown) and the target eUICC (not shown). Subsequently, an exchange of key creation material 10 (e.g., public keys) is performed between the server and the target eUICC. The creation of symmetric key material based on Diffie-Hellman creates a key derivation with a shared secret on the server and the eUICC. Then, the entire "Binding Profile Package" (BPP) with the eSIM profile data 30 with fragments DS1 ... DS7 is sent to the target eUICC device, where the key creation material 10 is sent together with the profile encryption key 20, but encrypted with the key material 10 created in the previous steps described. Due to technical limitations of the underlying transport protocol on the eUICC device and the limited resources of the eUICC device, the binding profile package with the eSIM profile data PD is sent to the eUICC device in fragments DS1...DS7 and is decrypted and processed / installed in fragments DS1...DSn rather than as a single large data block.

[0037] Figure 2 3 shows that, without any additional security layer, data owned by the subscriber or one of its business partners (so-called confidential user data CD1, CD2 and allocated as data objects by an application (e.g. JavaCard applet) on the eUICC device) will be part of the exported eSIM profile data 30 and can be read by the MNO, since it can derive the corresponding key material, as described above with reference to Figure 1 described.

[0038] like Figure 1 and Figure 2 As shown in , so-called "forward-only encryption" is performed, which is designed for partial delivery, decryption and processing in streaming mode.

[0039] Figure 3 In principle, a first sequence diagram of the proposed method for delivering eSIM profile data 30 containing confidential user data CD1 ... CDn is shown. The process flow for profile derivation with random confidential user data CD1 ... CDn works as follows:

[0040] In step S1 , a device change / profile export procedure is initiated on an "old" or first wireless communication device D1 (eg, smartphone, watch, automotive device, IoT device, etc.) by a user N, by the first device D1 or some other means.

[0041] In step S2, the user N is prompted to enter a user key UK ("user secret") for protecting his eSIM profile data 30 (e.g. a PIN, a password entry or some method for creating entropy), and in steps S3, S4, the eSIM profile data 30 is entered by the user N and securely stored.

[0042] In step S5 , the user key UK is sent together with all other data provided to the exporter first eUICC device 100 (secure element, eSE) arranged on the first wireless communication device D1 in order to export a specific eSIM profile, and is not disclosed to any other entity than the exporter first eUICC device 100 .

[0043] The eUICC / eSE device 100 will then perform the appropriate key derivation functions to create key material for encryption and / or MAC creation. A MAC (Message Authentication Code) is a kind of checksum to ensure that the data has not been tampered with. In contrast to a HASH, which also detects / prevents manipulation, a MAC uses a secret key (similar to the actual encryption of the data). The receiver and sender must know this MAC key in advance, just like the encryption key. In the GSMA standard, a MAC key for the profile is generated similarly to the ECC-Diffie-Hellman and key derivation described for the encryption key. The profile package is also not only encrypted in the GSMA standard, but also protected by a MAC. In the following, the reference to MAC creation is always an and / or option, even if the text only talks about "encryption".

[0044] In optional step S6, in case the object is not marked as confidential user data CD1 ... CDn by its nature, the first eUICC device 100 triggers the application to mark the confidential data.

[0045] The user key UK is used together with the publicly known key material data 10 (e.g. an identifier, a constant string, a counter, etc.) in step S7 in a key derivation function to create one or more secret keys 10a for the purpose of encryption and / or MAC creation of the confidential user data CD1 ... CDn. In this context, the generated key (or keys if a MAC is also included) must be kept secret and can only be regenerated by the mentioned key derivation (secret key + publicly known key material).

[0046] The eUICC device 100 already knows the special confidential user data objects CD1...Cdn (e.g., by using some JavaCard API classes), or the eUICC / eSE triggers each applet via a defined API to notify the applet to prepare for export. The applet can then decide whether to erase the data, or whether to mark the data object as confidential.

[0047] A sub-variant of the method could be that such confidential user data CD1 . . . CDn are not necessarily encrypted but only protected against manipulation (eg applying a MAC).

[0048] After all applets have been triggered, the first eUICC device 100 starts exporting the entire eSIM profile data 30 including the encrypted confidential user data objects CD1 ... CDn. The public known key material data 10 will be part of the exported eSIM profile data 30 before any confidential data objects.

[0049] In this context, the difference between two "public" key data is emphasized. The first is based on the proven GSMA principles for eSIM profiles (ECC-Diffie-Hellman + key derivation), and the second is for user data only, using an unspecified key derivation algorithm.

[0050] ECC-Diffie-Hellman is an algorithm that operates on two public / private key pairs. One on the sender side and one on the receiver side. Both sides exchange public keys and use them along with their own private keys as input to the Diffie-Hellman algorithm. Due to the basic mathematics, the same result (the so-called "shared secret") appears on both sides, and no one else can calculate the result without having the private key and exchanging the secret data.

