An esim remote configuration security method based on multi-factor dynamic verification

Abstract

The present application relates to the technical field of eSIM remote configuration, and discloses an eSIM remote configuration security method based on multi-factor dynamic verification, comprising the following steps: step S1, calculating the received power quantity and the signal-to-noise ratio quantity; step S2, calculating the wireless coherence time; step S3, calculating the bearing available coefficient; step S4, calculating the slice span time; step S5, calculating the coherent shear coefficient; step S6, calculating the verification time window; and step S7, generating a configuration execution envelope. The present application generates the bearing available coefficient by fusing the signal quality, the received power and the propagation delay, calculates the coherent shear coefficient to represent the degree of wireless state change of the configuration file slice sequence relative to the session starting point, and generates the physical load coefficient, the dynamic verification time window and the safe bearing quantity in combination with the storage, temperature and power supply state of the security element, so as to realize the adaptive adjustment of the configuration file slice strategy and adapt to the application requirements of various high-speed mobile terminals.

Description

Technical Field

[0001] This invention relates to the field of eSIM remote configuration technology, and more specifically, to a secure method for eSIM remote configuration based on multi-factor dynamic verification. Background Technology

[0002] eSIM (embedded universal integrated circuit card) technology, as an application form of embedded universal integrated circuit cards, has been widely used in various mobile terminals and IoT devices. The remote SIM configuration process, through standardized interfaces and protocols, enables the remote download, installation, and management of operator subscription configuration files without replacing the physical SIM card. In existing technologies, the security mechanisms for remote configuration are mainly based on certificate chain authentication, configuration file encryption protection, and end-to-end secure channels. The validity period of verification materials typically uses a fixed session lifetime setting, and the configuration file fragmentation strategy is mainly determined based on network transmission efficiency and the processing capabilities of the security element.

[0003] In high-speed mobile scenarios, the relative motion between the terminal and the base station causes Doppler spread in the wireless channel, significantly shortening the coherence time. Different configuration file fragments within the same remote configuration session may span multiple wireless channel states, including signal strength fluctuations, signal-to-interference-plus-noise ratio (SINNR) changes, and cell handover. Existing security mechanisms typically focus only on logical-level authentication and encryption, neglecting the impact of dynamic changes in the physical wireless channel state on configuration security. Furthermore, physical parameters such as the storage state, operating temperature, and power supply stability of the security element are not incorporated into the security verification system for remote configuration.

[0004] Therefore, when the duration of a remote configuration session exceeds the coherence time of the wireless channel, the physical bearer state upon which the secure channel established in the initial phase of the session relies has changed, potentially leading to security risks for configuration file fragments during transmission. Thus, a dynamic verification method that combines the wireless channel state and the physical state of the secure element is urgently needed to improve the security of eSIM remote configuration in high-speed mobile scenarios. Summary of the Invention

[0005] This invention provides a secure eSIM remote configuration method based on multi-factor dynamic verification, which solves the technical problems mentioned in the background.

[0006] This invention provides a secure eSIM remote configuration method based on multi-factor dynamic verification, comprising the following steps: Step S1: Collect the received power index and signal-to-interference-plus-noise ratio index, and convert them into received power and signal-to-interference-plus-noise ratio respectively. Step S2: Collect the moving speed and carrier frequency, calculate the Doppler frequency shift based on the constant of the speed of light, and calculate the wireless coherence time based on the Doppler frequency shift; Step S3: Collect the ranging propagation delay and the measurement reference power, and calculate the bearer availability coefficient based on the signal-to-interference-plus-noise ratio, the received power, and the wireless coherence time. Step S4: Collect the payload bit quantity, downlink rate quantity, nominal number of fragments, single fragment processing time and retransmission density quantity, and calculate the fragment span time. Step S5: Calculate the coherence shearing coefficient based on the wireless coherence time, the fragmentation span time, and the nominal number of fragments; Step S6: Collect available storage, internal temperature, nominal temperature, power supply ripple and nominal power supply; calculate the physical load factor based on the net load bits; and calculate the verification time window based on the wireless coherence time, bearer availability factor, coherence shearing factor and physical load factor. Step S7: Calculate the security bearer quantity based on the downlink rate quantity, verification time window, and retransmission density quantity; calculate the verification cycle quantity based on the payload bit quantity and security bearer quantity; collect the identity set, session identity set, and session key set; and generate the configuration execution envelope based on the verification time window, security bearer quantity, and verification cycle quantity.

[0007] The beneficial effects of this invention are as follows: By converting logarithmic wireless measurement parameters into linear physical quantities, this invention enables wireless signal strength and quality parameters to participate in multi-factor security calculations; by calculating the coherence time of the wireless channel, it provides a physical layer basis for dynamic verification windows; by fusing signal quality, received power, and propagation delay to generate a bearer availability coefficient, it quantifies the credibility of the current wireless bearer; by calculating the total physical time span of configuration file fragments, it accurately assesses the extent to which fragmented streams traverse the wireless channel state; by calculating the coherence shearing coefficient, it characterizes the degree of wireless state change of the configuration file fragment sequence relative to the session start point; by combining the storage, temperature, and power supply status of security elements to generate a physical load coefficient, it comprehensively considers the security status on the terminal side; by generating a dynamic verification time window and security bearer capacity, it achieves adaptive adjustment of the configuration file fragmentation strategy; and by generating a configuration execution envelope with a message authentication code, it ensures the integrity of execution parameters and session binding. This invention helps improve the security of eSIM remote configuration in high-speed mobile scenarios and adapts to the application needs of various high-speed mobile terminals. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating the calculation process of an eSIM remote configuration security method based on multi-factor dynamic verification according to the present invention. Detailed Implementation

[0009] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, features described in some examples may be combined in other examples.

[0010] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" indicate that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0011] like Figure 1 As shown, an eSIM remote configuration security method based on multi-factor dynamic verification includes the following steps: Step S1: Collect the received power index and signal-to-interference-plus-noise ratio index, and convert them into received power and signal-to-interference-plus-noise ratio respectively. Step S2: Collect the moving speed and carrier frequency, calculate the Doppler frequency shift based on the constant of the speed of light, and calculate the wireless coherence time based on the Doppler frequency shift; Step S3: Collect the ranging propagation delay and the measurement reference power, and calculate the bearer availability coefficient based on the signal-to-interference-plus-noise ratio, the received power, and the wireless coherence time. Step S4: Collect the payload bit quantity, downlink rate quantity, nominal number of fragments, single fragment processing time and retransmission density quantity, and calculate the fragment span time. Step S5: Calculate the coherence shearing coefficient based on the wireless coherence time, the fragmentation span time, and the nominal number of fragments; Step S6: Collect available storage, internal temperature, nominal temperature, power supply ripple and nominal power supply; calculate the physical load factor based on the net load bits; and calculate the verification time window based on the wireless coherence time, bearer availability factor, coherence shearing factor and physical load factor. Step S7: Calculate the security bearer quantity based on the downlink rate quantity, verification time window, and retransmission density quantity; calculate the verification cycle quantity based on the payload bit quantity and security bearer quantity; collect the identity set, session identity set, and session key set; and generate the configuration execution envelope based on the verification time window, security bearer quantity, and verification cycle quantity.

