A method and system for managing esim resource download

Abstract

This application discloses a method and system for managing eSIM resource downloads. The method includes: providing a Profile configuration file to SM-DP+; receiving the submitted Profile request quantity and licensed IP address information; sending a group order creation request to SM-DP+ to instruct SM-DP+ to generate a GroupDown-QR for user terminals to scan and download and an Auth-QR for administrator authorization, binding the GroupDown-QR and Auth-QR to the licensed IP address, and setting a group type flag for the group order Profile; receiving the GroupDown-QR and Auth-QR returned by the SM-DP+ platform; sending the GroupDown-QR and Auth-QR to the SP for distribution to the branch management device; the Auth-QR is used to perform authorization operations after being scanned; the GroupDown-QR is used to allow the user terminal to download the corresponding Profile configuration file when the Auth-QR completes the authorization operation and SM-DP+ confirms that the source IP address of the user terminal's download request belongs to the licensed IP address. This application associates multiple profile configuration files with a GroupDown-QR and an Auth-QR, eliminating the need for operators to manage a large number of independent QR codes and significantly reducing management costs in storage, distribution, and maintenance.

Description

Technical Field

[0001] This application relates to the field of mobile communications, and more specifically, to a method and system for managing eSIM resource downloads. Background Technology

[0002] With the rapid development of mobile communication technology, embedded SIM (eSIM), as a new type of SIM card technology, is gradually being widely used in smart devices. Traditional eSIM consumer electronics profile download methods typically assign a unique activation code to each profile and generate a QR code for users to scan and download. In the GSMA's SGP.22 technical specification, operators can provide QR code downloads to consumer terminals using AC activation codes in two main ways:

No Pre-Bound EID (Electronic Identity)

Pre-Bound EID

[0003] In existing technologies, the eSIM download method defined in the GSMA specification assigns a unique AC activation code to each profile, which is then used to generate a QR code for individual consumer electronics users to scan and download. While simple, this method has the following significant drawbacks: 1) High management costs: Operators need to store and distribute a large number of QR codes, including classifying, grouping, and updating this information, making the management process complex and time-consuming. 2) Insufficient security: This is a drawback of the method without pre-binding an EID. Since each QR code can be scanned independently, preventing the profile from being illegally obtained or misused increases the security management costs. 3) Insufficient flexibility: This is a drawback of the pre-binding EID method. While QR codes generated through pre-binding EID offer some security assurance, preventing unauthorized mobile devices from downloading profile configuration files by scanning them, this method also makes business operations cumbersome and complex. Because EID information must be provided and bound in advance at the beginning of the process, it reduces the flexibility of business operations.

[0004] Therefore, how to provide a method for managing eSIM resource downloads that significantly reduces operators' management costs while ensuring the security of profile configuration files to prevent unauthorized misuse has become an urgent problem to be solved in this field. Summary of the Invention

[0005] To address the aforementioned issues, this application proposes a method for managing eSIM resource downloads, comprising the following steps: A network operator provides a certain number of Profile configuration files to the eSIM configuration service platform SM-DP+, serving as a resource pool for eSIM download services; the network operator receives the required number of Profile configuration files and at least one licensed IP address from the SP service provider, the licensed IP address corresponding to the Wi-Fi hotspot network of the offline outlet managed by the SP; based on the required number of Profile configuration files and the licensed IP address, the network operator sends a request to the SM-DP+ platform to create a group order through a customized interface, the request instructing the SM-DP+ platform to perform the following operations: generate a group-level download QR code (GroupDown-QR) for user terminal scanning and an authorization QR code (Auth-QR) for administrator authorization; bind the GroupDown-QR and the Auth-QR to the licensed IP address information; the SM-DP+ platform... The platform sets a group type tag for the Profile configuration file corresponding to the group order; the group type tag is associated and bound with the corresponding GroupDown-QR, Auth-QR, group order, and permitted IP address information, so that the SM-DP+ platform can identify that a batch of the Profile configuration files belong to GroupDown-QR; the network operator receives the GroupDown-QR and Auth-QR returned by the SM-DP+ platform; the network operator sends the GroupDown-QR and Auth-QR to the SP service provider, so that the SP service provider can send the Auth-QR and GroupDown-QR to the corresponding management device of each branch; the GroupDown-QR is configured to allow the user terminal to download the corresponding Profile configuration file from the SM-DP+ when the Auth-QR has completed the authorization operation and the user terminal accesses the Wi-Fi network corresponding to the permitted IP address.

