ESIM terminal remote configuration method, proxy forwarding server and configuration system

Abstract

The invention provides an eSIM terminal remote configuration method, a proxy forwarding server and a configuration system. The eSIM terminal remote configuration method comprises the following steps: acquiring a configuration request sent by an eSIM downloading service platform; based on a pre-stored proxy forwarding mapping table, forwarding the configuration request to a local proxy service module corresponding to the target terminal identifier, so that the local proxy service module forwards the configuration request to the eSIM terminal through a local access port; receiving configuration response information returned by the local proxy service module; the configuration response information is feedback generated after the configuration file is written into the eSIM terminal; and based on the proxy forwarding mapping table, returning the configuration response information to the eSIM downloading service platform so as to complete the configuration of the target eSIM terminal. In the mode, the eSIM terminal in a complex network environment can be configured remotely by establishing a proxy forwarding mechanism, so that the success rate and reliability of remote downloading of the eSIM code number are improved.

Description

Technical Field

[0001] This application relates to the field of smart card configuration technology, and in particular to an eSIM terminal remote configuration method, a proxy forwarding server, and a configuration system. Background Technology

[0002] With the increasing popularity of eSIM (embedded SIM) technology, configuring user identification modules remotely on devices has become a mainstream trend, especially in the Internet of Things (IoT) and various smart terminals. This allows operators or service providers to flexibly manage device network access identities without physically replacing the SIM card.

[0003] In existing technologies, for terminals with interactive capabilities, eSIM configuration information is often obtained by scanning a QR code or manually entering a download address. However, for IoT devices without an interactive interface or deployed in complex network environments (such as NAT, behind firewalls, or within corporate intranets), remote control and configuration typically rely on message distribution protocols such as MQTT (message queuing telemetry transport). But under complex network conditions, such protocols may face problems such as message loss, congestion, or difficulty in establishing connections, resulting in low configuration success rates and a lack of stability. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a remote configuration method for eSIM terminals, a proxy forwarding server, and a configuration system. By establishing a proxy forwarding mechanism, eSIM terminals in complex network environments can be remotely configured, thereby improving the success rate, reliability, and adaptability of remote eSIM number download in diverse network deployment scenarios.

[0005] In a first aspect, the present invention provides a remote configuration method for an eSIM terminal, applied to a proxy forwarding server, the proxy forwarding server being communicatively connected to both the eSIM terminal and an eSIM download service platform; a local proxy service module is pre-installed in the eSIM terminal; the local proxy service module is used to provide a local access port for accessing the eSIM terminal; the method includes: obtaining a configuration request sent by the eSIM download service platform; the configuration request including a target terminal identifier and a configuration file; forwarding the configuration request to the local proxy service module corresponding to the target terminal identifier based on a pre-stored proxy forwarding mapping table, so that the local proxy service module forwards the configuration request to the eSIM terminal through the local access port; the proxy forwarding mapping table characterizes the association between the target terminal identifier and the local access port; receiving configuration response information returned by the local proxy service module; the configuration response information being feedback generated after the configuration file is written to the eSIM terminal; and returning the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table to complete the configuration of the target eSIM terminal.

[0006] In an optional implementation, the proxy forwarding mapping table is established as follows: receiving a connection request sent by the local proxy service module and establishing a communication channel with the local proxy service module; the connection request includes a terminal identifier and a local access port; based on the terminal identifier, assigning a unique external access port to the eSIM terminal; the external access port is a port established on the proxy forwarding server for the eSIM terminal to receive requests from the eSIM download service platform; storing the association between the communication channel, terminal identifier, local access port, and external access port in the proxy forwarding mapping table; wherein, the proxy forwarding mapping table stores at least one association.

[0007] In an optional implementation, the step of establishing a communication channel with the local proxy service module includes: sending a public key certificate issued by a certificate authority to the local proxy service module so that the local proxy service module can verify the public key certificate based on a preset CA root certificate; receiving the certificate verification result returned by the local proxy service module; and establishing a communication channel with the local proxy service module if the certificate verification result is successful.

[0008] In an optional implementation, before obtaining the configuration request sent by the eSIM download service platform, the method further includes: obtaining a port query request sent by the eSIM download service platform; the port query request includes a target terminal identifier; determining the external access port corresponding to the target terminal identifier based on a proxy forwarding mapping table, and sending the external access port to the eSIM download service platform; receiving a channel opening request sent by the eSIM download service platform through the external access port; the channel opening request includes a target terminal identifier; determining the communication channel corresponding to the target terminal identifier based on the proxy forwarding mapping table; forwarding the channel opening request to the corresponding local proxy service module through the communication channel, so that the local proxy service module sends the channel opening request to the eSIM terminal through the local access port; receiving channel opening response information sent by the local proxy service module; the channel opening response information includes a channel number generated by the eSIM terminal based on the channel opening request; and forwarding the channel opening response information to the eSIM download service platform through the external access port.

[0009] In an optional implementation, after the step of returning the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table, the method further includes: receiving a channel closure request sent by the eSIM download service platform through an external access port; the channel closure request includes a target terminal identifier; determining the communication channel corresponding to the target terminal identifier based on the proxy forwarding mapping table; forwarding the channel closure request to the corresponding local proxy service module through the communication channel, so that the local proxy service module sends the channel closure request to the eSIM terminal through a local access port; receiving channel closure response information sent by the local proxy service module; the channel closure response information includes a closure confirmation feedback generated by the eSIM terminal after executing the channel closure request; and forwarding the channel closure response information to the eSIM download service platform through the external access port.

[0010] In an optional implementation, after obtaining the port query request sent by the eSIM download service platform, the method further includes: obtaining the IP address of the eSIM download service platform; determining whether the IP address is in a preset IP address whitelist; and if the IP address is in the preset IP address whitelist, determining that the eSIM download service platform is a legitimate service platform.

