METHOD AND DEVICE FOR DUAL CONTROL GUIDELINE INSTALLATION IN AN EMBEDDED SIM CARD

Description

1. Field of invention

[0001] The invention application is in the field of mobile communication terminals, and more specifically so-called embedded SIM cards (eUICC, or eSIM). An embedded SIM card allows a mobile terminal to operate with subscriptions from several operators with a single, generally non-removable SIM card. 2. State of the prior art

[0002] An operator profile is a set of files installed within the eSIM card. This set of files, if activated, is used to ensure the execution of an operating environment for the terminal while remaining under the control of the operator associated with the profile. This is the same environment that a traditional, single-operator SIM card provided by that operator would provide.

[0003] Each operator profile is associated with a set of rules (Policy Rules) intended to manage the life cycle of the operator profile. Examples of rules are: prohibition of deactivation of the operator profile; prohibition of deletion of the operator profile; in case of deactivation, then deletion of the operator profile.

[0004] By analogy, in the environment provided by a classic single-operator SIM card, there is the so-called "SIM lock" rule that the operator can choose to apply in order to prevent the terminal from operating with a SIM card from a different operator. It is understood that the SIM lock module must be integrated into the terminal and not into the SIM card. On the other hand, since an eSIM card is not intended to be replaced or removed from the terminal by the user, particularly when it is soldered, the rules can be stored in the eSIM card, along with the operator profiles.

[0005] When the user of the terminal with an eSIM card wishes to perform an action on one of his operator profiles, for example deactivating it for a specific period in order to avoid excessive billing from the associated operator, a control mechanism called Policy Enforcement checks whether such an action is authorized, i.e. whether it is not contrary to the rules (Policy Rules) governing this operator profile. It is generally when the user subscribes to a subscription with an operator that the associated profile(s) and rules are installed, depending on the terms of the contract between the operator and the user (or between the operator and the subscriber if the subscriber is not the user). Neither the terminal manufacturer nor the eSIM card manufacturer are directly involved in this installation of profiles and rules allowing profiles to be modified.Since only the operator can exercise control over profiles and rules, as verified in the context of products with eSIM card meeting the M2M (machine to machine) specifications defined by the GSMA (GSM association), this does not allow, for example, manufacturers to verify compliance with their commercial agreements with operators, or compliance with local regulations when the manufacturer's liability is engaged.

[0006] One of the aims of the invention is to remedy these drawbacks of the state of the art. US 2015 / 281964 A1 (SEO MYOUNG HEE [KR] ET AL) October 1, 2015 (2015-10-01) and EP 2 854 432 A2 (KT CORP [KR]) April 1, 2015 (2015-04-01) present solutions for managing profiles in eSIMs, in particular the installation of profiles including their attributes, and the rules of use by different actors who are authenticated and establish a secure communication channel.

[0007] "Global Platform Card Specification Version 2.2", March 31, 2006 (2006-03-31), XP055090891 and "Smart Cards; Embedded UICC; Requirements Specification (Release 13)",TECHNICAL SPECIFICATION, EUROPEAN TELECOMMUNICATIONS STANDARDS INSTITUTE (ETSI), 650, ROUTE DES LUCIOLES; F-06921 SOPHIA-ANTIPOLIS; FRANCE, vol. SCP REQ, no. V13.1.0, February 1, 2016 (2016-02-01), XP014274101, are the applicable standards. 3. Statement of the invention

[0008] The invention is defined by the independent claims. The dependent claims constitute examples of implementation.

[0009] The invention improves the situation by means of a method for installing an execution rule of an operating environment for a communication terminal in a mobile network of an operator, said environment being called an operator profile, the operator profile being stored in a subscriber module embedded in the terminal, the method comprising the following steps implemented by the subscriber module: obtaining a first token signed by the operator and comprising information relating to the identification of the rule; obtaining a second token signed by a third party other than the operator and comprising a first means of verifying the authenticity of the first token; verifying the authenticity of the first token using the first verification means; verifying the authenticity of the second token using a second verification means; installing the rule in the subscriber module if the authenticities of the first and second tokens are verified.