[0006] The method for managing eSIM resource downloads as described above further includes EID verification: if the EID binding authorization mode is enabled, the administrator device scans the Auth-QR and uploads the user terminal's EID information to the SM-DP+ platform, completing the authorization binding of the user terminal to a Profile configuration file in the group order; when the user terminal scans the GroupDown-QR to initiate a download request, the SM-DP+ also verifies whether the user terminal's EID has been authorized and bound through the Auth-QR. If the verification passes, the download is allowed; if the verification fails, the download is rejected.

[0007] The method for managing eSIM resource downloads as described above, wherein verifying whether the EID of the user terminal is an EID that has been pre-authorized via Auth-QR, includes: checking the EID information contained in the eUICC certificate carried in the download request initiated by the user terminal by scanning the GroupDown-QR, which is extracted by the SM-DP+ platform; comparing the EID information with the EID that has been pre-authorized via Auth-QR; if the comparison matches, the download is allowed; if the comparison does not match, the download is rejected.

[0008] The method for managing eSIM resource downloads as described above, wherein the GroupDown-QR and the Auth-QR are generated together from the same group order.

[0009] The method for managing eSIM resource downloads as described above includes a customized interface called createGroupOrder for sending a request to the SM-DP+ platform.

[0010] In the method for managing eSIM resource downloads as described above, the fixed IP address of the network's WiFi is pre-entered when creating a group order, and the SM-DP+ platform verifies the source IP address for both the GroupDown-QR and Auth-QR scanning requests.

[0011] The method for managing eSIM resource downloads as described above involves reclaiming or terminating unused group order resources through a customized interface called recycleGroupOrder.

[0012] A system for managing eSIM resource downloads, applied to the method for managing eSIM resource downloads described above, includes: a network operator server for providing a certain number of Profile configuration files as a resource pool for eSIM download services to an eSIM configuration service platform (SM-DP+); receiving a request for a certain number of Profile configuration files and at least one licensed IP address from an SP service provider, wherein the licensed IP address corresponds to a Wi-Fi hotspot network of an offline outlet managed by the SP; and, based on the request number and the licensed IP address, sending a request to create a group order to the SM-DP+ platform via a customized interface, wherein the request instructs the SM-DP+ platform to perform the following operations: generating a group-level download QR code (GroupDown-QR) for user terminals to scan and download, and an authorization QR code (Auth) for administrator authorization. -QR; bind the GroupDown-QR and the Auth-QR to the permitted IP address information; set a group type flag for the Profile configuration file corresponding to the group order; the network operator server is also used to receive the GroupDown-QR and the Auth-QR returned by the SM-DP+ platform; send the GroupDown-QR and the Auth-QR to the SP service provider, so that the SP service provider can send the Auth-QR and GroupDown-QR to the management device corresponding to each branch; the GroupDown-QR is configured to allow the user terminal to download the corresponding Profile configuration file from the SM-DP+ when the Auth-QR has completed the authorization operation and the user terminal accesses the Wi-Fi network corresponding to the permitted IP address.

[0013] A computer-readable storage medium storing computer program instructions that, when executed on a computer, perform the method for managing eSIM resource downloads as described in any one of claims 1-7.

[0014] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, it performs the method for managing eSIM resource downloads as described in any one of claims 1-7.