[0011] Secondly, the present invention provides a remote configuration method for an eSIM terminal, applied to a local proxy service module; the local proxy service module is pre-installed in the eSIM terminal; the local proxy service module is communicatively connected to a proxy forwarding server; the method includes: obtaining a configuration request sent by the proxy forwarding server; the configuration request includes a configuration file; forwarding the configuration request to the eSIM terminal to write the configuration file to the eSIM terminal; obtaining configuration response information returned by the eSIM terminal, and sending the configuration response information to the proxy forwarding server to complete the configuration of the eSIM terminal; wherein, the configuration response information is feedback generated after the configuration file is written to the eSIM terminal.

[0012] In an optional implementation, before the step of obtaining the configuration request sent by the proxy forwarding server, the method further includes: after the eSIM terminal is powered on, enabling the local access port; the local access port is used to establish a communication path with the eSIM terminal; generating a connection request based on the terminal identifier corresponding to the eSIM terminal and the local access port; and sending the connection request to the proxy forwarding server to establish a communication channel with the proxy forwarding server.

[0013] Thirdly, the present invention provides a proxy forwarding server, comprising: a platform request receiving unit, configured to acquire a configuration request sent by an eSIM download service platform; the configuration request includes a target terminal identifier and a configuration file; a request forwarding unit, configured to forward the configuration request to a local proxy service module corresponding to the target terminal identifier based on a pre-stored proxy forwarding mapping table, so that the local proxy service module forwards the configuration request to the eSIM terminal; a response forwarding unit, configured to receive configuration response information returned by the local proxy service module; the configuration response information is feedback generated after the configuration file is written to the eSIM terminal; the response forwarding unit is further configured to return the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table, so as to complete the configuration of the target eSIM terminal.

[0014] Fourthly, the present invention provides a configuration system, including an eSIM download service platform, an eSIM terminal, and a local proxy service module pre-installed in the eSIM terminal, and also includes the aforementioned proxy forwarding server.

[0015] This application provides an eSIM terminal remote configuration method, proxy forwarding server, and configuration system. By using the proxy forwarding server as a relay communication node between the eSIM download service platform and the eSIM terminal, it enables remote configuration of the eSIM terminal in complex network environments, overcoming the limitation of direct terminal access in existing technologies. By setting up a local proxy service module and enabling the local access port, and establishing a secure communication channel with the proxy forwarding server, it supports the opening / closing of channels required for multi-round command interaction, ensuring the integrity and consistency of the configuration process. The proxy forwarding server maintains the association between the target terminal identifier and the local access port, external access port, and communication channel, flexibly supporting multiple terminals online simultaneously, avoiding connection chaos, and improving configuration scheduling efficiency. Furthermore, this application enhances authentication and access control capabilities during terminal communication by introducing TLS (Transport Layer Security) certificate authentication and IP whitelisting mechanisms, effectively ensuring the security and uniqueness of the remote configuration link. In summary, this application improves the practicality and deployability of eSIM terminal remote configuration in IoT scenarios.

[0016] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application are realized and obtained through the structures particularly pointed out in the description, claims and drawings.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 Flowchart of the eSIM terminal remote configuration method applied to the proxy forwarding server provided in this application; Figure 2 A flowchart of the eSIM terminal remote configuration method applied to the local agent service module provided in this application; Figure 3 A schematic diagram of a proxy forwarding server provided in an embodiment of this application; Figure 4This is a schematic diagram of the configuration system provided in an embodiment of this application; Figure 5 This is a schematic diagram of the local proxy service module provided in an embodiment of this application; Figure 6 A flowchart of the configuration system provided in this application embodiment.

[0020] Icons: 1-Proxy forwarding server; 2-Local proxy service module; 3-eSIM download service platform; 4-eSIM terminal; 11-Platform request receiving unit; 12-Request forwarding unit; 13-Response forwarding unit; 21-Server request receiving unit; 22-Terminal forwarding unit. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] To facilitate understanding of this embodiment, the embodiments of this application will be described in detail below.

[0023] Example 1: Figure 1 A flowchart illustrating the remote configuration method for an eSIM terminal applied to a proxy forwarding server provided in this application.

[0024] The proxy forwarding server communicates with both the eSIM terminal and the eSIM download service platform; the eSIM terminal has a local proxy service module pre-installed; the local proxy service module provides a local access port for accessing the eSIM terminal.

[0025] Here, the proxy forwarding server is a network entity that acts as an intermediary node to forward data and signaling between different network entities. In this embodiment, the proxy forwarding server establishes communication connections with both the eSIM terminal and the eSIM download service platform.

[0026] eSIM terminals, such as IoT devices, smart wearables, or other devices with embedded eSIMs, operate in complex network environments (such as NAT, firewalls, and corporate intranets). These eSIM terminals have a pre-installed or integrated local proxy service module. This module can be installed as a standalone component within the eSIM terminal or directly integrated into the eSIM chip. Regardless of its location, the local proxy service module provides a local access port, serving as a standardized interface for accessing the functions of the eSIM chip within the eSIM terminal. For example, the local proxy service module can initiate an HTTP (Hypertext Transfer Protocol) service on this local access port, receiving locally received or forwarded instructions and translating them into low-level operations for the eSIM chip.

[0027] An eSIM download service platform typically refers to a server entity deployed by an operator or service provider for managing and distributing eSIM numbers.

[0028] Reference Figure 1 The method for remote configuration of eSIM terminals applied to proxy forwarding servers includes: Step S101: Obtain the configuration request sent by the eSIM download service platform; the configuration request includes the target terminal identifier and configuration file.

[0029] Here, when the eSIM download service platform needs to configure a code number for a specific eSIM terminal, it sends a configuration request to the proxy forwarding server. The configuration request is the core data packet that directly contains the code number configuration file.

