Esim terminal configuration method based on cloud lpa function

Abstract

The application provides an eSIM terminal configuration method based on a cloud LPA function, comprising: in response to a received code number distribution instruction, sending short message generation information to an operator platform to enable the operator platform to send an activation notification short message to a target eSIM terminal; receiving a connection request sent by the target eSIM terminal and establishing a connection with the target eSIM terminal; after the connection is established, sending configuration file request information to an SM-DP+ platform and receiving a returned encrypted configuration file; decrypting the encrypted configuration file based on a pre-stored decryption key to obtain a target configuration file; and sending the target configuration file to the target eSIM terminal to enable the target eSIM terminal to complete code number configuration. By deploying an LPA function in a connection management platform, system resource consumption of the eSIM terminal can be reduced, and the security of eSIM code number distribution is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an eSIM terminal configuration method based on cloud-based LPA functionality. Background Technology

[0002] With the rapid development of IoT and mobile communication technologies, eSIM (embedded SIM), as a next-generation SIM card solution, has been widely used in smart terminals, in-vehicle devices, wearable devices, and other fields. eSIM offers advantages such as remote configuration and over-the-air (OTA) download, effectively improving device flexibility and connectivity efficiency. To achieve rapid deployment and remote activation of eSIM terminals, efficient collaboration between the connectivity management platform and the operator platform has become a crucial requirement.

[0003] Currently, eSIM profile management primarily relies on the Local Profile Assistant (LPA) deployed within the eSIM terminal device. The LPA within the terminal is responsible for interacting with the SM-DP+ platform (subscription management data preparation platform) to complete the download, installation, and lifecycle management of the eSIM profile. However, this approach suffers from issues such as heavy terminal load, poor compatibility, and complex security verification. Furthermore, when terminal resources are limited, it cannot flexibly support efficient remote number distribution. In addition, in existing solutions, activation commands and connection establishment, as well as profile requests and transmission processes, are often highly coupled, lacking a clear hierarchical management mechanism, resulting in insufficient system scalability and maintainability. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide an eSIM terminal configuration method based on cloud-based LPA function. By centrally deploying the LPA function in the connection management platform, unified management of the eSIM terminal configuration process can be achieved, thereby reducing the system resource consumption of the eSIM terminal, simplifying the terminal processing flow, and thus improving the security, efficiency and scalability of eSIM number distribution.

[0005] In a first aspect, the present invention provides an eSIM terminal configuration method based on cloud-based LPA functionality, applied to a connection management platform; the method includes: responding to a received number distribution instruction, sending SMS generation information to an operator platform, so that the operator platform sends an activation notification SMS to a target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information, used to instruct the target eSIM terminal to establish a connection with the connection management platform; receiving a connection request sent by the target eSIM terminal based on the activation notification SMS, and establishing a connection with the target eSIM terminal based on the connection request; after the connection is established, sending a configuration file request information to an SM-DP+ platform, and receiving an encrypted configuration file returned by the SM-DP+ platform; decrypting the encrypted configuration file based on a pre-stored decryption key to obtain a target configuration file; and sending the target configuration file to the target eSIM terminal, so that the target eSIM terminal completes number configuration based on the target configuration file.

[0006] In an optional implementation, the step of sending SMS generation information to the operator platform in response to the received number distribution instruction, and causing the operator platform to send an activation notification SMS to the target eSIM terminal, includes: obtaining the target terminal identifier in the number distribution instruction; generating SMS generation information based on the target terminal identifier, as well as the pre-stored connection management platform address and connection parameters; sending the SMS generation information to the operator platform, so that the operator platform generates an activation notification SMS based on the SMS generation information, and sends the activation notification SMS to the target eSIM terminal corresponding to the target terminal identifier; wherein, the connection parameters include BIP connection information and the activation instruction.

[0007] In an optional implementation, the connection request includes a current terminal identifier, activation information, and authentication parameters; the authentication parameters are generated by the target eSIM terminal based on a preset encryption standard; the activation information includes the connection parameters from the activation notification SMS; the step of establishing a connection with the target eSIM terminal based on the connection request includes: determining whether the current terminal identifier is consistent with the target terminal identifier, whether the activation information is consistent with the connection parameters, and whether the authentication parameters conform to the preset encryption standard; if the current terminal identifier is consistent with the target terminal identifier, the activation information is consistent with the connection parameters, and the authentication parameters conform to the preset encryption standard, determining whether the target eSIM terminal has access rights; if the target eSIM terminal has access rights, then establishing a connection with the target eSIM terminal.

[0008] In an optional implementation, the connection management platform establishes a connection with the target eSIM terminal based on the BIP protocol.

[0009] In an optional implementation, the configuration file request information includes a target terminal identifier, a configuration file type, and security authentication information. The steps of sending the configuration file request information to the SM-DP+ platform and receiving the encrypted configuration file returned by the SM-DP+ platform after the connection is established include: sending the configuration file request information to the SM-DP+ platform so that the SM-DP+ platform can determine whether the security authentication information is valid and whether the eSIM terminal corresponding to the target terminal identifier has access rights; if the security authentication information is valid and the eSIM terminal corresponding to the target terminal identifier has access rights, receiving the encrypted configuration file sent by the SM-DP+ platform; wherein the encrypted configuration file conforms to the configuration file type; the encrypted configuration file is obtained by the SM-DP+ platform encrypting the configuration file according to a preset encryption method.