[0010] Thanks to the tokens, a rule (Policy Rule) is installed in the subscriber module, i.e. in the SIM or eSIM card, only if the installation is authorized by both the operator and a third party entity other than the operator, and not only authorized by the operator associated with the profile as is the case in the prior art. The control of the installation of the rule, thanks to the verification of the authenticity of the tokens, can therefore be ensured jointly by the operator and the third party, who will have previously entered into an agreement in order to produce the necessary authenticatable tokens. The rule is part of a list of rules known to the subscriber module. The identifier of the rule allows the subscriber module to find the rule in the list and to install it.

[0011] Tokens are digital files transmitted to the terminal's subscriber module at the operator's initiative, for example at the time of profile installation. Tokens can be issued by an operator entity responsible for preparing subscription management data, called SMDP (Subscription Manager Data Preparation), and / or by an operator platform called OTA (over the air) if, for example, the installation of the profile and the rules are decorrelated in time.

[0012] Thus, the rule is installed and ready to be used in anticipation of a user action on the profile. Thus, if, for example, the profiles of two different operators are installed on the terminal's eSIM card, the active profile being the one corresponding to a professional subscription, the inactive profile corresponding to a private subscription, the user can switch from his professional subscription to his private subscription at the end of his working day, without requiring the slightest exchange of messages between his terminal and each of the operators to obtain authorizations for the deactivation of the first profile and the activation of the second profile. The terminal relies solely on the rules installed using the method according to the invention, which are sufficient to determine and authorize all possible actions on the installed profiles.

[0013] It should be noted that in this document, the term "installation" or "installer" applied to a rule takes the meaning given in English by the term "set up". The installation of a rule can for example simply be its activation, knowing that the rules, or "Policy Rules", are part of a list known between operators and manufacturers of terminals and SIM cards, and possibly standardized, where they are identifiable by an alphanumeric identifier. This list can for example be loaded into a memory of the terminal or the subscriber card.

[0014] According to one aspect of the invention, the second verification means is installed by the third party, prior to the step of obtaining the tokens.

[0015] Thanks to this aspect, the third party controls the means of verifying the authenticity of the token supposed to be signed by the operator. Thus, the control of the installation of the rule is twofold, by the operator through the first token, and by the third party through the verification of the authenticity of the first token.

[0016] This allows for greater security against possible token tampering, as well as greater flexibility in implementing rules. The token associated with the third party can in fact be obtained in advance when concluding a contract between the operator and the third party, which can apply either globally to a set of terminals or to individually identified terminals.

[0017] According to one aspect of the invention, the third party other than the operator is a manufacturer of the terminal.

[0018] Thanks to this aspect, the rule control can be carried out jointly by the operator and the terminal manufacturer. It is easy for the manufacturer to install "in the factory" the second means of verification directly in the subscriber module.

[0019] According to one aspect of the invention, the third party other than the operator is a manufacturer of the subscriber module of the terminal.

[0020] Thanks to this aspect, the rule control can be carried out jointly by the operator and by the manufacturer of the terminal subscriber module, the latter being able to be different from the terminal manufacturer. It is also easy for the subscriber module manufacturer to install "in factory" the second verification means directly in the subscriber module before its delivery to the manufacturer, or to an operator if it is the latter who installs the subscriber module in the terminal.

[0021] According to one aspect of the invention, the tokens are issued by the operator.

[0022] The contractual relationship between the operator and the subscriber creates an electronic link between the operator's network and the subscriber's terminal. Tokens are more easily transmitted by the operator than by a third party without a contractual relationship with the subscriber. Joint control can only be guaranteed if a contractual relationship exists between the operator and the third party before the tokens are issued.

[0023] These tokens, which are digital files, can be sent to the terminal's subscriber module, simultaneously or not, by an entity of the operator responsible for preparing subscription management data, called SMDP ("Subscription Manager Data Preparation" in English), and / or by an operator platform called OTA (over the air) if, for example, the installation of the profile and the rules are decorrelated in time.

