System, method and device for installing eSIM configuration file, and terminal equipment

Abstract

The invention relates to the technical field of embedded security, and discloses an installation system of an eSIM configuration file, which is applied to terminal equipment, and the installation system comprises a communication interface configured to receive an instruction data packet sent by an SM-DP + server, the instruction data packet comprises a security load and an execution bill, the security load is an eSIM configuration file encrypted based on a public key of an eSE asymmetric key pair; the fusion security domain comprises an eSE and an embedded universal integrated circuit card (eUICC), and the eSE is in secure communication with the eUICC; the routing logic unit is configured to route the instruction data packet to the eSE by hardware; wherein the eSE is configured to verify the execution bill, decrypt the security load based on a private key of the asymmetric key pair of the eSE after the verification is passed, so as to obtain an eSIM configuration file, and transmit the eSIM configuration file to the eUICC in a streaming manner; the eUICC is configured to perform an installation of the eSIM profile. According to the method, the security, reliability and anti-attack capability of eSIM configuration file installation can be improved. The invention further discloses an eSIM configuration file installation method and device and terminal equipment.

Description

Technical Field

[0001] This application relates to the field of embedded security technology, such as an eSIM profile installation system, method, apparatus, and terminal device. Background Technology

[0002] Currently, embedded SIM (eSIM) technology, standardized by the GSMA (Global System for Mobile Communications Association), allows users to remotely configure their mobile network operator's (MNO) profile without physically replacing the SIM card. Its core process relies on a software component called the LPA (Local Profile Assistant), which typically runs within the device's main operating system (Rich OS), such as Android or iOS.

[0003] In the standard process of existing technology (Prior Art), the LPA is responsible for establishing a secure connection with the remote SM-DP+ (SubscriptionManager - Data Preparation+) server, downloading the encrypted eSIM profile package, and then passing it to the eUICC (Embedded Universal Integrated Circuit Card) on the device for decryption and installation.

[0004] However, this architecture has inherent security risks and technical pain points: First, as an application running on Rich OS, the security of LPA itself and its operating environment constitutes a weak link in the entire trust chain. Rich OS may be vulnerable to malware, viruses, rootkit attacks, or unpatched vulnerabilities, leading to LPA hijacking or the theft of memory data, which in turn threatens the encrypted eSIM configuration file or related communication keys being processed.

[0005] Secondly, the data flow path of the eSIM configuration file is long and complex. Specifically, the data flow path is: network -> Rich OS network stack -> LPA application -> eUICC driver -> eUICC. Although the eSIM configuration file is encrypted, metadata, control signals, and data packets are temporarily stored in memory, which provides a theoretical attack window for side-channel attacks or cold start attacks.

[0006] Therefore, the industry urgently needs a configuration file installation mechanism that eliminates reliance on software man-in-the-middle and shortens the trust path in order to address high-level security threats targeting mobile devices and IoT terminals.

[0007] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0008] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.

[0009] This disclosure provides an eSIM profile installation system, method, apparatus, and terminal device to achieve hardware-level, end-to-end autonomous installation of eSIM profiles, thereby improving the security, reliability, and anti-attack capabilities of eSIM profile installation.

[0010] In some embodiments, the installation system is applied to a terminal device. The installation system includes: a communication interface configured to receive instruction data packets sent by an SM-DP+ server, the instruction data packets including a security payload and an execution ticket, the security payload being an eSIM profile encrypted with the public key of an eSE asymmetric key pair; a converged security domain including an eSE and an eUICC, the eSE and eUICC communicating securely; and a routing logic unit configured to hardware route instruction data packets to the eSE; wherein the eSE is configured to verify the execution ticket and, upon successful verification, decrypt the security payload using the private key of the eSE asymmetric key pair to obtain the eSIM profile, and stream the eSIM profile to the eUICC; the eUICC is configured to perform the installation of the eSIM profile.

[0011] In some embodiments, the routing logic unit accesses DMA or hardware interrupts to route instruction packets to the eSE.

[0012] In some embodiments, the execution ticket includes a data structure encrypted with the private key of the SM-DP+ server; wherein the data structure includes decryption instructions for decrypting the security payload and write instructions for writing the eSIM configuration file to the eUICC target memory address.