[0010] In an optional implementation, the step of decrypting the encrypted configuration file based on a preset decryption key to obtain the target configuration file includes: extracting the decryption key from local secure storage, and decrypting the encrypted configuration file based on the decryption key to obtain a first configuration file; the decryption key is negotiated and determined when establishing a connection with the SM-DP+ platform; performing integrity verification on the first configuration file based on a preset integrity verification method, and if the verification passes, formatting the first configuration file to obtain the target configuration file.

[0011] In an optional implementation, the step of sending the target configuration file to the target eSIM terminal so that the target eSIM terminal can complete the number configuration based on the target configuration file includes: encapsulating the target configuration file based on a preset data transmission protocol standard to obtain an encapsulated target configuration file; sending the encapsulated target configuration file to the target eSIM terminal; receiving activation confirmation information returned by the target eSIM terminal to confirm that the target eSIM terminal has completed the number configuration; wherein, the activation confirmation information is information generated by the target eSIM terminal after writing the target configuration file into the eSIM module of the eSIM terminal and accessing the communication network of the target operator based on the target configuration file.

[0012] In an optional implementation, when the data volume of the target configuration file exceeds a preset data volume threshold, the step of sending the encapsulated target configuration file to the target eSIM terminal includes: dividing the encapsulated target configuration file into multiple data segments based on the preset data volume threshold; and sequentially sending each data segment to the target eSIM terminal so that the target eSIM terminal can reassemble the data segments after receiving each data segment to obtain the encapsulated target configuration file.

[0013] Secondly, the present invention provides a connection management platform, comprising: an SMS management module, configured to send SMS generation information to an operator platform in response to a received number distribution instruction, so that the operator platform sends an activation notification SMS to a target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information and is used to instruct the target eSIM terminal to establish a connection with the connection management platform; a data transmission module, configured to receive a connection request sent by the target eSIM terminal based on the activation notification SMS, and establish a connection with the target eSIM terminal based on the connection request; a configuration file management module, configured to send a configuration file request to an SM-DP+ platform after the connection is established, and receive an encrypted configuration file returned by the SM-DP+ platform; an LPA function module, configured to decrypt the encrypted configuration file based on a pre-stored decryption key to obtain a target configuration file; and the data transmission module is further configured to send the target configuration file to the target eSIM terminal, so that the target eSIM terminal completes number configuration based on the target configuration file.

[0014] Thirdly, the present invention provides a connection management system, including the connection management platform described in the foregoing embodiments, and further including an eSIM terminal, an operator gateway platform, and an SM-DP+ platform that are communicatively connected to the connection management platform.

[0015] This application provides an eSIM terminal configuration method based on cloud-based LPA functionality. By setting the decryption step of the encrypted configuration file to be executed on the connection management platform side, the method eliminates the need for the eSIM terminal to perform complex LPA functions, thereby significantly reducing the hardware cost and software complexity of the eSIM terminal. This is particularly suitable for resource-constrained IoT devices, thus improving the scalability and deployment flexibility of the eSIM solution and facilitating unified management and maintenance of massive numbers of terminals. By actively generating SMS generation information containing the address and connection parameters through the connection management platform and sending activation notification SMS to the target eSIM terminal via the operator platform, proactive wake-up and remote guidance of eSIM terminals in any network state can be achieved, establishing a reliable and automated configuration initiation channel. Simultaneously, by performing multiple verifications on the identity, activation information, and authentication parameters in the connection request, it ensures that only legitimate terminals can establish a secure BIP communication connection after responding to legitimate instructions, enhancing the security of the entire number distribution process. By using the connection management platform as a unified interface to interact with the SM-DP+ platform, and centrally decrypting, verifying integrity, and formatting the returned encrypted configuration files within its built-in LPA function module, complex backend interaction logic and core security processing capabilities can be centralized in the cloud. This simplifies the direct interaction between the terminal and the SM-DP+ platform and ensures the correctness and consistency of the configuration files sent to the terminal. This provides a stable, efficient, and easily managed centralized service node for eSIM terminal configuration file acquisition and processing. After the configuration file is sent to the terminal, the activation confirmation information returned by the terminal can be received, accurately revealing the final result of the terminal-side code number configuration. This forms a complete business status closed loop, avoiding the problem of ambiguous configuration status. Consequently, the connection management platform can accurately track and reliably manage the configuration status of each terminal, achieving end-to-end automation and traceability.

[0016] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating the eSIM terminal configuration method based on cloud-based LPA functionality provided in this application embodiment; Figure 2 A schematic diagram of the connection management platform provided in the embodiments of this application; Figure 3 A flowchart illustrating the human-machine interface device login method provided in this application embodiment.

[0020] Icons: 11-Connectivity Management Platform; 12-eSIM Terminal; 13-Carrier Gateway Platform; 14-SM-DP+ Platform; 21-SMS Management Module; 22-Data Transmission Module; 23-Configuration File Management Module; 24-LPA Function Module. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] To help those skilled in the art better understand this application, a brief introduction to its application scenarios and design concepts is provided.

[0023] Traditional eSIM terminal configuration methods rely on the local integration of the LPA module in the eSIM terminal, which has problems such as high hardware overhead, poor compatibility, and fragmented processes, making it difficult to support high-concurrency and high-reliability remote configuration tasks.

