Methods and devices for an integrated circuit card identity profile

Abstract

Methods (300; 400; 500; 600) and apparatus (800; 830; 840; 850; 860) for subscription transferring are provided. A method performed by a first network device comprises receiving a first message from a second network device. The first message comprises first information regarding a target device and second information indicating the target device is trying to download an ICCID profile. The method comprises validating if the target device is eligible for subscription transferring for the ICCID profile based on the first information. The method comprises sending a second message to a source device when the target device is eligible for the subscription transferring. The subscription transferring is triggered by a user via the source device and wherein the second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

Description

METHODS AND DEVICES FOR AN INTEGRATED CIRCUIT CARD IDENTITY PROFILETECHNICAL FIELD

[0001] The non-limiting and exemplary embodiments of the present disclosure generally relate to the technical field of communications, and specifically to methods, devices, a computer-readable storage medium and a computer program for an integrated circuit card identity profile.BACKGROUND

[0002] This section introduces aspects that may facilitate a better understanding of the disclosure. Accordingly, the statements of this section are to be read in this light and are not to be understood as admissions about what is in the prior art or what is not in the prior art.

[0003] Embedded Subscriber Identity Module (eSIM) is defined as an embedded universal integrated circuit card (eUICC) by Global System for Mobile communications Association (GSMA), compared to the legacy plastic and removable Subscriber Identity Module (SIM) cards. The eUICC can be soldered directly into a device which provides greater flexibility since the devices can immediately connect to e.g. a network, no matter where they are deployed or where they may travel during their use.

[0004] Compared to the removable physical SIM card, where subscription of a Communication Service Provider (CSP) can be seamlessly transferred from one device to another device by physically removing the physical SIM card from an old device and inserting it into a new device, the transfer of a subscription associated withan eSIM device may rely on deleting the digital Integrated Circuit Card Identifier (ICCID) profile from an old eSIM device and applying and downloading the new digital ICCID profile to a new eSIM device. To facilitate this procedure, a network device (such as server) to coordinate the end-to-end subscription transferring flow may be needed.

[0005] GSMA Technical Specification (TS).43 Service Entitlement Configuration Version 9.0 discloses the procedure for configuration of a device-based service performed during the entitlement verification step of the service or during the activation of that service.

[0006] GSMA SGP.22 specification, i.e., GSMA Remote SIM Provisioning (RSP) Technical Specification Version 3.0, discloses a technical description of the GSMA’s “RSP Architecture for consumer devices” that applies for eSIM Products.SUMMARY

[0007] This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0008] As defined in GSMA Technical Specification (TS).43 Service Entitlement Configuration Version 9.0, , Entitlement Configuration Server (ECS) is a node deployed in the Communication Service Provider (CSP) network to configure the service at the (e.g. eSIM) device. The typical services may include Voice over Long-Term Evolution (LTE) (VoLTE), Voice over Wireless Fidelity (WiFi) (VoWiFi), Short Message Service (SMS) over Internet protocol (IP) (SMSoIP), On- Device Service Activation (ODSA) for primary eSIM devices. The ECS may be exactly this coordinator to handle the eSIM subscription transferring among different eSIM capable primary devices. As defined in the GSMA SGP.22 specification (GSMA RSP Technical Specification Version 3.0), a primary device may be a device that can be used to provide some capabilities to a Companion Device for the purpose of Remote SIM Provisioning.

[0009] In the case of transferring a physical SIM card, the responsibility lies with an end user, who is the owner of the SIM card, to ensure that the transferring procedure (plug out & plug in SIM) occurs only under his / her supervision or is just handled by himself / herself, and make sure both the old and new primary devices belong to the same end user. However, in the eSIM era, the transferring procedure occurs digitally, making the end user's consent is even more crucial to prevent the subscription from transferring to faked target devices of malicious attackers.

[0010] In scenarios where transferring can only occur to a specific desired target primary device, e.g. when the target device is sold by the CSP who requires strictly binding between the "SIM card / ICCID profile" and "specific phone / phone type / phone brand" to prevent unauthorized movement or relocation, it becomes imperative for the coordinator within the CSP to gather both the source and target device information for eligibility checking during the transferring procedure. However, due to the boundaries between different device vendors, obtaining the transferring peer's information poses significant challenges, especially in cross-platform cases, such as iOS (Apple's mobile operating system) to Android or vice versa, and even in cross-vendor cases involving different Android Original Equipment Manufacturer (OEM) vendors.

[0011] In response to the above described scenario wherein transferring of a subscription can only occur to a specific target primary device, the CSP is sometimes forced to generate an activation code (for transferring the subscription of a given device) accessible by any target device, serving as a compromise in the transfer procedure. Unfortunately, this approach increases the risk of the subscription being transferred to a device belonging to a malicious attacker.

[0012] Furthermore, even when there is a confirmation code delivered to the end user as an extra security insurance, it is often delivered to the end user simultaneously with the readiness of the new ICCID profile for download, rather than when the target device initiates the download process. This practice potentially allows attackers ample time to intercept the confirmation code.

[0013] FIG.1 shows a flowchart of cross OS / device vendors primary subscription transferring, which may be similar to the corresponding flowchart of GSMA TS.43 Service Entitlement Configuration Version 9.0.

[0014] At step 1 . A source device sends a request to an ECS to trigger subscription transferring without passing target device information in the request.

[0015] At step 2.1 . The ECS applies a new ICCID profile (i.e. an eSIM profile) from an enhanced subscription manager data preparation (SM-DP+) server without target device information.

[0016] At step 2.2. The ECS provisions the CSP's backend system (such as Business Support System(BSS) / core network node) for the subscription transferring. For example, the ECS may trigger the subscription transferring related provisioning to the BSS and core network.

[0017] For example, the ECS may provision (or request) the CSP's backend system (e.g. a BSS, a core network node, a Home Location Register (HLR), a Home Subscriber Server (HSS), a Unified Data Management (UDM)), to migrate / transfer subscription data associated with the old UICC (e.g. IMSI) to the new eUICC profile (e.g. the new IMSI in the ICCID profile). In some examples, the phone number (e.g. Mobile Station Integrated Services Digital Network (MSISDN)) is not changed during the provisioning by the ECS. The IMSI and MSISDN mapping may be updated in the CSP's backend system such as BSS and other backend systems. It may vary per different CSPs.

[0018] At step 3 . The ECS returns new ICCID profile download information to the source device (e.g. activation code in Quick Response (QR) code format).

[0019] At step 4. The ECS sends a confirmation code to the end user out-of-band (e.g, via the end user’s registered electronic mail (email) address).

[0020] At step 5. The target device may scan the QR code to trigger ICCID profile downloading, i.e., the end user uses the target device to get download information (e.g. scan QR code) from the source device.

[0021] At step 6. The target device requests ICCID profile (e.g. eSIM profile) to the SM-DP+ server by passing on the target device information (e.g. device identity) and the confirmation code.

[0022] Some problems for the above flowchart of FIG.1 may be as follows.

[0023] When the source device triggers subscription transferring, there is no target device information present in the CSP. The CSP can not perform the eligibility checking for the target device.

[0024] Once the subscription transferring is completed from the network side, the new eSIM profile download information (e.g. confirmation code and / or activation code) might be leaked to the attacker and the new ICCID profile can be downloaded to any device. The end user cannot guarantee that it is the desired target device which takes over the subscription. No end user consent is involved during the ICCID profile downloading to the target device.

[0025] Even though sending the confirmation code to the end user out of band can be seen as an additional layer of security enhancement, it introduces a vulnerability if it is sent before the target device starts to download the new ICCID profile without requiring the end user's reconfirmation on the source device. This time gap may provide an opportunity for attackers to engage in phishing or sniffing activities through various social engineering techniques.

[0026] To overcome or mitigate at least one of the above mentioned problems or other problems, an improved solution for subscription transferring may be desirable.

[0027] An object of the invention is to enable improved security for subscription transferring when a new Integrated Circuit Card Identifier (ICCID) profile is requested for a device.

[0028]

[0029] In a first aspect of the disclosure, there is provided a method performed by a first network device. The method comprises receiving a first message from a second network device. The first message comprises first information regarding a target device and second information indicating the target device is trying to download an integrated circuit card identity (ICCID) profile. The method comprises validating if the target device is eligible for subscription transferring for the ICCID profile based on the first information. The method comprises, when the target device is eligible for the subscription transferring, sending a second message to a source device. The subscription transferring is triggered by a user via the source device. The second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0030] In an embodiment, the second message is sent to the source device via a push server or a Short Message Service (SMS) or an Application Programming Interface (API).

[0031] In an embodiment, the second message comprises the first information and / or subscription information associated with the ICCID profile.

[0032] In an embodiment, the method comprises receiving a third message from the source device. The third message may comprise consent for subscription transferring of the user.

[0033] In an embodiment, the method comprises sending a fourth message comprising the first confirmation code associated with the ICCID profile to the user.

[0034] In an embodiment, the fourth message is sent to the user via a push server or an SMS or an API.

[0035] In an embodiment, the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

[0036] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises an Email address and the fourth message is sent to the user via a simple mail transfer protocol (SMTP) server.