[0013] In some embodiments, the data structure further includes a session establishment mechanism for eSE1021 to establish a secure communication session with eUICC1022; eSE is also configured to establish a secure communication session with eUICC via an encrypted on-chip bus within the converged security domain based on the session establishment mechanism after successful authentication, so as to stream the eSIM profile to eUICC based on the secure communication session.

[0014] In some embodiments, the data structure further includes key derivation instructions; the eSE is also configured to co-derive a network authentication key for installing the eSIM profile based on the key derivation instructions during a secure communication session with the eUICC; the converged security domain further includes: secure shared memory, which is only authorized to be accessed by the eSE and eUICC during a secure communication session via the encrypted on-chip bus, and the secure shared memory is configured to store the network authentication key and intermediate parameters associated with the network authentication key.

[0015] In some embodiments, the installation system further includes: a host operating system, including a downgraded LPA, the downgraded LPA being configured to trigger the communication interface to receive instruction data packets sent by the SM-DP+ server and / or receive status notifications; wherein the status notifications include the file installation status of the eSIM configuration file sent by the eSE.

[0016] In some embodiments, the installation method is applied to a terminal device, and the installation method includes: receiving an instruction data packet sent by an SM-DP+ server through a communication interface, the instruction data packet including a security payload and an execution ticket, the security payload being an eSIM profile encrypted with the public key of an eSE asymmetric key pair; routing the instruction data packet to the eSE through a routing logic unit hardware; verifying the execution ticket through the eSE and, after successful verification, decrypting the security payload based on the private key of the eSE asymmetric key pair to obtain the eSIM profile and streaming it to the eUICC; and performing eSIM profile installation through the eUICC.

[0017] In some embodiments, executing a ticket via eSE and, upon successful verification, decrypting the security payload using the private key of the eSE asymmetric key pair to obtain an eSIM profile and streaming it to the eUICC includes: executing a ticket via eSE; upon successful verification, establishing a secure communication session with the eUICC via an encrypted on-chip bus within the converged security domain based on a session establishment mechanism; and streaming the eSIM profile to the eUICC via eSE based on the secure communication session.

[0018] In some embodiments, the installation apparatus includes a processor and a memory storing program instructions, the processor being configured to execute the eSIM profile installation method as described above when the program instructions are executed.

[0019] In some embodiments, the terminal device includes: a terminal device body, including an eSIM profile installation system as described above or an eSIM profile installation device as described above.

[0020] The eSIM profile installation system, method, apparatus, and terminal device provided in this disclosure can achieve the following technical effects: This embodiment of the disclosure receives instruction data packets sent by the SM-DP+ server through the communication interface and routes them to the eSE via hardware routing logic unit. After receiving the instruction data packets from the SM-DP+ server, the eSE verifies the execution ticket and, upon successful verification, decrypts the security payload using the private key of the eSE asymmetric key pair to obtain the eSIM configuration file. The eSIM configuration file is then streamed to the eUICC for installation via the eUICC. This embodiment of the disclosure implements the eSIM configuration file installation process through hardware triggering and execution, completely eliminating the intermediary role of the LPA in the data path in the Rich OS, thus providing immunity to software vulnerabilities, malicious code injection, and monitoring from the operating system level. This embodiment of the disclosure also simplifies the data flow path to a hardware direct path: physical interface -> eSE -> eUICC. The anchor point of the trust chain is elevated from the software LPA to the chip-level eSE, resulting in an order-of-magnitude improvement in security. This embodiment of the disclosure achieves hardware-level, end-to-end autonomous installation of the eSIM configuration file, improving the security, reliability, and anti-attack capabilities of the eSIM configuration file installation.

[0021] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description

[0022] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein: Figure 1 This is a schematic diagram of the architecture of a typical eSIM profile installation system used in existing technologies; Figure 2 This is a schematic diagram of the architecture of an eSIM configuration file installation system provided in an embodiment of this disclosure; Figure 3 This is a schematic diagram of another eSIM profile installation system provided in this embodiment of the disclosure; Figure 4 This is a schematic diagram of an eSIM configuration file installation method provided in an embodiment of this disclosure; Figure 5 This is a schematic diagram of another eSIM profile installation method provided in this embodiment of the disclosure; Figure 6 This is an application illustration provided by an embodiment of the present disclosure; Figure 7 This is a schematic diagram of an eSIM profile installation device provided in an embodiment of this disclosure.