[0024] Therefore, referring to Figure 1 This application proposes an eSIM terminal configuration method based on cloud-based LPA functionality. The local LPA functionality originally deployed in the eSIM terminal is moved to the cloud-based connection management platform. The connection management platform uniformly completes the configuration request, security authentication, decryption and formatting of configuration files, and sends the configuration results to the target eSIM terminal through a standardized transmission protocol, realizing the configuration mode of light terminal and cloud master control.

[0025] Specifically, after receiving the code distribution instruction, the connection management platform generates SMS generation information, and the operator platform sends an activation notification SMS to the target eSIM terminal, prompting it to initiate a connection request. Upon receiving the connection request from the eSIM terminal, the connection management platform verifies the terminal's legitimacy based on the terminal identifier, authentication parameters, and activation parameters in the connection request, and establishes a connection with the eSIM terminal through a preset protocol. Subsequently, the connection management platform sends a configuration file request to the SM-DP+ platform, receives the returned encrypted configuration file, and decrypts, verifies, and formats it using a preset decryption key to obtain the target configuration file. Finally, the connection management platform encapsulates the configuration file as needed and sends it to the target eSIM terminal, supporting fragmented transmission and terminal reassembly for large data volumes. Simultaneously, after the terminal completes the configuration file writing and successfully accesses the target operator's network, it returns activation confirmation information, and the connection management platform updates the terminal's configuration status based on this activation confirmation information.

[0026] In this way, the above technical solution enables remote secure configuration of eSIM terminals, thereby avoiding the hardware resource overhead and maintenance complexity associated with deploying a complete LPA module on the terminal side. It can improve the automation of number distribution and activation, thus enhancing the configuration efficiency and platform controllability for large-scale device network access; furthermore, standardized authentication and transmission processes ensure the security and consistency of configuration data, enhancing the overall system reliability and scalability.

[0027] After introducing the application scenarios and design concepts of this application, the technical solutions provided by this application will be described in detail below.

[0028] This application provides a connection management system, referring to... Figure 1 The connectivity management system includes a connectivity management platform 11, as well as an eSIM terminal 12, an operator gateway platform 13, and an SM-DP+ platform 14 that are communicatively connected to the connectivity management platform 11.

[0029] Here, the Connectivity Management Platform 11, as a cloud service platform, centrally deploys the core functions of the LPA. The Connectivity Management Platform 11 is responsible for coordinating and driving the entire eSIM number distribution process. Specifically, the Connectivity Management Platform is a CMP (Connectivity Management Platform) platform.

[0030] eSIM terminal 12 is the target of the configuration task, such as IoT devices, smart wearable devices, and smartphones. eSIM terminal 12 has basic communication capabilities, including receiving SMS messages, establishing data connections, and the ability to install eSIM configuration files. Notably, eSIM terminal 12 does not require the integration of complete LPA functionality.

[0031] The operator gateway platform 13 mainly refers to the operator's SMS gateway platform. As a communication bridge between the connection management platform and the eSIM terminal, it is responsible for generating and delivering activation notification SMS messages with specific instructions to the target eSIM terminal according to the instructions sent by the connection management platform 11.

[0032] The SM-DP+ platform 14 is a configuration file management platform used to generate eSIM configuration files and respond to requests from the connectivity management platform 11.

[0033] In one feasible implementation, refer to Figure 2 The connection management platform 11 includes: The SMS management module 21 is used to send SMS generation information to the operator platform in response to the received code distribution instruction, so that the operator platform can send an activation notification SMS to the target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information and is used to instruct the target eSIM terminal to establish a connection with the connection management platform.

[0034] The data transmission module 22 is used to receive the connection request sent by the target eSIM terminal based on the activation notification SMS, and to establish a connection with the target eSIM terminal based on the connection request.

[0035] The configuration file management module 23 is used to send configuration file request information to the SM-DP+ platform after the connection is established, and to receive the encrypted configuration file returned by the SM-DP+ platform.

[0036] LPA module 24 is used to decrypt the encrypted configuration file based on a pre-stored decryption key to obtain the target configuration file.

[0037] The data transmission module 22 is also used to send the target configuration file to the target eSIM terminal.

[0038] In one feasible implementation, the SMS management module 21 is further configured to: Obtain the target terminal identifier from the code distribution instruction.

[0039] SMS generation information is generated based on the target terminal identifier, as well as the pre-stored connection management platform address and connection parameters.

[0040] The SMS generation information is sent to the operator platform, so that the operator platform can generate an activation notification SMS based on the SMS generation information and send the activation notification SMS to the target eSIM terminal corresponding to the target terminal identifier; wherein, the connection parameters include BIP connection information and activation instructions.

[0041] In one feasible implementation, the connection request includes a current terminal identifier, activation information, and authentication parameters; the authentication parameters are generated by the target eSIM terminal based on a preset encryption standard; the activation information includes the connection parameters from the activation notification SMS. The data transmission module 22 is further configured to: Determine whether the current terminal identifier is consistent with the target terminal identifier, whether the activation information is consistent with the connection parameters, and whether the authentication parameters meet the preset encryption standard.

[0042] If the current terminal identifier matches the target terminal identifier, the activation information matches the connection parameters, and the authentication parameters meet the preset encryption standard, then continue to determine whether the target eSIM terminal has access rights.

[0043] If the target eSIM terminal has access rights, a connection is established with the target eSIM terminal.

