ESIM card management method and system and eSIM card

Abstract

The invention provides an eSIM card management method and system and an eSIM card, and the method comprises the steps: obtaining the current position information of a mobile terminal, and judging whether the current position information is located in a preset credible position region or not; if the current position information is not located in the preset credible position area, limiting the operation of at least one preset high-risk function module of the eSIM card, and maintaining the operation of a preset basic function module at the same time; and after the operation of the preset high-risk function module is limited, continuously monitoring the position information of the mobile terminal until the position information is located in the preset credible position area, and recovering the operation of the limited preset high-risk function module. In the mode, the operation of the high-risk function module is dynamically limited by monitoring the position information of the equipment in real time, so that the operation of a malicious program in an untrusted network environment is avoided, and the security of the eSIM card is ensured.

Description

Technical Field

[0001] This application relates to the field of mobile communication technology, and in particular to a management method, system and eSIM card for an eSIM card. Background Technology

[0002] With the rapid development of eSIM technology, the flexibility and convenience of devices have been greatly enhanced, allowing users to switch between different operators' networks without changing their SIM cards. However, the widespread use of eSIM cards has also brought new security risks, especially in cross-border scenarios. Devices may connect to untrusted operator networks, which can forge configuration files and implant malicious applications into the eSIM card. These malicious programs are often hidden within the security domain of the eSIM card, making them difficult for ordinary users to detect, and can steal user information or perform malicious operations. Existing eSIM management methods lack effective security guarantees for cross-border use and cannot prevent the activation of malicious applications. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a management method, system and eSIM card for eSIM cards, which dynamically restricts the operation of high-risk functional modules by monitoring the location information of the device in real time, so as to avoid running malicious programs in untrusted network environments and thus ensure the security of eSIM cards.

[0004] In a first aspect, the present invention provides a method for managing an eSIM card, comprising: Obtain the current location information of the mobile terminal, and determine whether the mobile terminal is located within a preset trusted location area based on the location information.

[0005] If the mobile terminal is not located within a preset trusted location area, restrict the operation of at least one preset high-risk functional module of the eSIM card, while maintaining the operation of the preset basic functional modules.

[0006] After the preset high-risk function modules are restricted from operation, the location information of the mobile terminal is continuously monitored, and the location of the mobile terminal is determined based on the location information until the mobile terminal is located within the preset trusted location area, at which point the operation of the restricted preset high-risk function modules is restored.

[0007] In an optional implementation, the method further includes: A time server group is pre-deployed in a preset trusted location area, and the time server group includes at least two time servers; the time server group communicates with the eSIM card.

[0008] The steps of obtaining the current location information of the mobile terminal and determining whether the mobile terminal is located within a preset trusted location area based on the location information include: Get the local time of the mobile device.

[0009] Send a time retrieval request to the time server group and receive the server time group returned by the time server group; wherein the server time group includes at least two server times.

[0010] Calculate the time difference between each server time and the local time, and determine whether each time difference is greater than the preset error tolerance threshold.

[0011] If any time difference exceeds the preset error tolerance threshold, the corresponding time server is identified as an abnormal server.

[0012] Count the number of abnormal servers.

[0013] If the number of abnormal servers reaches a preset proportion, it is determined that the mobile terminal is not located in the preset trusted location area.

[0014] In an optional implementation, after the step of sending a time request to the time server group, the method further includes: The mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0015] If a time acquisition request is sent to the time server group a preset number of times and all requests fail, it is determined that the mobile terminal is not located within the preset trusted location area.

[0016] In an optional implementation, the mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0017] The eSIM card stores the maximum difference in reference time, which is the largest time difference among the time differences between each server time obtained when the last time a time acquisition request was sent and the local time obtained the last time.

[0018] After calculating the time difference between each server time and the local time, the method also includes: Count the number of times the server time obtained in this time acquisition request has a time difference greater than the maximum difference of the base time between the local time and the server time.

[0019] If the number of differences is greater than or equal to the preset time difference number threshold, it is determined that the mobile terminal is not located in the preset trusted location area.

[0020] In an optional implementation, the eSIM card contains a pre-defined list of trusted locations; the list includes multiple pre-defined trusted location regions and their corresponding trusted location information.

[0021] The steps of obtaining the current location information of the mobile terminal and determining whether the mobile terminal is located within a preset trusted location area based on the location information include: Identify whether the location information is from the list of trusted locations.

[0022] If the location information is in the list of trusted locations, the location information is determined to be within the preset trusted location area.

[0023] In an optional implementation, the step of restricting the operation of at least one preset high-risk functional module of the eSIM card includes: By sending a disable command to the preset high-risk functional modules, the security policy of the preset high-risk functional modules is adjusted to a disabled state.