[0023] Figure label: 1: eSIM profile installation system; 10: Chip; 20: Rich OS; 30: SM-DP+ server; 101: Communication interface; 102: Converged Security Domain; 103: Routing Logical Unit; 201: Degraded LPA; 202: LPA; 1021: eSE; 1022: eUICC; 1023: Secure Shared Memory; 70: eSIM profile installation device; 700: Processor; 701: Memory; 702: Communication interface; 703: Bus. Detailed Implementation

[0024] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.

[0025] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.

[0026] Unless otherwise stated, the term "multiple" means two or more.

[0027] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0028] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0029] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.

[0030] Figure 1 This diagram illustrates the architecture of a typical eSIM profile installation system in the prior art. In the above installation system, the LPA202, located in the insecure environment of the terminal device (i.e., Rich OS20), plays a core role. After the SM-DP+ server 30 sends the encrypted eSIM profile to the LPA via a public network, the LPA forwards the encrypted eSIM profile to the eUICC through a standard interface. The eUICC then decrypts and installs the encrypted eSIM profile.

[0031] The above installation scheme has significant security vulnerabilities: the LPA application itself and the Rich OS environment it runs on are the primary attack surface. Malware, operating system vulnerabilities, or man-in-the-middle attacks could intercept or tamper with configuration file data, or inject malicious commands during critical interactions between LPA and eUICC, leading to user privacy breaches or hijacking of communication services.

[0032] In the disclosed embodiments, the communication interface is an NFC (Near Field Communication) controller or a wireless communication module.

[0033] An eSE (Embedded Secure Element) is a security chip with an independent processor, cryptographic coprocessor, and private memory. The eSE stores an eSE asymmetric key pair, which includes a public key and a private key.

[0034] eUICC is secure hardware for storing and executing eSIM profiles.

[0035] Secure shared memory is on-chip SRAM (Static Random-Access Memory) protected by a memory protection unit or equivalent hardware mechanism, and is only authorized to be accessed by eSE and eUICC through an encrypted on-chip bus secure communication session.

[0036] The encrypted on-chip bus is a dedicated, physically or logically isolated on-chip communication bus used to connect eSE and eUICC, eSE and secure shared memory, and eUICC and mounted shared memory. Data to be transmitted is encrypted with a session key and then transmitted via the encrypted on-chip bus.

[0037] The Converged Security Domain (CSD) is a hardware-enforced, highly secure on-chip execution environment. The CSD comprises the eSE and eUICC. The eSE and eUICC are physically tightly integrated. The eSE exchanges data with the eUICC via an encrypted on-chip bus, enabling direct, high-speed, and secure data transmission and preventing external components outside the CSD from eavesdropping on or interfering with the data exchange between the eSE and eUICC.

[0038] The Degraded LPA is configured to initiate trigger commands to the Converged Security Domain and / or receive processing results (such as successful or failed configuration file installation) from the Converged Security Domain after user interaction and then send the processing results back to the user. It should be noted that the Degraded LPA communicates with the Converged Security Domain through a strictly limited secure mailbox mechanism. The data transmitted between the Degraded LPA and the Converged Security Domain only contains status information and does not contain sensitive data (such as command packets).

[0039] To address the security vulnerabilities inherent in typical eSIM configuration file installation systems, combined with Figure 2 As shown, this embodiment of the present disclosure provides an eSIM profile installation system 1, including a chip 10. The chip 10 includes a communication interface 101, a converged security domain 102, and a routing logic unit 103.

[0040] Communication interface 101 is configured to receive instruction data packets sent by SM-DP+ server 30, the instruction data packets including security payload and execution ticket.

[0041] The converged security domain 102 includes eSE1021 and eUICC1022, with eSE1021 and eUICC1022 communicating securely.

[0042] The routing logic unit 103 is configured to send hardware routing instruction packets to eSE1021.

[0043] The eSE1021 is configured to verify the execution ticket and, upon successful verification, decrypt the security payload based on the private key of the eSE asymmetric key pair to obtain the eSIM profile, and then stream the eSIM profile to the eUICC1022.