[0037] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises a phone number and the fourth message is sent to the user via an SMS.

[0038] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises a push notification address and the fourth message is sent to the user via the push notification address.

[0039] In an embodiment, the method comprises, when the target device is not eligible for the subscription transferring, sending a fifth message to a source device. The fifth message is for notifying a user that the target device is not eligible for the subscription transferring.

[0040] In an embodiment, the method comprises sending a sixth message to the second network device. The sixth message comprises a validation result for the target device.

[0041] In an embodiment, the first information comprises at least one of an embedded universal integrated circuit card identifier (EID), an international mobile equipment identity (IMEI), or a type allocation code (TAC).

[0042] In an embodiment, the first network device may comprise an ECS and / or the second network device may comprise an SM-DP+ server.

[0043] In a second aspect of the disclosure, there is provided a method performed by a second network device. The method comprises receiving a request from a target device. The request is for downloading an ICCID profile and the request comprises first information regarding the target device. The method comprises sending a first message comprising the first information and second information to a first network device. The second information indicates the target device is trying to download the ICCID profile.

[0044] In an embodiment, the method comprises sending a seventh message to the target device. The seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0045] In an embodiment, the method comprises receiving an eighth message comprising a second confirmation code from the target device.

[0046] In an embodiment, the method comprises validating the second confirmation code.

[0047] In an embodiment, the method comprises, when the second confirmation code passes validation, sending the ICCID profile to the target device.

[0048] In an embodiment, the method comprises receiving a sixth message from the first network device. The sixth message comprises a validation result for the target device.

[0049] In an embodiment, the method comprises receiving a ninth message comprising a third confirmation code from the target device.

[0050] In an embodiment, the method comprises validating the third confirmation code.

[0051] In an embodiment, the method comprises, when the third confirmation code passes validation and the validation result for the target device indicates the target device is eligible for subscription transferring for the ICCID profile, sending the ICCID profile to the target device.

[0052] In an embodiment, the first information comprises at least one of an EID, an IMEI, or a TAC.

[0053] In an embodiment, the first network device comprises an ECS and / or the second network device may comprise an SM-DP+ server.

[0054] In a third aspect of the disclosure, there is provided a method performed by a source device. The method comprises sending a transfer request for an ICCID profile to a first network device. The method comprises, when a target device is eligible for subscription transferring for the ICCID profile, receiving a second message from the first network device. The second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0055] In an embodiment, the second message is received from the first network device via a push server or an SMS or an API.

[0056] In an embodiment, the second message comprises first information regarding the target device and / or subscription information associated with the ICCID profile.

[0057] In an embodiment, the method comprises, when the target device is eligible for subscription transferring for the ICCID profile, sending a third message to the first network device. The third message comprises consent for subscription transferring of the user.

[0058] In an embodiment, the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

[0059] In an embodiment, the address for receiving the first confirmation code associated with the ICCID profile comprises an Email address or a phone number or a push notification address.

[0060] In an embodiment, the method comprises, when the target device is not eligible for the subscription transferring, receiving a fifth message from the first network device. The fifth message is for notifying the user that the target device is not eligible for the subscription transferring.

[0061] In an embodiment, the first information comprises at least one of an EID, an IMEI, or a TAC.

[0062] In an embodiment, the first network device may comprise an ECS.

[0063] In a fourth aspect of the disclosure, there is provided a method performed by a target device. The method comprises sending a request to a second network device. The request is for downloadingan ICCID profile and comprises first information regarding the target device. The first information is for validating if the target device is eligible for subscription transferring for the ICCID profile. The subscription transferring is triggered by a user via a source device.

[0064] In an embodiment, the method comprises receiving a seventh message from the second network device. The seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile. The method comprises receiving a confirmation code input by a user. The method comprises sending a message comprising the confirmation code to the second network device.

[0065] In an embodiment, the first information comprises at least one of an EID, an IMEI, or a TAC.

[0066] In an embodiment, the second network device may comprise an SM-DP+ server.

[0067] In a fifth aspect of the disclosure, there is provided a first network device. The first network device comprises a processor and a memory coupled to the processor. Said memory contains instructions executable by said processor. Said first network device is operative to receive a first message from a second network device. The first message comprises first information regarding a target device and second information indicating the target device is trying to download an ICCID profile. Said first network device is operative to validate if the target device is eligible for subscription transferring for the ICCID profile based on the first information.

[0068] In a sixth aspect of the disclosure, there is provided a second network device. The second network device comprises a processor and a memory coupled to the processor. Said memory contains instructions executable by said processor. Said second network device is operative to receive a request from a target device. The request is for downloading an integrated circuit card identity (ICCID) profile and comprises first information regarding the target device. Said second network device is operative to send a first message comprising the first information and second information to a first network device. The second information indicates the target device is trying to download the ICCID profile.

[0069] In a seventh aspect of the disclosure, there is provided a source device. The source device comprises a processor and a memory coupled to the processor. Said memory contains instructions executable by said processor. Said source device is operative to send a transfer request for an ICCID profile to a first network device. Said source device is operative to, when a target device is eligible for subscription transferring for the ICCID profile, receive a second message from a first network device. The second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0070] In an eighth aspect of the disclosure, there is provided a target device. The target device comprises a processor and a memory coupled to the processor. Said memory contains instructions executable by said processor. Said target device is operative to send a request to a second networkdevice. The request is for downloading an ICCID profile and comprises first information regarding the target device. The first information is for validating if the target device is eligible for subscription transferring for the ICCID profile. The subscription transferring is triggered by a user via a source device.

[0071] In a ninth aspect of the disclosure, there is provided a first network device. The first network device comprises a first receiving module configured to receive a first message from a second network device. The first message comprises first information regarding a target device and second information indicating the target device is trying to download an ICCID profile. The first network device comprises a validating module configured to validate if the target device is eligible for subscription transferring for the ICCID profile based on the first information.

[0072] In an embodiment, the first network device comprises a first sending module configured to, when the target device is eligible for the subscription transferring, send a second message to a source device. The subscription transferring is triggered by a user via the source device. The second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0073] In an embodiment, the first network device comprises a second receiving module configured to receive a third message from the source device. The third message comprises consent for subscription transferring of the user.

[0074] In an embodiment, the first network device comprises a second sending module configured to send a fourth message comprising the first confirmation code associated with the ICCID profile to the user.

[0075] In an embodiment, the first network device comprises a third sending module configured to, when the target device is not eligible for the subscription transferring, send a fifth message to a source device. The fifth message is for notifying a user that the target device is not eligible for the subscription transferring.

[0076] In an embodiment, the first network device comprises a fourth sending module configured to send a sixth message to the second network device. The sixth message comprises a validation result for the target device.

[0077] In a tenth aspect of the disclosure, there is provided a second network device. The second network device comprises a first receiving module configured to receive a request from a target device. The request is for downloading an ICCID profile and comprises first information regarding the target device. The second network device comprises a first sending module configured to send a first message comprising the first information and second information to a first network device. The second information indicates the target device is trying to download the ICCID profile.

[0078] In an embodiment, the second network device comprises a second sending module configured to send a seventh message to the target device. The seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0079] In an embodiment, the second network device comprises a second receiving module configured to receive an eighth message comprising a second confirmation code from the target device.

[0080] In an embodiment, the second network device comprises a first validating sending module configured to validate the second confirmation code.

[0081] In an embodiment, the second network device comprises a third sending module configured to, when the second confirmation code passes validation, send the ICCID profile to the target device.

[0082] In an embodiment, the second network device comprises a third receiving module configured to receive a sixth message from the first network device. The sixth message comprises a validation result for the target device.

[0083] In an embodiment, the second network device comprises a fourth receiving module configured to receive a ninth message comprising a third confirmation code from the target device.

[0084] In an embodiment, the second network device comprises a second validating module configured to validate the third confirmation code.

[0085] In an embodiment, the second network device comprises a fourth sending module configured to, when the third confirmation code passes validation and the validation result for the target device indicates the target device is eligible for subscription transferring for the ICCID profile, send the ICCID profile to the target device.

[0086] In an eleventh aspect of the disclosure, there is provided a source device. The source device comprises a first sending module configured to send a transfer request for an ICCID profile to a first network device. The source device comprises a first receiving module configured to, when a target device is eligible for subscription transferring for the ICCID profile, receive a second message from the first network device. The second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0087] In an embodiment, the source device comprises a second sending module configured to, when the target device is eligible for subscription transferring for the ICCID profile, send a third message to the first network device. The third message comprises consent for subscription transferring of the user.

[0088] In an embodiment, the source device comprises a second receiving module configured to, when the target device is not eligible for the subscription transferring, receive a fifth message fromthe first network device. The fifth message is for notifying the user that the target device is not eligible for the subscription transferring.

[0089] In a twelfth aspect of the disclosure, there is provided a target device. The target device comprises a first sending module configured to send a request to a second network device. The request is for downloading an integrated circuit card identity (ICCID) profile and comprises first information regarding the target device. The first information is for validating if the target device is eligible for subscription transferring for the ICCID profile. The subscription transferring is triggered by a user via a source device.