[0030] Specifically, the target terminal identifier is an identifier that can uniquely identify the target eSIM terminal. In a preferred embodiment of the present invention, this identifier is the EID (Embedded Identity File Identifier) ​​of the eSIM chip. The eSIM download service platform uses this EID to specify the target device for configuration operations.

[0031] The configuration file, also known as a profile, is the code data to be downloaded to the eSIM chip of the target eSIM terminal. It contains subscription data, authentication information, operator network parameters, etc., enabling the eSIM terminal to access the mobile network. In actual interaction, the configuration file may not be downloaded all at once, but rather gradually written to the eSIM chip through a series of APDU (Application Protocol Data Unit) commands. Therefore, a configuration request can also be understood as an initial request containing these APDU commands or used to trigger these command sequences.

[0032] The proxy forwarding server listens on one or more specific external access ports to receive configuration requests from the eSIM download service platform.

[0033] In one embodiment, prior to step S101, the method further includes the following steps S201-S207.

[0034] Step S201: Obtain the port query request sent by the eSIM download service platform; the port query request includes the target terminal identifier.

[0035] Before performing any configuration operations with the target eSIM terminal, the eSIM download service platform needs to determine the correct network access point for communication with the target eSIM terminal through the proxy forwarding server. To do this, the eSIM download service platform sends a port query request to the proxy forwarding server.

[0036] Specifically, in addition to listening for specific service requests on the external access port allocated to each eSIM terminal, the proxy forwarding server also provides one or more predefined, publicly available query service interfaces. The eSIM download service platform sends a port query request to this query service interface. The port query request includes the target EID.

[0037] Step S202: Based on the proxy forwarding mapping table, determine the external access port corresponding to the target terminal identifier, and send the external access port to the eSIM download service platform.

[0038] Here, after receiving a port query request, the proxy forwarding server will perform the following operations: 1. Parse the request: Extract the target EID contained in the request.

[0039] 2. Query the mapping table: Use the received target EID as the query key to query its internal proxy forwarding mapping table.

[0040] 3. Determine the port: Locate the external access port information corresponding to the target EID.

[0041] 4. Return result: The proxy forwarding server will send the information of the external access port (e.g., port number) as a response back to the eSIM download service platform.

[0042] Step S203: Receive a channel opening request sent by the eSIM download service platform through an external access port; the channel opening request includes the target terminal identifier.

[0043] Here, after obtaining the correct external access port information, the eSIM download service platform can now begin actual service interaction with the target eSIM terminal. Typically, before interacting with the eSIM terminal via APDU commands, a logical channel needs to be established through a channel opening request.

[0044] The channel opening request is sent to the proxy forwarding server via the external access port obtained through the query. In addition to the specific parameters required to perform the channel opening operation, the request usually also includes the target terminal identifier so that the proxy forwarding server can verify or record it.

[0045] Step S204: Based on the proxy forwarding mapping table, determine the communication channel corresponding to the target terminal identifier.

[0046] Here, after receiving a channel opening request on the external access port, the proxy forwarding server forwards the request to the target eSIM terminal.

[0047] By receiving the request from the external access port or the target EID contained in the request, the proxy forwarding server can find the communication channel corresponding to the EID in the mapping table.

[0048] Step S205: The channel opening request is forwarded to the corresponding local agent service module through the communication channel, so that the local agent service module sends the channel opening request to the eSIM terminal through the local access port.

[0049] Here, after the communication channel is determined, the proxy forwarding server will forward the received channel opening request through that communication channel.

[0050] After receiving this channel opening request, the local agent service module further passes it to the eSIM terminal.

[0051] Step S206: Receive channel opening response information sent by the local agent service module; the channel opening response information includes the channel number generated by the eSIM terminal based on the channel opening request.

[0052] Here, after processing the channel opening request, if the operation is successful, the eSIM terminal will allocate a logical channel and return a channel number. This channel number is used to transmit APDU command interactions performed on that logical channel. The eSIM terminal then returns this response information, including the channel number, to the local agent service module.

[0053] After receiving the response information that this channel has been opened, the local proxy service module will send it back to the proxy forwarding server through the previously established communication channel (long connection).

[0054] Step S207: The channel opening response information is forwarded to the eSIM download service platform through the external access port.

[0055] Here, after receiving the channel opening response information from the local proxy service module through the communication channel, the proxy forwarding server sends this response information back to the eSIM download service platform.

[0056] The proxy forwarding server uses its internal relationships to forward the channel opening response information, which includes the channel number, back to the eSIM download service platform through the external access port that initially received the request.

[0057] At this point, the eSIM download service platform has successfully obtained the logical channel number required to interact with the eSIM chip, in order to conduct subsequent APDU command interactions.

[0058] In one embodiment, prior to step S101, the method further includes the following steps S301-S303.

[0059] Step S301: Obtain the IP address of the eSIM download service platform.

[0060] Here, when the eSIM download service platform sends a port query request to the query service interface of the proxy forwarding server, the proxy forwarding server obtains the network address of the eSIM download service platform.

[0061] Specifically, when the proxy forwarding server receives the port query request in its network protocol stack, it extracts the source IP address from the network connection or data packet carrying the request. Each IP data packet contains the source IP address, which is the network address of the eSIM download service platform. For example, if the request is sent via a TCP connection, the proxy forwarding server can obtain the IP address of the eSIM download service platform by querying the socket information of that TCP connection.

[0062] Step S302: Determine whether the IP address is in the preset IP address whitelist.

[0063] Here, after obtaining the IP address of the eSIM download service platform, the proxy forwarding server will compare it with the preset IP address whitelist.

[0064] The default IP address whitelist is a pre-configured and maintained list. It contains one or more groups of IP addresses or IP address ranges considered trustworthy and legitimate eSIM download service platforms. Only requests originating from IP addresses stored in this whitelist are initially considered trustworthy.