[0044] The eUICC1022 is configured to perform eSIM profile installation. Specifically, the eUICC1022 performs eSIM profile installation based on the GSMA standard.

[0045] The eSIM profile installation system provided in this disclosure receives instruction data packets from the SM-DP+ server via a communication interface and then routes them to the eSE via a routing logic unit. Upon receiving the instruction data packets, the eSE verifies the execution ticket and, after successful verification, decrypts the security payload using the private key of the eSE's asymmetric key pair to obtain the eSIM profile. The eSIM profile is then streamed to the eUICC for installation via the eUICC.

[0046] The aforementioned installation system has advantages in eliminating software man-in-the-middle attacks, chip-level convergence and collaborative computing, reshaping data flow and trust chains, overcoming technological ecosystem barriers, and having a wide range of application scenarios, as detailed below: (1) Eliminate software man-in-the-middle and achieve zero-trust hardware execution: Completely eliminate the intermediary role of LPA in the eSIM configuration file installation process in Rich OS, and transform the installation process into an atomic operation triggered and executed by hardware, which can be immune to all software vulnerabilities and malicious code injection and monitoring from the operating system level.

[0047] (2) Chip-level fusion and collaborative computing: Innovatively integrates the physically adjacent eSE and eUICC from two independent black-box hardware designs into a unified fusion security domain, realizing deep integration of functions and trust, and thus realizing secure collaborative key derivation and data flow control.

[0048] (3) Reshaping of data flow and trust chain: The data flow path is simplified from the long and vulnerable network -> OS -> LPA -> eUICC to a hardware direct path of physical interface -> eSE -> eUICC. The anchor point of the trust chain is upgraded from software LPA to chip-level eSE, which improves security by orders of magnitude.

[0049] (4) Technological ecosystem barriers: Chip manufacturers need to customize at the hardware design level, and equipment manufacturers, operating system suppliers, and standards organizations such as GSMA need to work together to modify the eSIM distribution standard to achieve deep cross-domain integration and build a strong technological moat.

[0050] (5) Wide range of application scenarios: It is suitable for next-generation smartphones, financial terminals, and government and military equipment with extremely high security requirements, providing solutions for the secure deployment of IoT devices in zero-trust network environments. It can also serve as a standard solution for the secure injection of high-value credentials such as digital identities and digital car keys in the future.

[0051] In summary, the embodiments disclosed herein enable hardware-level, end-to-end autonomous installation of eSIM profiles, thereby improving the security, reliability, and resistance to attacks during eSIM profile installation.

[0052] Optionally, the security payload is an eSIM profile encrypted with the public key of an eSE asymmetric key pair. The security payload is the core data of the command packet, containing the complete eSIM profile.

[0053] Here, the eSIM profile contained in the security payload is encrypted using the public key of the eSE asymmetric key pair within the fused security domain, rather than encrypting the eSIM profile using the eUICC's transport key as used in existing technologies. This means that only the private key paired with the public key of the eSE asymmetric key pair can decrypt the security payload; the eUICC cannot decrypt the security payload independently, thus ensuring the confidentiality of transmitted data until it reaches the eUICC.

[0054] The execution ticket is a plaintext or lightly encrypted block of metadata. The execution ticket contains the task instructions issued by the SM-DP+ server to the converged security domain.

[0055] The task instructions include an operation instruction set, metadata, and an SM-DP+ digital signature. The operation instruction set defines the task type. For example, a task type might be "install eSIM profile" or "enable eSIM profile." The metadata includes verification information, such as the eUICC identifier and the hash value of the eSIM profile. The SM-DP+ digital signature is used to sign the execution ticket based on the SM-DP+ server's private key.

[0056] Optionally, the execution ticket includes a data structure encrypted with the private key of the SM-DP+ server. This data structure includes decryption instructions for decrypting the security payload and write instructions for writing the eSIM configuration file to the eUICC target memory address.

[0057] eSE1021 verifies execution tickets, specifically including: eSE1021 parses the execution ticket in the instruction packet to obtain the SM-DP+ digital signature.

[0058] The eSE1021 verifies SM-DP+ digital signatures based on the public key of a pre-installed SM-DP+ server.

[0059] If the verification is successful, the eSE1021 decrypts the security payload using the private key of the eSE asymmetric key pair to obtain the eSIM profile.