[0090] In an embodiment, the target device comprises a first receiving module configured to receive a seventh message from the second network device. The seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0091] In an embodiment, the target device comprises a second receiving module configured to receive a confirmation code input by a user.

[0092] In an embodiment, the target device comprises a second sending module configured to send a message comprising the confirmation code to the second network device.

[0093] In a thirteenth aspect of the disclosure, there is provided a computer program comprising instructions which when executed by at least one processor, cause the at least one processor to perform the method according to any one of the first, second, third or fourth aspects.

[0094] In an eleventh aspect of the disclosure, there is provided a computer-readable storage medium storing instructions which when executed by at least one processor, cause the at least one processor to perform the method according to any one of the first, second, third or fourth aspects.

[0095] Embodiments herein may provide many advantages, of which a non-exhaustive list of examples follows. In some embodiments herein, the proposed solution can enhance the subscription transferring flow to allow the CSP to check if it is the desired target device to take over the subscription to be transferred, without device to device communication. In some embodiments herein, the proposed solution can involve the end user to re-confirm it is the desired target device transferring the subscription before the downloading of the new ICCID profile. In some embodiments herein, the proposed solution can ensure the confirmation code is delivered only when it is really needed, which can enhance the security. In some embodiments herein, the proposed solution can mitigate security risks and minimize the possibility of an attacker intercepting the confirmation code. The embodiments herein are not limited to the features and advantages mentioned above. A person skilled in the art will recognize additional features and advantages upon reading the following detailed description.BRIEF DESCRIPTION OF THE DRAWINGS

[0096] The above and other aspects, features, and benefits of various embodiments of the present disclosure will become more fully apparent, by way of example, from the following detailed description with reference to the accompanying drawings, in which like reference numerals or letters are used to designate like or equivalent elements. The drawings are illustrated for facilitating better understanding of the embodiments of the disclosure and not necessarily drawn to scale, in which:

[0097] FIG.l shows a flowchart of cross OS / device vendors primary subscription transferring;

[0098] FIG.2a schematically shows a high level architecture in a 5G network according to an embodiment of the present disclosure;

[0099] FIG.2b schematically shows a high level architecture in a 4G network according to an embodiment of the present disclosure;

[0100] FIG.2c schematically shows example architecture for subscription transferring according to an embodiment of the present disclosure;

[0101] FIG.2d schematically shows example architecture for subscription transferring according to another embodiment of the present disclosure;

[0102] FIG.3a shows a flowchart of a method according to an embodiment of the present disclosure;

[0103] FIG.3b shows a flowchart of a method according to another embodiment of the present disclosure;

[0104] FIG.3c shows a flowchart of a method according to another embodiment of the present disclosure;

[0105] FIG.3d shows a flowchart of a method according to another embodiment of the present disclosure;

[0106] FIG.4a shows a flowchart of a method according to another embodiment of the present disclosure;

[0107] FIG.4b shows a flowchart of a method according to another embodiment of the present disclosure;

[0108] FIG.4c shows a flowchart of a method according to another embodiment of the present disclosure;

[0109] FIG.5a shows a flowchart of a method according to another embodiment of the present disclosure;

[0110] FIG.5b shows a flowchart of a method according to another embodiment of the present disclosure;

[0111] FIG.5c shows a flowchart of a method according to another embodiment of the present disclosure;

[0112] FIG.6a shows a flowchart of a method according to another embodiment of the present disclosure;

[0113] FIG.6b shows a flowchart of a method according to another embodiment of the present disclosure;

[0114] FIG.7a shows a flowchart of a method according to another embodiment of the present disclosure;

[0115] FIG.7b shows a flowchart of a method according to another embodiment of the present disclosure;

[0116] FIG.8a is a block diagram showing an apparatus suitable for practicing some embodiments of the disclosure;

[0117] FIG.8b is a block diagram showing a first network device according to another embodiment of the disclosure;

[0118] FIG.8c is a block diagram showing a second network device according to an embodiment of the disclosure;

[0119] FIG.8d is a block diagram showing a source device according to an embodiment of the disclosure;

[0120] FIG.8e is a block diagram showing a target device according to an embodiment of the disclosure;

[0121] FIG.9 shows an example of a communication system according to an embodiment of the disclosure;

[0122] FIG.10 shows a UE in accordance with some embodiments;

[0123] FIG.11 shows a network node in accordance with some embodiments;

[0124] FIG.12 is a block diagram of a host according to an embodiment of the disclosure;

[0125] FIG.13 is a block diagram illustrating a virtualization environment in which functions implemented by some embodiments may be virtualized; and

[0126] FIG.14 shows a communication diagram of a host communicating via a network node with a UE over a partially wireless connection according to an embodiment of the disclosure.DETAILED DESCRIPTION

[0127] The embodiments of the present disclosure are described in detail with reference to the accompanying drawings. It should be understood that these embodiments are discussed only for the purpose of enabling those skilled persons in the art to better understand and thus implement the present disclosure, rather than suggesting any limitations on the scope of the present disclosure. Reference throughout this specification to features, advantages, or similar language does not implythat all of the features and advantages that may be realized with the present disclosure should be or are in any single embodiment of the disclosure. Rather, language referring to the features and advantages is understood to mean that a specific feature, advantage, or characteristic described in connection with an embodiment is included in at least one embodiment of the present disclosure. Furthermore, the described features, advantages, and characteristics of the disclosure may be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize that the disclosure may be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the disclosure.

[0128] As used herein, the term “network” refers to a network following any suitable communication standards such as new radio (NR), long term evolution (LTE), LTE-Advanced, wideband code division multiple access (WCDMA), high-speed packet access (HSPA), Code Division Multiple Access (CDMA), Time Division Multiple Address (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency-Division Multiple Access (OFDMA), Single carrier frequency division multiple access (SC-FDMA) and other wireless networks. In the following description, the terms “network” and “system” can be used interchangeably. Furthermore, the communications between two devices in the network may be performed according to any suitable communication protocols, including, but not limited to, the communication protocols as defined by a standard organization such as Third Generation Partnership Project (3 GPP). For example, the communication protocols may comprise the first generation (1G), 2G, 3G, 4G, 4.5G, 5G, 6G communication protocols, and / or any other protocols either currently known or to be developed in the future.

[0129] The term “network function” refers to any suitable function which can be implemented in a network entity (physical or virtual) of a communication network. For example, the network function can be implemented either as a network element on a dedicated hardware (e.g. the first network device 830, the second network device 840, the source device 850, the target device 860), as a software instance running on a dedicated hardware (e.g. the first network device 830, the second network device 840, the source device 850, the target device 860), or as a virtualized function instantiated on an appropriate platform, e.g. on a cloud infrastructure. For example, the 5G system (5GS) may comprise a plurality of NFs such as Access and Mobility Management Function (AMF), Session Management Function (SMF), Authentication Service Function (AUSF), Unified Data Management (UDM), Policy Control Function (PCF), Application Function (AF), Network Exposure Function (NEF), User plane Function (UPF) and Network Repository Function (NRF), radio access network (RAN), service communication proxy (SCP), network data analytics function (NWDAF), Network Slice Selection Function (NSSF), Network Slice-Specific Authentication andAuthorization Function (NSSAAF), etc. For example, the 4G system (such as Long Term Evolution (LTE)) may include Mobile Management Entity (MME), home subscriber server (HSS), PCRF (Policy and Charging Rules Function), PGW (Packet Data Network Gateway), PGW control plane (PGW-C), Serving gateway (SGW), SGW control plane (SGW-C), E-UTRAN Node B (eNB), etc. In other embodiments, the network function may comprise different types of NFs for example depending on a specific network.

[0130] Virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to a provider edge node and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines or containers executing on one or more physical processing nodes in one or more networks).

[0131] In some embodiments, some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments hosted by one or more of hardware nodes (e.g. the first network device 830, the second network device 840, the source device 850, the target device 860). Further, in embodiments in which the virtual node is not a radio access node or does not require radio connectivity (e.g., a core network node), then the virtual node may be entirely virtualized.

[0132] The functions may be implemented by one or more applications (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) operative to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein. Applications are run in virtualization environment which provides hardware comprising processing circuitry and memory. Memory contains instructions executable by processing circuitry whereby application is operative to provide one or more of the features, benefits, and / or functions disclosed herein.

[0133] Virtualization environment, comprises general-purpose or special-purpose network hardware devices (e.g. the first network device 830, the second network device 840, the source device 850, the target device 860) comprising a set of one or more processors or processing circuitry, which may be commercial off-the-shelf (COTS) processors, dedicated Application Specific Integrated Circuits (ASICs), or any other type of processing circuitry including digital or analog hardware components or special purpose processors. Each hardware device may comprise memory which may be non-persistent memory for temporarily storing instructions or software executed by processing circuitry. Each hardware device may comprise one or more network interface controllers (NICs), also known as network interface cards, which include physical network interface. Each hardware device may also include non-transitory, persistent, machine-readable storage media -having stored therein software and / or instructions executable by processing circuitry. Software may include any type of software including software for instantiating one or more virtualization layers (also referred to as hypervisors), software to execute virtual machines as well as software allowing it to execute functions, features and / or benefits described in relation with some embodiments described herein.