[0051] This "shared secret" is then used together with the "public key material data" as input to a so-called "key derivation algorithm" (e.g., a HASH such as SHA-256 or SHA3), and the result here (again on both sides) is thus the real encryption and / or MAC key.

[0052] In the present disclosure, the "user key" may already be a "shared secret" and the key derivation function is the same as that of the GSMA, but it does not have to be so. Therefore, the public key material data 10a used for user data protection is not a public key, but "other public" data used in the "key derivation" algorithm together with the user key.

[0053] In case the first eUICC device 100 encounters a data object marked as confidential, it shall protect the data object with the key material derived in step S7.

[0054] In step S8 , the first data segment DS1 is sent from the first wireless communication device D1 to the profile exporting first eUICC device 100 .

[0055] In step S9 , profile export information is prepared together with the first encrypted data segment and then sent to the first wireless communication device D1 in step S10 .

[0056] In the loop-type process S11, in step S11a, the next data segment DS2 is sent from the first wireless communication device D1 to the first eUICC device 100. In step S11b, the next encrypted data segment is prepared. In optional step S11c, in case confidential user data CD1 ... CDn are detected, the confidential user data CD1 ... CDn are protected at least partly by means of the user key UK. In step S11d, the encrypted data segment is sent from the first eUICC device 100 to the first wireless communication device D1.

[0057] In optional step S12 , the derived eSIM profile data 30 is stored in a profile storage device 40 (eg, a server).

[0058] Finally, in step S13 , the eSIM profile data 30 is transferred from the first wireless communication device D1 to the second wireless communication device D2 (eg, a smartphone, an automotive device, an IoT device, etc.).

[0059] As a result of the process shown, another layer of security has been added and information about it will result in the derived eSIM profile data 30, such as Figure 4 It will be appreciated that the public key material data 10a is used together with the user key UK to obtain the public key data 10a according to the above reference. Figure 3 Step S11c is shown to encrypt the confidential user data CD1 . . . CDn.

[0060] Figure 5 In principle, a sequence diagram is shown for importing exported eSIM profile data PD into a second wireless communication device D2 having a second eUICC device 200 using the following steps. Re-importing previously exported eSIM profile data 30 and decryption of confidential data objects CD1 ... CDn will be similar to that described above with reference to Figure 3 The derivation shown is carried out.

[0061] In step S14 , a device change / profile import procedure is initiated on the second wireless communication device D2 by the user N, by the first wireless communication device D1 , or by some other component.

[0062] In optional step S15 , the eSIM profile data 30 is downloaded from the server 40 , or in step S16 , the eSIM profile data 30 is downloaded from the first wireless communication device D1 .

[0063] In step S17, the user N is prompted to input the user key UK previously input on the first wireless communication device D1, and then the user key UK is input and securely stored in step S18. In this context, in order to import a specific profile, the user key UK is sent together with all other data provided to the importing eUICC device 200 or the secure element (eSE) in steps S19 and S20, respectively, and the user key UK is not disclosed to any other entity (inside or outside the device) except the second wireless communication eUICC device 200.

[0064] In steps S21, S22 and S23, the second wireless communication eUICC device 200 prepares for profile import, decrypting the first profile fragment (without user confidential data CD1 ... CDn) of the "normal" eSIM profile data 30 according to the standard. In addition, the second wireless communication eUICC device 200 will use the same appropriate key derivation function to create the same key material 10a for verification and decryption.

[0065] The user key UK is used in a key derivation function together with public known key material data (eg an identifier, a constant string, a counter, ...).

[0066] The looping process S24 is performed until the entire eSIM profile data 30 is exported. In this context, in steps S24a, S24b, data segments are sent from the second wireless communication device D2 to the second eUICC device 200, and the next encrypted data segment is decrypted and processed. In step 24c, if the second eUICC device 200 encounters a data object marked as confidential, it will verify the authenticity of the data object and decrypt the data object using the key material previously derived in step S23, and then store it together with all other data objects. Step S24c confirms that the process S24 is complete and the complete eSIM profile 30 has been successfully exported.

[0067] In step S25 , the eSIM profile data 30 has been successfully imported into the second wireless communication device D2 and is now ready for activation.

[0068] Once the re-imported eSIM profile data 30 are activated, the confidential data objects CD1 . . . CDn can be used by the corresponding applications on the first wireless communication device D1 as before.

[0069] As a result, protection of confidential user data CD1 . . . CDn is supported in such a way that the data cannot be used by any other person or device other than the authorized user N.

[0070] Figure 6 A flow of an embodiment of the proposed method for transferring eSIM profile data 30 from a first wireless communication device D1 having a first eUICC device 100 to a second wireless communication device D2 having a second eUICC device 200 is shown.