[0012] In one embodiment of the present invention, the specific calculation process of step S1 is as follows: The formula for calculating the received power is as follows, based on the received power index:

[0013] in, This represents the received power after linear conversion, expressed in milliwatts as relative power. This indicates the received power index in logarithmic units, with units of decibels and milliwatts. The formula for calculating the signal-to-interference-plus-noise ratio (SIR) is as follows, based on the SIR index:

[0014] in, This represents the signal-to-interference-plus-noise ratio after linear transformation, and is dimensionless. The signal-to-interference-plus-noise ratio (SIR) is expressed in decibels (dB).

[0015] It should be noted that the received power index is the logarithm of the received power of the synchronization signal and the reference signal, measured in decibels (dB) and milliwatts (mW), and can be obtained through the terminal modem. The received power quantity is the relative value of the received power after linear transformation, measured in milliwatts, and represents the physical quantity of received power that can be used in calculations after transformation. The signal-to-interference-plus-noise ratio (SIR) index is the logarithm of the SIR of the synchronization signal, measured in decibels (dB), and can be obtained through the terminal modem. The SIR quantity is the relative value of the SIR after linear transformation, dimensionless, and represents the physical quantity of the SIR that can be used in calculations after transformation.

[0016] It should be noted that the logarithmic measured power index and signal-to-interference-plus-noise ratio (SNR) index cannot be directly used in subsequent calculations involving multiplicative exponential attenuation and proportional compression. This is because the logarithmic magnitudes inherently imbalance; direct use would lead to incorrect amplification or reduction of parameter weights, making multi-parameter joint calculations impossible. In a high-speed train scenario at 350 km / h, the power index is -85 dBm, and the SNR index is 15 dB, a difference of over 100 times. Directly using logarithmic dimensions for joint calculations would overemphasize the SNR effect while completely ignoring the power index effect, resulting in incorrect results. The converted power index is... The received power is 31.62 dBm, and the signal-to-interference-plus-noise ratio (SNR) is 31.62. Both are aligned to a computationally acceptable range and can be directly used in subsequent calculations. Linear conversion is suitable before the SMDPlus (Subscription Management Data Preparation Plus) initiates a PrepareDownload request, which is the formal start point for the RSP (Remote Configuration Protocol) session. Completing the conversion before this point ensures that subsequent secure calculations are based on the latest wireless measurement data, guaranteeing data timeliness and avoiding calculation errors caused by rapid signal changes in high-speed scenarios. When the signal condition is good, the received power index is -70 dBm, and the SNR index is 20 dB. Before conversion, the difference in magnitude between the two is as high as 90 dBm; direct calculation will ignore the influence of the received power. After conversion, the received power is... Milliwatts and a signal-to-interference-plus-noise ratio of 100 are of the same order of magnitude, which can accurately reflect the parameter weights and avoid imbalance problems.

[0017] It should be further explained that this embodiment transforms logarithmic wireless parameters, which were originally only used to determine communication connectivity, into linear physical quantities that can be directly involved in security calculations. This makes them the basic input parameters for the eSIM remote configuration dynamic verification window, realizing the first direct association between wireless communication status and eSIM configuration security.

[0018] In traditional eSIM configuration processes, the LPA (Local Configuration Assistant) only forwards the binding profile packet, without reading the modem's wireless measurement parameters or using them for secure calculations. Traditional LPAs only have communication interfaces with eUICC and SMDPlus, lacking a modem interface and thus unable to acquire wireless parameters. This invention adds a dedicated communication interface based on the AT command protocol to the LPA, enabling direct communication with the modem and real-time reading of wireless measurement parameters. Traditional applications rely solely on these parameters to determine if the signal meets communication requirements; this invention uses them as the foundational input for security verification, determining whether the wireless bearer meets the security requirements for eSIM remote configuration. Even if the signal can transmit normally, if the security status is not met, the configuration process will be adjusted to ensure security.

[0019] This embodiment solves the technical obstacle of the inability to integrate the dimensions of the quantity into the security verification model, providing an accurate and calculable linear physical quantity for the subsequent calculation of the dynamic verification window, ensuring the mathematical rationality of the security calculation. In scenarios with poor signal, such as when a train enters a tunnel, the received power exponent drops rapidly. After linear transformation, it can be accurately integrated into subsequent calculations, lowering the available load factor and adjusting the window size. At the same time, it lays the foundation for the unification of the parameters of the scheme, ensuring that all input parameters participate in the calculation with a unified linear order of magnitude, avoiding order of magnitude imbalance, and ensuring the accuracy of the calculation process.

[0020] In one embodiment of the present invention, the specific calculation process of step S2 is as follows: Collect movement speed data With carrier frequency , move speed With carrier frequency The product of these two products is used as the first numerator, and the constant of the speed of light is taken as the numerator. Using the first numerator as the first denominator, calculate the ratio of the first numerator to the first denominator to obtain the Doppler frequency shift. ; Using the constant 0.423 as the second numerator, the Doppler frequency shift... The second numerator is used as the second denominator. The ratio of the second numerator to the second denominator is then calculated to obtain the wireless coherence time. ; in, This indicates the speed of the mobile terminal, measured in meters per second. This indicates the carrier frequency used to carry remote configuration traffic, measured in Hertz. The speed of light is a constant, expressed in meters per second. This represents the Doppler frequency shift calculated based on the moving speed and carrier frequency, expressed in Hertz or per second. This represents the wireless coherence time calculated based on the Doppler frequency shift, in seconds.

[0021] It should be noted that the moving speed is the current moving speed of the high-speed mobile terminal, measured in meters per second, and can be obtained through the terminal's positioning module or speed sensor. The carrier frequency is the cellular network carrier frequency currently carrying eSIM remote configuration traffic, measured in Hertz, and can be obtained through the terminal's modem. The speed of light constant is a physical constant with a fixed value of 300,000,000 meters per second. The Doppler frequency shift is the frequency offset of the received signal caused by the relative motion between the terminal and the base station, measured in Hertz, characterizing the degree of influence of the terminal's motion on the wireless signal frequency. The wireless coherence time is the duration for which the wireless channel remains approximately correlated in a statistical sense, measured in seconds, characterizing the maximum duration for which the current wireless channel maintains a reliable state.

[0022] It should be noted that the constant 0.423 is a common engineering approximation coefficient used in the field of wireless communication to calculate wireless coherence time from the maximum Doppler frequency shift. This coefficient is derived based on the statistical characteristics of Rayleigh fading channels. In high-speed mobile scenarios, the error of this coefficient can be controlled within 5%. Compared with approximation coefficients such as 0.5, it can more accurately reflect the true coherence characteristics of wireless channels.