[0134] Virtual machines, comprise virtual processing, virtual memory, virtual networking or interface and virtual storage, and may be run by a corresponding virtualization layer or hypervisor. Different embodiments of the instance of virtual appliance may be implemented on one or more of virtual machines, and the implementations may be made in different ways.

[0135] During operation, processing circuitry executes software to instantiate the hypervisor or virtualization layer, which may sometimes be referred to as a virtual machine monitor (VMM). Virtualization layer may present a virtual operating platform that appears like networking hardware to virtual machine.

[0136] The source device 850 and / or the target device 860 refers to any end device that can access a communication network and receive services therefrom. By way of example and not limitation, the source device 850 and / or the target device 860 refers to a mobile terminal, a UE, or other suitable devices. The UE may be, for example, a Subscriber Station (SS), a Portable Subscriber Station, a Mobile Station (MS), or an Access Terminal (AT). The source device 850 and / or the target device 860 may include, but not limited to, a portable computer, an image capture terminal device such as a digital camera, a gaming terminal device, a music storage and a playback appliance, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet, a wearable device, a personal digital assistant (PDA), a portable computer, a desktop computer, a wearable terminal device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop-embedded equipment (LEE), a laptop-mounted equipment (LME), a USB dongle, a smart device, a wireless customer-premises equipment (CPE) and the like. As one example, a source device 850 and / or a target device 860 may represent a UE configured for communication in accordance with one or more communication standards promulgated by the 3GPP (3rd Generation Partnership Project), such as 3GPP LTE standard or NR standard. As used herein, a “user equipment” or “UE” may not necessarily have a “user” in the sense of a human user who owns and / or operates the relevant device. In some embodiments, the source device 850 and / or the target device 860 may be configured to transmit and / or receive information without direct human interaction. For instance, the source device 850 and / or the target device 860 may be designed to transmit information to a network on a predetermined schedule, when triggered by an internal or external event, or in response to requests from the communication network. Instead, aUE may represent a device that is intended for sale to, or operation by, a human user but that may not initially be associated with a specific human user.

[0137] As yet another example, in an Internet of Things (loT) scenario, the source device 850 and / or the target device 860 may represent a machine or other device that performs monitoring and / or measurements, and transmits the results of such monitoring and / or measurements to another terminal device and / or network equipment. The source device 850 and / or the target device 860 may in this case be a machine-to-machine (M2M) device, which may in a 3GPP context be referred to as a machine-type communication (MTC) device. As one particular example, the source device 850 and / or the target device 860 may be a UE implementing the 3GPP narrow band internet of things (NB-IoT) standard. Particular examples of such machines or devices are sensors, metering devices such as power meters, industrial machinery, or home or personal appliances, for example refrigerators, televisions, personal wearables such as watches etc. In other scenarios, the source device 850 and / or the target device 860 may represent a vehicle or other equipment that is capable of monitoring and / or reporting on its operational status or other functions associated with its operation.

[0138] References in the specification to “one embodiment,” “an embodiment,” “an example embodiment,” and the like indicate that the embodiment described may include a particular feature, structure, or characteristic, but it is not necessary that every embodiment includes the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

[0139] It shall be understood that although the terms “first” and “second” etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and similarly, a second element could be termed a first element, without departing from the scope of example embodiments. As used herein, the term “and / or” includes any and all combinations of one or more of the associated listed terms.

[0140] As used herein unless expressly stated to the contrary, the phrase “at least one of A and B” or “at least one of A or B” should be understood to mean any of the following “only A, only B, or both A and B.” The phrase “A and / or B” should be understood to mean any of the following “only A, only B, or both A and B”.

[0141] As used herein unless expressly stated to the contrary, the phrase “a plurality of’ followed by a conjunctive list of enumerated items (e.g., “A and B”, “A, B, and C”) is intended to mean“multiple items, with each item selected from the list consisting of’ the enumerated items. For example, “a plurality of A and B” is intended to mean any of the following: more than one A; more than one B; or at least one A and at least one B.

[0142] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes” and / or “including”, when used herein, specify the presence of stated features, elements, and / or components etc., but do not preclude the presence or addition of one or more other features, elements, components and / or combinations thereof.

[0143] It is noted that these terms as used in this document are used only for ease of description and differentiation among nodes, devices or networks etc. With the development of the technology, other terms with the similar / same meanings may also be used.

[0144] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skills in the art to which this disclosure belongs.

[0145] Although the subject matter described herein may be implemented in any appropriate type of system using any suitable components, the embodiments disclosed herein are described in relation to a communication system complied with the exemplary system architectures illustrated in FIGs.2a-2d. For simplicity, the system architectures of FIGs.2a-2d only depict some exemplary elements. In practice, a communication system may further include any additional elements suitable to support communication between terminal devices or between a wireless device and another communication device, such as a landline telephone, a service provider, or any other network node or terminal device. The communication system may provide communication and various types of services to one or more terminal devices to facilitate the terminal devices’ access to and / or use of the services provided by, or via, the communication system.

[0146] FIG.2a schematically shows a high level architecture in a 5G network according to an embodiment of the present disclosure. The architecture of FIG.2a is same as Figure 4.2.3-1 of 3GPP TS 23.501 V18.0.0. The system architecture of FIG.2a may comprise some exemplary elements such as AUSF, AMF, data network (DN), NEF, NRF, NSSF, PCF, SMF, UDM, UPF, AF, UE, (R)AN, SCP, NSSAAF, Network Slice Admission Control Function (NSACF), Edge Application Server Discovery Function (EASDF), etc.

[0147] In accordance with an exemplary embodiment, the UE can establish a signaling connection with the AMF over the reference point Nl, as illustrated in FIG.2a. This signaling connection may enable NAS (Non-access stratum) signaling exchange between the UE and the core network,comprising a signaling connection between the UE and the (R)AN and the N2 connection for this UE between the (R)AN and the AMF. The (R)AN can communicate with the UPF over the reference point N3. The UE can establish a protocol data unit (PDU) session to the DN (e.g. an operator network or Internet) through the UPF over the reference point N6.

[0148] As further illustrated in FIG.2a, the exemplary system architecture also contains the service-based interfaces such as Nnrf, Nnef, Nausf, Nudm, Npcf, Namf, Nnsacf, Neasdf and Nsmf exhibited by NFs such as the NRF, the NEF, the AUSF, the UDM, the PCF, the AMF, the NSACF, the EASDF and the SMF. In addition, FIG.2a also shows some reference points such as Nl, N2, N3, N4, N6 and N9, which can support the interactions between NF services in the NFs. For example, these reference points may be realized through corresponding NF service-based interfaces and by specifying some NF service consumers and providers as well as their interactions in order to perform a particular system procedure.

[0149] FIG.2b schematically shows a high level architecture in a 4G network according to an embodiment of the present disclosure, which is same as Figure 4.2.1-1 of 3GPP TS 23.401 V18.1.0. The system architecture of FIG.2b may comprise some exemplary elements such as HSS, UE, Evolved Universal Terrestrial Radio Access Network (E-UTRAN), Serving General Packet Radio Service (GPRS) Support Node (SGSN), MME, Serving Gateway (S-GW), Packet Data Network (PDN) Gateway, PCRF, etc. . GERAN denotes GSM EDGE Radio Access Network. IMS denotes Internet protocol (IP) Multimedia Subsystem. PSS denotes Packet- switched Streaming Service (PSS). Gx is the reference point between PCRF and PDN gateway and it provides transfer of (QoS) policy and charging rules from PCRF to Policy and Charging Enforcement Function (PCEF) in the PDN gateway. The network elements and interfaces as shown in FIG.2b may be same as the corresponding network elements and interfaces as described in 3GPP TS 23.401 V18.1.0.

[0150] FIG.2c schematically shows example architecture for subscription transferring according to an embodiment of the present disclosure.

[0151] A source device 850 may be any user equipment or terminal device that has the credential (e.g. 3GPP credential) in it (e.g., a USIM card and / or eSIM profile). The source device 850 may have a mobile OS that supports carrier (CSP) push notification. The mobile OS may be any suitable OS (such as Android, iOS, etc.) and the present disclosure has no limit on it. The source device 850 may have a native application supporting entitlement specification.

[0152] A target device 860 may be any user equipment or terminal device without subscription profile (e.g., ICCID profile). The target device 860 may download the subscription profile such as ICCID profile from SM-DP+ to complete the subscription transferring.

[0153] A CSP 200 may be the carrier that provides the subscription to the UE or terminal device in a form of e.g., USIM, eSIM, etc. The CSP 200 may also have deployed ECS and a Business Support System (BSS) (or a core network (CN) network function) to handle transfer request.

[0154] A push server may be a public cloud server (e.g., Apple Push Notification Server, Google Firebase Cloud Messaging, etc.) that allows a push application server (e.g. ECS) to send a push notification to the source device.

[0155] An SM-DP+ may be a platform for storing and delivering digital subscription profile (such as eSIM profile). The SM-DP+ may prepare profile packages, secure them with a profile protection key, store profile protection keys in a secure manner and the protected profile packages in a profile package repository, and allocate the protected profile packages to specified embedded universal integrated circuit card identifiers (EIDs).