[0071] In step 300 , encrypted eSIM profile data 30 are provided on the first eUICC device 100 , which have been encrypted by means of a profile encryption key 20 , together with encrypted confidential user data CD1 . . . CDn, which have been at least partly encrypted by means of a user key UK.

[0072] In step 310 , the encrypted eSIM profile data 30 together with the encrypted confidential user data CD1 . . . CDn are transferred from the first eUICC device 100 to the second eUICC device 200 .

[0073] In step 320 , the encrypted eSIM profile data 30 is decrypted and installed on the second wireless communication device D2 , wherein the confidential user data CD1 . . . CDn are at least partially decrypted by means of the user key UK and installed on the second wireless communication device D2 .

[0074] Alternatively, after receiving the eSIM profile data 30, the user N may decide not to accept the confidential user data CD1 ... CDn, wherein the confidential user data CD1 ... Cdn are deleted from the second wireless communication device D2.

[0075] Figure 7 A block diagram of a system with a first wireless communication device D1 and a second wireless communication device D2 is shown, wherein eSIM profile data 30 is communicated in the manner shown above. The proposed wireless communication units D1, D2 are configured to perform the proposed method. The proposed system comprises at least two proposed wireless communication units D1, D2 configured to perform the proposed method. The proposed eUICC devices 100, 200 are at least partially implemented as hardware. It will be appreciated that, optionally, the eSIM profile data 30 may also be communicated to a server 40, from which the eSIM profile data 30 may be communicated to the second wireless communication device D2.

[0076] In summary, the present disclosure proposes exporting the eSIM profile data 30 from a current eUICC device to a server and / or to another eUICC device via a peer-to-peer manner.

[0077] Aspects of the present disclosure are believed to be applicable to a variety of different types of devices, systems, and methods involving radar systems and related communications. In certain embodiments, aspects of the present disclosure have proven to be beneficial when used in the context of automotive radars in an environment susceptible to the presence of multiple objects in a relatively small area. Aspects may be understood through the following discussion of non-limiting examples using exemplary contexts, but are not necessarily limited thereto.

[0078] Advantageously, in addition to transferring different data such as applications, emails, etc., the eSIM profile data can also be transferred between different entities in the manner shown above.

[0079] In the foregoing description, various specific details have been set forth to describe the specific examples presented herein. However, it should be apparent to those skilled in the art that one or more other examples and / or variations of these examples may be practiced without all the specific details given below. In other examples, well-known features are not described in detail to avoid obscuring the description of the examples herein. For ease of illustration, the same reference numerals may be used in different drawings to refer to the same element or other examples of the same element. Also, although aspects and features may be described in individual figures in some cases, it should be understood that features from one figure or embodiment may be combined with features of another figure or embodiment, although the combination is not explicitly shown or is not explicitly described as a combination.

[0080] For example, the specification describes and / or illustrates aspects useful for implementing the claimed disclosure with the aid of various circuits or circuit systems, which may be illustrated as or using items such as blocks, modules, devices, systems, units, controllers, and / or other circuit-type depictions. These circuits or circuit systems are used with other elements to illustrate how certain embodiments may be implemented in terms of form or structure, steps, functions, operations, activities, etc. For example, where such circuits or circuit systems may correspond to logic circuit systems (which may refer to or include a code-programmed / configured CPU), in one example, the logic circuit system may implement a process or method (sometimes an "algorithm") by performing such activities and / or steps associated with the above-mentioned functionality. In other examples, the logic circuit system may implement a process or method by performing these same activities / operations.

[0081] For example, in certain embodiments discussed above, one or more modules are discrete logic circuits or programmable logic circuits configured and arranged to implement these operations / activities. In certain embodiments, this programmable circuit is one or more computer circuits that include a memory circuit system for storing and accessing a program to be executed as one (or more) instruction sets (and / or to be used as configuration data to define how the programmable circuit will execute), and the algorithm or process described above is used by the programmable circuit to perform the relevant steps, functions, operations, activities, etc. Depending on the application, the instructions (and / or configuration data) can be configured to be implemented in a logic circuit system, where the instructions (whether represented in the form of object code, firmware or software) are stored in the memory (circuitry) and can be accessed from the memory. As another example, where the specification may refer to a "first" type of structure, a "second" type of structure, the adjectives "first" and "second" are not used to imply any description of the structure or provide any substantial meaning; in fact, such adjectives are only used in English antecedents to distinguish one such similarly named structure from another similarly named structure.

[0082] Based on the above discussion and illustration, it will be readily apparent to those skilled in the art that various modifications and changes may be made to the various embodiments without strictly following the exemplary embodiments and applications shown and described herein. For example, the methods illustrated in the figures may involve steps performed in various orders, wherein one or more aspects of the embodiments herein are maintained, or may involve fewer or more steps.