[0023] Wireless coherence time characterizes the approximately invariant statistical properties of the channel, rather than an absolutely invariant time threshold. Within this time, the wireless channel state can be approximated as unchanged, and data transmitted within this period can be considered to be transmitted under the same reliable channel state. After this time, the channel state changes significantly, and the original reliable state becomes invalid. In a high-speed train scenario at 350 km / h, with a moving speed of 97.2 m / s and a carrier frequency of 3.5 GHz, the calculated Doppler frequency shift is 1134 Hz, resulting in a final wireless coherence time of [missing value]. This time interval is only about 0.4 milliseconds, meaning that the channel state changes significantly every 0.4 milliseconds. If the train speed increases to 400 km / h, the Doppler frequency shift is 1300 Hz, and the corresponding radio coherence time is... The second aligns with the logic that the faster the speed, the faster the channel changes, and the shorter the coherence time.

[0024] It should be noted that this embodiment introduces the physical time characteristics of the wireless channel into the security verification system for eSIM remote configuration, replacing the fixed cryptographic session lifetime in the traditional RSP specification. This solves the problem that in high-speed mobile scenarios, the trusted duration of the wireless channel is much shorter than the standard cryptographic session lifetime, leading to a mismatch between the physical bearer trusted window and the logical security channel.

[0025] In traditional RSP specifications, the effective time of a single session is typically several minutes, designed for ordinary low-speed scenarios where the coherence time for pedestrian users can reach tens of milliseconds, and a fixed session lifetime can meet the requirements. However, in high-speed train scenarios, the reliable time of the wireless channel is only a fraction of a millisecond, far less than the traditional session lifetime. If a fixed session lifetime is still used, the logical security channel will still consider the session valid after the channel state changes, resulting in a security risk that traditional logical security cannot detect. Attackers can take advantage of the gap in channel changes to tamper with data, while the logical security channel only checks the validity of certificates and encryption and cannot detect this tampering, i.e., the mismatch between logical security and physical bearer.

[0026] This embodiment accurately quantifies the maximum duration for which the wireless channel remains in a trusted state, providing a core time reference for subsequent determination of whether BPP (Binding Profile Packet) fragments span multiple untrusted physical channels. This is a key prerequisite for achieving the coupling of logical security and physical security. With this accurate coherence time, it can be used as a benchmark to determine whether the time span of the fragmented stream exceeds the trusted time and whether it spans multiple untrusted channel states, providing a basis for all subsequent security calculations and avoiding the inapplicability of traditional fixed session lifetimes in high-speed scenarios.

[0027] In one embodiment of the present invention, the specific calculation process of step S3 is as follows: The formula for calculating the bearer availability factor is as follows, based on the signal-to-interference-plus-noise ratio, received power, measurement reference power, ranging propagation delay, and wireless coherence time:

[0028] in, This represents the available load-bearing capacity coefficient, which is dimensionless. This represents the signal-to-interference-plus-noise ratio (SIR) after linear transformation. This represents the received power after linear conversion. This indicates the reference power for measurement, in milliwatts. This indicates the ranging propagation delay, in seconds. This indicates the wireless coherence time, in seconds. This represents the natural exponential function.

[0029] It should be noted that the ranging propagation delay is the equivalent signal propagation delay between the terminal and the base station, measured in seconds, and can be calculated from the time advance parameter or the ranging results from the base station. The measurement reference power is the receiver's measurement reference power value, measured in milliwatts, and is given by the terminal equipment's factory calibration. The signal-to-interference-plus-noise ratio (SIRR) is the ratio of the linear SIRR to 1 plus the linear SIRR, characterizing the impact of signal quality on bearer availability. The received power ratio is the ratio of the linear received power to the linear received power plus the measurement reference power, characterizing the impact of signal strength on bearer availability. The bearer index is the negative value of the ratio of ranging propagation delay to wireless coherence time, characterizing the impact of propagation delay on bearer availability. The bearer availability coefficient is a continuous variable comprehensively characterizing the availability of wireless bearers; a larger value indicates higher security and availability of the wireless bearer.

[0030] It should be noted that the three sub-factors of the bearer availability coefficient characterize the reliability of the wireless bearer from three independent dimensions: signal quality, signal strength, and propagation delay. The product form is used to achieve joint constraints across multiple dimensions; any deterioration in any dimension will directly lower the overall bearer availability coefficient. If an additive form were used, the value would exceed 1, failing to achieve normalization and failing to reflect the characteristic that any deterioration in any dimension leads to a decrease in overall availability. For example, when the signal strength is 0, the additive form would still result in other factors contributing to the overall value, while the product form would directly result in 0, indicating the bearer is unavailable, which is more in line with practical needs. For example, in a high-speed train scenario at 350 km / h, the signal-to-interference-plus-noise ratio is 31.62 / 32.62, and the received power ratio is... / The carrying capacity index is -0.00001 / Multiplying the three together yields a bearer availability coefficient of 0.94, indicating that the current wireless bearer security availability is at a high level (value greater than 0.9). If the train enters the tunnel, the received power index becomes -110dBm, the received power ratio becomes 0.1, and the corresponding bearer availability coefficient becomes 0.1. At this time, the dynamic verification window will be compressed accordingly to ensure safety.

[0031] It should be further explained that this embodiment synthesizes three discrete air interface measurement parameters—signal quality, received power, and propagation delay—into a single continuous security bearer variable. This avoids the subjectivity and errors inherent in traditional manual level determination, achieving accurate and objective quantification of wireless bearer security availability. The continuity coefficient of this invention changes smoothly, enabling smooth window adjustment and ensuring the stability of the configuration process. This embodiment eliminates human intervention in wireless bearer availability determination, providing a continuous and quantifiable bearer security input. The dynamic verification window can be smoothly and adaptively adjusted according to the wireless bearer status, avoiding the misjudgment problem of traditional manual thresholds. It also solves the problem of inconsistent thresholds among different manufacturers. The continuity coefficient of this invention is universal and adaptable to all terminals, avoiding the confusion of different manufacturers' judgments under the same signal state. It also allows for more precise control of the subsequent dynamic verification window, avoiding the problem of the window being too large or too small, and providing the most accurate window size based on the current bearer status.

[0032] In one embodiment of the present invention, the specific calculation process of step S4 is as follows: Collect payload bits Downlink speed nominal number of fragments Single-chip processing time and retransmission density ; Net payload bits Except for the following line rate quantity , to obtain the transmission time; The nominal number of fragments With single-chip processing time Multiply them to get the processing time. Add the transmission time to the processing time to obtain the base span time. ; One and retransmission density Add them together to get a large amount of retransmission. Basic span time Multiply by the replay function to obtain the segmentation span time. .

[0033] in, This indicates the net payload in bits, in units of bits. This indicates the downlink rate, measured in bits per second. Represents the nominal number of fragments, dimensionless. This indicates the processing time per chip, in seconds. Represents the retransmission density quantity, which is dimensionless. This represents the basic span time, in seconds. This indicates the time span of the segment, in seconds.