[0015] This application has the following beneficial effects: (1) Reduced management costs: This application associates multiple profile configuration files with a group-level download QR code GroupDown-QR and an optional authorization QR code Auth-QR. Operators do not need to manage a large number of independent QR codes, thereby significantly reducing the management costs of storage, distribution and maintenance.

[0016] 2) Enhance security and prevent illegal abuse: This application uses IP address whitelist verification and special marking mechanisms to ensure that the Profile configuration file can only be legally obtained and used in specific network environments, effectively preventing the risk of illegal abuse.

[0017] 3) Enhanced security checks to prevent overuse: This application provides flexibility and additional binding constraint checks by binding EID after the fact, ensuring that the Profile configuration file is not used in violation of regulations.

[0018] 4) Compatibility and scalability: The proposed solution is fully compatible with the existing eSIM technology system and has good scalability, which can be applied to various scenarios (such as tourism, aviation, etc.) and different types of network environments. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0020] Figure 1 This is a flowchart illustrating a method for managing eSIM resource downloads according to an embodiment of this application; Figure 2 This is a schematic diagram of the internal structure of a system for managing eSIM resource downloads according to an embodiment of this application. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0022] This application presents a group QR code security solution for bulk distribution of eSIM profiles in network service point WiFi scenarios, such as airports and tourist attractions. First, the service provider (SP) collects the WiFi IPs of the network service points, calculates the required profiles, and submits this information to the mobile network operator (MNO). The MNO then uses the SM-DP+ interface to create a group order, binding a specified IP whitelist and batch profile configuration files, simultaneously generating corresponding group-level download QR codes ("GroupDown-QR") and authorization QR codes ("Auth-QR"). Both belong to the same group order, are strongly bound together, and share IP access restrictions. The Auth-QR is kept by the network service point administrator and used to upload the user terminal's EID to complete resource pre-allocation authorization. Without this authorization, the GroupDown-QR cannot distribute usable profiles, and users can only download the eSIM by scanning the GroupDown-QR. After a user connects to the designated network service point WiFi, the administrator uploads the EID using the Auth-QR to complete authorization, and then presents the GroupDown-QR for the user to scan. The SM-DP+ platform performs dual verification of the request source IP and the user terminal's EID; only after successful verification is the configuration distributed. The proposed solution can disable EID verification to simplify the process and improve operational efficiency. It also supports the interface to reclaim idle group order resources, balancing batch management efficiency with dual-layer security protection of IP and EID.

[0023] This application manages profile configuration files in a one-to-many manner through group-level QR codes (GroupDown-QR) and optional Auth-QR authorization QR codes, which can effectively reduce the operator's management costs. The trusted source verification method can ensure that the operator's profile configuration files are not illegally transmitted or misused, and the enhanced authorization QR code (Auth-QR) can ensure that the operator's profile configuration files are not overused.

[0024] Example 1 like Figure 1 The method for managing eSIM resource downloads provided in this embodiment includes the following steps: Step S1: The network operator provides a certain number of profile configuration files to the SM-DP+ platform with eSIM service in advance.

[0025] A certain number of profile configuration files are used for initial data preparation so that they can be used for future download needs of eSIM electronic consumer services.

[0026] Step S2: The SP service provider collects the IP address information of the WIFI network corresponding to the outlets that need to carry out business services in advance.

[0027] Step S3: The SP service provider sends the required number of Profile configuration files and the IP address information to be constrained to the network operator.

[0028] Step S4: The network operator sends a request to create a group order to the SM-DP+ platform through a customized interface.

[0029] Creating a group order request includes specifying the number of profiles to be associated with the group order and the IP addresses from which the constraints need to be applied.

[0030] The customized interface is the createGroupOrder interface.

[0031] Step S5: The SM-DP+ platform creates a group-level order based on the group order creation request sent by the network operator. The SM-DP+ platform backend associates this group-level order with the required profile configuration file into a group-level download QR code (GroupDown-QR). The SM-DP+ platform simultaneously marks the group order characteristics on the batch of profile configuration files under the group-level order. The group type mark is associated and bound with the corresponding GroupDown-QR, Auth-QR, group order, and licensed IP address information, so that the SM-DP+ platform can identify that a batch of the profile configuration files belongs to the GroupDown-QR.