[0060] In the event of verification failure, the eSE1021 destroys the instruction data packet. Simultaneously, the eSE1021 logs the verification result in the error log.

[0061] In this way, eSE verifies the SM-DP+ digital signature based on the public key of the internally pre-configured SM-DP+ server. If the verification passes, it continues the subsequent process; if the verification fails, it indicates that the source of the instruction data packet is untrusted or that the instruction data packet has been tampered with. In this case, it is immediately destroyed.

[0062] Optionally, the routing logic unit 103 routes instruction packets to the eSE via DMA (Direct Memory Access) or hardware interrupt.

[0063] In this way, after receiving the instruction data packet, the routing logic unit does not pass through the main operating system, but sends it directly to the eSE via DMA or dedicated hardware interrupt routing. The above process does not require the intervention of the Rich OS, physically eliminating the possibility of the main operating system accessing the encrypted eSIM configuration file. It can be immune to all software vulnerabilities, malicious code injection and monitoring from the operating system level, which helps to improve the security and anti-attack capability of the eSIM configuration file installation process.

[0064] Optionally, the data structure also includes a session establishment mechanism for establishing a secure communication session between the eSE1021 and the eUICC1022.

[0065] The eSE1021 is also configured to establish a secure communication session with the eUICC1022 via an encrypted on-chip bus within the converged security domain after successful authentication, based on a session establishment mechanism, so as to stream the eSIM profile to the eUICC1022 based on the secure communication session.

[0066] In this way, after the ticket verification is successful, the eSE establishes a temporary secure communication session with the eUICC via an encrypted on-chip bus within the converged security domain based on the session establishment mechanism. The eSIM configuration file is then streamed to the eUICC based on this temporary secure communication session. Thus, during the installation process of the eSIM configuration file from the SM-DP+ server to the eUICC, its confidentiality is protected by the eSE's asymmetric key encryption, and its integrity and authenticity are guaranteed by the SM-DP+ digital signature. This ensures that sensitive data processing is strictly confined within the hardware-enforced, isolated converged security domain, enabling hardware-level and end-to-end autonomous installation of the eSIM configuration file, thereby improving the security, reliability, and anti-attack capabilities of the eSIM configuration file installation.

[0067] Optionally, if the installation structure of the eSIM profile has key derivation requirements, the data structure may also include key derivation instructions.

[0068] The eSE1021 is also configured to co-derive a network authentication key for installing the eSIM profile based on key derivation instructions during secure communication sessions with the eUICC1022. The co-derived network authentication key and its associated intermediate parameters reside within the hardware boundary of the converged security domain. The network authentication key includes either a session key or an application key.

[0069] In some optional embodiments, eSE1021 includes a true random number generator. During a secure communication session between eSE1021 and eUICC1022, a network authentication key for installing the eSIM profile is collaboratively derived based on key derivation instructions. Specifically, this includes: eSE1021 generating a random number via the true random number generator in response to the key derivation instructions; eSE1021 sending the random number to eUICC1022 via the encrypted on-chip bus; and eSE1021 and eUICC1022 jointly executing the key derivation algorithm using a shared key to generate the network authentication key for installing the eSIM profile.

[0070] The shared key is either a pre-set DUK (Device Unique Key) or another shared key. The key derivation algorithm includes HMAC (Hash-based Message Authentication Code) or AES-CMAC (Advanced Encryption Standard-Cipher-based Message Authentication Code).

[0071] Combination Figure 3 As shown, the converged security domain also includes secure shared memory 1023. Figure 3 In this context, Rich OS20 represents the main operating system.

[0072] Secure shared memory 1023 is authorized to be accessed only by eSE1021 and eUICC1022 during a secure communication session via an encrypted on-chip bus. Secure shared memory 1023 is configured to store network authentication keys and intermediate parameters associated with the network authentication keys.

[0073] Thus, during the critical phase of eSIM profile installation, it is also necessary to derive the network authentication key. This network authentication key derivation process is collaboratively completed by the eSE and eUICC during a temporary secure communication session within the converged security domain, ensuring that the generated network authentication key and its associated intermediate parameters do not leave the hardware boundary of the converged security domain. Simultaneously, leveraging the hardware cryptographic capabilities of both the eSE and eUICC guarantees the security of the network authentication key throughout its lifecycle, thereby enhancing the security, reliability, and attack resistance of the eSIM profile streaming transmission.