[0034] It should be noted that the payload bit count is the total payload length of the bound profile packet to be downloaded, in bits, provided by SMDPlus. The downlink rate is the effective downlink rate available for downloading the bound profile packet at the application layer, in bits per second, which can be obtained from terminal application layer statistics. The nominal number of fragments is the total number of fragments formed after initial encoding of the bound profile packet by SMDPlus or LPA, dimensionless. The single fragment processing time is the average time eUICC takes to process a single bound profile packet fragment, in seconds, obtained from eUICC historical processing data statistics or factory calibration. The retransmission density is the HARQRLC and TCP layer retransmission bonus ratio per unit payload, dimensionless, which can be obtained from terminal link layer statistics. The transmission time is the total download time of the bound profile packet considering only network transmission, representing the time spent in the network transmission stage. The processing time is the total time eUICC takes to process all bound profile packet fragments, representing the time spent in the internal processing stage of eUICC. The base span time is the total end-to-end time of the bound profile packets before retransmission, representing the total time consumption without considering retransmission. The retransmission amplification is the time dilation factor considering the impact of retransmission, representing the amplification effect of retransmission on the total time. The fragment span time is the total end-to-end physical span of the bound profile packet fragmented stream after considering the impact of retransmission, in seconds, representing the total time span of the entire fragmented stream.

[0035] It's important to note that the retransmission density metric is the sum of all retransmissions at the physical layer, link layer, and transport layer, not just a single layer. Retransmissions can occur at any of the three layers, and any retransmission at any layer increases the time span of the fragmented stream. Therefore, it's crucial to count all retransmissions to accurately calculate the total time and avoid errors caused by underestimating the total time. The base span time includes both network transmission latency and eUICC internal processing latency, correcting the shortcoming of traditional models that only consider network transmission latency. In a high-speed train scenario, the network transmission time is 1 second, and the total time for eUICC to process 10 fragments is also 1 second, for a total time of 2 seconds. If processing time is ignored, the total time would be incorrectly assumed to be 1 second, and only the coherence time would be compared. The difference in seconds is not significant, leading to errors in the shearing calculation. If eUICC performance is even worse, the single-piece processing time is 0.2 seconds, the total processing time is 2 seconds, the basic span time is 3 seconds, and the fragment span time is 3.6 seconds. The shearing and window will also change accordingly.

[0036] It should be further explained that this embodiment incorporates the APDU processing latency within the eUICC into the security time model configured in the profile, accurately calculating the end-to-end physical time span of the entire fragmented stream from SMDPlus to the eUICC. In the traditional RSP process, SMDPlus cannot know the processing speed of the eUICC and only sends fragments according to its own rhythm, causing fragments to be buffered at the LPA, thus amplifying the time span of the fragments. SMDPlus cannot perceive this buffering time and ignores the security risks of physical bearer. In this invention, the LPA incorporates the processing time of the eUICC into the calculation, accurately obtaining the time span of the fragmented stream and guiding SMDPlus to adjust its sending rhythm. This embodiment comprehensively covers all time consumption stages in the binding profile packet configuration process, providing an accurate total time reference for subsequent determination of whether the fragmented sequence spans multiple wireless coherent intervals, ensuring the accuracy of coherent shearing calculation, avoiding the underestimation of the time span caused by ignoring processing time, avoiding errors in security calculations, and ensuring the accuracy of all subsequent calculations.

[0037] In one embodiment of the present invention, the specific calculation process of step S5 is as follows: The formula for calculating the coherence shearing factor, based on the wireless coherence time, fragmentation span time, and nominal number of fragments, is as follows:

[0038] in, Represents the coherent shear coefficient, dimensionless. Represents the nominal number of fragments, dimensionless. This represents the fragment number, incrementing from 1 to the nominal number of fragments. This indicates the time span of the segment, in seconds. This indicates the wireless coherence time, in seconds. This represents the natural exponential function. Indicates according to the fragment number From one to the nominal number of fragments Perform summation.

[0039] It should be noted that the fragment sequence number is an integer sequence increasing from 1 to the nominal number of fragments, used to identify each fragment of the bound profile packet. The fragment time offset is the time offset of a single fragment relative to the session start point, representing the fragment's position on the timeline. The time normalization is the product of the nominal number of fragments and the radio coherence time, used to normalize the time offset. The fragment exponent is the negative of the square of the ratio of the fragment time offset to the time normalization. The single-fragment coherence value is the fidelity of a single fragment relative to the radio state of the session start point, preferably ranging from 0 to 1; a larger value indicates a higher consistency between the fragment and the radio state of the session start point. The mean coherence is the arithmetic mean of the single-fragment coherence values ​​of all fragments, representing the average fidelity of all fragments. The coherence shearing coefficient represents the degree of time shearing of the bound profile packet fragment sequence relative to the radio coherence state of the session start point; a larger value indicates a greater difference in the radio physical state traversed by the fragment, and a higher risk of physical bearer mismatch.

[0040] It should be noted that this invention uses an exponential function to simulate the coherence attenuation of the wireless channel. This is because the coherence of the wireless channel decays exponentially over time, rather than linearly. This characteristic conforms to the real characteristics of the wireless channel. For example, when the time offset is 1 times the coherence time, the coherence value is 0.37; at 2 times, it is 0.018; and at 3 times, it is close to 0. Using linear simulation would yield incorrect results. In the scenario of a high-speed train traveling at 350 km / h, the segmentation span is 2.4 seconds, and the wireless coherence time is... In the second, except for the first segment, the coherence values ​​of the remaining segments are close to 0. If the nominal number of segments is 10, the average coherence is about 0.1 and the coherence shearing coefficient is about 0.9. If the number of segments is large enough, the coherence shearing coefficient can approach 1, indicating that the current physical load is completely mismatched. In the normal walking scenario, the speed is 1m / s, the coherence time is 0.1 seconds, the segment span time is 2 seconds, and the shearing coefficient is 0.9, which is consistent with the logic that the slower the speed, the smaller the mismatch.

[0041] It should be further explained that this embodiment accurately characterizes the degree of mismatch between the logical security channel and the physical bearer's trusted window by quantitatively calculating the changes in wireless coherence of the bound profile packet fragment sequence over time. When the total fragment span time is much greater than the wireless coherence time, the coherence shearing coefficient approaches 1, indicating that the physical bearer has completely mismatched. This shearing index is applicable to all high-speed mobile scenarios, including high-speed trains, high-speed drones, and high-speed ships, and can accurately quantify the degree of mismatch to achieve secure eSIM configuration.