[0024] And / or, perform access control on a preset sensitive data area; the access control includes, when an access request for the preset sensitive data area is received, determining whether the application initiating the access request is a preset general user identity module application; if the initiating application is not a general user identity module application, interrupting or denying the access request.

[0025] In an optional implementation, after the step of adjusting the security policy of the preset high-risk functional module to a disabled state by sending a disable command to the preset high-risk functional module, the method further includes: If a remote management command is received, a preset status code is returned to prevent the execution of the remote management command.

[0026] And / or, if an application authentication command is received, a preset error code is returned to prevent the execution of the application authentication command.

[0027] And / or, if an event listener instruction is received, return an empty list of events to disable the event service corresponding to the event listener instruction.

[0028] In an optional implementation, after a preset high-risk functional module is restricted from operation, the step of continuously monitoring the location information of the mobile terminal until the location information is within a preset trusted location area, and then restoring the operation of the restricted preset high-risk functional module, includes: Periodically acquire the location information of the mobile terminal.

[0029] If the location information is within a preset trusted location area, the location confirmation count is incremented by 1 until the location confirmation count reaches a preset threshold, at which point the operation of all restricted high-risk functional modules is restored; the initial value of the location confirmation count is 0.

[0030] Secondly, the present invention provides an eSIM card management system, comprising: The location information acquisition module is used to acquire the current location information of the mobile terminal and determine whether the mobile terminal is located within a preset trusted location area based on the location information.

[0031] The function restriction module is used to restrict the operation of at least one preset high-risk function module of the eSIM card if the mobile terminal is not located in a preset trusted location area, while maintaining the operation of the preset basic function modules.

[0032] The function recovery module is used to continuously monitor the location information of the mobile terminal after the preset high-risk function modules are restricted from operation, and determine the location of the mobile terminal based on the location information until the mobile terminal is located in a preset trusted location area, and then restore the operation of the restricted preset high-risk function modules.

[0033] Thirdly, the present invention provides an eSIM card, including an eSIM card body and an eSIM card management system as described in the foregoing embodiments; the eSIM card management system is deployed on the eSIM card body.

[0034] This application provides an eSIM card management method, system, and eSIM card. It can determine in real time whether the eSIM card is in an untrusted cross-border usage scenario. When determined to be outside the country, it automatically restricts high-risk functional modules that are easily exploited by malicious applications, while maintaining basic communication functions unaffected. This effectively prevents malicious applications hidden in the security domain from being activated or executed without impacting the user's basic usage. Furthermore, it can automatically restore all functions after the device returns to a trusted area, achieving fully automated cross-border security.

[0035] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application.

[0036] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0038] Figure 1 A flowchart illustrating an eSIM card management method provided in this application embodiment; Figure 2This is a flowchart of the mobile terminal location determination process provided in an embodiment of this application; Figure 3 This is a schematic diagram of the eSIM card management system provided in an embodiment of this application; Figure 4 This is a schematic diagram of an eSIM card provided in an embodiment of this application.

[0039] Icons: 1-Location information acquisition module; 2-Function restriction module; 3-Function recovery module; 4-eSIM card body; 5-eSIM card management system. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] To facilitate understanding of this embodiment, the embodiments of this application will be described in detail below.

[0042] Example 1: Figure 1 This is a flowchart illustrating an eSIM card management method provided in an embodiment of this application.

[0043] Reference Figure 1 eSIM card management methods include: Step S101: Obtain the current location information of the mobile terminal, and determine whether the mobile terminal is located within a preset trusted location area based on the location information.

[0044] Here, the preset trusted location area can be one or more countries or regions, such as the user's home country. There are various ways to obtain location information.

[0045] In one embodiment, the eSIM card can obtain the current Mobile Country Code (MCC) and Mobile Network Code (MNC) from the mobile terminal. The eSIM card pre-stores a list of trusted locations, which includes the MCC and MNC corresponding to trusted regions. The eSIM card compares the obtained MCC and MNC with the list of trusted locations; if the current MCC and MNC are not in the list, it determines that the mobile terminal is not located within a preset trusted location region.

[0046] In another embodiment, the eSIM card can also directly obtain the current country or city-level geographic location information of the terminal through local information instructions (such as Provide LocalInfo instructions) provided by the terminal, and compare it with a preset list of trusted locations.