[0032] After being marked, these profiles are associated with and bound to the corresponding GroupDown-QR, Auth-QR, group order ID, and IP whitelist configuration. The system can recognize that these profiles belong to the same group resource pool and supports the business logic of post-EID authorization and on-demand allocation within the pool, which is different from traditional profiles that are pre-bound to EID.

[0033] Understandably, orders represent demands. Group-level orders indicate a customer's need for batch and unified management of profile configuration files. Group-level download QR codes provide a technical means for customers to achieve this unified batch management. The GroupDown-QR generation method is the same as the QR code generation method defined in the SGP.22 specification. That is, it uses a predefined format to separate and concatenate various information such as the SM-DP+ domain name address, a unique MatchingID, etc., for example: 1$domain.com$04386-A74Y8-3F815. However, in the SM-DP+ platform's backend system, this QR code will be marked as a download QR code for group-level use.

[0034] The group order batch profile is distinguished from the traditional one-to-one order profile where a single QR code corresponds to a single profile. This allows the SM-DP+ server to quickly identify that the batch of profiles belongs to the GroupDown-QR group mode, rather than the traditional single profile activation code mode.

[0035] Group Profile carries group feature tags, and multiple Profiles belong to the same GroupDown-QR. It supports branches to dynamically assign Profiles to terminal EIDs after the fact via Auth-QR, which is suitable for mobile batch business scenarios in airports, exhibitions, and scenic spots.

[0036] As a specific embodiment of the present invention, multiple Profile configuration files within a certain scope or purpose are associated with a group-level QR code GroupDown-QR for end users to scan and download.

[0037] As a specific embodiment of the present invention, in the backend of the SM-DP+ platform, profile configuration files for specific fields (such as short-term travel packages, exhibition activities, scenic spot activities, etc.) are associated with data. Based on each group-level order ID, a corresponding GroupDown-QR can be generated, thereby associating the group-level order with the required profile configuration file into the GroupDown-QR. This method will make the transmission and management of QR code resources simpler and more efficient.

[0038] Furthermore, when generating GroupDown-QR codes, the SM-DP+ platform backend can also bind them to specific licensed IP address information. For example, it can be associated with the IP address corresponding to an airport Wi-Fi hotspot or the IP address corresponding to a Wi-Fi hotspot developed in a tourist area.

[0039] By pre-entering the fixed IP address of the network's WiFi when creating a group order, the SM-DP+ platform verifies the source IP address for all scanning requests for both types of QR codes (i.e., group-level download QR codes GroupDown-QR and authorization QR codes Auth-QR). Network connection requests from unauthorized hotspots are directly rejected, thereby isolating malicious scanning from the external network.

[0040] Each GroupDown-QR code associated with a GroupDown download is specially marked to distinguish it from the traditional one-to-one mapping of QR codes in profile configuration files, thus preventing it from being directly scanned and downloaded using conventional methods.

[0041] Step S6: After the SM-DP+ platform completes the creation of the group order and the marking of the group order features, it generates an authorization QR code for authorization and returns the group-level download QR code GroupDown-QR and the authorization QR code Auth-QR to the network operator.

[0042] After the SM-DP+ platform completes the association of the Profile configuration file and the preparation of the order information, it generates an authorization QR code Auth-QR for administrators to perform EID authorization management, and returns the Auth-QR and GroupDown-QR information to the network operator.

[0043] Preferably, the authorized QR code Auth-QR is generated based on the group order ID and authorization token, and is associated with the authorized IP address information. It shares the same group order ID with GroupDown-QR, thereby ensuring that the two are used together.