[0042] In one embodiment of the present invention, the specific calculation process of step S6 is as follows: The formula for calculating the physical load factor is as follows, based on net load bits, available storage, internal temperature, nominal temperature, power supply ripple, and nominal power supply:

[0043] in, Represents the physical load factor, dimensionless. This indicates the net payload in bits, in units of bits. This indicates the amount of available storage, in bytes. This indicates the internal temperature, measured in Kelvin. This indicates the nominal temperature, expressed in Kelvin. This indicates the power supply ripple, measured in volts. This indicates the nominal power supply, in volts. This represents the number of storage bits calculated from the available storage capacity.

[0044] Based on the wireless coherence time, bearer availability factor, coherence shearing factor, and physical load factor, the formula for calculating the verification time window is as follows:

[0045] in, This indicates the verification time window, in seconds. This indicates the wireless coherence time, in seconds. This represents the available load-bearing capacity coefficient, which is dimensionless. Represents the coherent shear coefficient, dimensionless. Represents the physical load factor, dimensionless. This represents the natural exponential function.

[0046] It should be noted that the available storage capacity refers to the available non-volatile storage capacity of the eUICC before profile installation, in bytes, which can be directly read from the eUICC. The internal temperature is the current operating temperature of the eUICC safety element, in Kelvin, which can be obtained from the eUICC's built-in temperature sensor or approximated by the device's motherboard temperature. The nominal temperature is the rated operating temperature of the eUICC safety element, in Kelvin, provided by the eUICC manufacturer. The power supply ripple is the RMS value of the eUICC's power supply voltage, in volts, which can be obtained from the terminal power management module. The nominal power supply capacity is the rated power supply ripple reference value of the eUICC safety element, in volts, provided by the eUICC manufacturer.

[0047] It should be noted that the storage bit quantity is the value obtained by converting the available storage quantity from bytes to bits, used for unit standardization. Storage occupancy is the ratio of the net load bit quantity of the bound profile packet to the storage bit quantity, characterizing the impact of storage occupancy on the load. Temperature difference ratio is the ratio of the absolute value of the difference between the current temperature and the nominal temperature of the eUICC to the nominal temperature, characterizing the impact of temperature deviation on the load. Ripple ratio is the ratio of the current power supply ripple of the eUICC to the nominal power supply, characterizing the impact of power supply ripple on the load. Load amplification is the sum of 1 and the temperature difference ratio and ripple ratio, used to amplify the impact of storage occupancy. The physical load factor is a variable that comprehensively characterizes the physical load state of the eUICC safety element; a larger value indicates a higher physical load on the eUICC. The window index is the negative value of the sum of the coherence shearing coefficient and the physical load factor, used to calculate the dynamic verification window. The verification time window is the maximum effective duration of a single verification cycle in this RSP session, in seconds; after this duration, security verification must be re-performed.

[0048] It should be noted that the physical load factor reflects the impact of three aspects on safe execution: the storage utilization rate of eUICC, the degree of temperature deviation, and the stability of power supply. Deterioration in any of these aspects will increase the physical load of eUICC, thereby compressing the dynamic verification window. All three factors will affect the safe execution capability of eUICC. Insufficient storage will lead to storage overflow, excessive temperature will lead to calculation errors, and excessive power supply ripple will lead to calculation errors. Therefore, all three must be taken into consideration. When the state deteriorates, the window should be compressed to reduce the workload of each window and reduce the probability of error.

[0049] It should be further explained that this embodiment incorporates the physical load state of the eUICC secure element into the verification system, making the dynamic verification time window jointly determined by the wireless communication environment and the secure element state, thus achieving end-to-end full-link security verification. Traditional solutions only focus on the state of the wireless side, ignoring the state of the eUICC itself. This leads to fragmentation being sent at the original pace even when the eUICC state deteriorates, causing configuration failures or even eUICC crashes. For example, after a train carriage has been exposed to the sun in summer, the eUICC temperature rises. If a large number of fragments are still sent, the eUICC will be unable to process them, resulting in calculation errors. This invention can detect changes in the eUICC state, narrow the window, and give the eUICC time to process. This embodiment comprehensively considers changes in the physical state of the wireless link and the secure element, improving the accuracy and comprehensiveness of the dynamic verification window. It avoids configuration failures or security vulnerabilities caused by excessive eUICC load (values ​​greater than 0.5). The window can be adjusted according to the eUICC state, avoiding the configuration failure problem of traditional solutions and improving the stability and reliability of the solution.

[0050] In one embodiment of the present invention, the specific calculation process of step S7 is as follows: Calculate the safe carrying capacity based on the downlink rate, verification time window, and retransmission density. Downlink speed With verification time window Multiply to obtain the window bit quantity; then multiply by the retransmission density quantity. Add them together to get the number of retransmissions; divide the window bit count by the number of retransmissions to get the safe bearer size. ; in, This indicates the downlink rate, measured in bits per second. This indicates the verification time window, in seconds. Represents the retransmission density quantity, which is dimensionless. Indicates the safe carrying capacity, in bits; Based on the net payload bits and the safe carrying capacity, the formula for calculating the verification cycle is as follows:

[0051] in, This indicates the verification cycle length. This indicates the net payload in bits, in units of bits. Indicates the safe carrying capacity, in bits. This indicates the rounding up operation; The formula for generating the configuration execution envelope is as follows, based on the identity set, session identity set, verification time window, security capacity, verification cycle, and session key set:

[0052] in, This indicates the configuration execution envelope. Represents a set of identity identifiers. Represents the session identifier set. This indicates the verification time window, in seconds. Indicates the safe carrying capacity, in bits. This indicates the verification cycle length. Represents the session key set. This represents the message authentication code generated based on the session key set. This indicates a field cascading symbol.

[0053] It should be noted that the window bit count is the product of the downlink rate and the verification time window, representing the theoretical transmission capacity within a single verification window. The retransmission divide-by-number is the sum of 1 and the retransmission density, used to deduct the time consumption caused by retransmissions. The security bearer capacity is the net payload bit count of the bound profile packet that can be securely carried within a single dynamic verification time window, in bits, and is determined by dividing the window bit count by the retransmission divide-by-number, representing the size of the net payload that can be securely transmitted within a single window. The verification cycle count is the total number of dynamic verification cycles required to complete the entire bound profile packet configuration, rounded up to the nearest integer, and is determined by dividing the payload bit count by the security bearer capacity and then rounding up, representing the total number of verification cycles required.

[0054] It should be noted that the identity set is the unique identifier EID (Embedded Identity) of the eUICC, used to bind to a specific security element. The session identifier set is the unique identifier SID (Session Identifier) ​​of this RSP session, used to identify this configuration session. The session key set is the session key KR (Session Key) negotiated between SMDPlus and eUICC during the RSP process, used to generate the message authentication code. The authentication input is the concatenated result of the identity set, session identifier set, verification time window security bearer, and verification period, used to generate the message authentication code. The message authentication code is an integrity check code generated using the session key set on the authentication input, used to verify the integrity of the parameters. The configuration execution envelope is a secure data packet containing all configuration execution parameters and the message authentication code.