[0047] In another embodiment, the determination can be achieved using network latency and timestamps. For example, at least two trusted time servers are deployed within a preset trusted location area. Each time server has a preset time difference threshold Mi, which represents the maximum tolerable network latency difference expected for that specific server. The eSIM card first obtains the mobile terminal's local time T1, and then simultaneously sends time requests to all trusted time servers to obtain server times T2, T3, ..., Ti. The eSIM card calculates the time difference Ci between each server time Ti and the local time T1. Subsequently, the eSIM card compares the calculated time difference Ci of each server with the server's time difference threshold Mi. If Ci > Mi, it is recorded as an anomaly. If the number of servers recorded as anomalies exceeds a preset proportion (e.g., 80%), or if multiple consecutive (e.g., 3) requests to all time servers fail, it is determined that the mobile terminal is not located within the preset trusted location area.

[0048] In other feasible embodiments, the eSIM card may also request the mobile terminal to provide its location coordinates obtained through GPS, Wi-Fi network positioning, or base station triangulation, and then compare the coordinates with the geographical range of a preset trusted location area.

[0049] Step S102: If the mobile terminal is not located in a preset trusted location area, restrict the operation of at least one preset high-risk functional module of the eSIM card, while maintaining the operation of the preset basic functional modules.

[0050] Here, if the eSIM card determines that the mobile terminal is not located within a preset trusted location area (i.e., it is outside the country), the eSIM system will immediately implement restrictive measures. These measures include restricting the operation of at least one preset high-risk functional module of the eSIM card, while maintaining the operation of preset basic functional modules.

[0051] Maintaining the operation of the default basic function modules means ensuring that the basic communication capabilities of the eSIM card are not affected, such as preserving the basic functions of USIM (Universal Subscriber Identity Module) to maintain voice, SMS and data connections.

[0052] Restricting high-risk pre-defined functional modules means turning off or blocking unnecessary functions that may be exploited by malicious applications. These restrictions may include, but are not limited to, completely disabling them, returning preset response codes for specific commands, or blocking access.

[0053] In one embodiment, the preset high-risk functional modules may include remote file management (RFM) and remote application management (RAM) functions. The restriction method could be that when the eSIM card receives an RFM or RAM instruction, the eSIM system does not actually process it, but instead directly returns a preset status code, such as 9000 (indicating success), to prevent the actual injection of malicious instructions.

[0054] In another embodiment, the preset high-risk functional module may include GP (Global Platform) application management functions. The restriction method could be that when a GP instruction (such as an application installation, download, or deletion instruction) is received, the eSIM card directly returns a preset error code, such as 6985, to disable the authentication function of the security domain and prevent the execution of application management operations.

[0055] In another embodiment, the preset high-risk function module may include an event service function. The restriction method could be that when the SETUP EVENT LIST command is received, the eSIM card always returns an empty event list, or actively resends the command to set the event list to empty, thereby disabling the event listening service and preventing malicious applications from being triggered by listening to terminal events (such as phone calls or location changes).

[0056] In other embodiments, high-risk functional modules may also include access to sensitive data areas. Restriction methods could include blocking non-USIM access to the key area and user data area, for example, by checking and ensuring that only USIM applications are allowed access, and that access from other applications results in errors.

[0057] In yet another embodiment, the high-risk functional module may also include contactless functionality. A possible restriction is to disable the SWP interface to prevent card swiping via the contactless interface.

[0058] eSIM systems can mark these high-risk operations as disabled by setting a profile policy.

[0059] Step S103: After the preset high-risk function modules are restricted from operation, the location information of the mobile terminal is continuously monitored, and the location of the mobile terminal is determined based on the location information until the mobile terminal is located in the preset trusted location area, and the operation of the restricted preset high-risk function modules is restored.

[0060] Here, even after the preset high-risk functional modules are restricted from operation, the eSIM card does not stop location detection but continues to monitor the mobile terminal's location information. This continuous monitoring can involve periodically obtaining MCC / MNC data or periodically requesting a time server. Based on this continuously monitored location information, the eSIM card determines whether the mobile terminal has returned to a preset trusted location area.

[0061] To prevent frequent handovers caused by signal fluctuations or in border areas, a recovery confirmation mechanism can be implemented. For example, in one embodiment, the eSIM card can be configured with a location confirmation count, initially set to 0. When the mobile terminal is detected to be within a preset trusted location area, the location confirmation count is incremented by 1. The eSIM card only confirms that the mobile terminal has returned to the preset trusted location area when the location confirmation count reaches a preset threshold number (e.g., 3 consecutive times).

[0062] Once it is confirmed that the mobile terminal is located within a preset trusted location area, the eSIM card will automatically restore the operation of all restricted preset high-risk functional modules, such as re-enabling RFM / RAM functions, allowing GP application management, restoring event services and contactless functions, etc.

[0063] In an optional implementation, the method further includes: A time server group is pre-deployed in a preset trusted location area, and the time server group includes at least two time servers; the time server group communicates with the eSIM card.