[0156] A Simple Mail Transfer Protocol (SMTP) server may be responsible for sending electronic mails (Emails). The SMTP may be used by mail servers to send, receive, and relay outgoing Email between senders and receivers.

[0157] FIG.2d schematically shows example architecture for subscription transferring according to another embodiment of the present disclosure.

[0158] The functionality of each component is listed as below.

[0159] A UE (i.e., the target device 860) may comprise eUICC / LPAd (Local Profile Assistant (LPA) when LPA is in the Device). LPAd embedded in the target device 860 may communicate with SM-DP+ server to download ICCID profile and install the ICCID profile into the eUICC which enables the remote and / or local management of profiles in a secure way. LPAd is defined in the GSMA SGP.22 specification (GSMA RSP Technical Specification Version 3.0).

[0160] The UE may comprise an entitlement client. The entitlement client may be a native application embedded in OS to communicate with ECS to trigger subscription transferring for the eSIM capable primary device.

[0161] The UE may comprise a notification center. The notification center may be a native application embedded in OS to receive push notification and invoke the entitlement client to handle the interaction with the end user.

[0162] An ECS may handle the subscription transferring related request from the entitlement client on the source device. The ECS may communicate to the SM-DP+ to prepare and release the new ICCID profile for the target device. The ECS may receive the new ICCID downloading start indication from the SM-DP+ and perform the target device eligibility check. The ECS may trigger the subscription transferring related provisioning to the BSS and core network. The ECS may initiate push notification towards the push server to ask for end user's consent for transferring. ECS may send the confirmation code associated with the new ICCID profile to the end user via Email.

[0163] A push server may be a public push cloud, e.g. Apple Push Notification Server (APNs), Google Firebase Cloud Messaging (FCM) to deliver the push notification to registered devices.

[0164] An SMTP Server may be responsible for sending Emails. SMTP may be used by mail servers to send, receive, and relay outgoing Email between senders and receivers.

[0165] An SM-DP+ server may prepare profile packages, secure them with a profile protection key, store profile protection keys in a secure manner and the protected profile packages in a profile package repository, and allocate the protected profile packages to specified EIDs. The SM-DP+ may also bind protected profile packages to the respective EID and securely downloads these bound profile packages to the LPA of the respective eUICC.

[0166] An entitlement client may reside in the source device. Entitlement client may trigger transfer request towards ECS.

[0167] The ECS may interact with the SM-DP+ to allocate a new ICCID profile with a confirmation code binding with it and complete the subscription transferring provisioning. ECS will return a QR code to the source device.

[0168] An end user may use the target device to scan the QR code and trigger the eSIM profile download towards SM-DP+ server by passing device information, such as an embedded universal integrated circuit card identifier (EID), an international mobile equipment identity (EMEI), or a type allocation code (TAC).

[0169] The SM-DP+ server may ask the end user to fill the confirmation code to continue the downloading. SM-DP+ may send a notification towards ECS to indicate the target device is trying to download the ICCID profile and ECS may check the transferring eligibility based on the target device’s information.

[0170] A notification may be pushed to the source device to indicate the subscription is transferring to a specific target device and ask for the end user's consent to continue the subscription transferring. The notification may display the target device information and the phone number associated with the subscription to the end user. Once the end user confirms the transferring and enter the address (such as an Email address) to receive the confirmation code, the entitlement client on the source device may send an acknowledge request with the address towards the ECS. The ECS can confirm the end user is still own the source device, aware of the target device is trying to download the new ICCID profile and grant the permission to finish the transfer procedure.

[0171] Then the ECS may send the confirmation code to the address (e.g. Email) input by the end user. The end user fills the confirmation code on the target device and the SM-DP+ server may verify if the confirmation code is associated with the new ICCID profile, and then complete the downloading. The confirmation code is just sent to the end user in the last minutes after the end user grants the consent.

[0172] In an embodiment, a solution may be proposed to enhance the end user consent for the subscription transferring flow between two primary devices, especially the two primary devices are from different vendors.

[0173] In an embodiment, the CSP (e.g. ECS) may get the target eSIM device's information before the new ICCID information is really downloaded to the target device to perform more eligibility check.

[0174] In an embodiment, to indicate the end user the target device is going to transferring the subscription and ask for end user's consent at the source device before the transferring really happens.

[0175] In an embodiment, the security of the confirmation code is improved by sending it to the end user only when necessary for entry, rather than sending it beforehand. This practice ensures the confidentiality of the code and minimizes potential opportunities for attackers to exploit it in other ways.

[0176] FIG.3a shows a flowchart of a method 300 according 800 to an embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as a first network device 830 or communicatively coupled to the first network device 830. As such, the apparatus provides means or modules or circuits for accomplishing various parts of the method 300 as well as means or modules or circuits for accomplishing other processes in conjunction with other components.

[0177] At block 302, the first network device 830 receives a first message from a second network device 840. The first message may comprise first information regarding a target device 860 and second information indicating the target device 860 is trying to download an integrated circuit card identity (ICCID) profile.

[0178] The first network device 830 may be any suitable server or network node or network device or network function. For example, the first network device may provide entitlement configuration for different services to clients. The entitlement configuration may comprise any suitable entitlement information on a service returned to the client by the first network device. The client may be a component / module on a device that provides a service such as Voice-over-Cellular or VoWiFi service, etc. The client verifies with the network’s ECS if it is entitled or not to offer that service to end-users. Entitlement may comprise the applicability, availability, and status of a service, needed by the client before offering that service to end-users.

[0179] In an embodiment, the first network device 830 comprises an ECS as described in GSMA TS.43 Service Entitlement Configuration Version 9.0.

[0180] The second network device 840 may be any suitable server or network node or network device or network function. For example, the second network 840 device may prepare profile packages, secure them with a profile protection key, store profile protection keys in a secure mannerand the protected profile packages in a profile package repository, and allocate the protected profile packages to specified EIDs. The second network device 840 may bind protected profile packages to the respective EID and securely downloads these bound profile packages to the LPA of the respective eUICC. The second network device 840 may perform remote profile management and remote eUICC management.

[0181] In an embodiment, the second network device 840 comprises an SM-DP+ server as described in GSMA RSP Technical Specification Version 3.0.

[0182] The first message may be any suitable message such as an existing message or a new message. In an embodiment, the first message is an eligibility notification message.

[0183] The first information regarding a target device may be any suitable information which can be used by the first network device to validate if the target device is eligible for subscription transferring for the ICCID profile. For example, the first information is an identifier associated with the target device or the detailed target device information.

[0184] In an embodiment, the first information comprises at least one of an embedded universal integrated circuit card identifier (EID), an international mobile equipment identity (IMEI), or a type allocation code (TAC). The EID, IMEI and TAC may be similar to the corresponding terms as described in GSMA RSP Technical Specification Version 3.0.

[0185] The ICCID may be similar to the corresponding term as described in GSMA RSP Technical Specification Version 3.0.

[0186] The ICCID profile may be a combination of data and applications to be provisioned on an eUICC for the purpose of providing services.

[0187] The second information may be any suitable information such as a bit, a flag, an indicator, etc.At block 304, the first network device 830 validates if the target device is eligible for subscription transferring for the ICCID profile based on the first information.

[0188] The first network device 830 validates if the target device 860 is eligible for subscription transferring for the ICCID profile based on the first information in various ways.

[0189] For example, the first network device 830 validates if the target device is eligible for subscription transferring for the ICCID profile based on the first information by itself. The first network device 830 may send a request comprising the first information to a network node which will validate if the target device is eligible for subscription transferring for the ICCID profile based on the first information and send the validation result to the first network device 830.

[0190] In an embodiment, the first network device 830 validates if the target device is eligible for the subscription's transferring for the selected phone number in the CSP's backend nodes. The CSP'sbackend nodes may be any suitable node such as BSS or core network node (such as UDM or HSS), etc.

[0191] At block 312, when the target device 860 is eligible for the subscription transferring, the first network device 830 sends a second message to a source device.

[0192] In an embodiment, the subscription transferring may be triggered by a user via the source device 850.

[0193] The entitlement client on the source device 850 may query the push token from the push server. The end user may trigger subscription transferring from the source device 850 and pick up a phone number to be transferred. The entitlement client on the source device 850 may send a transfer request and register the push token to ECS. The ECS may generate a confirmation code for the new ICCID profile. The ECS may send an ICCID profile allocation request towards SM-DP+ server by passing the confirmation code. The SM-DP+ server may prepare a new ICCID profile and associate it with the confirmation code. The SM-DP+ server may return the allocated new ICCID information to ECS. The ECS may trigger the BSS and core network node provisioning for the subscription transferring. The ECS may generate a QR code containing the new ICCID profile's download information. The ECS may return the QR code to the source device 850. The end user may scan the QR code from the target device's LPAd. The LPAd at the target device 860 may start to download the new ICCID profile from SM-DP+. The SM-DP+ server may indicate the LPAd of the target device 860 that the confirmation code is needed to continue the transferring. The LPAd of the target device 860 may pop-up a window to ask the end user to fill the confirmation code.