[0044] Understandably, the specific encoding algorithms for generating GroupDown-QR and Auth-QR can refer to the standard processes in existing technologies, as can the specific bytes and their arrangement, which will not be elaborated here. The Auth-QR authorization QR, while adhering to the encoding principles defined in the standard specification, can utilize the Confirmation Code Required Flag field in the encoding definition for escaping. That is, the content of the field used for the Confirmation Code Required Flag in the encoding rules is escaped in the Auth-QR authorization QR code and repurposed for a novel purpose: allowing branch managers to input their EID for authorization.

[0045] Step S7: The network operator returns the received authorization QR code and download QR code information to the SP service provider.

[0046] Step S8: The SP service provider will distribute the obtained Auth-QR and GroupDown-QR information to the devices of the managers corresponding to each branch.

[0047] Branch managers must properly store the Auth-QR authorization code information to prevent leakage, and can also print out the GroupDown-QR code of the corresponding Profile configuration file.

[0048] Step S9: After connecting to the WIFI network provided by the outlet, consumers within the outlet request GroupDown-QR information from the outlet manager to scan and download.

[0049] This embodiment also includes an optional step S10: If EID binding authorization is enabled, the branch administrator first obtains the EID information of the passenger's mobile terminal, then scans the authorization QR code, submits the request to the SM-DP+ platform via the airport Wi-Fi network, and provides the terminal's EID information during the process of providing confirmation code information (i.e., using the Confirmation CodeRequired Flag field for escaping). After receiving the request, the SM-DP+ platform marks a Profile configuration file that can be downloaded by the specified EID terminal in the Profile configuration file associated with the downloaded QR code.

[0050] Step S11: After the branch manager completes the Auth-QR information scanning, the GroupDown-QR information is presented to the user terminal for scanning and downloading. The user terminal submits the download request to the SM-DP+ platform via the Wi-Fi network provided by the branch.

[0051] If the EID binding authorization mode is enabled, after the branch manager completes the Auth-QR information scanning and provides the EID information in the confirmation code, the GroupDown-QR information will be presented to the user terminal for scanning and downloading.

[0052] In this embodiment, the Auth-QR and GroupDown-QR are generated together from the same createGroupOrder order. They are bound to the same group order ID and the same batch of Profile configuration files, and cannot be used interchangeably across orders. Specifically: Auth-QR is the operation credential: only after submitting the EID with Auth-QR to complete the authorization and acquisition will the eSIM configuration file in the corresponding GroupDown-QR be released to the specified terminal. Without Auth-QR authorization, GroupDown-QR can only be scanned, but cannot trigger resource allocation.

[0053] Auth-QR is responsible for authorizing and locking the EID, while GroupDown-QR is responsible for users downloading resources. The two are used together and neither can be omitted.

[0054] The Auth-QR is held only by the site administrator's device and is only used to submit EID pre-reservation authorization; ordinary users can only see the GroupDown-QR, and cannot assign a Profile without the Auth-QR.

[0055] Auth-QR scanning requests must be initiated from a pre-selected Wi-Fi whitelist IP address; scanning from external networks will be directly blocked.

[0056] Step S12: After receiving the download request, the SM-DP+ platform performs a verification operation.

[0057] The verification process includes the following: ①IP address verification: The

SM-DP+

[0058] ②EID Verification (if EID binding authorization mode is enabled): Check whether the EID information contained in the eUICC certificate carried in the download request is an EID that has been pre-authorized through Auth-QR.

[0059] After scanning the Auth-QR, the branch administrator obtains the device identifier (EID) of the user terminal and sends it to the SM-DP+ platform. Upon receiving the EID, the SM-DP+ platform authorizes and binds one of the Profile configuration files corresponding to each group order to the EID. Therefore, in the second verification step, the SM-DP+ performs a secondary verification to check whether the EID information corresponding to the eUICC certificate carried in the download request matches the already authorized and bound EID. If they do not match, the SM-DP+ platform refuses to send the Profile configuration file, thus preventing unauthorized terminals from impersonating the GroupDown-QR to obtain the Profile configuration file.