[0064] Here, the time server group includes at least two (or more) trusted time servers, such as time server A (IP: XXXX) and time server B (IP: YYYY). The eSIM card needs to be able to access the Internet through a mobile terminal or a specific channel in order to establish a communication connection with the time server group and initiate a time request.

[0065] The location determination process can be performed periodically. For example, an eSIM card can register to listen for status events and automatically perform a time sampling every N status intervals (e.g., N=10).

[0066] Reference Figure 2 Step S101 includes the following steps S201-S206.

[0067] Step S201: Obtain the local time of the mobile terminal.

[0068] Here, when sampling begins, the eSIM card first obtains the local time of the mobile terminal, such as the phone's local system time T1.

[0069] Step S202: Send a time acquisition request to the time server group and receive the server time group returned by the time server group; wherein the server time group includes at least two server times.

[0070] Here, after obtaining the local time T1, the eSIM card immediately sends a time acquisition request to all time servers in the time server group simultaneously. The eSIM card will receive the server time group returned by the time server group. This server time group includes times from various servers, such as T2, T3, etc., and includes at least two server times.

[0071] Step S203: Calculate the time difference between each server time and the local time, and determine whether each time difference is greater than the preset error tolerance threshold.

[0072] Here, after receiving the server time, the eSIM card calculates the time difference Ci between each server time Ti and the local time T1. The calculation formula is, for example, Ci = Ti - T1.

[0073] For each time server in the time server group, a corresponding preset error tolerance threshold Mi is set in advance. The preset error tolerance threshold Mi is set in advance based on experience and represents the maximum tolerable value of expected network latency difference.

[0074] The eSIM card then determines whether each calculated time difference Ci is greater than its corresponding preset error tolerance threshold Mi.

[0075] Step S204: If any time difference is greater than the preset error tolerance threshold, the corresponding time server is determined to be an abnormal server.

[0076] Here, if any time difference Ci is greater than its corresponding preset error tolerance threshold Mi, the comparison is recorded as an anomaly, and the server corresponding to the time difference is identified as an abnormal server.

[0077] Step S205: Count the number of abnormal servers.

[0078] Here, eSIM card statistics represent the number of all servers identified as abnormal in this sampling.

[0079] Step S206: If the number of abnormal servers reaches a preset ratio, determine that the mobile terminal is not located in the preset trusted location area.

[0080] Here, the eSIM card determines whether the number of abnormal servers has reached a preset percentage, for example, whether it accounts for 80% of the total number of servers. If the number of abnormal servers reaches or exceeds this preset percentage, the mobile terminal is determined to be outside the preset trusted location area, i.e., it is classified as being outside the country. Conversely, if the percentage is not reached, it is classified as being within the country.

[0081] In an optional implementation, after the step of sending a time request to the time server group in step S202, the method further includes the following steps S301-S302.

[0082] Step S301: The mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0083] Here, the eSIM card periodically executes time acquisition requests. For example, the mobile terminal can send a time acquisition request to the time server group every preset time interval. At the same time, the eSIM card counts the number of consecutive failed requests.

[0084] Step S302: If a time acquisition request is sent to the time server group a preset number of times and all requests fail, it is determined that the mobile terminal is not located in the preset trusted location area.

[0085] Here, if all time acquisition requests sent by the eSIM card to the time server group fail within a preset number of consecutive attempts, it is directly determined that the mobile terminal is not located within the preset trusted location area.

[0086] Request failures here can include various situations, such as request timeout or connection errors. The preset number of attempts can be set in advance according to actual needs, for example, set to 3 consecutive attempts.

[0087] Specifically, if the eSIM card fails to obtain time data after three consecutive attempts to send requests to all deployed time servers (e.g., all times out or connection failures), the eSIM card will default to determining that the mobile terminal is in an overseas state.

[0088] In an optional implementation, the mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0089] The eSIM card stores the maximum difference in reference time, which is the largest time difference among the time differences between each server time obtained when the last time a time acquisition request was sent and the local time obtained the last time.

[0090] Here, the mobile terminal will send a time acquisition request to the time server group every preset time interval, such as after every N status events.

[0091] The eSIM card stores a maximum base time difference. This maximum base time difference is the largest of all time differences between the server time and the local time calculated in the last (or previous) successful time acquisition request. The eSIM card records the original differences such as C1 and C2 with each sampling and retains the maximum difference Cmax in the current sampling. This Cmax can then be used as the maximum base time difference for the next sampling.

[0092] Reference Figure 4 After step S203, which calculates the time difference between each server time and the local time, the method further includes the following steps S401-S402.

[0093] Step S401: Count the number of times the time difference between each server time and the local time obtained in this time acquisition request is greater than the maximum difference of the reference time.