[0065] The specific judgment process involves matching the obtained actual IP address of the eSIM download service platform with each entry stored in the whitelist.

[0066] Step S303: If the IP address is in the preset IP address whitelist, determine that the eSIM download service platform is a legitimate service platform.

[0067] Here, if the proxy forwarding server finds an entry in the preset IP address whitelist that matches the obtained eSIM download service platform's IP address, it means that the source of the eSIM download service platform initiating the port query request is trustworthy. At this point, the proxy forwarding server can determine that the eSIM download service platform is a legitimate service platform.

[0068] If the platform is identified as a legitimate service platform, the proxy forwarding server will continue to process the port query requests previously sent by that eSIM download service platform.

[0069] If the determination result is that the IP address is not in the preset IP address whitelist, the proxy forwarding server will perform one or more of the following operations: Denial of Service: The proxy forwarding server will not process the port query request and will not return any external access port information.

[0070] Error response: The proxy forwarding server may return an error code or message to the IP address indicating authentication failure or lack of permission.

[0071] Log recording and alerts: The proxy forwarding server will record this unauthorized access attempt in the security log and trigger a security alert so that the administrator can audit and respond.

[0072] Connection lost: The proxy forwarding server directly disconnected the network connection established with the illegal IP address.

[0073] Through this IP address whitelist verification mechanism, this application can effectively block illegal requests from unauthorized IP addresses, enhance the security of the proxy forwarding server and the entire eSIM remote configuration system, and ensure that only legitimate eSIM download service platforms can query and use the forwarding services they provide.

[0074] Step S102: Based on the pre-stored proxy forwarding mapping table, the configuration request is forwarded to the local proxy service module corresponding to the target terminal identifier, so that the local proxy service module forwards the configuration request to the eSIM terminal through the local access port; the proxy forwarding mapping table represents the association between the target terminal identifier and the local access port.

[0075] Here, after receiving the configuration request, the proxy forwarding server needs to forward the request to the local proxy service module inside the target eSIM terminal.

[0076] When the proxy forwarding server receives a configuration request for a specific target terminal identifier, it queries the proxy forwarding mapping table. Using the target terminal identifier, the proxy forwarding server can locate the previously established communication channel with the local proxy service module corresponding to that EID. Then, the proxy forwarding server forwards the received configuration request to the local proxy service module on the target eSIM terminal through this found communication channel, either unchanged or after necessary protocol conversion.

[0077] Once the local proxy service module receives a configuration request forwarded by the proxy forwarding server, it parses the request and sends the instructions to the eSIM chip inside the eSIM terminal for processing via its provided local access port. If the local proxy service module itself is integrated into the eSIM chip, then forwarding via the local access port here refers to internal function calls or inter-process communication.

[0078] In one embodiment, the proxy forwarding mapping table in step S102 is established through the following steps S401-S403.

[0079] Step S401: Receive a connection request sent by the local proxy service module and establish a communication channel with the local proxy service module; the connection request includes the terminal identifier and the local access port.

[0080] Here, in order to communicate indirectly with the eSIM terminal, the proxy forwarding server needs to establish a stable and reliable communication path with the local proxy service module on the eSIM terminal.

[0081] Specifically, when the eSIM terminal is powered on or its local proxy service module is started, it will proactively initiate a connection request to the address and port of the pre-configured proxy forwarding server.

[0082] The connection request carries key identification information, mainly including: terminal identifier and local access port.

[0083] A terminal identifier is an identifier that uniquely identifies the eSIM terminal. In a preferred embodiment of the invention, the terminal identifier is the EID of the eSIM chip. The proxy forwarding server will subsequently use this EID to distinguish different eSIM terminals.

[0084] The local access port refers to a port number on the eSIM terminal that is provided and listened to by the local proxy service module. The local proxy service module provides an access interface to the eSIM chip through this port; for example, an HTTP service can run on this port to receive and process instructions sent to the eSIM chip. The proxy forwarding server records this local access port information.

[0085] Upon receiving this connection request, the proxy forwarding server negotiates and establishes a communication channel with the local proxy service module. This communication channel is the actual path for subsequent data transmission between the proxy forwarding server and the local proxy service module. In a preferred embodiment, the communication channel is a persistent connection based on the TCP / IP protocol (Transmission Control Protocol / Internet Protocol), i.e., a long-lived TCP connection. Once established, this long-lived connection remains open unless a network failure occurs or it is explicitly closed, ensuring that the proxy forwarding server can send instructions to the local proxy service module at any time, and also ensuring that the local proxy service module can promptly send back response information.

[0086] Step S402: Based on the terminal identifier, assign a unique external access port to the eSIM terminal; the external access port is a port established on the proxy forwarding server for the eSIM terminal to receive requests from the eSIM download service platform.

[0087] Here, after successfully establishing a communication channel with the local proxy service module of the eSIM terminal, the proxy forwarding server needs to set up a unique external access port for the eSIM terminal to be accessed by the eSIM download service platform.

[0088] The external access port is a network port that the proxy forwarding server opens and listens on. For each eSIM terminal that successfully connects to the proxy forwarding server through the local proxy service module, the proxy forwarding server will assign it a unique external access port number, or use other mechanisms (such as based on URL path or other parameters) to ensure that requests for different EIDs can be distinguished through one or more shared external access ports.

[0089] The external access port is the designated receiving point for the eSIM download service platform to send configuration requests to a specific eSIM terminal.

[0090] Step S403: Store the association between the communication channel, terminal identifier, local access port and external access port in the proxy forwarding mapping table; wherein the proxy forwarding mapping table stores at least one association.

[0091] Here, the proxy forwarding server creates or updates an entry in the proxy forwarding mapping table, which binds at least the communication channel, terminal identifier, local access port, and external access port together.