[0060] If both checks pass, proceed to step S13. If either check fails, SM-DP+ rejects the download request.

[0061] Step S13: The SM-DP+ platform responds to the user terminal's request, completing the normal eSIM Profile download and installation process.

[0062] After completing the above process, this embodiment can also perform resource recycling. When the Profile configuration file in a group order is used up or the order expires, the group order resources that are no longer in use can be recycled or terminated through the recycleGroupOrder customized interface, thereby achieving closed-loop management of resources.

[0063] Example 2 like Figure 2 As shown, this embodiment provides a system for managing eSIM resource downloads, applied to the method for managing eSIM resource downloads described in the embodiment, specifically including: an MNO server 100, an SM-DP+ server 200, an SP server 300, a management device 400, and a user terminal 500.

[0064] MNO server 100 communicates with SM-DP+ server 200 and SP server 300 respectively. It provides a certain number of Profile configuration files to SM-DP+ server 200 as a resource pool for eSIM download services; receives the required number of Profile configuration files and at least one licensed IP address information submitted by SP server 300, where the licensed IP address information corresponds to the Wi-Fi hotspot network of the offline outlets managed by the SP; sends a request to create a group order to SM-DP+ server 200 through a customized interface according to the required number of configuration files and the licensed IP address information; and receives the GroupDown-QR and Auth-QR returned by SM-DP+ server 200 and sends the GroupDown-QR and Auth-QR to SP server 300.

[0065] The SM-DP+ server 200, which communicates with the MNO server 100, receives requests from the MNO server 100 to create group orders and performs the following operations based on the requests: generating a group-level download QR code (GroupDown-QR) for user terminals to scan and download, and an authorization QR code (Auth-QR) for administrator authorization; binding the GroupDown-QR and Auth-QR to authorized IP address information; setting a group type flag for the profile configuration file corresponding to the group order to distinguish it from the profile configuration file of non-group orders; and returning the generated GroupDown-QR and Auth-QR to the MNO server 100.

[0066] The SM-DP+ server 200 is also used to: receive Auth-QR scanning requests sent by the management device 400 through the Wi-Fi network corresponding to the licensed IP address; and receive GroupDown-QR scanning download requests sent by the user terminal 500 through the Wi-Fi network corresponding to the licensed IP address, verify the source IP address of the download request, and after confirming that the source IP address belongs to the licensed IP address information, send the corresponding Profile configuration file to the user terminal 500.

[0067] SP server 300 is connected to MNO server 100 and management device 400 respectively. It is used to submit the required number of Profile configuration files and at least one licensed IP address information to MNO server 100; and to receive GroupDown-QR and Auth-QR issued by MNO server 100, and distribute GroupDown-QR and Auth-QR to the management device 400 corresponding to each branch.

[0068] The management device 400 is communicatively connected to the SP server 300 and can communicate with the SM-DP+ server 200 via the Wi-Fi network corresponding to the licensed IP address. It is used to receive Auth-QR and GroupDown-QR distributed by the SP server 300. The Auth-QR is configured to be scanned by the management device 400 and then send an authorization request to the SM-DP+ server 200 to perform the authorization operation. The GroupDown-QR is configured to be provided by the management device 400 to the user terminal 500 for scanning and downloading after the Auth-QR has completed the authorization operation.

[0069] User terminal 500 can communicate with SM-DP+ server 200 through the Wi-Fi network corresponding to the licensed IP address. When accessing the Wi-Fi network corresponding to the licensed IP address, it scans the GroupDown-QR provided by management device 400, initiates a download request to SM-DP+ server 200, and downloads the corresponding Profile configuration file from SM-DP+ server 200 after SM-DP+ server 200 confirms that the source IP address of the download request belongs to the licensed IP address information.