[0044] In one feasible implementation, the configuration file request information includes the target terminal identifier, configuration file type, and security authentication information. The configuration file management module 23 is further configured to: Send a configuration file request message to the SM-DP+ platform so that the SM-DP+ platform can determine whether the security identity authentication information is valid and whether the eSIM terminal corresponding to the target terminal identifier has the necessary access permissions.

[0045] If the security authentication information is valid and the eSIM terminal corresponding to the target terminal identifier has the necessary access permissions, it can receive the encrypted configuration file sent by the SM-DP+ platform.

[0046] Among them, the encrypted configuration file conforms to the configuration file type; the encrypted configuration file is obtained by the SM-DP+ platform after encrypting the configuration file according to the preset encryption method.

[0047] In one feasible implementation, the LPA function module 24 is further configured to: The decryption key is extracted from local secure storage and used to decrypt the encrypted configuration file to obtain the first configuration file; the decryption key is negotiated and determined when establishing a connection with the SM-DP+ platform.

[0048] Based on the preset integrity verification method, the first configuration file is verified for integrity. If the verification passes, the first configuration file is formatted to obtain the target configuration file.

[0049] In one feasible implementation, the data transmission module 22 is further configured to: Based on a preset data transmission protocol standard, the target configuration file is encapsulated to obtain the encapsulated target configuration file.

[0050] The packaged target configuration file is sent to the target eSIM terminal.

[0051] Receive activation confirmation information returned by the target eSIM terminal to confirm that the target eSIM terminal has completed the code number configuration; wherein, the activation confirmation information is the information generated by the target eSIM terminal after writing the target configuration file into the eSIM module of the eSIM terminal and accessing the communication network of the target operator based on the target configuration file.

[0052] In one feasible implementation, when the data volume of the target configuration file exceeds a preset data volume threshold, the data transmission module 22 is further configured to: The encapsulated target configuration file is divided into multiple data fragments based on a preset data volume threshold.

[0053] Each data segment is sent sequentially to the target eSIM terminal, so that the target eSIM terminal can reassemble the data segments after receiving each data segment to obtain the encapsulated target configuration file.

[0054] Based on the above embodiments, this application provides an eSIM terminal configuration method based on cloud-based LPA functionality, referring to... Figure 3 The general flow of the human-machine interface device login method provided in this application embodiment is as follows: Step S101: In response to the received code distribution instruction, send SMS generation information to the operator platform so that the operator platform sends an activation notification SMS to the target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information and is used to instruct the target eSIM terminal to establish a connection with the connection management platform.

[0055] Here, the code distribution instruction can be manually triggered by administrators through the platform interface, or it can be automatically triggered by upper-level business systems (such as IoT device management platforms) through API interfaces.

[0056] The connection management platform sends the SMS generation information to the operator platform through a standard interface. The operator platform then generates a technically complete activation notification SMS that can be parsed by the eSIM terminal based on the received information and delivers it to the target eSIM terminal.

[0057] In one embodiment, step S101 includes the following steps S201-S203.

[0058] Step S201: Obtain the target terminal identifier from the code number distribution instruction.

[0059] Here, the target terminal identifier can be the integrated circuit card identification code (ICCID) of the eSIM card, the embedded universal integrated circuit card identification code (EID), or the International Mobile Subscriber Identity (IMSI). After receiving the instruction, the connection management platform will parse and extract this identifier to identify the target eSIM terminal.

[0060] Step S202: Generate SMS generation information based on the target terminal identifier and the pre-stored connection management platform address and connection parameters.

[0061] Here, the target terminal identifier is used for subsequent routing and location by the operator platform.

[0062] The connection management platform address is the external network address or terminal access address pre-stored in the connection management platform's own configuration, such as a fixed IP address and port number. The connection management platform address is used to inform the eSIM terminal where to initiate subsequent connection requests after receiving an SMS message.

[0063] Connection parameters are a set of key parameters used to define subsequent interaction behavior, including BIP connection information. The connection management platform preferably establishes a connection with the target eSIM terminal through BIP (Bearer Independent Protocol). BIP connection information is used to instruct the eSIM terminal how to establish a secure BIP connection. Specifically, it can include the type of security protocol to be used (such as a PSK (Pre-Shared Key) authentication mechanism or TLS (Transport Layer Security) / DTLS (Dual Packet Transport Layer Security)), the key ID required during the authentication process, or the specified suite of encryption algorithms, etc.

[0064] An activation command is a specific instruction code or a unique transaction ID used to instruct the eSIM terminal to perform an activation operation, and serves as the unique credential for this configuration task. When the eSIM terminal subsequently initiates a connection request, it will send back this information. The connection management platform can then use this information to accurately associate the connection request with the command issued this time, preventing incorrect requests or unauthorized connections.

[0065] Step S203: Send SMS generation information to the operator platform so that the operator platform can generate an activation notification SMS based on the SMS generation information and send the activation notification SMS to the target eSIM terminal corresponding to the target terminal identifier; wherein, the connection parameters include BIP connection information and activation instructions.

[0066] Here, the connection management platform connects with the operator platform through the standard A2P (Application to Person) messaging interface, via SMPP (Short Message Peer-to-Peer) or HTTPS API (Two-way Authentication Gateway Interface), and pushes the SMS generation information to the operator platform.

[0067] After receiving the SMS generation information from the connection management platform, the operator platform will parse the received SMS generation information and encapsulate the business data (CMP address, connection parameters, etc.) into an activation notification SMS that conforms to the telecommunications network transmission standards and can be correctly identified and parsed by the eSIM terminal. The activation notification SMS can be a data SMS in binary format.