[0083] It should be noted that the term "comprising" does not exclude other elements or steps, and "a" or "an" does not exclude a plurality. Moreover, elements described in connection with different embodiments may be combined. It should also be noted that the reference numerals in the claims should not be interpreted as limiting the scope of the claims.

[0084] The disclosed devices, apparatuses, units, elements, systems, and methods described herein may be embodied, at least in part, by a computer program or multiple computer programs, which may exist in a variety of forms in a single computer system or across multiple computer systems in both active and inactive states. For example, they may exist as software programs consisting of program instructions in source code, object code, executable code, or other formats for performing some of the steps described. Any of the above formats may be embodied in compressed or uncompressed form on a computer-readable medium, which may include storage devices and signals.

[0085] It should be noted that the above embodiments have been described with reference to different subject matters. In particular, some embodiments may have been described with reference to method type claims, whereas other embodiments may have been described with reference to apparatus type claims.

[0086] However, those skilled in the art will appreciate from the foregoing that, unless otherwise indicated, any combination of features relating to different subjects, in addition to any combination of features belonging to one type of subject matter, and in particular, any combination of features of method type claims with features of apparatus type claims, are also deemed to be disclosed herein.

[0087] It has to be noted that the embodiments have been described with reference to different subject matters. In particular, some embodiments have been described with reference to method type claims, whereas other embodiments have been described with reference to apparatus type claims.

[0088] However, those skilled in the art will understand from the foregoing and the following description that, unless otherwise stated, in addition to any combination of features belonging to one type of subject matter, any combination of features related to different subject matters, in particular, the combination of features of method claims with features of apparatus claims, are also deemed to be disclosed together with the present application.

[0089] Reference numerals:

[0090] 10 Key creation material for configuration file data protection

[0091] 10a Public key material data for user data protection

[0092] 20 Configuration file encryption key

[0093] 30 eSIM profile data

[0094] 40 Servers

[0095] 100 1st eUICC device

[0096] 200 2nd eUICC device

[0097] 300…320 Method steps

[0098] 400 System

[0099] D1 First wireless communication device

[0100] D2 Second wireless communication device

[0101] SD1…SDn data segment

[0102] CD1…Cdn Confidential User Data

[0103] UK User Key

[0104] S1…S25 method steps.

Claims

1. A method for transferring eSIM profile data (30) from a first wireless communication device (D1) having a first eUICC device (100) to a second wireless communication device (D2) having a second eUICC device (200), characterized in that: The following steps are involved: a. providing, on the first eUICC device (100), encrypted eSIM profile data (30) together with encrypted confidential user data (CD1 ... CDn), the encrypted eSIM profile data (30) having been encrypted by means of a profile encryption key (20), wherein the encrypted confidential user data (CD1 ... CDn) having been at least partially encrypted by means of a user key (UK); b. passing the encrypted eSIM profile data (30) together with the encrypted confidential user data (CD1 ... CDn) from the first eUICC device (100) to the second eUICC device (200); and c. decrypting and installing the encrypted eSIM profile data (30) on the second wireless communication device (D2), wherein the confidential user data (CD1...CDn) is decrypted and installed on the second wireless communication device (D2) at least in part with the aid of the user key (UK).

2. The method according to claim 1, characterized in that The user key (UK) is a password.

3. The method according to claim 1 or 2, characterized in that: The user key (UK) is combined with public key material data (10a) to generate an encryption key for the confidential user data (CD1 . . . CDn).

4. A method according to any of the preceding claims, characterised in that When the eSIM profile data (30) has been received on the second wireless communication device (D2), input of the user key (UK) is requested in order to decrypt the encrypted personalization data by means of a personalization key.

5. The method according to claim 4, characterized in that When the eSIM profile data (30) has been received by the second wireless communication device (D2) and the user (N) does not want the confidential user data (CD1...CDn) on the second wireless communication device (D2), deleting the confidential user data (CD1...CDn) from the second wireless communication device (D2).

6. The method according to claim 4 or 5, characterized in that: The key creation material (10) and the profile encryption key (20) are generated transiently.

7. A method according to any of the preceding claims, characterised in that At least a single eSIM profile (30) is transferred from the first wireless communication device (D1) to the second wireless communication device (D2).

8. The method according to any one of claims 1 to 7, characterized in that In step a., the encrypted eSIM profile data (30) may alternatively have been MAC protected.

9. A wireless communication device (D1, D2), characterized in that: Arranged to perform a method according to any preceding claim.

10. A system (400), characterized in that: The invention comprises a first wireless communication device (D1) and a second wireless communication device (D2) according to claim 9.

Images