[0194] In an embodiment, the second message is for requesting consent for subscription transferring from the user.

[0195] In an embodiment, the second message is for requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0196] In an embodiment, the second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0197] The address for receiving the first confirmation code associated with the ICCID profile may be any suitable address such as an Email address or a phone number or a push notification address. In an embodiment, the address for receiving the first confirmation code associated with the ICCID profile comprises an Email address.

[0198] The second message may be any suitable message such as an existing message or a new message. In an embodiment, the second message is a push notification message.

[0199] The second message may be sent to the source device in various ways such as directly or via another network device. In an embodiment, the second message is sent to the source device via a push server or a Short Message Service (SMS) or an Application Programming Interface (API).

[0200] In an embodiment, the second message comprises the first information and / or subscription information associated with the ICCID profile. The subscription information associated with the ICCID profile may be any suitable information which can be used by the user to validate the subscription transferring. For example, the subscription information associated with the ICCID profile is a specific phone number.

[0201] The first information and / or the subscription information associated with the ICCID profile may be used by the user to validate the subscription transferring. For example, the first information is used by the user to determine whether he / she is the owner of the target device is user. If the use is the owner of the target device, the user may provide the consent for the subscription transferring. Otherwise the user may reject the subscription transferring. As another example, if the subscription information associated with the ICCID profile is correct (e.g. the phone number is correct), the user may provide the consent for the subscription transferring. Otherwise the user may reject the subscription transferring.

[0202] FIG.3b shows a flowchart of a method 320 according to an optional embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as the first network device 830 or communicatively coupled to the first network device 830. As such, the apparatus 800 may provide means or modules or circuits for accomplishing various parts of the method 320 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. The embodiment presented herein is compatible with the embodiment presented in relation to the description of FIG. 3 a.

[0203] In the embodiment, at block 322, the first network device 830 receives a third message from the source device 850. The third message comprises consent for subscription transferring of the user and / or the address for receiving a first confirmation code associated with the ICCID profile.

[0204] In an embodiment, the third message comprises rejection for subscription transferring of the user. In this case, the current subscription transferring ends.

[0205] The third message may be any suitable message such as an existing message or a new message.

[0206] In an embodiment, at block 324, the first network device 830 sends a fourth message comprising the first confirmation code associated with the ICCID profile to the user.

[0207] The fourth message may be any suitable message such as an existing message or a new message.

[0208] The fourth message may be sent to the user in various ways. In an embodiment, the fourth message is sent to the user via a push server or an SMS or an API.

[0209] In an embodiment, the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

[0210] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises an Email address, the fourth message is sent to the user via an SMTP server.

[0211] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises a phone number, the fourth message is sent to the user via a Short Message Service (SMS).

[0212] In an embodiment, when the address for receiving the first confirmation code associated with the ICCID profile comprises a push notification address, the fourth message is sent to the user via the push notification address.

[0213] FIG.3c shows a flowchart of a method 330 according to an optional embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as the first network device or communicatively coupled to the first network device. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 330 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a and 3b.

[0214] In the embodiment, at block 332, when the target device 860 is not eligible for the subscription transferring, the first network device 830 sends a fifth message to a source device 850.

[0215] In an embodiment, the fifth message is for notifying a user that the target device 860 is not eligible for the subscription transferring. For example, after knowing that the target device 860 is not eligible for the subscription transferring, the user may end the current subscription transferring. The user may trigger a new subscription transferring procedure.

[0216] The fifth message may be any suitable message such as an existing message or a new message.

[0217] The fifth message may be sent to the source device 850 in various ways such as directly or via a network device. In an embodiment, the fifth message may be sent to the source device via a push server or an SMS or an API.

[0218] FIG.3d shows a flowchart of a method 340 according to an optional embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as the first network device or communicatively coupled to the first network device. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 340 as well asmeans or modules or circuits for accomplishing other processes in conjunction with other components. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a, 3b and 3c.

[0219] In the embodiment, at block 342, the first network device 830 sends a sixth message to the second network device 840.

[0220] In an embodiment, the sixth message comprises a validation result for the target device 860.

[0221] The sixth message may be any suitable message such as an existing message or a new message.

[0222] For example, after receiving the sixth message, the second network device determines whether the current subscription transferring can be continued or not. For example, if the target device passes the validation, the current subscription transferring can be continued. Otherwise the current subscription transferring can be stopped or ended.

[0223] FIG.4a shows a flowchart of a method 400 according to an embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as a second network device 840 or communicatively coupled to the second network device 840. As such, the apparatus 800 may provide means or modules or circuits for accomplishing various parts of the method 400 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a, 3b, 3c and 3d.

[0224] At block 402, the second network device 840 receives a request from a target device 860. The request is for downloading an ICCID profile and the request comprises first information regarding the target device 860.

[0225] In an embodiment, the second network device 840 may comprise an SM-DP+ server.

[0226] In an embodiment, the first information may comprise at least one of an EID, an IMEI, or a TAC.

[0227] For example, as described above, ECS may return the QR code to the source device 850. An end user may scan QR code from the target device's LPAd. The LPAd at the target device 860 may send a request to SM-DP+ server to start to download the new ICCID profile from SM-DP+ server.

[0228] At block 404, optionally, the second network device 840 sends a seventh message to the target device 860. In an embodiment, the seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0229] At block 406, the second network device 840 sends a first message comprising the first information and second information to the first network device 830. The second information indicates the target device is trying to download the ICCID profile.

[0230] In an embodiment, the first network device comprises an ECS.

[0231] FIG.4b shows a flowchart of a method 410 according to an optional embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as a second network device or communicatively coupled to the second network device. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 410 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIG. 4a.

[0232] At block 412, the second network device 840 receives an eighth message comprising a second confirmation code from the target device 860.

[0233] For example, as described above, at block 324 of FIG.3b, the first network device 830 sends a fourth message comprising the first confirmation code associated with the ICCID profile to the source device 850. The user may fill the first confirmation code into the LPAd of the target device 860 to continue the new ICCID profile downloading. Then the second network device 840 receives the eighth message comprising the second confirmation code.

[0234] The second confirmation code may be same or different as / from the first confirmation code. For example, the user may wrongly input the first confirmation code.

[0235] In an embodiment, at block 414, the second network device 840 validates the second confirmation code. For example, the second network device validates whether the second confirmation code is same as the first confirmation code. At block 416, when the second confirmation code passes validation (i.e. the second confirmation code is same as the first confirmation code), the second network device 840 may send the ICCID profile to the target device 860.

[0236] When the second confirmation code does not pass validation (i.e. the second confirmation code is different from the first confirmation code), the second network device 840 may reject sending the ICCID profile to the target device 860.

[0237] FIG.4c shows a flowchart of a method 420 according to an optional embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as a second network device 840 or communicatively coupled to the second network device 840. As such, the apparatus 800 may provide means or modules or circuits for accomplishing various parts of the method 420 as well as means or modules or circuits for accomplishing other processes inconjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 4a and 4b.

[0238] At block 422, the second network device receives a sixth message from the first network device 830. In an embodiment, the sixth message comprises a validation result for the target device 860.

[0239] At block 424, the second network device 840 receives a tenth message comprising a third confirmation code from the target device.

[0240] At block 426, the second network device 840 validates the third confirmation code.

[0241] At block 428, when the third confirmation code passes validation and the validation result for the target device 860 indicates that the target device 860 is eligible for subscription transferring for the ICCID profile, the second network device 840 may send the ICCID profile to the target device 860.

[0242] FIG.5a shows a flowchart of a method 500 according to another embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as a source device 850 or communicatively coupled to the source device 850. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 500 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a, 3b, 3c, 3d, 4a, 4b and 4c.

[0243] At block 502, the source device sends a transfer request for an integrated circuit card identity (ICCID) profile to a first network device.

[0244] For example, the subscription transferring may be triggered by a user via the source device. The entitlement client on the source device 850 may query the push token from the push server. End user may trigger subscription transferring from the source device 850 and pick up the phone number to be transferred. The entitlement client on the source device 850 may send a transfer request and register the push token to the first network device 830 such as an ECS.

[0245] In an embodiment, the first network device 830 comprises an ECS.

[0246] At block 504, when a target device is eligible for subscription transferring for the ICCID profile, the source device 850 receives a second message from the first network device 830.

[0247] In an embodiment, the second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0248] In an embodiment, the second message is received from the first network device 850 via a push server or an SMS or an API.

[0249] In an embodiment, the second message comprises first information regarding the target device and / or subscription information associated with the ICCID profile.

[0250] In an embodiment, the first information comprises at least one of an EID, an IMEI, or a TAC.

[0251] FIG.5b shows a flowchart of a method 510 according to another embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as a source device 850 or communicatively coupled to the source device 850. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 510 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIG. 5a.

[0252] In an embodiment, at block 512, when the target device 860 is eligible for subscription transferring for the ICCID profile, the source device sends a third message to the first network device 850. The third message comprises consent for subscription transferring of the user.

[0253] For example, the user may check whether the target device 860 is eligible for subscription transferring for the ICCID profile based on the second message. If the target device is eligible for subscription transferring for the ICCID profile, the user may provide the consent for subscription transferring of the user on the source device 850. Then the source device 850 may send the third message to the first network device 830. Otherwise, the current subscription transferring may end. The subscription transferring may be re-triggered by the user via the source device 850.