[0074] Optionally, combined Figure 3 As shown, the eSIM configuration file installation system 1 also includes a main operating system 20. The main operating system 20 includes a downgraded LPA 201.

[0075] The downgraded LPA201 is configured to trigger the communication interface to receive instruction data packets sent by the SM-DP+ server 30 and / or receive status notifications; wherein, the status notification includes the file installation status of the eSIM configuration file sent by the eSE1021. As an example, if the eUICC1022 is installed successfully, the file installation status is "installation successful"; if the eUICC1022 installation fails, the file installation status is "installation failed" or an error code.

[0076] In this way, the communication interface is triggered by a downgraded LPA to receive instruction data packets sent by the SM-DP+ server to initiate the transmission and installation process under the eSIM profile hardware mechanism. Simultaneously, after initiating eSIM profile transmission, the downgraded LPA does not participate in the core process of eSIM profile installation, but only receives the file installation status. This disclosure embodiment downgrades the function of the LPA in the prior art, making it only a receiver of the file installation status, thus ensuring the security and reliability of eSIM profile installation.

[0077] Optionally, eSE1021 sends status notifications to the downgraded LPA201 based on a secure email mechanism. In some alternative embodiments, the secure email mechanism can be a secure and restricted interface, or it can be a mailbox.

[0078] Combination Figure 4 As shown, this disclosure provides a method for installing an eSIM profile, including: S01, the terminal device receives the instruction data packet sent by the SM-DP+ server through the communication interface. The instruction data packet includes a security payload and an execution ticket. The security payload is an eSIM configuration file encrypted with the public key of the eSE asymmetric key pair.

[0079] S02, the terminal device routes instruction data packets to the eSE through the routing logic unit hardware routing.

[0080] S03, the terminal device verifies the execution ticket through eSE and, after successful verification, decrypts the security payload based on the private key of the eSE asymmetric key pair to obtain the eSIM profile and streams it to the eUICC.

[0081] S04, the terminal device performs eSIM configuration file installation via eUICC.

[0082] The eSIM configuration file installation method provided in this disclosure involves receiving an instruction data packet from an SM-DP+ server via a communication interface and then routing it to an eSE via a routing logic unit. Upon receiving the instruction data packet, the eSE verifies the execution ticket and, after successful verification, decrypts the security payload using the private key of the eSE's asymmetric key pair to obtain the eSIM configuration file. The eSIM configuration file is then streamed to the eUICC for installation via the eUICC.

[0083] This disclosure implements the eSIM profile installation process through hardware triggering and execution, completely eliminating the intermediary role of the LPA in the data path within RichOS, thus providing immunity to software vulnerabilities, malicious code injection, and monitoring from the operating system level. This disclosure also simplifies the data flow path to a hardware-through path of physical interface -> eSE -> eUICC, elevating the trust chain anchor from the software LPA to the chip-level eSE, resulting in an order-of-magnitude improvement in security. This disclosure achieves hardware-level, end-to-end autonomous installation of the eSIM profile, enhancing the security, reliability, and attack resistance of the eSIM profile installation.

[0084] Optionally, the terminal device verifies the ticket via eSE and, upon successful verification, decrypts the security payload using the private key of the eSE asymmetric key pair to obtain the eSIM profile and streams it to the eUICC, including: The terminal device verifies the execution ticket via eSE.

[0085] After successful verification, the terminal device establishes a secure communication session with eUICC via an encrypted on-chip bus within the converged security domain based on the session establishment mechanism.

[0086] The terminal device streams the eSIM profile to the eUICC via eSE based on a secure communication session.

[0087] Optionally, the terminal device performs eSIM profile installation via eUICC, including: During secure communication sessions between eSE and eUICC, the terminal device collaboratively derives a network authentication key for installing the eSIM configuration file based on key derivation instructions.

[0088] The terminal device completes the installation of the eSIM configuration file based on the network authentication key under eUICC.

[0089] Combination Figure 5 As shown in the embodiments of this disclosure, an eSIM profile installation method is also provided, including: S11, the terminal device receives the instruction data packet sent by the SM-DP+ server through the communication interface. The instruction data packet includes a security payload and an execution ticket. The security payload is an eSIM profile encrypted with the public key of the eSE asymmetric key pair.