[0068] The operator platform uses its SMS gateway to address and route the generated activation notification SMS in the mobile core network based on the target terminal identifier contained in the SMS generation information, and finally sends the generated activation notification SMS to the target eSIM terminal through the wireless network.

[0069] Step S102: Receive the connection request sent by the target eSIM terminal based on the activation notification SMS, and establish a connection with the target eSIM terminal based on the connection request.

[0070] Here, after receiving the activation notification SMS, the target eSIM terminal will parse the SMS content and, based on the connection management platform address and connection parameters contained therein, will proactively initiate a connection request to the connection management platform.

[0071] Upon receiving the connection request, the connection management platform verifies the request and, if it determines that the eSIM terminal has the necessary access rights, establishes a secure communication connection with the target eSIM terminal.

[0072] In one embodiment, the connection request includes a current terminal identifier, activation information, and authentication parameters; the authentication parameters are generated by the target eSIM terminal based on a preset encryption standard; the activation information includes the connection parameters from the activation notification SMS.

[0073] Here, the activation information is generated by the eSIM terminal based on the content of the received activation notification SMS, and includes the connection parameters from the activation notification SMS (e.g., the activation command or its corresponding transaction ID). The activation information is used by the connection management platform to prove that this connection request is a response to a legitimate command initiated by the connection management platform, and not an unexpected or malicious connection attempt.

[0074] Authentication parameters are a set of critical cryptographic data generated by the target eSIM terminal using its internal security environment (such as the eUICC security chip) and pre-stored keys or certificates, following preset encryption standards (e.g., PSK-based HMAC algorithm or asymmetric encryption-based digital signature algorithm). These authentication parameters are used to prove the authenticity of the eSIM terminal's physical identity to the connection, preventing device forgery.

[0075] Step S102, the step of establishing a connection with the target eSIM terminal based on the connection request, includes the following steps S301-S303.

[0076] Step S301: Determine whether the current terminal identifier is consistent with the target terminal identifier, whether the activation information is consistent with the connection parameters, and whether the identity authentication parameters meet the preset encryption standard.

[0077] Here, the connection management platform compares the current terminal identifier included in the connection request with the target terminal identifier recorded in this code distribution task. When the two match exactly, it is determined that the target device initiated the connection.

[0078] The connection management platform will compare the activation information in the connection request with the connection parameters sent via SMS for this task. For example, it will compare whether the transaction ID contained in the activation information matches the transaction ID sent by the connection management platform.

[0079] The connection management platform will verify the identity authentication parameters carried in the request according to the encryption standard agreed upon with the target eSIM terminal or the preset encryption standard.

[0080] In one optional implementation, if a pre-shared key mechanism (PSK) is used, the connection management platform will use its locally stored PSK, which corresponds to the target eSIM terminal, to perform the same cryptographic operations on the agreed-upon data, and compare the calculation result with the authentication parameters reported by the eSIM terminal. If the results match, authentication is successful.

[0081] In another optional implementation, if a digital certificate mechanism is used, the connectivity management platform uses a pre-installed root certificate or CA (Certificate Authority) public key to verify the validity of the eSIM terminal certificate, and uses the public key in the eSIM certificate to decrypt or verify the digital signature generated by the eSIM private key. If the signature is valid, authentication is successful.

[0082] Step S302: If the current terminal identifier is consistent with the target terminal identifier, the activation information is consistent with the connection parameters, and the identity authentication parameters meet the preset encryption standard, determine whether the target eSIM terminal has access rights.

[0083] Here, if the current terminal identifier matches the target terminal identifier, the activation information matches the connection parameters, and the authentication parameters meet the preset encryption standard, the connection management platform continues to determine access permissions. This access permission determination is used to ascertain whether the eSIM terminal, having passed security verification, is authorized to perform subsequent operations. For example, the connection management platform will query its internal database to check if the terminal's account status is normal, if it is within the allowed configurable geographical region or time window, and if it has been blacklisted.

[0084] Step S303: If the target eSIM terminal has access rights, then establish a connection with the target eSIM terminal.

[0085] Here, after confirming that the target eSIM terminal has access rights, the connection management platform establishes a connection with the target eSIM terminal.

[0086] The connection management platform establishes a connection with the target eSIM terminal based on the BIP protocol. Based on the BIP protocol, all communication between the connection management platform and the target eSIM terminal, especially the transmission of sensitive eSIM configuration files, will take place in a channel with end-to-end encryption and integrity protection, thus providing a solid guarantee for the security of the entire configuration process.

[0087] Step S103: After the connection is established, send a configuration file request message to the SM-DP+ platform and receive the encrypted configuration file returned by the SM-DP+ platform.

[0088] Here, after establishing a secure communication connection with the eSIM terminal, the connection management platform sends a configuration file request to the SM-DP+ platform. Upon receiving the request, the SM-DP+ platform first verifies the legitimacy of the connection management platform's authentication information and determines whether the target eSIM terminal has the permission to access the configuration file. After all verifications are successful, the SM-DP+ platform generates the corresponding configuration file based on the request type, encrypts the configuration file using a preset encryption method, and then returns the encrypted configuration file to the connection management platform.

[0089] In one embodiment, the configuration file request information includes the target terminal identifier, configuration file type, and security authentication information.

[0090] Here, the configuration file type can be a configuration file for a specific mobile network operator, an IoT package that only includes data services, or a full-featured package that includes complete voice and data services.