[0055] It's important to note that rounding up means taking the smallest integer greater than the quotient when it's not a whole number. This ensures the entire binding profile packet is covered, preventing some data from being unsafely carried. For example, if the payload is 1,000,000 bits and the safe carry capacity is 68 bits, dividing them gives 14705.88. If rounded down to 14705, 60 bits of payload will remain uncovered. Therefore, rounding up to 14706 ensures all payload is covered. Field concatenation refers to concatenating multiple fields according to the encoding format specified in the GSMA specification, rather than simply string concatenation. In the GSMA specification, each field has a TLV (Type Length Value) format. Concatenating according to this format ensures the receiver can correctly parse the parameters, avoiding parsing errors. The configuration execution envelope is generated by SMDPlus and forwarded to eUICC via LPAIPA. Before executing each verification cycle, eUICC must first verify the validity of the message authentication code to ensure that the parameters have not been tampered with. In the high-speed train scenario, SMDPlus splits the binding profile package into 14706 fragments. Each fragment completes the download verification and installation within the corresponding verification time window. After each window ends, eUICC re-verifies the validity of the configuration execution envelope to ensure that the session state is valid.

[0056] It should be further explained that this embodiment transforms the abstract dynamic verification window parameters into fragmentation strategies and verification rules that can be directly executed by SMDPlus, LPAIPA, and eUICC. Furthermore, it strongly binds all physical execution parameters to the current RSP session through message authentication codes, preventing man-in-the-middle attacks from tampering with critical execution parameters such as the number of fragments and the verification window. In traditional solutions, without this envelope, eUICC only performs verification after SMDPlus has sent all fragments. Attackers can tamper with the window size and the number of fragments to bypass security verification. In this invention, all execution parameters generate message authentication codes through the session key; any tampering will lead to verification failure, and eUICC will directly reject the request. Simultaneously, after each window ends, parameters are re-collected, and the dynamic verification window is recalculated to adapt to real-time changes in the wireless and eUICC states, automatically adjusting the window size to balance security and efficiency. This embodiment achieves a complete transformation from security parameter calculation to executable configuration instructions, ensuring the integrity and immutability of execution parameters through message authentication codes, forming a complete security closed loop from wireless measurement to configuration execution.

[0057] In one embodiment of the present invention, to improve the actual executability of the verification time window calculated in step S6 in high-speed mobile scenarios, weak coverage scenarios, and scenarios with limited processing capabilities of security elements, this embodiment further describes the specific execution methods of the verification time window, security capacity, verification cycle, and configuration execution envelope in the LPA, modem, terminal operating system, and eUICC. It should be noted that this embodiment does not change the calculation order, calculation parameters, or calculation results of steps S1 to S7. The verification time window calculated in step S6 is still used as the basic input parameter for calculating the security capacity and verification cycle in step S7, and the security capacity calculated in step S7 is still used as the net load limit of the allowed security capacity within a single verification cycle.

[0058] In the specific execution process, the verification time window calculated in step S6 is used to characterize the security constraint time under the combined effect of the current wireless bearer state, the physical state of the security element, and the configuration file fragmentation coherence state. Since the LPA, modem, terminal operating system, and eUICC all have actual scheduling granularity and processing time, directly using a very small verification time window as the physical execution scheduling cycle may result in the terminal side being unable to complete effective scheduling. Therefore, in a preferred embodiment, the LPA or eUICC further determines the smallest locally executable scheduling time granularity.

[0059] The locally executable minimum scheduling time granularity is determined based on at least one of the following: eUICC single-chip processing time, message authentication code verification time, wireless measurement parameter refresh cycle, and terminal timer minimum scheduling granularity. The calculation method is as follows:

[0060] in, This represents the smallest locally executable scheduling time granularity. This indicates the minimum processing time for eUICC to process a single configuration file fragment or a single APDU instruction; This indicates the minimum time required for eUICC to verify the message authentication code once. Indicates the period at which the modem or terminal system refreshes wireless measurement parameters; This indicates the smallest timer granularity that the LPA or terminal operating system can use for local scheduling.

[0061] LPA or eUICC determines the project execution window based on the verification time window obtained in step S6 and the smallest locally executable scheduling time granularity. The calculation method is as follows:

[0062] in, This indicates the project execution window; This represents the verification time window calculated in step S6. It should be noted that the project execution window is only used for local execution scheduling of LPA or eUICC, and does not replace the verification time window calculated in step S6, nor is it used to amplify the security capacity calculated based on the verification time window in step S7.

[0063] When the following conditions are met: When the current wireless bearer state corresponds to a security constraint time that is less than the minimum executable scheduling granularity of the terminal and eUICC, the LPA or eUICC uses the engineering execution window as its local scheduling cycle. However, the net payload bits allowed to enter the eUICC security processing queue within a single engineering execution window must still not exceed the security bearer capacity calculated in step S7. Thus, without relaxing the security bearer constraints, the verification time window is adapted to the actual execution capabilities of the terminal and eUICC.

[0064] In a preferred embodiment, LPA or eUICC sets a cumulative payload counter within each project execution window to count the number of configuration file fragment payload bits that have entered the eUICC security processing queue within the current project execution window. The cumulative net load bits within each project execution window must satisfy the following constraints: in, Indicates the first The cumulative net payload bits that have entered the eUICC security processing queue within each project execution window; This represents the safe load capacity calculated in step S7.

[0065] When the payload bits of the configuration file fragment to be received are And satisfy: At this time, the LPA or eUICC will pause receiving new configuration file fragments within the current project execution window until the next verification cycle begins, or until the LPA requests an update to the configuration execution envelope based on the re-collected parameters. Through this method, even if the project execution window is larger than the verification time window calculated in step S6, the actual amount of data entering the security processing flow within a single cycle is still limited by the security capacity calculated in step S7, thereby avoiding weakening of the original security constraints due to the expansion of the project execution window.

[0066] In a preferred embodiment, the verification cycle quantity calculated in step S7 is used to represent the number of security cycle numbers during the local execution of configuration file fragment reception, verification, and installation by the eUICC, and does not indicate that SM-DP+, LPA, and eUICC must perform a network round-trip interaction for each verification cycle. When SM-DP+ generates the configuration execution envelope according to step S7, it can encapsulate authorization information for multiple verification cycles in the configuration execution envelope. The authorization information includes an identity identifier set, a session identifier set, a verification time window, a security bearer, a verification cycle quantity, a cycle number range, and a message authentication code.

[0067] The period number range is represented as follows:

[0068] in, This represents the set of period numbers for configuring and executing envelope authorization; This indicates the verification cycle quantity calculated in step S7.

[0069] eUICC executes the first locally During each verification cycle, determine whether the current cycle number meets the following criteria:

[0070] If the current period number belongs to the set of period numbers authorized by the configuration execution envelope, and the cumulative payload bits in the current period do not exceed the safe carrying capacity, then eUICC allows the reception and processing of the corresponding configuration file fragment. If the current period number does not belong to the set of period numbers authorized by the configuration execution envelope, or the cumulative payload bits in the current period exceed the safe carrying capacity, then eUICC refuses to receive the new configuration file fragment and requests an update to the configuration execution envelope via LPA.