[0024] According to one aspect of the invention, at least one token further comprises information relating to limits in the application of the rule to the operator profile.

[0025] Thanks to this aspect, the operator or the manufacturer, for example, can control the rule more precisely, for example by only allowing its use with the profile for a specific period of time, or only in association with another partner operator, if it is a question of switching from one profile to another. This makes it possible, for example, to prevent one of the two actors (the operator or the manufacturer) from being able to modify or add a rule beyond the duration of the agreements between the operator and the manufacturer.

[0026] According to one aspect of the invention, the first verification means is a digest resulting from a hash function applied to a key corresponding to the operator.

[0027] Due to this aspect, the first means of verification is reduced in size in the second token, and is simple to implement in the subscriber module.

[0028] The various aspects of the rule installation process just described can be implemented independently of each other or in combination with each other.

[0029] The invention also relates to a device for installing an execution rule of an operating environment for a communication terminal in a mobile network of an operator, said environment being called an operator profile, the operator profile being stored in a subscriber module embedded in the terminal, the device comprising the following modules: module for obtaining two tokens, a first token being signed by the operator and comprising information relating to the identification of the rule, a second token being signed by a third party other than the operator and comprising a first means of verifying the authenticity of the first token; module for verifying the authenticity of the first token using the first verification means, and the authenticity of the second token using a second verification means; module for installing the rule in the subscriber module if the authenticity of the first and second tokens are verified.

[0030] This device, capable of implementing in all its embodiments the method of installing a rule which has just been described, can for example be included in a subscriber module such as an eSIM card, with ISD-R and Policy Enforcement (polEnf) modules which are modified with respect to GSMA standards.

[0031] The invention also relates to a subscriber module of a communication terminal in a mobile network of an operator comprising at least one operator profile module and a device such as that which has just been described.

[0032] This subscriber module can, for example, be an eSIM card modified to GSMA standards.

[0033] The invention further relates to a communication terminal in a mobile network of an operator comprising a subscriber module such as that which has just been described.

[0034] The invention finally relates to a computer program comprising instructions for implementing the steps of the method for installing a rule which has just been described, when this program is executed by a processor.

[0035] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0036] The invention also relates to an information medium readable by a mobile terminal, and comprising instructions of a computer program as mentioned above.

[0037] The information carrier may be any entity or device capable of storing the program. For example, the carrier may include a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a hard disk.

[0038] On the other hand, the information carrier may be a transmissible carrier such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network such as the Internet.

[0039] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to perform or to be used in performing the methods in question. 4. Presentation of figures

[0040] Other advantages and characteristics of the invention will appear more clearly on reading the following description of particular embodiments of the invention, given as simple illustrative and non-limiting examples, and the appended drawings, among which: there figure 1presents an example of implementation of the method of installing a rule, according to one aspect of the invention, the figure 2 presents an example of the structure of a device implementing the method of installing a rule, according to one aspect of the invention. 5. Detailed description of at least one embodiment of the invention

[0041] In the remainder of the description, examples of several embodiments of the invention are presented, applying to an eSIM card as currently being standardized within the framework of the GSMA association, but the invention also applies to other types of subscriber module.

[0042] Also, the invention is illustrated using an example which is the deactivation of an activated profile, but the invention applies to other examples, such as the activation of a deactivated profile, the deletion of an activated or inactivated profile, etc.

[0043] There figure 1presents an example of implementation of the method of installing a rule, according to one aspect of the invention.

[0044] During a step U1, a user mobile terminal UE receives an operating environment P1 in a mobile network of an operator Op1. This operating environment, called a profile, is a set of data and applications to be installed on a subscriber module and allowing the provision of services by a mobile network operator within the framework of a subscription contract between this operator and the owner of the mobile terminal. The subscriber module is for example an eSIM card, the particularity of which is to allow the installation of profiles from several different operators.