[0091] Because the SM-DP+ platform manages highly sensitive user subscription data, it must ensure that it only responds to requests from trusted sources. Therefore, the connection management platform must attach valid authentication information, i.e., secure identity authentication information, when sending requests. In one optional implementation, secure identity authentication information can be a client certificate based on a two-way TLS handshake, or a valid API (interface) key or OAuth (Open Authorization) token carried in the HTTP (Hypertext Transfer Protocol) request header.

[0092] Step S103 includes the following steps S401-S402.

[0093] Step S401: Send configuration file request information to the SM-DP+ platform so that the SM-DP+ platform can determine whether the security identity authentication information is valid and whether the eSIM terminal corresponding to the target terminal identifier has access rights.

[0094] Here, after receiving the configuration file request information sent by the connection management platform, the SM-DP+ platform will either verify the legitimacy of the requester or the permissions of the target terminal.

[0095] Specifically, the SM-DP+ platform verifies the security authentication information carried in the request. Only after confirming that this information is legitimate and valid, meaning the request indeed originates from a registered and authorized connection management platform, will the request continue to be processed.

[0096] After verifying the legitimacy of the connection management platform, the SM-DP+ platform uses the target terminal identifier provided in the request to query its internal policies and databases to determine whether the target eSIM terminal itself has access to obtain the configuration file. This may include checking whether the terminal's EID is on the whitelist, whether it is in a state where downloading is allowed, and whether it is qualified to obtain the requested configuration file type.

[0097] Step S402: If the security identity authentication information is valid and the eSIM terminal corresponding to the target terminal identifier has access permissions, receive the encrypted configuration file sent by the SM-DP+ platform.

[0098] Among them, the encrypted configuration file conforms to the configuration file type; the encrypted configuration file is obtained by the SM-DP+ platform after encrypting the configuration file according to the preset encryption method.

[0099] Here, after both the connection management platform and the target eSIM terminal pass the dual authentication, the SM-DP+ platform generates the corresponding configuration file based on the requested configuration file type and the target terminal identifier.

[0100] Before returning the configuration file to the connection management platform, the SM-DP+ platform encrypts the configuration file using a preset encryption method. This encryption process typically uses a key that has been pre-negotiated and shared securely with the connection management platform. This is done to ensure that the configuration file data remains encrypted throughout its transmission from the SM-DP+ platform to the connection management platform, preventing data theft or tampering during the intermediate link.

[0101] The connection management platform will receive this configuration file, which is of the requested type and is in an encrypted state, returned by the SM-DP+ platform.

[0102] Step S104: Decrypt the encrypted configuration file based on the pre-stored decryption key to obtain the target configuration file.

[0103] Here, after receiving the encrypted configuration file returned from the SM-DP+ platform, the connection management platform decrypts the encrypted configuration file to obtain the target configuration file.

[0104] In one embodiment, step S104 includes the following steps S501-S502.

[0105] Step S501: Extract the decryption key from the local secure storage and decrypt the encrypted configuration file based on the decryption key to obtain the first configuration file; the decryption key is negotiated and determined when establishing a connection with the SM-DP+ platform.

[0106] The LPA module obtains the decryption key used for decryption, which is pre-stored in the local secure storage of the connection management platform. This local secure storage can be a hardware security module, a trusted execution environment, or a dedicated key management service.

[0107] The decryption key is determined through secure offline or online channels when the connection management platform and the SM-DP+ platform establish a business partnership and technical integration.

[0108] After successfully retrieving the corresponding decryption key from secure storage, the LPA function module calls a cryptographic algorithm library (e.g., an algorithm conforming to the Advanced Encryption Standard AES) and uses the key to decrypt the entire encrypted configuration file data block received from the SM-DP+ platform.

[0109] The output of the decryption operation is a temporary plaintext configuration file, also known as the first configuration file. The first configuration file contains all the original, sensitive user subscription data, such as the International Mobile Subscriber Identity (IMSI), authentication keys, and carrier-specific data.

[0110] Step S502: Based on the preset integrity verification method, perform integrity verification on the first configuration file. If the verification passes, format the first configuration file to obtain the target configuration file.

[0111] Here, to ensure that the configuration file data is not damaged or maliciously tampered with during the transmission of the configuration file data from SM-DP+ to the connection management platform, and during the decryption within the connection management platform, the LPA function module will verify the decrypted first configuration file based on a preset integrity verification method.

[0112] Verification methods can include hash value comparison or digital signature verification.

[0113] Specifically, the hash value comparison works as follows: The SM-DP+ platform sends a hash value calculated from the original plaintext configuration file along with the encrypted configuration file. After decryption, the LPA module calculates a new hash value for the first configuration file using the same hash algorithm and compares it with the hash value provided by SM-DP+. If they match, the integrity check passes.

[0114] Digital signature verification: The SM-DP+ platform uses its private key to sign the original configuration file. The LPA module then uses the pre-stored SM-DP+ platform public key to verify the signature. If the signature verification is successful, the integrity check passes.

[0115] After the integrity verification passes, the LPA module formats the first configuration file. Formatting transforms the raw configuration file data into a format that the target eSIM terminal can directly install and parse.

[0116] Formatting processes may include data structure adjustments, metadata stripping, and the addition of management information.

[0117] Specifically, the data structure adjustment involves reorganizing the data fields into a data structure that conforms to a specific ASN.1 (Abstract Syntax Notation One) standard or other terminal definitions.