[0070] Preferably, the customized interface is the createGroupOrder interface. GroupDown-QR and Auth-QR are generated together from the same createGroupOrder order. They are bound to the same order ID and the same batch of Profile configuration files and cannot be used interchangeably across orders.

[0071] Preferably, the SM-DP+ server 200 verifies whether the source IP address is a licensed IP address for both Auth-QR and GroupDown-QR scanning requests.

[0072] Preferably, if the EID binding authorization mode is enabled, after the management device 400 scans the Auth-QR, it is also used to obtain the device identifier EID of the user terminal 500 and upload the EID information to the SM-DP+ server 200; the SM-DP+ server 200 is also used to perform one-to-one authorization binding with one of the profile configuration files corresponding to the group order and the EID according to the received EID information; when the user terminal 500 scans the GroupDown-QR to initiate a download request, the SM-DP+ server 200 is also used to verify whether the EID of the user terminal 500 has been authorized and bound through the Auth-QR. If the verification is successful, the download is allowed; if the verification fails, the download is rejected.

[0073] Preferably, the MNO server 100 is also used to recycle or terminate unused group order resources through the recycleGroupOrder customized interface.

[0074] This application also provides a computer storage medium storing computer instructions, which, when invoked, are used to execute the method for managing eSIM resource downloads.

[0075] The embodiments disclosed in this invention provide a computer-readable storage medium storing computer program instructions that, when executed on a computer, cause the computer to perform the aforementioned method for managing eSIM resource downloads.

[0076] This invention provides a computer device, including a memory and a processor. The memory stores a computer program. When the processor runs the computer program stored in the memory, the processor processes the above-described method for managing eSIM resource downloads.

[0077] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0078] The various methods, steps, and logic diagrams disclosed in the embodiments of this invention can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods.

[0079] The storage medium can be memory, such as volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.

[0080] Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate Synchronous DRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM).

[0081] This application has the following beneficial effects: (1) Reduced management costs: This application associates multiple profile configuration files with a group-level QR code GroupDown-QR and an optional authorization QR code Auth-QR. Operators do not need to manage a large number of independent QR codes, thereby significantly reducing the management costs of storage, distribution and maintenance.

[0082] 2) Enhance security and prevent illegal abuse: This application uses IP address whitelist verification and special marking mechanisms to ensure that the Profile configuration file can only be legally obtained and used in specific network environments, effectively preventing the risk of illegal abuse.

[0083] 3) Enhanced security checks to prevent overuse: This application provides flexibility and additional binding constraint checks by binding EID after the fact, ensuring that the Profile configuration file is not used in violation of regulations.

[0084] 4) Compatibility and scalability: The proposed solution is fully compatible with the existing eSIM technology system and has good scalability, which can be applied to various scenarios (such as tourism, aviation, etc.) and different types of network environments.

[0085] Although the examples referenced in this application are described for illustrative purposes only and not for limiting the scope of this application, changes, additions and / or deletions to the implementation may be made without departing from the scope of this application.

[0086] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for managing eSIM resource downloads, characterized in that, Includes the following steps: Network operators provide a certain number of Profile configuration files to the eSIM configuration service platform SM-DP+ as a resource pool for eSIM download services; The network operator receives the number of profile configuration files required and at least one licensed IP address information submitted by the SP service provider, wherein the licensed IP address information corresponds to the Wi-Fi hotspot network of the offline outlets managed by the SP service provider; Based on the required quantity and the permitted IP address information, the network operator sends a request to the SM-DP+ platform to create a group order through a customized interface. The request instructs the SM-DP+ platform to perform the following operations: generate a group-level download QR code (GroupDown-QR) for user terminals to scan and download, and an authorization QR code (Auth-QR) for administrator authorization; and bind the GroupDown-QR and the Auth-QR to the permitted IP address information. The SM-DP+ platform sets a group type tag for the Profile configuration file corresponding to the group order; the group type tag is associated with and bound to the corresponding GroupDown-QR, Auth-QR, group order, and licensed IP address information, so that the SM-DP+ platform can identify that a batch of the Profile configuration files belong to GroupDown-QR; Network operators receive the GroupDown-QR and the Auth-QR returned by the SM-DP+ platform; The network operator sends the GroupDown-QR and the Auth-QR to the SP service provider, so that the SP service provider can send the Auth-QR and GroupDown-QR to the corresponding management equipment of each branch. The GroupDown-QR is configured to allow the user terminal to download the corresponding Profile configuration file from the SM-DP+ when the Auth-QR has completed the authorization operation and the user terminal accesses the Wi-Fi network corresponding to the licensed IP address.