[0092] By storing this association, the proxy forwarding mapping table acquires route lookup capabilities. When the eSIM download service platform sends a request to the proxy forwarding server through an external access port, the proxy forwarding server can find the corresponding communication channel handle based on that external access port (or the EID included in the request), and thus forward the request to the corresponding eSIM terminal. Conversely, when the proxy forwarding server receives a response from an eSIM terminal through a communication channel, it can also find out which external access port to use to send the response back to the eSIM download service platform.

[0093] In one embodiment, step S102, the step of establishing a communication channel with the local proxy service module, includes the following steps S501-S503.

[0094] Step S501: Send the public key certificate issued by the certificate authority to the local proxy service module so that the local proxy service module can verify the public key certificate based on the preset CA root certificate.

[0095] Here, after the local proxy service module initiates an initial connection request to the proxy forwarding server and the proxy forwarding server accepts it, the two parties can start a TLS handshake process before formally establishing a communication channel for application layer data transmission.

[0096] In this process, as part of the TLS handshake, the proxy forwarding server sends a public key certificate issued by a Certificate Authority (CA) to the local proxy service module. This public key certificate is the digital identity proof of the proxy forwarding server, which contains the proxy forwarding server's public key, the server's identity information (such as domain name), the certificate's validity period, and the digital signature of the CA that issued the certificate.

[0097] Upon receiving this public key certificate, the local proxy service module will verify it to confirm the authenticity and trustworthiness of the proxy forwarding server. The verification process specifically includes: 1. Check the certificate chain: If the certificate of the proxy forwarding server is not issued directly by the root CA, but by an intermediate CA, the local proxy service module will check the complete certificate chain up to a trusted root CA.

[0098] 2. Signature Verification: The local proxy service module uses its default CA root certificate to verify the validity of the digital signature of the next-level certificate in the certificate chain. The local proxy service module internally stores one or more root certificates of trusted CAs.

[0099] 3. Check the validity period: Ensure that the certificate is currently valid.

[0100] 4. Check if the certificate subject matches the expected identity: For example, check if the domain name in the certificate is consistent with the expected domain name or IP address of the proxy forwarding server that the local proxy service module is trying to connect to.

[0101] Through this series of verification steps, the local proxy service module can determine whether the connected proxy forwarding server is a legitimate and expected server.

[0102] Step S502: Receive the certificate verification result returned by the local agent service module.

[0103] Here, after the local proxy service module completes the verification of the public key certificate of the proxy forwarding server, it returns the certificate verification result to the proxy forwarding server so that the proxy forwarding server knows the result of the verification.

[0104] Step S503: If the certificate verification result is successful, establish a communication channel with the local agent service module.

[0105] Here, if the certificate verification result is successful, it means that the local proxy service module has confirmed that the identity of the proxy forwarding server is trustworthy. In this case, both parties will continue to complete the remaining parts of the TLS handshake, such as key exchange, encryption specification negotiation, sending and verifying the "Finished" message, etc.

[0106] Once all steps of the TLS handshake are successfully completed, an encrypted and secure communication channel is established between the proxy forwarding server and the local proxy service module. At this point, all application layer data transmitted through this channel will be protected by TLS encryption and integrity verification.

[0107] If the certificate verification fails, the proxy forwarding server will not establish a communication channel with the local proxy service module, and the connection attempt will be terminated, thus ensuring the security of communication and preventing the establishment of connections with unauthorized or counterfeit terminals.

[0108] Step S103: Receive configuration response information returned by the local agent service module; the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal.

[0109] Here, after the eSIM terminal processes the instructions sent by the local proxy service module through the local access port (e.g., successfully opening a logical channel and returning the channel number, successfully executing an APDU instruction and returning the execution result, or final confirmation after the entire configuration file is successfully written), it will generate corresponding feedback information. The eSIM terminal will then return the feedback information to the local proxy service module.

[0110] After receiving feedback from the eSIM terminal, the local proxy service module will send this feedback information back to the proxy forwarding server through the same communication channel previously established with the proxy forwarding server.

[0111] Step S104: Based on the proxy forwarding mapping table, the configuration response information is returned to the eSIM download service platform to complete the configuration of the target eSIM terminal.

[0112] Here, after receiving the configuration response information from the local proxy service module via a long connection, the proxy forwarding server returns it to the eSIM download service platform that initially initiated the request, based on the proxy forwarding mapping table.

[0113] In one embodiment, step S104 includes the following steps S601-S605.

[0114] Step S601: Receive a channel closure request sent by the eSIM download service platform through an external access port; the channel closure request includes the target terminal identifier.

[0115] Here, when the eSIM download service platform believes that the current configuration interaction phase with the target eSIM terminal (e.g., a complete profile download and installation process, or a specific APDU instruction sequence exchange) has been completed, the eSIM download service platform will proactively initiate a channel closure request.

[0116] The channel closure request is sent by the eSIM download service platform to the same external access port previously used for the target eSIM terminal.

[0117] A channel close request is intended to instruct an eSIM terminal to close the logical channel previously opened via a channel open request. The request typically includes the target terminal identifier for routing confirmation or logging by the proxy forwarding server.

[0118] Step S602: Based on the proxy forwarding mapping table, determine the communication channel corresponding to the target terminal identifier.

[0119] Here, after receiving a channel closure request on the external access port, the proxy forwarding server forwards this request to the target eSIM terminal based on the proxy forwarding mapping table.

[0120] By identifying the external access port that receives the request or by directly utilizing the target EID contained in the request, the proxy forwarding server can find the communication channel corresponding to the target EID in the mapping table.

[0121] Step S603: The channel closure request is forwarded to the corresponding local agent service module through the communication channel, so that the local agent service module sends the channel closure request to the eSIM terminal through the local access port.

[0122] Here, after determining the communication channel of the target eSIM terminal's local proxy service module, the proxy forwarding server forwards the entire content of the received channel closure request or its core instruction portion through that communication channel.