[0071] In this way, the verification cycle quantity is used for local cycle control of eUICC, which does not require a complete remote interaction between SM-DP+ and eUICC to be triggered in each verification cycle. This reduces the network interaction burden caused by the small verification time window in high-speed mobile scenarios and improves the continuity of configuration file fragment reception and installation process.

[0072] In a preferred embodiment, the verification time window is used to limit the admission time and admission payload of configuration file fragments entering the eUICC security processing queue, without requiring configuration file fragments already in the security processing queue to complete all internal processing within the same verification time window. For configuration file fragments that have passed cycle number verification, cumulative payload verification, and message authentication code verification within a valid verification period, eUICC can continue to complete decryption, integrity verification, writing, or installation operations within the processing grace period.

[0073] The processing grace time is determined based on the single-piece processing time and the number of fragments that have entered the safe processing queue but have not yet been processed. The calculation method is as follows:

[0074] in, Indicates the grace period for processing; This indicates the number of configuration file fragments that have entered the eUICC security processing queue but have not yet been processed; This indicates the processing time per chip.

[0075] In another preferred embodiment, to avoid excessively long processing grace time, an upper limit is set for the processing grace time, which is calculated as follows:

[0076] in, This indicates the preset maximum processing grace time.

[0077] When eUICC completes the processing of the corresponding configuration file fragment within the grace period, it continues to execute subsequent verification cycles. When the processing time exceeds the grace period, eUICC pauses receiving new configuration file fragments and requests an update to the configuration execution envelope via LPA. By separating the admission control of configuration file fragments from the internal processing, the configuration process can be prevented from failing to execute due to the radio coherence time being less than the eUICC single-fragment processing time.

[0078] In a preferred embodiment, when the safety capacity calculated in step S7 is lower than a preset minimum safety capacity threshold, the LPA or eUICC enters a safety pause state. The triggering condition for the safety pause state is:

[0079] in, This represents the safe load capacity calculated in step S7; This indicates the preset minimum safe carrying threshold.

[0080] When the above conditions are met, the LPA suspends requesting new configuration file fragments from SM-DP+, and the eUICC retains the session identifier, period number, cumulative payload, and integrity check status of the received configuration file fragments. The LPA re-collects the radio bearer status parameters and security element physical status parameters at preset intervals, and re-executes steps S1 to S7.

[0081] When the recalculated safe carrying capacity satisfies: And the load capacity availability factor satisfies: At this point, LPA or eUICC exits the secure pause state and continues to receive and install configuration file fragments according to the updated configuration. This represents the load-bearing capacity availability factor calculated in step S3; This indicates the preset minimum available capacity threshold.

[0082] Through the aforementioned security pause and recovery mechanisms, in scenarios involving high-speed movement, weak coverage, strong retransmission, or abnormal physical load of security elements, the system will not generate an unexecutable number of verification cycles due to insufficient security capacity. Instead, it will ensure the stability and security of the configuration process by pausing the reception of new configuration file fragments, maintaining the status of already received fragments, re-collecting parameters, and updating the configuration execution envelope.

[0083] In a preferred embodiment, to avoid frequent changes in the verification time window due to short-term fluctuations in wireless measurement parameters, LPA or eUICC smooths the verification time window calculated twice consecutively. Let the currently calculated verification time window be... The verification time window used in the previous execution cycle was The smoothed execution reference time window is then:

[0084] in, This represents the smoothed execution reference time window; Let represent the smoothing coefficient, and satisfy:

[0085] When the change ratio of the verification time window calculated in two consecutive calculations is less than the preset hysteresis threshold, LPA or eUICC maintains the current configuration and executes the envelope unchanged. The method for determining the change ratio is as follows:

[0086] in, This indicates the preset hysteresis threshold.

[0087] When the change ratio of the verification time window calculated in two consecutive calculations is greater than or equal to the preset hysteresis threshold, the LPA or eUICC requests an update to the configuration execution envelope based on the recalculated verification time window, security capacity, and verification cycle. The update trigger condition is:

[0088] Through the above smoothing and hysteresis processing, frequent configuration envelope updates can be avoided when there are small fluctuations in the received power index, signal-to-interference-plus-noise ratio index, retransmission density, power supply ripple, or internal temperature, thereby improving the continuity of the configuration process in high-speed mobile scenarios.

[0089] In a preferred embodiment, the configuration execution envelope may further include at least one of the following: project execution window, cycle number range, cumulative net load limit, minimum security carrying capacity threshold, processing grace time limit, and hysteresis threshold. SM-DP+ generates a message authentication code based on the session key set for the above fields, enabling eUICC to verify that the above fields have not been tampered with. The authentication input of the configuration execution envelope can be expressed as:

[0090] in, Indicates the amount of authentication input; Represents a set of identity identifiers; Represents the session identifier set; Indicates the verification time window; Indicates safe load capacity; Indicates the verification cycle length; This indicates the project execution window; Indicates the range of period numbers; This indicates the preset minimum safe carrying threshold; This indicates the preset maximum processing grace time; Indicates the preset hysteresis threshold; This indicates a field cascading symbol.

[0091] The message authentication code is generated as follows:

[0092] in, Indicates the message authentication code; This represents the function for generating the message authentication code; This represents the session key set.

[0093] Therefore, before executing the configuration file fragment reception and installation, eUICC can perform integrity checks on fields such as verification time window, security capacity, verification cycle, project execution window, cycle number range, cumulative net load limit and processing grace time in the configuration execution envelope based on the session key set, to prevent intermediate nodes from tampering with execution parameters.

[0094] It should be noted that the engineering execution window, cumulative payload counter, cycle number range, processing grace time, security pause state, smoothing processing, and hysteresis processing in this embodiment are all used to describe the specific execution methods of the calculation results of steps S6 and S7 on the terminal side, LPA side, and eUICC side, without changing the original calculation logic of steps S1 to S7. The verification time window calculated in step S6 is still used to characterize the security constraint time under the combined effect of the wireless bearer state, the physical state of the security element, and the fragmented coherent state; the security bearer quantity calculated in step S7 is still used to limit the amount of payload bits that can be securely carried within a single verification cycle; the verification cycle quantity is still used to represent the number of security verification cycles required to complete the entire binding profile packet configuration; and the configuration execution envelope is still used to encapsulate the identity set, session identity set, verification time window, security bearer quantity, verification cycle quantity, and message authentication code.

[0095] Through the above-mentioned engineering execution adaptation method, even in scenarios such as high-speed trains, high-speed vehicles, drones, ships, tunnels, weak coverage cell handover, or limited security element processing capabilities, LPA and eUICC can still complete the reception, verification, and installation of configuration file fragments through local scheduling, periodic number verification, cumulative net load constraints, processing grace periods, secure pause recovery, and configuration execution envelope integrity verification, thereby improving the executability, stability, and security of this method in real eSIM remote configuration systems.