[0094] Here, the eSIM card will count how many of the time differences (C1, C2, etc.) obtained in this time acquisition request are greater than the previously stored maximum difference (Cmax) of the baseline time. This statistical result is the number of differences.

[0095] Step S402: If the number of differences is greater than or equal to the preset time difference number threshold, it is determined that the mobile terminal is not located in the preset trusted location area.

[0096] Here, the eSIM card compares this difference to a preset threshold for the amount of time difference. This threshold can be preset according to security needs; for example, it can be set to 2.

[0097] If the difference is greater than or equal to the preset time difference threshold, the eSIM card will also determine that the mobile terminal is not located in the preset trusted location area, i.e., it is determined to be overseas.

[0098] In an optional implementation, the eSIM card contains a pre-defined list of trusted locations; the list includes multiple pre-defined trusted location regions and their corresponding trusted location information.

[0099] Specifically, the eSIM card has a pre-installed list of trusted locations. This list can contain one or more preset trusted location areas, such as the user's home country and other allied countries or regions considered safe.

[0100] The trusted location list stores trusted location information corresponding to these preset trusted location areas. In one embodiment, the trusted location information may be a combination of Mobile Country Code (MCC) and Mobile Network Code (MNC). In another embodiment, this trusted location information may also be a national or city-level geolocation identifier.

[0101] Step S101 includes the following steps S501-S502.

[0102] Step S501: Identify whether the location information is trusted location information in the trusted location list.

[0103] Here, when location needs to be determined, the eSIM card obtains the current real-time location information from the mobile terminal. For example, the eSIM card can obtain the MCC and MNC of the terminal's currently registered network, or obtain the country or city-level location information perceived by the terminal, by sending the Provide Local Info command to the terminal.

[0104] After obtaining the current location information, the eSIM card compares it with a list of trusted locations stored in the card.

[0105] Step S502: If the location information is in the list of trusted locations, determine that the location information is located within the preset trusted location area.

[0106] Here, if the current location information (such as a combination of MCC and MNC) is found to exist in the trusted location list, the mobile terminal is determined to be located within the preset trusted location area.

[0107] Conversely, if the current location information is not in the list of trusted locations, the mobile terminal is determined to be outside the preset trusted location area, i.e., it is determined to be in an overseas state.

[0108] In an optional implementation, when the eSIM card determines that the mobile terminal is not located within a preset trusted location area, the steps to restrict the operation of at least one preset high-risk functional module of the eSIM card include the following two methods. These steps can be performed individually or in combination.

[0109] The first restriction method is to send a disable command to the preset high-risk functional modules to adjust the security policy of the preset high-risk functional modules to a disabled state.

[0110] Here, by sending a disable command to the preset high-risk functional modules, the security policy of the preset high-risk functional modules is adjusted to a disabled state. Specifically, eSIM can mark risky operations as disabled by setting a profile policy.

[0111] The second restriction method is to implement access control on a preset sensitive data area. The access control includes: when an access request for the preset sensitive data area is received, determining whether the application initiating the access request is a preset general user identity module application; if the initiating application is not a general user identity module application, interrupting or rejecting the access request.

[0112] Here, the preset sensitive data area may include a key area and a user data area. When the eSIM card receives an access request for the preset sensitive data area, the eSIM card first determines whether the application initiating the access request is a preset Universal Subscriber Identity Module (USIM) application. If the initiating application is not a USIM application, the eSIM card will interrupt or reject the access request, for example, by returning an error code. The eSIM card will check and ensure that only USIM applications are allowed to access these sensitive data areas.

[0113] In an optional implementation, after the security policy of the preset high-risk functional module is adjusted to a disabled state, the eSIM card will further perform special processing on the received specific instructions to prevent the execution of high-risk operations. The processing steps include the following. These steps can be performed individually or in combination.

[0114] First: If a remote management command is received, a preset status code is returned to prevent the execution of the remote management command.

[0115] Here, when the eSIM card receives a remote management command, it returns a preset status code to prevent the execution of that command. For example, preset high-risk functional modules may include Remote File Management (RFM) and Remote Application Management (RAM) functions; the RFM / RAM security domains containing these functions will be disabled. When the eSIM card receives an RFM or RAM command, it first checks the relevant operation flags for RFM and RAM. If the flag is disabled, the eSIM card will not perform any processing but will directly return a preset status code, such as 9000. This status code typically indicates successful operation, thus preventing malicious command injection without executing malicious instructions.

[0116] Second: If an application authentication command is received, a preset error code is returned to prevent the execution of the application authentication command.