[0123] Upon receiving this channel closure request, the local agent service module further transmits it to the eSIM terminal.

[0124] Step S604: Receive channel closure response information sent by the local agent service module; the channel closure response information includes closure confirmation feedback generated after the eSIM terminal executes the channel closure request.

[0125] Here, after successfully executing the channel closure request and closing the specified logical channel, the eSIM terminal will generate a status response indicating that the operation was successful, namely the closure confirmation feedback, and return the closure confirmation feedback to the local agent service module.

[0126] After receiving the response information that this channel is closed, the local proxy service module will send it back to the proxy forwarding server through the previously established communication channel.

[0127] Step S605: Forward the channel closure response information to the eSIM download service platform through the external access port.

[0128] Here, after receiving the channel closure response information from the local proxy service module through the communication channel, the proxy forwarding server sends this channel closure response information back to the eSIM download service platform.

[0129] Based on the proxy forwarding mapping table, the proxy forwarding server forwards the channel closure response information back to the eSIM download service platform through the external access port that initially received the channel closure request.

[0130] At this point, the eSIM download service platform received confirmation of successful closure of the logical channel, marking the end of a complete interactive session with the eSIM chip (from opening the channel, data exchange to closing the channel), thereby ensuring effective management of eSIM terminal resources and the integrity of the entire remote configuration session.

[0131] The eSIM terminal remote configuration method for a proxy forwarding server provided in this application establishes and manages a long-connection communication tunnel initiated by the eSIM terminal that can penetrate complex network barriers such as Network Address Translation and firewalls. It also provides the eSIM download service platform with a query mechanism based on terminal identifiers and a dedicated external access port, thereby achieving highly reliable and secure remote configuration of eSIM terminals in complex network environments. This application not only utilizes a proxy forwarding mapping table to ensure accurate and stable bidirectional relay of configuration request and response information between the eSIM download service platform and the target eSIM terminal, significantly improving the success rate of eSIM configuration and its adaptability under various network conditions, but also enhances the security of the entire configuration process through an integrated security authentication mechanism, improving the flexible deployment and efficient management capabilities of eSIM technology in diverse and large-scale scenarios.

[0132] Example 2: Figure 2 This is a schematic diagram of an eSIM terminal remote configuration method applied to a local agent service module, as provided in Embodiment 2 of this application.

[0133] The local proxy service module is pre-installed in the eSIM terminal; the local proxy service module communicates with the proxy forwarding server.

[0134] Reference Figure 2 The method for remote configuration of eSIM terminals applied to the local agent service module includes: Step S701: Obtain the configuration request sent by the proxy forwarding server; the configuration request includes a configuration file.

[0135] Here, when the eSIM download service platform sends configuration information to the target eSIM terminal through the proxy forwarding server, the proxy forwarding server sends the corresponding configuration requests to the target eSIM terminal's local proxy service module through a previously established communication channel (TCP long connection). The local proxy service module obtains these requests by listening to this communication channel.

[0136] The configuration request includes the actual data of the configuration file or a sequence of instructions for writing to the profile. In the complete eSIM configuration process, the configuration request can also refer to other types of instructions, such as a logical channel open request, an APDU instruction request, or a logical channel close request. When these request data are transmitted over a communication channel, if it is through a secure protocol such as TLS, the data itself is encrypted.

[0137] In one embodiment, before step S701, the method further includes the following steps S801-S803.

[0138] Step S801: After the eSIM terminal is powered on, the local access port is enabled; the local access port is used to establish a communication path with the eSIM terminal.

[0139] Here, when the eSIM terminal is powered on or the local proxy service module is activated, the local proxy service module initializes its internal services to enable the local access port.

[0140] The local agent service module is pre-installed or integrated into the eSIM terminal.

[0141] The local access port is used to receive and interact with instructions sent to the eSIM chip.

[0142] Step S802: Generate a connection request based on the terminal identifier and local access port corresponding to the eSIM terminal.

[0143] Here, after the local access port is successfully enabled and ready to provide access services to the eSIM terminal, the local proxy service module initiates a connection to the remote proxy forwarding server by generating a connection request. The connection request includes: the terminal identifier corresponding to the eSIM terminal and the local access port.

[0144] The local proxy service module assembles information such as EID and local access port number into a connection request message in a predefined format.

[0145] Step S803: Send a connection request to the proxy forwarding server to establish a communication channel with the proxy forwarding server.

[0146] Here, after generating a connection request, the local proxy service module sends it to the network address (IP address and port number) of the pre-configured proxy forwarding server. Because the connection is initiated by the eSIM terminal located in an intranet or restricted network to the proxy forwarding server in a public or reachable network, this application can penetrate NAT and firewalls to send information to the proxy forwarding server.

[0147] Step S702: Forward the configuration request to the eSIM terminal to write the configuration file to the eSIM terminal.

[0148] Here, after receiving a configuration request containing a configuration file, the local agent service module passes the request to the eSIM terminal for processing.

[0149] Step S703: Obtain the configuration response information returned by the eSIM terminal and send the configuration response information to the proxy forwarding server to complete the configuration of the eSIM terminal; wherein, the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal.

[0150] Here, after the eSIM chip completes the operation of writing the configuration file (or related instruction sequence), it generates a "configuration response message". This response message is "feedback generated after the configuration file is written to the eSIM terminal", such as a status code indicating whether the writing was successful or failed, or more detailed execution results.

[0151] The local proxy service module obtains this configuration response information from the eSIM chip through its "local access port" mechanism (e.g., receiving a response from its local HTTP service).

[0152] Upon receiving the response, the local proxy service module immediately retransmits the "configuration response information" to the proxy forwarding server via the previously established communication channel (TCP long connection). The proxy forwarding server then forwards the information to the eSIM download service platform, enabling the platform to understand the configuration operation result and complete the entire closed-loop communication process to "complete the eSIM terminal configuration."