2. The method for managing eSIM resource downloads as described in claim 1, characterized in that, Also includes EID verification: If the EID binding authorization mode is enabled, the administrator's device scans the Auth-QR code and uploads the user terminal's EID information to the SM-DP+ platform, thus completing the authorization binding of the user terminal to a Profile configuration file in the group order; When the user terminal scans the GroupDown-QR to initiate a download request, the SM-DP+ also verifies whether the user terminal's EID has been authorized and bound through the Auth-QR. If the verification passes, the download is allowed; if the verification fails, the download is rejected.

3. The method for managing eSIM resource downloads as described in claim 2, characterized in that, The verification of whether the EID of the user terminal is a pre-authorized EID via Auth-QR includes: The SM-DP+ platform extracts the EID information contained in the eUICC certificate carried in the download request initiated by the user terminal scanning the GroupDown-QR. Compare the EID information with the EID that has been pre-authorized via Auth-QR; If the comparison matches, the download is allowed; otherwise, the download is rejected.

4. The method for managing eSIM resource downloads as described in claim 1, characterized in that, The GroupDown-QR and the Auth-QR are generated together from the same group order.

5. The method for managing eSIM resource downloads as described in claim 1, characterized in that, The customized interface for sending group order creation requests to the SM-DP+ platform is the createGroupOrder interface.

6. The method for managing eSIM resource downloads as described in claim 1, characterized in that, When creating a group order, the fixed IP address of the network's WiFi is pre-entered. The SM-DP+ platform verifies the source IP address for both the GroupDown-QR and Auth-QR scanning requests.

7. The method for managing eSIM resource downloads as described in claim 1, characterized in that, It also includes the ability to recycle or terminate unused group order resources through the recycleGroupOrder customized interface.

8. A system for managing eSIM resource downloads, characterized in that, include: The network operator's server is used to provide a certain number of Profile configuration files as a resource pool for eSIM download services to the eSIM configuration service platform SM-DP+. The system receives the required number of Profile configuration files and at least one licensed IP address from the SP service provider, where the licensed IP address corresponds to the Wi-Fi hotspot network of the offline outlets managed by the SP service provider. Based on the required number of files and the licensed IP address, the system sends a request to create a group order to the SM-DP+ platform through a customized interface. The request instructs the SM-DP+ platform to perform the following operations: Generate a group-level download QR code (GroupDown-QR) for user terminals to scan and download, and an authorization QR code (Auth-QR) for administrator authorization operations; Bind the GroupDown-QR and the Auth-QR to the authorized IP address information; set a group type flag for the Profile configuration file corresponding to the group order; The network operator server is also used to receive the GroupDown-QR and the Auth-QR returned by the SM-DP+ platform; and to send the GroupDown-QR and the Auth-QR to the SP service provider, so that the SP service provider can send the Auth-QR and GroupDown-QR to the corresponding management devices of each branch; the GroupDown-QR is configured to allow the user terminal to download the corresponding Profile configuration file from the SM-DP+ when the Auth-QR has completed the authorization operation and the user terminal accesses the Wi-Fi network corresponding to the licensed IP address.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed on a computer, perform the method for managing eSIM resource downloads as described in any one of claims 1-7.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor runs the computer program stored in the memory, it performs the method for managing eSIM resource downloads as described in any one of claims 1-7.

Images