[0117] Here, when the eSIM card receives an application authentication command, it returns a preset error code to prevent the execution of that command. For example, preset high-risk functional modules may include GP application management functions, whose security domain authentication functions will be disabled. When the eSIM card receives a GP command, it will directly return a preset error code, such as 6985. By returning error codes, the eSIM card ensures that operations such as application installation, download, and deletion are not allowed to be performed.

[0118] Third: If an event listener command is received, return an empty event list to disable the event service corresponding to the event listener command.

[0119] Here, when the eSIM card receives an event listening command, it returns an empty event list to disable the event service corresponding to that command. For example, pre-defined high-risk functional modules may include event services. When it detects that the device is outside of China, the eSIM card will not allow event services to be enabled, such as listening to the terminal's phone calls. This can be achieved by the eSIM card returning an empty event list when the terminal sends a SETUP EVENT LIST command to the card, for example, by setting the event count in the TLV (Tag–Length–Value) to 0, thus notifying the terminal that no events need to be listened to. Alternatively, the eSIM card can proactively resend the setupevenlist command to set the event list to empty. By consistently responding to an empty list, the event service can be completely disabled.

[0120] In addition, other pre-defined high-risk functional modules can also be restricted, such as contactless functions. Restriction can be achieved by disallowing contactless card swiping, specifically by disabling the SWP interface (Single-Wire Protocol Interface).

[0121] In an optional implementation, step S103 includes the following steps S601-S602.

[0122] Step S601: Periodically acquire the location information of the mobile terminal.

[0123] Here, after the preset high-risk function modules are restricted from operation, the eSIM card will continuously monitor the location information of the mobile terminal and determine the location of the mobile terminal based on the location information until the mobile terminal is located in the preset trusted location area. At this time, the eSIM card will restore the operation of the restricted preset high-risk function modules.

[0124] The location information of the mobile terminal is periodically acquired. The method for acquiring location information can be the same as that used for initial location determination, such as periodically comparing the MCC or MNC, or periodically sending requests to the time server group.

[0125] Step S602: If the location information is within a preset trusted location area, increment the location confirmation count by 1 until the location confirmation count reaches a preset number of times threshold, and restore the operation of all restricted high-risk functional modules; wherein, the initial value of the location confirmation count is 0.

[0126] Here, a location confirmation count is set, with its initial value set to 0.

[0127] When periodically acquiring location information, if the current location is determined to be within a preset trusted location area (e.g., within the country), the location confirmation count is incremented by 1. If the location is still within the trusted area during the next periodic check, the count continues to accumulate.

[0128] The eSIM card will continue periodic monitoring until the location confirmation count reaches a preset threshold. In one specific embodiment, the preset threshold can be set to 3 times. That is, the eSIM card will only confirm that the device has stably returned to the trusted area when it detects the device re-entering the territory 3 times consecutively.

[0129] Once the location confirmation count reaches a preset threshold, the eSIM card will restore the operation of all restricted high-risk functional modules, such as reopening RFM, RAM, GP application management, event services, and contactless functions, thus restoring all functions of the eSIM card.

[0130] This application provides an eSIM card management method that dynamically restricts the operation of high-risk functional modules by monitoring the device's location information in real time, thereby preventing the execution of malicious programs in untrusted network environments and ensuring the security of the eSIM card.

[0131] Example 2: Figure 3 This is a schematic diagram of the eSIM card management system provided in an embodiment of this application.

[0132] Reference Figure 3 The eSIM card management system includes: Location information acquisition module 1 is used to acquire the current location information of the mobile terminal and determine whether the mobile terminal is located within a preset trusted location area based on the location information.

[0133] Function restriction module 2 is used to restrict the operation of at least one preset high-risk function module of the eSIM card if the mobile terminal is not located in a preset trusted location area, while maintaining the operation of the preset basic function module.

[0134] Function recovery module 3 is used to continuously monitor the location information of the mobile terminal after the preset high-risk function modules are restricted from operation, and determine the location of the mobile terminal based on the location information until the mobile terminal is located in a preset trusted location area, and then restore the operation of the restricted preset high-risk function modules.

[0135] In an optional implementation, the method further includes: A time server group is pre-deployed in a preset trusted location area, and the time server group includes at least two time servers; the time server group communicates with the eSIM card.

[0136] Location information acquisition module 1 is also used for: Get the local time of the mobile device.

[0137] Send a time retrieval request to the time server group and receive the server time group returned by the time server group; wherein the server time group includes at least two server times.

[0138] Calculate the time difference between each server time and the local time, and determine whether each time difference is greater than the preset error tolerance threshold.

[0139] If any time difference exceeds the preset error tolerance threshold, the corresponding time server is identified as an abnormal server.

[0140] Count the number of abnormal servers.

[0141] If the number of abnormal servers reaches a preset proportion, it is determined that the mobile terminal is not located in the preset trusted location area.