[0118] Metadata stripping involves removing metadata that is only used for interaction between SM-DP+ and the connection management platform, and this data is meaningless to the terminal itself.

[0119] Add management information to the connection management platform by adding some management tags or tracking information to the configuration file.

[0120] The data obtained after formatting is the target configuration file. The target configuration file can be directly used by the target eSIM terminal.

[0121] Step S105: Send the target configuration file to the target eSIM terminal so that the target eSIM terminal can complete the number configuration based on the target configuration file.

[0122] Here, the connection management platform encapsulates the processed target configuration file based on a preset data transmission protocol standard to ensure that it can be transmitted over the established secure connection.

[0123] After the complete configuration file is sent to the target eSIM terminal, the target eSIM terminal will perform the local installation and activation process.

[0124] In one embodiment, step S105 includes the following steps S601-S603.

[0125] Step S601: Based on the preset data transmission protocol standard, the target configuration file is encapsulated to obtain the encapsulated target configuration file.

[0126] Here, before sending the target configuration file to the target eSIM terminal, the target configuration file is encapsulated based on a preset data transmission protocol standard.

[0127] Specifically, the target configuration file is wrapped with the appropriate protocol header information, making it a standardized data packet that can be transmitted over an established secure connection. In a preferred embodiment, the data transmission protocol standard is the BIP protocol. Therefore, the encapsulation process includes placing the target configuration file into the payload of the BIP data packet and adding the necessary BIP protocol headers, such as command identifiers and data lengths.

[0128] Step S602: Send the encapsulated target configuration file to the target eSIM terminal.

[0129] In one embodiment, in certain scenarios, the data volume of an eSIM profile (especially when it contains information from multiple operators or complex applications) may be large. A single transmission may exceed the MTU (Maximum Transmission Unit) limit of a single data packet in the underlying network, or exceed the receive buffer size of a resource-constrained terminal, thereby causing transmission failure.

[0130] Therefore, before sending the encapsulated target configuration file, the connection management platform will first determine whether the total data volume of the encapsulated target configuration file exceeds a preset data volume threshold. This preset data volume threshold is set in advance based on actual conditions.

[0131] When the data volume of the target configuration file is greater than the preset data volume threshold, step S602 includes the following steps S701-S702.

[0132] Step S701: The encapsulated target configuration file is divided into multiple data segments based on a preset data volume threshold.

[0133] Here, the encapsulated configuration file is divided into multiple data segments according to a preset size (e.g., one segment per 1KB). Each data segment is encapsulated independently and assigned a sequence number or offset information.

[0134] Step S702: Each data segment is sent to the target eSIM terminal in sequence, so that the target eSIM terminal can reassemble the data segments after receiving each data segment to obtain the encapsulated target configuration file.

[0135] Here, each data segment is sent to the target eSIM terminal in sequence through the established secure connection.

[0136] Step S603: Receive activation confirmation information returned by the target eSIM terminal to confirm that the target eSIM terminal has completed number configuration; wherein, the activation confirmation information is generated by the target eSIM terminal after writing the target configuration file into the eSIM module of the eSIM terminal and accessing the communication network of the target operator based on the target configuration file.

[0137] Here, the target eSIM terminal receives all data fragments and reassembles them in the correct order based on the sequence number or offset information within them, in order to recover a complete, encapsulated target profile locally that is consistent with the one before transmission.

[0138] The target eSIM terminal writes the data received from the target configuration file into the storage space of its internal eSIM module (eUICC).

[0139] Access the target operator's communication network based on the network parameters and subscription credentials in the target configuration file.

[0140] Once the configuration file is successfully installed and the new identity is used to access the network, the eSIM terminal will generate activation confirmation information.

[0141] Subsequently, the eSIM terminal will return the activation confirmation information to the connection management platform through the previously established secure connection.

[0142] Upon receiving this activation confirmation, the connectivity management platform determines that the target eSIM terminal has successfully completed number configuration. The platform updates the terminal's service status to "Activation Successful" or "Configuration Completed" and records the relevant logs.

[0143] The computer program product provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0144] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0145] Furthermore, in the description of the embodiments of this application, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0146] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0147] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in this application, or make equivalent substitutions for some of the technical features. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the protection scope of this application.

Claims

1. A method for configuring an eSIM terminal based on cloud-based LPA functionality, characterized in that, Applied to a connection management platform; the method includes: In response to the received code number distribution instruction, SMS generation information is sent to the operator platform, so that the operator platform sends an activation notification SMS to the target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information and is used to instruct the target eSIM terminal to establish a connection with the connection management platform. Receive the connection request sent by the target eSIM terminal based on the activation notification SMS, and establish a connection with the target eSIM terminal based on the connection request; After the connection is established, a configuration file request message is sent to the SM-DP+ platform, and the encrypted configuration file returned by the SM-DP+ platform is received. The encrypted configuration file is decrypted using a pre-stored decryption key to obtain the target configuration file; The target configuration file is sent to the target eSIM terminal so that the target eSIM terminal can complete the number configuration based on the target configuration file; The step of sending SMS generation information to the operator platform in response to the received code distribution instruction, so that the operator platform sends an activation notification SMS to the target eSIM terminal, includes: Obtain the target terminal identifier from the code distribution instruction; The SMS generation information is generated based on the target terminal identifier, as well as the pre-stored connection management platform address and connection parameters; The SMS generation information is sent to the operator platform, so that the operator platform generates the activation notification SMS based on the SMS generation information and sends the activation notification SMS to the target eSIM terminal corresponding to the target terminal identifier; wherein, the connection parameters include BIP connection information and activation instructions; the activation instructions are a unique transaction ID used to command the target eSIM terminal to perform the activation operation, and are the unique credential for this configuration task; When the target eSIM terminal initiates the connection request based on the activation notification SMS, it sends back the transaction ID. The connection management platform associates the connection request with the activation command issued via the activation notification SMS in this configuration task based on the transaction ID sent back by the target eSIM terminal.