[0045] In a step U2, the profile P1 is installed by the terminal UE, i.e. stored in a special compartment of the eSIM card, for example the module called ISD-P (Issuer Security Domain - Profile) and responsible for instantiating, in the eSIM card, a representation of the operator, for example an operator equipment responsible for preparing the subscription management data, called SMDP.

[0046] Steps U1 and U2 are prior to the following steps, and can take different forms, or be combined, the main result being on the one hand, the memorization of the P1 profile in the eSIM card of the UE terminal, and on the other hand, the activation of the P1 profile.

[0047] During a step U3, following, or in anticipation of, a wish or a request from the user to deactivate the profile P1, the terminal UE receives from the operator Op1 a tokDM token, called a "manufacturer token". Since a terminal or SIM card manufacturer generally has no direct relationship with the user, nor a communication link with its terminal UE, the tokDM token is transmitted to the terminal UE by the operator Op1, for example by the SMDP equipment. The way in which the operator Op1 generated or obtained the tokDM token is described below (steps O2 to O4).

[0048] During a step U4, following, or in anticipation of, a wish or request from the user to deactivate the profile P1, the terminal UE receives from the operator Op1 a token tokOp1, called an "operator token".

[0049] The order in which the terminal obtains the tokens is unimportant, and steps U3 and U4 can therefore be reversed in time.

[0050] The tokDM and tokOp1 tokens can take the form of a message including a file.

[0051] The operator token tokOp1 includes a signature of the operator Op1, an identifier of at least one rule R1 applicable to the profile P1, and optionally an identifier of the profile P1 (but not necessarily because a verification of the signature normally makes it possible to identify P1). Optionally, the operator token tokOp1 may include one or more other fields specifying conditions restricting the application of the rule. Examples of such conditions are: lifetime of the rule, associated partner operator, etc.

[0052] Rule R1 is part of a set of rules determined and known to the terminal, for example through a library of rules previously stored in the eSIM card.

[0053] The tokDM manufacturer token includes a signature from the DM manufacturer of the EU terminal, as well as a means of verifying the authenticity of the operator token.

[0054] The means of verifying the authenticity of the manufacturer token exists in the terminal, preferably prior to the installation of the Op1 profile. This means of verifying the authenticity of the manufacturer token tokDM can, for example, be a public and private key mechanism pre-installed "at the factory" by the DM manufacturer in a module of the eSIM card of the UE terminal. Advantageously, this verification module can be the polEnf module of the eSIM card, called the "Policy Enforcement" module. This module, in fact, is a neutral component in the eSIM card, with respect to all operators likely to install a profile associated with them.

[0055] The means for verifying the authenticity of the tokOp1 operator token is included in the manufacturer token. For example, this means can be a public key of the Op1 operator, a certificate of the Op1 operator, or a hash of the Op1 operator's public key. Advantageously, the module for verifying the authenticity of the tokOp1 operator token can also be the polEnf module of the eSIM card.

[0056] In a U5 step, the authenticity of the tokens is verified, for example by the polEnf module of the eSIM card of the UE terminal.

[0057] The authenticity of the tokOp1 token is performed using the verification means included in the tokDM token. For example, in an implementation of an easy-to-implement authenticity verification mechanism, the tokOp1 token is signed using a symmetric key calculated by the Op1 operator, according to a mechanism known as MAC or HMAC. This key is communicated by the operator to the polEnf module at the time of installation or activation of the P1 profile. Finally, the hash function to be used for the key (e.g. SHA256) is communicated to the polEnf module in a similar manner, and the digest resulting from the application of the hash function on this key is communicated to the DM manufacturer, as part of an agreement between the operator and the manufacturer.The tokDM token includes the digest, i.e. the means of verification, which will allow the polEnf module to verify the authenticity of the tokOp1 token by comparing the digest included in the tokDM token with the digest obtained by applying the hash function to the key used to sign the tokOp1 token, this key having been previously communicated by the operator to the polEnf module.

[0058] The authenticity of the tokDM token, for example, can be verified using a private key signature associated with a public key known by the polEnf module as being that of the DM manufacturer.