[0142] In an optional implementation, the location information acquisition module 1 is further configured to: The mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0143] If a time acquisition request is sent to the time server group a preset number of times and all requests fail, it is determined that the mobile terminal is not located within the preset trusted location area.

[0144] In an optional implementation, the mobile terminal sends a time acquisition request to the time server group every preset time interval.

[0145] The eSIM card stores the maximum difference in reference time, which is the largest time difference among the time differences between each server time obtained when the last time a time acquisition request was sent and the local time obtained the last time.

[0146] Location information acquisition module 1 is also used for: Count the number of times the server time obtained in this time acquisition request has a time difference greater than the maximum difference of the base time between the local time and the server time.

[0147] If the number of differences is greater than or equal to the preset time difference number threshold, it is determined that the mobile terminal is not located in the preset trusted location area.

[0148] In an optional implementation, the eSIM card contains a pre-defined list of trusted locations; the list includes multiple pre-defined trusted location regions and their corresponding trusted location information.

[0149] Location information acquisition module 1 is also used for: Identify whether the location information is from the list of trusted locations.

[0150] If the location information is in the list of trusted locations, the location information is determined to be within the preset trusted location area.

[0151] In an optional implementation, the function limiting module 2 is further configured to: By sending a disable command to the preset high-risk functional modules, the security policy of the preset high-risk functional modules is adjusted to a disabled state.

[0152] And / or, perform access control on a preset sensitive data area; the access control includes, when an access request for the preset sensitive data area is received, determining whether the application initiating the access request is a preset general user identity module application; if the initiating application is not a general user identity module application, interrupting or denying the access request.

[0153] In an optional implementation, the function limiting module 2 is further configured to: If a remote management command is received, a preset status code is returned to prevent the execution of the remote management command.

[0154] And / or, if an application authentication command is received, a preset error code is returned to prevent the execution of the application authentication command.

[0155] And / or, if an event listener instruction is received, return an empty list of events to disable the event service corresponding to the event listener instruction.

[0156] In an optional implementation, the function recovery module 3 is further configured to: Periodically acquire the location information of the mobile terminal.

[0157] If the location information is within a preset trusted location area, the location confirmation count is incremented by 1 until the location confirmation count reaches a preset threshold, at which point the operation of all restricted high-risk functional modules is restored; the initial value of the location confirmation count is 0.

[0158] The eSIM card management system provided in this application embodiment can automatically identify whether the eSIM card is in a high-risk, untrusted location area. When a risk is identified, the system can proactively and automatically restrict the high-risk functions of the eSIM card while maintaining the user's basic communication functions such as voice and SMS without being affected, thereby effectively blocking the way for malicious applications to be implanted or activated overseas. Furthermore, after the device returns to a trusted area, it can automatically restore all functions, achieving cross-border dynamic security protection of eSIM cards with zero user intervention.

[0159] Example 3: Figure 4 This is a schematic diagram of an eSIM card provided in an embodiment of this application.

[0160] Reference Figure 4The eSIM card provided in this application embodiment includes an eSIM card body 4 and an eSIM card management system 5; the eSIM card management system 5 is deployed on the eSIM card body 4.

[0161] Here, the eSIM card body 4 can be understood as the hardware and firmware of the eSIM chip. The eSIM card management system 5 can be implemented on the eSIM card body 4 as an upgraded chip OS firmware, without modifying the existing GSMA eSIM protocol (GSMA Embedded SIM Remote Configuration and Management Specification), and has good compatibility.

[0162] This application provides an eSIM card that, by deploying an integrated management system on the eSIM card itself, possesses proactive and automatic security protection capabilities. The eSIM card can detect its own geographical location in real time. When it determines that it is in a high-risk area overseas, it can automatically shut down high-risk modules to completely block the operation of malicious applications, while maintaining basic communication functions unaffected. When the device returns to a trusted area, it can automatically restore all functions. The entire process requires no user intervention and can be achieved simply by upgrading the chip's OS firmware, and is compatible with existing GSMA standards.

[0163] The computer program product provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0164] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0165] Furthermore, in the description of the embodiments of this application, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0166] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0167] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0168] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in this application, or make equivalent substitutions for some of the technical features. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the protection scope of this application.

Claims

1. A method for managing an eSIM card, characterized in that, include: Obtain the current location information of the mobile terminal, and determine whether the mobile terminal is located within a preset trusted location area based on the location information; If the mobile terminal is not located within the preset trusted location area, the operation of at least one preset high-risk functional module of the eSIM card is restricted, while the operation of the preset basic functional modules is maintained. After the preset high-risk function module is restricted from operation, the location information of the mobile terminal is continuously monitored, and the location of the mobile terminal is determined based on the location information until the mobile terminal is located within the preset trusted location area, at which point the operation of the restricted preset high-risk function module is restored.