[0153] The eSIM terminal remote configuration method provided in this application, applied to a local proxy service module, enables eSIM terminals deployed in complex network environments such as network address translation and firewalls to be remotely, reliably, and securely configured. This method allows the local proxy service module to proactively initiate and maintain a secure long-term communication channel with the proxy forwarding server after the eSIM terminal is powered on. Simultaneously, it utilizes its internally established local access port as a standardized interface for interaction with the eSIM chip. This not only improves the accessibility of eSIM terminals in networks that are difficult to access directly, and ensures stable reception of configuration requests relayed via the proxy forwarding server and accurate response information, but also simplifies the remote control logic of the eSIM terminal through a standardized local interface.

[0154] Example 3: Figure 3 This is a schematic diagram of a proxy forwarding server provided in an embodiment of this application.

[0155] Reference Figure 3 Proxy forwarding servers, including: The platform request receiving unit 11 is used to obtain the configuration request sent by the eSIM download service platform; the configuration request includes the target terminal identifier and configuration file.

[0156] The request forwarding unit 12 is used to forward the configuration request to the local proxy service module corresponding to the target terminal identifier based on the pre-stored proxy forwarding mapping table, so that the local proxy service module forwards the configuration request to the eSIM terminal.

[0157] The response forwarding unit 13 is used to receive configuration response information returned by the local agent service module; the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal.

[0158] The response forwarding unit 13 is also used to return the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table in order to complete the configuration of the target eSIM terminal.

[0159] The proxy server provided in this application manages long-lived connections initiated by the terminal and capable of penetrating complex network barriers such as Network Address Translation and firewalls. By combining external access port allocation with an internal proxy forwarding mapping table mechanism, it constructs a stable, reliable, and secure bidirectional data path in complex network environments. This enables the proxy forwarding server to locate the access point of a specific terminal based on queries from the eSIM download service platform and accurately relay configuration request and response information. This significantly improves the reachability, success rate, and management efficiency of eSIM remote configuration. Furthermore, by implementing security measures such as TLS certificate authentication and IP whitelist verification, the security and controllability of the entire configuration process are ensured.

[0160] Example 4: Figure 4 This is a schematic diagram of the configuration system provided in an embodiment of this application.

[0161] Figure 5 This is a schematic diagram of the local proxy service module provided in an embodiment of this application.

[0162] Reference Figure 4 It includes an eSIM download service platform 3, an eSIM terminal 4, and a local proxy service module 2 pre-installed in the eSIM terminal 4, as well as the aforementioned proxy forwarding server 1.

[0163] In one embodiment, reference is made to Figure 5 Local proxy service module 2 includes: Server request receiving unit 21 is used to obtain configuration requests sent by the proxy forwarding server; the configuration request includes a configuration file.

[0164] Terminal forwarding unit 22 is used to forward configuration requests to the eSIM terminal so as to write the configuration file to the eSIM terminal.

[0165] The terminal forwarding unit 22 is also used to obtain the configuration response information returned by the eSIM terminal and send the configuration response information to the proxy forwarding server to complete the configuration of the eSIM terminal; wherein, the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal.

[0166] The local proxy service module provided in this application proactively initiates and maintains a secure, persistent communication connection with the proxy forwarding server. It utilizes its internal local access port to construct a standardized interface for operating the eSIM chip, thereby enabling eSIM terminals deployed in complex or restricted network environments such as those with network address translation or firewalls to accept remote management and online configuration. The local proxy service module not only allows eSIM terminals to penetrate common network barriers, register themselves with the remote configuration system, and establish a stable bidirectional communication path, but also translates configuration requests from the network side and passes them to the eSIM chip for execution. Simultaneously, it reliably sends the chip's execution results or feedback information back to the proxy forwarding server, improving the accuracy and security of the entire end-to-end remote configuration solution on the terminal side.

[0167] Reference Figure 6 In the eSIM remote configuration system, various components work together to remotely configure eSIM terminals in complex network environments. Specifically, the eSIM download service platform, as the initiator and code provider of the configuration, is responsible for generating eSIM configuration requests. These requests typically contain a unique identifier for the target eSIM terminal and configuration file data or related instructions to be written. The local proxy service module is responsible for actively establishing and maintaining a secure and persistent communication channel with the proxy forwarding server after the terminal starts up, while providing a standardized access interface to the eSIM chip within the eSIM terminal through its internal local access port. The proxy forwarding server, through its internal platform request receiving unit, request forwarding unit, and response forwarding unit (and the proxy forwarding mapping table supporting these units), receives and manages connections from the local proxy service modules of various eSIM terminals, and provides the eSIM download service platform with external access ports for querying and issuing configuration requests. When the eSIM download service platform needs to configure an eSIM terminal, it first determines the external access port corresponding to the target terminal through the query mechanism of the proxy forwarding server, and then sends the configuration request to that port. The proxy forwarding server then uses the mapping table to find the established communication channel to the local proxy service module of the target terminal, forwards the request, and after receiving the configuration response information returned by the local proxy service module, returns it to the eSIM download service platform, thus jointly completing the entire remote configuration process.

[0168] The configuration system provided in this application not only ensures that the eSIM download service platform can reliably and securely deliver configuration commands and data to the target eSIM terminal that was originally difficult to access directly, and stably receive its response, through the active connection mechanism of the proxy forwarding server and the local proxy service module, but also improves the success rate of eSIM configuration, the stability of the overall process, security and management efficiency through the clear division of labor and efficient cooperation of each component. It provides operators and users with a complete, efficient and controllable technical platform for large-scale eSIM deployment and flexible management under diverse network conditions.