[0059] If the authenticity of the two tokens is verified, this means that the rule identified in the tokOp1 token does indeed concern the operator identified in the tokDM token, i.e. there is indeed a correspondence between the two tokens.

[0060] In step U6, rule R1 is installed, for example by the polEnf module, and ready to be used.

[0061] In a step not shown, subsequent to the installation of rule R1, the rule is used. For example, the terminal UE performs, as required by the user, the deactivation of profile P1, if this modification is authorized by rule R1. Thus, thanks to the installation method according to the invention, the modification is only possible if it is jointly authorized by the operator Op1 and by the manufacturer DM.

[0062] If rule R1 is, for example, that a profile of operator Op1 on a terminal manufactured by DM can only be deactivated if it is deleted completely, then the terminal UE additionally performs the deletion of profile P1.

[0063] The invention further relates to a method for transmitting, by an operator, a token signed by the manufacturer of a mobile terminal. This method is also illustrated by the figure 1 .

[0064] During a step O1, the SMDP equipment of the operator Op1 transmits the profile P1 to the terminal UE.

[0065] During a step O2, a device of the operator Op1, for example the SMDP device, sends a token request to a device of the manufacturer DM having manufactured the terminal UE. The request comprises at least one identifier of the operator Op1, and may comprise one or more rule identifiers, and one or more profile identifiers.

[0066] In a step O3, the operator Op1's equipment receives a tokDMOp1 token in response. This token may depend on the type of control authorized and delegated by the DM manufacturer to the operator Op1. The token may include, in addition to one or more rules applicable to the profile, conditions restricting their application. Optionally, the tokDMOp1 token generated by the DM manufacturer may itself be based on a tokCM token generated by the CM manufacturer of the eSIM card, using a public and private key mechanism for example.

[0067] It should be noted that step O1, which is the provision of the profile to the terminal, may take place after step O3, in which case the provision of the manufacturer's token to the operator anticipates a subsequent action on the profile by the user.

[0068] In step O4, the SMDP device of operator Op1 issues a tokDM token that is based on the tokDMOp1 token. If the token request is rule- and profile-specific, the tokDM token can be the same as the tokDMOP1 token, but in the general case, the token request, as well as the response, concerns a set of rules and a set of profiles.

[0069] During step O5, the SMDP equipment of operator Op1 issues, in addition to the tokDM token, a tokOp1 token which is specific to a rule and a profile.

[0070] In relation to the figure 2 , we now present an example of the structure of a device implementing the method of installing a rule, different embodiments of which have just been described.

[0071] Such a device 100 can be implemented in the subscriber module of the terminal UE. This subscriber module can be an eSIM card, embedded or not in a fixed manner in the terminal, for example soldered.

[0072] For example, the device 100 is equipped with a microprocessor µP, and is controlled by a computer program 110, stored in a memory 120 and implementing the method for installing a rule according to the invention. Upon initialization, the code instructions of the computer program 110 are for example loaded into a RAM memory, before being executed by the processor of the eSIM card.

[0073] Such a device 100 comprises the following hardware or software modules: an ISD-R module, capable of obtaining tokOp1 and tokDM tokens signed respectively by an operator and by a third party, and of receiving one or more P1 operator profiles and managing their installation in an ISD-P module of the eSIM card; a polEnf module, capable of verifying the authenticity of the tokDM and tokOp1 tokens, and of installing in the eSIM card a rule included in one of the signed tokens.

[0074] The eSIM card also includes one or more ISD-P modules, each ISD-P module being capable of hosting an operator's profile for the terminal subscriber, and acting as a representative of that operator on the terminal.

[0075] Advantageously, the polEnf module can update, for each of the hosted profiles, a list of installed rules.

[0076] The eSIM card itself is included in a UE terminal which further comprises a LUI (Local User Interface) module allowing the user to act on the operator profile(s) installed on the eSIM card in the ISD-P module(s), via the ISD-R module, while respecting the rule(s) installed using the installation method according to the invention.