[0254] In an embodiment, the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

[0255] In an embodiment, the address for receiving the first confirmation code associated with the ICCID profile comprises an Email address or a phone number or a push notification address.

[0256] FIG.5c shows a flowchart of a method 520 according to another embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as a source device or communicatively coupled to the source device. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 520 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 5a and 5b.

[0257] In an embodiment, at block 522, when the target device 860 is not eligible for the subscription transferring, the source device 850 receives a fifth message from the first network device 830. The fifth message is for notifying the user that the target device 860 is not eligible for the subscription transferring. After receiving the fifth message, the target device 860 notifies the user that the target device 860 is not eligible for the subscription transferring.

[0258] FIG.6a shows a flowchart of a method 600 according to another embodiment of the present disclosure, which may be performed by an apparatus 800 implemented in or at or as a target device 860 or communicatively coupled to the target device 860. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 600 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a, 3b, 3c, 3d, 4a, 4b, 4c, 5a, 5b and 5c.

[0259] At block 602, the target device 860 sends a request to a second network device 840. The request is for downloading an ICCID profile and the request comprises first information regarding the target device 860.

[0260] The first information is for validating if the target device is eligible for subscription transferring for the ICCID profile. The subscription transferring is triggered by a user via a source device 850.

[0261] In an embodiment, the first information comprises at least one of an EID, an IMEI, or a TAC.

[0262] In an embodiment, the second network device comprises an SM-DP+ server.

[0263] FIG.6b shows a flowchart of a method 610 according to another embodiment of the present disclosure, which may be performed by an apparatus implemented in or at or as a target device or communicatively coupled to the target device. As such, the apparatus may provide means or modules or circuits for accomplishing various parts of the method 610 as well as means or modules or circuits for accomplishing other processes in conjunction with other components. For some parts which have been described in the above embodiments, the description thereof is omitted here for brevity. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIG. 6a.

[0264] In an embodiment, at block 612, the target device 860 may receive a seventh message from the second network device 840. The seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0265] At block 614, the target device 860 receives a confirmation code input by a user.

[0266] At block 616, the target device 860 sends a message comprising a confirmation code to the second network device 840.

[0267] The confirmation code may be the second confirmation code or the third confirmation code. As described above, when the second confirmation code passes validation, the second network device 840 may send the ICCID profile to the target device 860. In an embodiment, when the third confirmation code passes validation and the validation result for the target device 860 indicates that the target device 860 is eligible for subscription transferring for the ICCID profile, the second network device 840 may send the ICCID profile to the target device 860.

[0268] FIG.7a shows a flowchart of a method according to an embodiment of the present disclosure. The embodiment presented herein is compatible with the embodiments presented in relation to the description of FIGS. 3a, 3b, 3c, 3d, 4a, 4b, 4c, 5a, 5b, 5c, 6a and 6b.

[0269] At step 1. A source device 850 fetches a push token from the push server.

[0270] At step 2. An end user starts to perform subscription transferring on the source device 850, i.e., the end user triggers a subscription transferring on the source device 850.

[0271] At step 3. The source device 850 triggers a transfer request without target device information. The source device 850 also registers its push token to an ECS.

[0272] At step 4. The ECS applies (i.e., allocates) a new ICCID profile from the SM-DP+ server.

[0273] At step 5. The ECS provisions the CSP's backend system (such as a BSS / a core network node) for the subscription transferring. For example, ECS may trigger the subscription transferring related provisioning to the BSS and the core network.

[0274] At step 6. The ECS returns a new ICCID profile download information to the source device 850 (e.g. activation code in QR code format).

[0275] At step 7. The target device 860 scans the download information (e.g. the QR code) to trigger the new ICCID profile downloading.

[0276] At step 8. The target device 860 requests ICCID profile towards SM-DP+ server by passing target device information.

[0277] At step 9. The SM-DP+ server notifies the ECS that the target device 860 is intending / trying to download the new ICCID profile with the target device information (e.g. EID, IMEI, TAC, etc ).

[0278] At step 10. The ECS checks / validates the eligibility of the target device 860 based on target device information e.g. by itself or with the help of the CSP's backend nodes. Optionally, the ECS sends the checking result to at least one of the SM-DP+ server, the user, the source device 850 or the target device 860.

[0279] At step 11. Optionally, the SM-DP+ server requests the end user to enter the confirmation code at the target device 860 to proceed with the downloading of the new ICCID profile.

[0280] At step 12. The ECS sends a message to request consent from the end user. The message comprises the detailed target device information and subscription information. For example, ECS may send a push notification to the source device 850 to ask for the end user consent for the subscription of a phone number transferring to the target device 860 (with target device information) via a push server.

[0281] At step 13. An end user clicks a pop-up window to grant / allow permission to allow the target device 860 to transfer the subscription of a phone number from the source device 850. An address (such as an Email address, a phone number, a push notification address, etc.) to receive the confirmation code may be entered by the end user. Alternatively the address may be obtained in any other suitable ways. For example, the end user may register the address (such as end user registered email) in the ECS.

[0282] At step 14. The source device 850 sends a message towards the ECS, which comprises acknowledgement and / or the address to receive the confirmation code.

[0283] At step 15. The ECS sends the confirmation code to the address (such as end user registered email address). Then the end user obtains the confirmation code.

[0284] At step 16. The end user fills the confirmation code on the target device 860.

[0285] At step 17. The SM-DP+ server validates the confirmation code. If the confirmation code passes validation, the SM-DP+ server completes the ICCID profile download to the target device 860. Alternatively, if the confirmation code passed validation and the target device is eligible for subscription transferring for the ICCID profile, the SM-DP+ server completes the ICCID profile download to the target device 860.

[0286] FIG.7b shows a flowchart of a method according to an embodiment of the present disclosure. The embodiment presented herein is compatible with the embodiment presented in relation to the description of FIG. 7a.

[0287] At step 1. The entitlement client on the source device 850 queries a push token from the push server.

[0288] At step 2. The end user triggers subscription transferring from the source device 850 and picks up / retrieves the phone number to be transferred.

[0289] At step 3. The entitlement client on the source device 860 sends a transfer request for the subscription and registers the push token to the ECS.

[0290] At step 4. The ECS generates a confirmation code for a new ICCID profile.

[0291] At step 5. The ECS sends an ICCID profile allocation request towards the SM-DP+ server by passing the confirmation code.

[0292] At step 6. The SM-DP+ server prepares the new ICCID profile and associates the new ICCID profile with the confirmation code.

[0293] At step 7. The SM-DP+ server optionally returns the allocated new ICCID information to ECS.

[0294] At step 8. The ECS triggers the BSS and core network node provisioning for the subscription transferring. For example, the ECS may trigger the subscription transferring related provisioning to the BSS and core network.

[0295] At step 9. The ECS generates a QR code containing the new ICCID profile's download information.

[0296] At step 10. The ECS optionally returns the QR code to the source device 850.

[0297] At step 11. The end user scans the QR code from the target device's LPAd.

[0298] At step 12. The LPAd at the target device 860 starts to download the new ICCID profile from SM-DP+ server.

[0299] At step 13. The SM-DP+ server optionally indicates to the LPAd of the target device 860 that the confirmation code is needed to continue the transferring.

[0300] At step 14. The LPAd of the target device 860 optionally initiates a pop-up window to ask the end user to fill the confirmation code.

[0301] At step 15. The SM-DP+ server notifies ECS that the target device 860 is trying to download the new ICCID profile by providing the detailed target device information (e.g. EID, IMEI, TAC, etc ).

[0302] At step 16. The ECS validates if the target device is eligible for the subscription transferring for the selected phone number e.g. by itself or with the help of the CSP's backend nodes. Optionally, the ECS may send the validation result to at least one of SM-DP+ server, the user, the source device 850 or the target device 860.

[0303] At step 17. Once validation is passed, the ECS sends a message to request consent from the end user. The message comprises the detailed target device information and subscription information. For example, the ECS sends a push notification towards the push server with the detailed target device information and subscription information to request consent from the end user.

[0304] At step 18. The push server delivers the push notification to the notification center in the source device 850.

[0305] At step 19. The notification center at the source device 850 wakes up the entitlement client to display the ongoing transferring details to the end user, especially the target device information.

[0306] At step 20. The entitlement client asks for the end user consent for the subscription transferring and / or the address (such as Email address, phone number, push notification address, etc.) to receive the confirmation code.

[0307] At step 21. The End user optionally grants consent for the subscription transferring. The end user may input the address (such as email address, phone number, push notification address, etc.) to receiving the confirmation code at the entitlement client of the source device 850.

[0308] At step 22. The entitlement client on the source device 850 sends a message towards the ECS, which may comprise user consent and / or the address to receive the confirmation code.

[0309] At step 23. The ECS sends the confirmation code to the address (such as email address, phone number, push notification address, etc.). For example, the ECS sends an Email to the SMTP server which contains the confirmation code associated with the new ICCID profile.

[0310] At step 24. The SMTP server optionally delivers an Email to the end user.