[0096] The content of this embodiment has been described above, but this embodiment is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this embodiment, all of which are within the protection scope of this embodiment.

Claims

1. A secure eSIM remote configuration method based on multi-factor dynamic verification, characterized in that, Includes the following steps: Step S1: Collect the received power index and signal-to-interference-plus-noise ratio index, and convert them into received power and signal-to-interference-plus-noise ratio respectively. Step S2: Collect the moving speed and carrier frequency, calculate the Doppler frequency shift based on the constant of the speed of light, and calculate the wireless coherence time based on the Doppler frequency shift; Step S3: Collect the ranging propagation delay and the measurement reference power, and calculate the bearer availability coefficient based on the signal-to-interference-plus-noise ratio, the received power, and the wireless coherence time. Step S4: Collect the payload bit quantity, downlink rate quantity, nominal number of fragments, single fragment processing time and retransmission density quantity, and calculate the fragment span time. Step S5: Calculate the coherence shearing coefficient based on the wireless coherence time, the fragmentation span time, and the nominal number of fragments; Step S6: Collect available storage, internal temperature, nominal temperature, power supply ripple and nominal power supply; calculate the physical load factor based on the net load bits; and calculate the verification time window based on the wireless coherence time, bearer availability factor, coherence shearing factor and physical load factor. Step S7: Calculate the security bearer quantity based on the downlink rate quantity, verification time window, and retransmission density quantity; calculate the verification cycle quantity based on the payload bit quantity and security bearer quantity; collect the identity set, session identity set, and session key set; and generate the configuration execution envelope based on the verification time window, security bearer quantity, and verification cycle quantity.

2. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S1 includes the following steps: Step S101: Collect the received power index, which is the logarithm of the received power of the synchronization signal and the reference signal. Step S102: Divide the received power index by ten to obtain the received power exponent, and calculate the power value of the received power exponent with ten as the base to obtain the received power quantity. Step S103: Collect the signal-to-interference-plus-noise ratio (SINR) index, which is the logarithm of the SINR of the synchronization signal. Step S104: Divide the signal-to-interference-plus-noise ratio (SIR) exponent by 10 to obtain the SIR exponent power, and calculate the power value of the SIR exponent power with 10 as the base to obtain the SIR quantity.

3. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S2 includes the following steps: Step S201: Collect the moving speed and carrier frequency. Step S202: The product of the moving speed and the carrier frequency is used as the first numerator; Step S203: Use the constant of the speed of light as the first denominator, and calculate the ratio of the first numerator to the first denominator to obtain the Doppler frequency shift; In step S204, the constant 0.423 is used as the second numerator, the Doppler frequency shift is used as the second denominator, and the ratio of the second numerator to the second denominator is calculated to obtain the wireless coherence time.

4. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S3 includes the following steps: Step S301: Collect the ranging propagation delay and the measurement reference power; Step S302: Take the signal-to-interference-plus-noise ratio (SINR) as the first numerator, take the sum of the two SINR values ​​as the first denominator, and calculate the ratio of the first numerator to the first denominator to obtain the SINR value. Step S303: Take the received power as the second numerator, take the sum of the received power and the measured reference power as the second denominator, and calculate the ratio of the second numerator to the second denominator to obtain the received power ratio. Step S304: The ratio of ranging propagation delay to wireless coherence time is negativeized and used as the carrying index, and the natural exponential function value of the carrying index is calculated. Step S305: The product of the signal-to-interference-plus-noise ratio, the received power ratio, and the natural exponential function value is determined as the bearer availability coefficient.

5. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S4 includes the following steps: Step S401: Collect the payload bit quantity, downlink rate quantity, nominal number of fragments, single-fragment processing time, and retransmission density quantity; Step S402: The ratio of the payload bit quantity to the downlink rate quantity is used as the transmission time quantity; Step S403: The product of the nominal number of slices and the processing time per slice is used as the processing time. Step S404: Use the sum of the transmission time and the processing time as the base span time; Step S405: The sum of the retransmission density and the retransmission amplification value is used as the retransmission amplification value. Step S406: The product of the base span time and the re-amplified amount is determined as the piecewise span time.

6. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S5 includes the following steps: Step S501: Establish a fragment sequence number based on the nominal number of fragments, with the fragment sequence number increasing from one to the nominal number of fragments; Step S502: For each fragment number, multiply the difference between the fragment number and the fragment span time by the fragment number to obtain the fragment time offset. Step S503: The product of the nominal number of fragments and the wireless coherence time is used as the time normalization quantity, and the ratio of the fragment time offset to the time normalization quantity is calculated. Step S504: Square the ratio and take the negative to obtain the fragmentation index, and calculate the natural exponential function value of the fragmentation index to obtain the single-fragment coherence value; Step S505: Sum the coherence values ​​of all individual slices and divide by the nominal number of slices to obtain the average coherence value; Step S506: The difference between the coherence quantity and the mean coherence quantity is determined as the coherence shearing coefficient.

7. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S6 includes the following steps: Step S601: Collect available storage capacity, internal temperature, nominal temperature, power supply ripple, and nominal power supply. Step S602: Multiply the available storage by eight to obtain the storage bit quantity, and use the ratio of the net payload bit quantity to the storage bit quantity as the storage occupancy. Step S603: Take the absolute value of the difference between the internal temperature and the nominal temperature, and divide the absolute value by the nominal temperature to obtain the temperature difference ratio. Step S604: Divide the power supply ripple by the nominal power supply to obtain the ripple ratio; Step S605: Add the temperature difference ratio and the ripple ratio to obtain the load amplification, and determine the product of the storage occupancy and the load amplification as the physical load coefficient. Step S606: The sum of the coherent shearing coefficient and the physical load coefficient is negativeized and used as the window index. The natural exponential function value of the window index is calculated, and the product of the wireless coherent time, the bearer availability coefficient and the natural exponential function value is determined as the verification time window.

8. The eSIM remote configuration security method based on multi-factor dynamic verification according to claim 1, characterized in that, Step S7 includes the following steps: Step S701: The product of the downlink rate and the verification time window is used as the window bit quantity; Step S702: Take the sum of the retransmission density as the retransmission division number, and divide the window bit quantity by the retransmission division number to obtain the safe bearer quantity. Step S703: Divide the net payload bit quantity by the safe carrying capacity and round the quotient up to obtain the verification cycle quantity; Step S704: Collect the identity set, session identity set, and session key set; Step S705: Concatenate the identity set, session identity set, verification time window, security capacity, and verification cycle in the order of the fields to obtain the authentication input quantity; Step S706: Generate a message authentication code based on the session key set for the authentication input, and encapsulate the identity set, session identity set, verification time window, security capacity, verification cycle, and message authentication code to obtain the configuration execution envelope.

Images