2. The eSIM card management method according to claim 1, characterized in that, The method further includes: A time server group is pre-deployed within the preset trusted location area, the time server group including at least two time servers; the time server group is communicatively connected to the eSIM card. The step of obtaining the current location information of a mobile terminal and determining whether the mobile terminal is located within a preset trusted location area based on the location information includes: Obtain the local time of the mobile terminal; Send a time acquisition request to the time server group and receive a server time group returned by the time server group; wherein the server time group includes at least two server times; Calculate the time difference between each server time and the local time, and determine whether each time difference is greater than a preset error tolerance threshold. If any of the time differences is greater than the preset error tolerance threshold, the corresponding time server is determined to be an abnormal server. Count the number of the abnormal servers; If the number of abnormal servers reaches a preset proportion, it is determined that the mobile terminal is not located within the preset trusted location area.

3. The eSIM card management method according to claim 2, characterized in that, After the step of sending a time request to the time server group, the method further includes: The mobile terminal sends a time acquisition request to the time server group every preset time. If the time acquisition request is sent to the time server group a preset number of times and all requests fail, it is determined that the mobile terminal is not located within the preset trusted location area.

4. The eSIM card management method according to claim 2, characterized in that, The mobile terminal sends a time acquisition request to the time server group every preset time. The eSIM card stores the maximum difference in reference time, which is the maximum time difference among the time differences between each server time obtained when the last time a time acquisition request was sent and the local time obtained the last time. After the step of calculating the time difference between each of the server times and the local time, the method further includes: Count the number of times the server time and the local time obtained in this time acquisition request are greater than the maximum difference of the reference time; If the number of differences is greater than or equal to a preset time difference threshold, it is determined that the mobile terminal is not located within the preset trusted location area.

5. The eSIM card management method according to claim 1, characterized in that, The eSIM card contains a pre-defined list of trusted locations; the list of trusted locations includes multiple pre-defined trusted location regions and their corresponding trusted location information. The step of obtaining the current location information of a mobile terminal and determining whether the mobile terminal is located within a preset trusted location area based on the location information includes: Identify whether the location information is a trusted location information in the trusted location list; If the location information is in the list of trusted locations, it is determined that the location information is located within a preset trusted location area.

6. The eSIM card management method according to claim 1, characterized in that, The steps of restricting the operation of at least one preset high-risk functional module of the eSIM card include: By sending a disable command to the preset high-risk functional module, the security policy of the preset high-risk functional module is adjusted to a disabled state; And / or, Access control is performed on a preset sensitive data area; the access control includes, when an access request for the preset sensitive data area is received, determining whether the application initiating the access request is a preset general user identity module application; if the initiating application is not the general user identity module application, interrupting or rejecting the access request.

7. The eSIM card management method according to claim 6, characterized in that, After the step of adjusting the security policy of the preset high-risk functional module to a disabled state by sending a disable command to the preset high-risk functional module, the method further includes: If a remote management command is received, a preset status code is returned to prevent the execution of the remote management command; And / or, If an application authentication command is received, a preset error code is returned to prevent the execution of the application authentication command; And / or, If an event listening command is received, an empty event list is returned to disable the event service corresponding to the event listening command.

8. The eSIM card management method according to claim 1, characterized in that, After the preset high-risk functional module is restricted from operation, the step of continuously monitoring the location information of the mobile terminal until the location information is within the preset trusted location area, and then restoring the operation of the restricted preset high-risk functional module, includes: The location information of the mobile terminal is acquired periodically; If the location information is located within the preset trusted location area, the location confirmation count is incremented by 1 until the location confirmation count reaches a preset number threshold, and the operation of all restricted high-risk functional modules is restored; wherein, the initial value of the location confirmation count is 0.

9. A management system for an eSIM card, characterized in that, include: The location information acquisition module is used to acquire the current location information of the mobile terminal and determine whether the mobile terminal is located within a preset trusted location area based on the location information. A function restriction module is used to restrict the operation of at least one preset high-risk function module of the eSIM card if the mobile terminal is not located in the preset trusted location area, while maintaining the operation of the preset basic function module. The function recovery module is used to continuously monitor the location information of the mobile terminal after the preset high-risk function module is restricted from operation, and determine the location of the mobile terminal based on the location information until the mobile terminal is located within the preset trusted location area, and then restore the operation of the restricted preset high-risk function module.

10. An eSIM card, characterized in that, It includes an eSIM card body and an eSIM card management system as described in claim 9; the eSIM card management system is deployed on the eSIM card body.

Images