[0090] S12, the terminal device routes instruction data packets to the eSE via the routing logic unit hardware.

[0091] S13, the terminal device verifies the execution ticket through eSE and, after successful verification, decrypts the security payload based on the private key of the eSE asymmetric key pair to obtain the eSIM profile and streams it to the eUICC.

[0092] S14, the terminal device performs eSIM configuration file installation via eUICC.

[0093] S15, the terminal device obtains the file installation status of the eUICC eSIM configuration file installation through eSE.

[0094] S16, the terminal device sends a status notification to the downgraded LPA via eSE. The status notification includes the file installation status.

[0095] The eSIM configuration file installation method provided in this disclosure implements the installation process through hardware triggering and execution, completely eliminating the intermediary role of the LPA in the data path within the Rich OS, thus providing immunity to software vulnerabilities, malicious code injection, and monitoring from the operating system level. This disclosure also simplifies the data flow path to a hardware pass-through path of physical interface -> eSE -> eUICC, elevating the trust chain anchor from the software LPA to the chip-level eSE, resulting in an order-of-magnitude improvement in security. Furthermore, this disclosure also provides feedback on the eSIM configuration file installation status to the degraded LPA via the eSE. This disclosure achieves hardware-level, end-to-end autonomous installation of the eSIM configuration file, enhancing the security, reliability, and anti-attack capabilities of the eSIM configuration file installation.

[0096] Optionally, the method for installing the eSIM profile also includes: The terminal device obtains the verification result of the verification execution ticket through eSE.

[0097] If the terminal device receives a verification failure message, it sends a verification notification to the downgraded LPA. The verification notification includes the status corresponding to the verification failure.

[0098] In practical applications, such as Figure 6 As shown, the installation method for the eSIM configuration file involves the following steps: S21, the terminal device receives the instruction data packet sent by the SM-DP+ server through the communication interface. The instruction data packet includes a security payload and an execution ticket. The security payload is an eSIM profile encrypted with the public key of the eSE asymmetric key pair.

[0099] S22, the terminal device routes instruction data packets to the eSE via the routing logic unit hardware.

[0100] S23, the terminal device verifies the execution ticket via eSE.

[0101] S24, the terminal device determines whether the verification passed. If yes, proceed to S25; otherwise, proceed to S29.

[0102] S25, the terminal device establishes a secure communication session with eUICC via an encrypted on-chip bus based on a session establishment mechanism within the converged security domain.

[0103] S26, the terminal device streams the eSIM profile to the eUICC via eSE based on a secure communication session.

[0104] S27, during a secure communication session between eSE and eUICC, the terminal device collaboratively derives a network authentication key for installing the eSIM configuration file based on a key derivation instruction.

[0105] S28, the terminal device completes the installation of the eSIM profile based on the network authentication key under eUICC.

[0106] S29, the terminal device destroys the instruction data packet via eSE, records the verification result in the error log, and sends a verification notification to the downgraded LPA. The verification notification includes the status corresponding to the verification failure.

[0107] Combination Figure 7 As shown, this disclosure provides an eSIM profile installation apparatus 70, including a processor 700 and a memory 701. Optionally, the apparatus 70 may further include a communication interface 702 and a bus 703. The processor 700, communication interface 702, and memory 701 can communicate with each other via the bus 703. The communication interface 702 can be used for information transmission. The processor 700 can call logical instructions in the memory 701 to execute the eSIM profile installation method of the above embodiment.

[0108] Furthermore, the logic instructions in the aforementioned memory 701 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0109] The memory 701, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 700 executes functional applications and data processing by running the program instructions / modules stored in the memory 701, that is, it implements the eSIM configuration file installation method in the above embodiments.

[0110] The memory 701 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 701 may include high-speed random access memory and may also include non-volatile memory.

[0111] This disclosure provides a terminal device, including: a terminal device body and the eSIM profile installation device 70 described above. The terminal device body includes either the eSIM profile installation system 1 or the eSIM profile installation device 70 described above. The eSIM profile installation system 1 or the eSIM profile installation device 70 described above is installed on the terminal device body. The installation relationship described herein is not limited to placement within the terminal device body, but also includes installation connections with other components of the terminal device, including but not limited to physical connections, electrical connections, or signal transmission connections. Those skilled in the art will understand that the eSIM profile installation system 1 or the eSIM profile installation device 70 can be adapted to various terminal device bodies to achieve other feasible embodiments.