2. The eSIM terminal configuration method based on cloud-based LPA function according to claim 1, characterized in that, The connection request includes the current terminal identifier, activation information, and authentication parameters; the authentication parameters are generated by the target eSIM terminal based on a preset encryption standard. The activation information includes the connection parameters in the activation notification SMS message; The steps of establishing a connection with the target eSIM terminal based on the connection request include: Determine whether the current terminal identifier is consistent with the target terminal identifier, whether the activation information is consistent with the connection parameters, and whether the identity authentication parameters meet the preset encryption standard; If the current terminal identifier is consistent with the target terminal identifier, the activation information is consistent with the connection parameters, and the identity authentication parameters meet the preset encryption standard, determine whether the target eSIM terminal has access rights; If the target eSIM terminal has access rights, a connection is established with the target eSIM terminal.

3. The eSIM terminal configuration method based on cloud-based LPA function according to claim 2, characterized in that, The connection management platform establishes a connection with the target eSIM terminal based on the BIP protocol.

4. The eSIM terminal configuration method based on cloud-based LPA function according to claim 1, characterized in that, The configuration file request information includes the target terminal identifier, configuration file type, and security authentication information; After the connection is established, the steps of sending a configuration file request message to the SM-DP+ platform and receiving the encrypted configuration file returned by the SM-DP+ platform include: Send the configuration file request information to the SM-DP+ platform so that the SM-DP+ platform can determine whether the security identity authentication information is valid and whether the eSIM terminal corresponding to the target terminal identifier has access rights; If the security identity authentication information is valid and the eSIM terminal corresponding to the target terminal identifier has access rights, it receives the encrypted configuration file sent by the SM-DP+ platform; The encrypted configuration file conforms to the configuration file type; the encrypted configuration file is obtained by the SM-DP+ platform after encrypting the configuration file according to a preset encryption method.

5. The eSIM terminal configuration method based on cloud-based LPA function according to claim 4, characterized in that, The steps of decrypting the encrypted configuration file based on a preset decryption key to obtain the target configuration file include: The decryption key is extracted from local secure storage, and the encrypted configuration file is decrypted based on the decryption key to obtain the first configuration file; the decryption key is negotiated and determined when establishing a connection with the SM-DP+ platform; Based on a preset integrity verification method, the first configuration file is subjected to integrity verification. If the verification passes, the first configuration file is formatted to obtain the target configuration file.

6. The eSIM terminal configuration method based on cloud-based LPA function according to claim 5, characterized in that, Sending the target configuration file to the target eSIM terminal, so that the target eSIM terminal can complete the number configuration based on the target configuration file, includes the following steps: Based on a preset data transmission protocol standard, the target configuration file is encapsulated to obtain the encapsulated target configuration file; The encapsulated target configuration file is sent to the target eSIM terminal; The system receives activation confirmation information returned by the target eSIM terminal to confirm that the target eSIM terminal has completed number configuration; wherein, the activation confirmation information is generated by the target eSIM terminal after writing the target configuration file into the eSIM module of the eSIM terminal and accessing the communication network of the target operator based on the target configuration file.

7. The eSIM terminal configuration method based on cloud-based LPA function according to claim 6, characterized in that, When the data volume of the target configuration file exceeds a preset data volume threshold, the step of sending the encapsulated target configuration file to the target eSIM terminal includes: The encapsulated target configuration file is divided into multiple data fragments based on a preset data volume threshold. Each data segment is sent sequentially to the target eSIM terminal, so that the target eSIM terminal can reassemble the data segments after receiving each data segment to obtain the encapsulated target configuration file.

8. A connection management platform, characterized in that, For performing the method as described in any one of claims 1-7, the connection management platform comprises: The SMS management module is used to respond to the received code distribution instruction by sending SMS generation information to the operator platform, so that the operator platform sends an activation notification SMS to the target eSIM terminal; the activation notification SMS is generated by the operator platform based on the SMS generation information and is used to instruct the target eSIM terminal to establish a connection with the connection management platform. The data transmission module is used to receive the connection request sent by the target eSIM terminal based on the activation notification SMS, and to establish a connection with the target eSIM terminal based on the connection request; The configuration file management module is used to send configuration file request information to the SM-DP+ platform after the connection is established, and to receive the encrypted configuration file returned by the SM-DP+ platform. The LPA function module is used to decrypt the encrypted configuration file based on a pre-stored decryption key to obtain the target configuration file; The data transmission module is further configured to send the target configuration file to the target eSIM terminal, so that the target eSIM terminal can complete the number configuration based on the target configuration file.

9. A connection management system, characterized in that, The system includes the connection management platform as described in claim 8, and further includes an eSIM terminal, an operator gateway platform, and an SM-DP+ platform that are communicatively connected to the connection management platform.

Images