[0169] The computer program product provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0170] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0171] Furthermore, in the description of the embodiments of this application, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0172] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0173] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

Claims

1. A method for remote configuration of an eSIM terminal, characterized in that, This is applied to a proxy forwarding server, which is communicatively connected to both the eSIM terminal and the eSIM download service platform; the eSIM terminal has a local proxy service module pre-installed in it. The local proxy service module is used to provide a local access port for accessing the eSIM terminal; the method includes: Obtain the configuration request sent by the eSIM download service platform; the configuration request includes the target terminal identifier and configuration file; Based on a pre-stored proxy forwarding mapping table, the configuration request is forwarded to the local proxy service module corresponding to the target terminal identifier, so that the local proxy service module forwards the configuration request to the eSIM terminal through the local access port; the proxy forwarding mapping table represents the association between the target terminal identifier and the local access port; Receive configuration response information returned by the local agent service module; the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal; Based on the proxy forwarding mapping table, the configuration response information is returned to the eSIM download service platform to complete the configuration of the target eSIM terminal.

2. The eSIM terminal remote configuration method according to claim 1, characterized in that, The proxy forwarding mapping table is established in the following manner: The system receives a connection request sent by the local proxy service module and establishes a communication channel with the local proxy service module; the connection request includes a terminal identifier and the local access port. Based on the terminal identifier, a unique external access port is assigned to the eSIM terminal; the external access port is a port established on the proxy forwarding server for the eSIM terminal to receive requests from the eSIM download service platform; The association between the communication channel, the terminal identifier, the local access port, and the external access port is stored in the proxy forwarding mapping table; wherein, the proxy forwarding mapping table stores at least one of the associations.

3. The eSIM terminal remote configuration method according to claim 2, characterized in that, The step of establishing a communication channel with the local proxy service module includes: Send a public key certificate issued by a certificate authority to the local proxy service module so that the local proxy service module can verify the public key certificate based on a preset CA root certificate; Receive the certificate verification result returned by the local proxy service module; If the certificate verification result is successful, a communication channel is established with the local agent service module.

4. The eSIM terminal remote configuration method according to claim 2, characterized in that, Before the step of obtaining the configuration request sent by the eSIM download service platform, the method further includes: Obtain the port query request sent by the eSIM download service platform; the port query request includes the target terminal identifier; Based on the proxy forwarding mapping table, the external access port corresponding to the target terminal identifier is determined, and the external access port is sent to the eSIM download service platform; Receive a channel opening request sent by the eSIM download service platform through the external access port; the channel opening request includes the target terminal identifier; Based on the proxy forwarding mapping table, the communication channel corresponding to the target terminal identifier is determined; The channel opening request is forwarded to the corresponding local proxy service module through the communication channel, so that the local proxy service module sends the channel opening request to the eSIM terminal through the local access port; The system receives a channel opening response message sent by the local proxy service module; the channel opening response message includes a channel number generated by the eSIM terminal based on the channel opening request. The channel opening response information is forwarded to the eSIM download service platform through the external access port.

5. The eSIM terminal remote configuration method according to claim 4, characterized in that, After the step of returning the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table, the method further includes: Receive a channel closure request sent by the eSIM download service platform through the external access port; the channel closure request includes the target terminal identifier; Based on the proxy forwarding mapping table, the communication channel corresponding to the target terminal identifier is determined; The channel closure request is forwarded to the corresponding local proxy service module through the communication channel, so that the local proxy service module sends the channel closure request to the eSIM terminal through the local access port; The system receives channel closure response information sent by the local proxy service module; the channel closure response information includes closure confirmation feedback generated by the eSIM terminal after executing the channel closure request. The channel closure response information is forwarded to the eSIM download service platform through the external access port.

6. The eSIM terminal remote configuration method according to claim 4, characterized in that, After the step of obtaining the port query request sent by the eSIM download service platform, the method further includes: Obtain the IP address of the eSIM download service platform; Determine whether the IP address is in the preset IP address whitelist; If the IP address is in the preset IP address whitelist, the eSIM download service platform is determined to be a legitimate service platform.

7. A method for remote configuration of an eSIM terminal, characterized in that, Applied to the local proxy service module; the local proxy service module is pre-installed in the eSIM terminal; The local proxy service module communicates with the proxy forwarding server; the method includes: Obtain the configuration request sent by the proxy forwarding server; the configuration request includes a configuration file; The configuration request is forwarded to the eSIM terminal to write the configuration file to the eSIM terminal; The configuration response information returned by the eSIM terminal is obtained and sent to the proxy forwarding server to complete the configuration of the eSIM terminal; wherein, the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal.

8. The eSIM terminal remote configuration method according to claim 7, characterized in that, Before the step of obtaining the configuration request sent by the proxy forwarding server, the method further includes: After the eSIM terminal is powered on, it enables the local access port; the local access port is used to establish a communication path with the eSIM terminal. A connection request is generated based on the terminal identifier corresponding to the eSIM terminal and the local access port. The connection request is sent to the proxy forwarding server to establish a communication channel with the proxy forwarding server.

9. A proxy forwarding server, characterized in that, include: The platform request receiving unit is used to obtain configuration requests sent by the eSIM download service platform; The configuration request includes the target terminal identifier and the configuration file; The request forwarding unit is used to forward the configuration request to the local proxy service module corresponding to the target terminal identifier based on a pre-stored proxy forwarding mapping table, so that the local proxy service module forwards the configuration request to the eSIM terminal. The response forwarding unit is used to receive configuration response information returned by the local proxy service module; the configuration response information is the feedback generated after the configuration file is written to the eSIM terminal; The response forwarding unit is further configured to return the configuration response information to the eSIM download service platform based on the proxy forwarding mapping table, so as to complete the configuration of the target eSIM terminal.

10. A configuration system, characterized in that, It includes an eSIM download service platform, an eSIM terminal, and a local proxy service module pre-installed in the eSIM terminal, and also includes the proxy forwarding server as described in claim 9.

Images