[0112] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to execute the installation method of the eSIM configuration file described above.

[0113] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc., and other media capable of storing program code.

[0114] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used in this application means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.

[0115] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0116] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to implement this embodiment according to actual needs. Furthermore, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0117] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

Claims

1. An eSIM profile installation system, characterized in that, Applied to terminal devices, the installation system includes: The communication interface is configured to receive instruction packets sent by the Subscription Manager-Data Preparation SM-DP+ server. The instruction packets include a security payload and an execution ticket. The security payload is an eSIM profile encrypted with a public key based on an eSE asymmetric key pair. The converged security domain includes the embedded mounting element eSE and the embedded universal integrated circuit card eUICC, with secure communication between eSE and eUICC; The routing logic unit is configured to send hardware routing instruction packets to the eSE; The eSE is configured to verify the execution ticket and, upon successful verification, decrypt the security payload based on the private key of the eSE asymmetric key pair to obtain the eSIM profile, and then stream the eSIM profile to the eUICC. eUICC is configured to perform the installation of the eSIM profile.

2. The installation system according to claim 1, characterized in that, The routing logic unit routes instruction packets to the eSE via direct memory access DMA or hardware interrupt.

3. The installation system according to claim 1, characterized in that, The execution ticket includes a data structure encrypted with the private key of the SM-DP+ server; The data structure includes decryption instructions for decrypting the security payload and write instructions for writing the eSIM configuration file to the eUICC target memory address.

4. The installation system according to claim 3, characterized in that, The data structure also includes a session establishment mechanism for establishing a secure communication session between the eSE and the eUICC; the eSE is also configured to establish a secure communication session with the eUICC via an encrypted on-chip bus within the converged security domain based on the session establishment mechanism after successful authentication, so as to stream the eSIM configuration file to the eUICC based on the secure communication session.

5. The installation system according to claim 4, characterized in that, The data structure also includes key derivation instructions; the eSE is also configured to collaboratively derive network authentication keys for installing the eSIM profile based on the key derivation instructions during secure communication sessions with the eUICC. The converged security domain also includes: Secure shared memory is authorized to be accessed only by the eSE and eUICC during secure communication sessions via the encrypted on-chip bus. Secure shared memory is configured to store network authentication keys and intermediate parameters associated with the network authentication keys.

6. The installation system according to any one of claims 1 to 5, characterized in that, The installation system also includes: The main operating system includes the Downgrade Local Profile Assistant (LPA), which is configured to trigger the communication interface to receive instruction data packets sent by the SM-DP+ server and / or receive status notifications; wherein the status notifications include the file installation status of the eSIM profile sent by the eSE.

7. A method for installing an eSIM profile, characterized in that, For use in terminal devices, installation methods include: The system receives instruction data packets sent by the SM-DP+ server through the communication interface. The instruction data packets include a security payload and an execution ticket. The security payload is an eSIM profile encrypted with the public key of the eSE asymmetric key pair. The command data packets are routed to the eSE via the hardware routing logic unit. The ticket is executed via eSE verification, and after successful verification, the security payload is decrypted using the private key of the eSE asymmetric key pair to obtain the eSIM profile and streamed to the eUICC. eSIM configuration file installation is performed via eUICC.

8. The installation method according to claim 7, characterized in that, The ticket is executed via eSE verification, and upon successful verification, the secure payload is decrypted using the private key of the eSE asymmetric key pair to obtain the eSIM profile, which is then streamed to the eUICC, including: Execution tickets are verified via eSE; After successful verification, a secure communication session is established with eUICC via an encrypted on-chip bus within the converged security domain based on the session establishment mechanism. Based on a secure communication session, the eSIM profile is streamed from eSE to eUICC.

9. An installation apparatus for an eSIM profile, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to perform the eSIM profile installation method as described in claim 7 or 8 when running the program instructions.

10. A terminal device, characterized in that, include: The terminal device body includes an eSIM profile installation system as described in any one of claims 1 to 6 or an eSIM profile installation device as described in claim 9.

Images