[0077] This figure 2 illustrates only one particular way, among several possible ones, of carrying out the algorithm detailed above, in relation to the figure 1 . Indeed, the technique of the invention is carried out indifferently on a reprogrammable eSIM card (a DSP processor or a microcontroller) executing a program comprising a sequence of instructions, or on a dedicated computing machine (for example a set of logic gates such as an FPGA or an ASIC, or any other hardware module).

[0078] In the case where the invention is implemented on a reprogrammable computing machine, the corresponding program (i.e. the sequence of instructions) may be stored in a removable storage medium (such as for example a floppy disk, a CD-ROM or a DVD-ROM) or not, this storage medium being partially or totally readable by a computer or a processor.

[0079] The exemplary embodiments of the invention that have just been presented are only some of the possible embodiments. They show that the invention allows joint control by an operator and by a third party, for example the manufacturer of the terminal or the manufacturer of the eSIM card, of any action by the user of a terminal on an operator profile that is installed or to be installed, even if the eSIM card hosts profiles from several operators at the same time.

Claims

1. Method for installing a rule for executing an operating environment for a communication terminal (UE) in a mobile network of an operator (Op1), said environment (P1) being called operator profile, the operator profile being stored in a subscriber module (eSIM) embedded in the terminal, the method comprising the following steps implemented by the subscriber module: • obtaining (U4) a first token (tokOp1) from the operator, the first token comprising an item of information relating to the identification of the rule and a signature of the operator; • obtaining (U3) a second token (tokDM) from the operator, the second token comprising a first verification means for verifying the authenticity of the first token and a signature of a third party (DM; CM) other than the operator; • verifying (U5) the authenticity of the first token by way of the first verification means; • verifying (U5) the authenticity of the second token by way of a second verification means pre-installed in the subscriber module by the third party; • installing (U6) the rule in the subscriber module if the authenticities of the first and second tokens are verified.

2. Method according to Claim 1, wherein the second verification means is installed by the third party (DM; CM), prior to at least one of the steps (U3; U4) of obtaining the tokens (tokDM; tokOp1).

3. Method according to either of Claims 1 and 2, wherein the third party other than the operator (Op1) is a manufacturer (DM) of the terminal (UE).

4. Method according to either of Claims 1 and 2, wherein the third party other than the operator (Op1) is a manufacturer (CM) of the subscriber module (eSIM) of the terminal (UE).

5. Method according to one of the preceding claims, wherein at least one token (tokDM; tokOp1) furthermore comprises information relating to limits in terms of the application of the rule to the operator profile (P1).

6. Method according to one of the preceding claims, wherein the first verification means is a hash resulting from a hash function applied to a key corresponding to the operator (Op1).

7. Device for installing a rule for executing an operating environment for a communication terminal (UE) in a mobile network of an operator (Op1), said environment (P1) being called operator profile, the operator profile being stored in a subscriber module (eSIM) embedded in the terminal, the device comprising the following modules: • a module (ISD-R) for obtaining two tokens from the operator, a first token (tokOp1) comprising an item of information relating to the identification of the rule and a signature of the operator, a second token (tokDM) comprising a first verification means for verifying the authenticity of the first token and a signature of a third party (DM; CM) other than the operator; • a module (polEnf) for verifying the authenticity of the first token by way of the first verification means, and the authenticity of the second token by way of a second verification means pre-installed in the subscriber module by the third party; • a module (polEnf) for installing the rule in the subscriber module if the authenticities of the first and second tokens are verified.

8. Subscriber module of a communication terminal (UE) in a mobile network of an operator (Op1), comprising at least one operator profile module (ISD-P) and a device according to Claim 7.

9. Communication terminal (UE) in a mobile network of an operator (Op1), comprising a subscriber module (eSIM) according to Claim 8.

10. Computer program, characterized in that it comprises instructions for implementing the steps of the method for installing a rule according to Claim 1 when this program is executed by a processor.

11. Recording medium able to be read by a subscriber module and on which the program according to Claim 10 is recorded.