[0311] At step 25. The end user fills in confirmation code into the LPAd of the target device 860 to continue the new ICCID profile downloading.

[0312] At step 26. The target device 860 downloads the new ICCID profile from SM-DP+ server successfully.

[0313] It is noted that some messages or entities of FIGs.7a and 7b may be similar to the corresponding messages or entities as described in GSMA TS.43 Service Entitlement Configuration Version 9.0 and GSMA RSP Technical Specification Version 3.0. Some messages of FIGs.7a and 7b may be enhanced according to various embodiments of the present disclosure.

[0314] In an embodiment, to support the cross primary eSIM devices subscription transferring flow, GSMA TS.43 Service Entitlement Configuration Version 9.0 and GSMA RSP Technical Specification Version 3.0 need to be enhanced.

[0315] In an embodiment, to support the step 15 in FIG.7b, the section "5.3.5 Function: HandleNotification" of GSMA RSP Technical Specification Version 3.0 is enhanced. For example, a new parameters "deviceinfo" may be added into the request. The newly added "deviceinfo" attribute may follow the definition in the Annex H.

[0316] Deviceinfo ::= SEQUENCE {

[0317] tac Octet4,

[0318] deviceCapabilities DeviceCapabilities,

[0319] imei Octet8 OPTIONAL,

[0320] preferredLanguages SEQUENCE OF UTF8String OPTIONAL,

[0321] deviceTestMode NULL OPTIONAL,

[0322] IpaRspCapability LpaRspCapability OPTIONAL

[0323] }

[0324] In an embodiment, to support the steps 17 and 18 of FIG.7b, the section "2.6.2 Messaging Infrastructure-Based Notifications" of GSMA TS.43 Service Entitlement Configuration Version 9.0are enhanced by adding the transferring details into, an example as below, the underlined part is newly added.

[0325] {

[0326] "data": {

[0327] "app": "ap2009",

[0328] "timestamp": "2023-07-29T13: 15:31-08:00",

[0329] "subscriptionTransferringDetails" : {

[0330] "targetDevicelnfo" : {

[0331] "imei": "352971112352162",

[0332] "tac": "35297111",

[0333] "eid": "89049032006008883000150534302575"

[0334] t

[0335] "phoneNumber" : "14256508189"

[0336] }

[0337] }

[0338] }

[0339] In an embodiment, to support the step 22 of FIG.7b, in the section "6.2 ODSA Request Parameters" of GSMA TS.43 Service Entitlement Configuration Version 9.0, a new operation named "UpdateUserConsent" is introduced with two parameters:

[0340] UpdateUserConsent ::= SEQUENCE {

[0341] acked Boolean,

[0342] email UTF8String

[0343] }

[0344] In an embodiment, the whole use cases of FIG.7a and / or FIG.7b are introduced to the "section 8" of GSMA TS.43 Service Entitlement Configuration Version 9.0 as a new call flow supported.

[0345] In an embodiment, the proposed solution can enhance the GSMA SGP.22 specification(GSMA RSP Technical Specification Version 3.0) to make the target device 860 information sent to the ECS which allows the CSP 200 to perform essential eligibility check before the new ICCID is downloaded to the target device 860.

[0346] In an embodiment, the proposed solution can enhance the GSMA TS.43 Service Entitlement Configuration Version 9.0 to ask end user's consent on the source device 850 to acknowledge the transferring when a new device is trying to download the ICCID profile that binds with transferred subscription.

[0347] In an embodiment, the proposed solution can enhance the delivery mechanism of the "confirmation code" by sending it only when the target device 860 is actively attempting to download the ICCID profile and has obtained explicit consent from the end user. Reducing the time window between sending and using the confirmation code will effectively mitigate security risks and minimize the possibility of an attacker intercepting it.

[0348] Embodiments herein may provide many advantages, of which a non-exhaustive list of examples follows. In some embodiments herein, the proposed solution can enhance the subscription transferring flow to allow the CSP 200 to check if it is the desired target device 860 to take over the subscription to be transferred, without device to device communication. In some embodiments herein, the proposed solution can involve the end user to re-confirm it is the desired target device 860 transferring the subscription before the downloading of the new ICCID profile. In some embodiments herein, the proposed solution can ensure the confirmation code is delivered only when it is really needed, which can enhance the security. In some embodiments herein, the proposed solution can mitigate security risks and minimize the possibility of an attacker intercepting the confirmation code. The embodiments herein are not limited to the features and advantages mentioned above. A person skilled in the art will recognize additional features and advantages upon reading the following detailed description.

[0349] FIG.8a is a block diagram showing an apparatus suitable for practicing some embodiments of the disclosure. For example, any one of the first network device 830, the second network device 840, the source device 850 or the target device 860 described above may be implemented as or through the apparatus 800.

[0350] The apparatus 800 comprises at least one processor 821, such as a digital processor (DP), and at least one memory (MEM) 822 coupled to the processor 821. The apparatus 800 may comprise a transmitter (TX) and receiver (RX) 823 coupled to the processor 821. The MEM 822 stores a program (PROG) 824. The PROG 824 may include instructions that, when executed on the associated processor 821, enable the apparatus 800 to operate in accordance with the embodiments of the present disclosure. A combination of the at least one processor 821 and the at least one MEM 822 may form processing means 825 adapted to implement various embodiments of the present disclosure.

[0351] Various embodiments of the present disclosure may be implemented by computer program executable by one or more of the processor 821, software, firmware, hardware or in a combination thereof.

[0352] The MEM 822 may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor based memorydevices, magnetic memory devices and systems, optical memory devices and systems, fixed memories and removable memories, as non-limiting examples.

[0353] The processor 821 may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs) and processors based on multicore processor architecture, as nonlimiting examples.

[0354] In an embodiment where the apparatus 800 is implemented as or at the first network device 830, the memory 822 contains instructions executable by the processor 821, whereby the first network device 830 operates according to any of the methods performed by the first network device 830 as described above.

[0355] In an embodiment where the apparatus 800 is implemented as or at the second network device 840, the memory 822 contains instructions executable by the processor 821, whereby the second network device 840 operates according to any of the methods performed by the second network device 840 as described above.

[0356] In an embodiment where the apparatus 800 is implemented as or at the source device 850, the memory 822 contains instructions executable by the processor 821, whereby the source device 850 operates according to any of the methods performed by the source device 850 as described above.

[0357] In an embodiment where the apparatus 800 is implemented as or at the target device 860, the memory 822 contains instructions executable by the processor 821, whereby the target device 860 operates according to any of the methods performed by the target device 860 as described above.

[0358] FIG.8b is a block diagram showing a first network device 830 according to an embodiment of the disclosure. As shown, the first network device 830 comprises a first receiving module 831 configured to receive a first message from a second network device 840. The first message comprises first information regarding a target device 860 and second information indicating that the target device 860 is trying to download an ICCID profile. The first network device 830 comprises a validating module 832 configured to validate if the target device is eligible for subscription transferring for the ICCID profile based on the first information.

[0359] The first network device 830 comprises a first sending module 833 configured to, when the target device 860 is eligible for the subscription transferring, send a second message to a source device 850. The subscription transferring may be triggered by a user via the source device 850. The second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0360] The first network device 830 optionally comprises a second receiving module 834 configured to receive a third message from the source device. The third message may comprise consent for subscription transferring of the user.

[0361] The first network device 830 optionally comprises a second sending module 835 configured to send a fourth message comprising the first confirmation code associated with the ICCID profile to the user.

[0362] The first network device 830 optionally comprises a third sending module 836 configured to, when the target device 860 is not eligible for the subscription transferring, send a fifth message to a source device 850. The fifth message may be for notifying a user that the target device 860 is not eligible for the subscription transferring.

[0363] The first network device 830 optionally comprises a fourth sending module 837 configured to send a sixth message to the second network device. The sixth message may comprise a validation result for the target device.

[0364] FIG.8c is a block diagram showing a second network device 840 according to an embodiment of the disclosure. As shown, the second network device 840 comprises a first receiving module 841 configured to receive a request from a target device 860. The request is for downloading an ICCID profile and the request comprises first information regarding the target device 860. The second network device 840 comprises a first sending module 842 configured to send a first message comprising the first information and second information to a first network device 830. The second information indicates the target device is trying to download the ICCID profile.

[0365] The second network device 840 optionally comprises a second sending module 843 configured to send a seventh message to the target device 860. The seventh message may comprise information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0366] The second network device 840 optionally comprises a second receiving module 844 configured to receive an eighth message comprising a second confirmation code from the target device.

[0367] The second network device 840 optionally comprises a first validating sending module 845 configured to validate the second confirmation code.

[0368] The second network device 840 optionally comprises a third sending module 846 configured to, when the second confirmation code passes validation, send the ICCID profile to the target device.

[0369] The second network device 840 optionally comprises a third receiving module 847 configured to receive a sixth message from the first network device 830. The sixth message comprises a validation result for the target device 860.

[0370] The second network device 840 optionally comprises a fourth receiving module 848 configured to receive a ninth message comprising a third confirmation code from the target device 860.

[0371] The second network device 840 optioanlly comprises a second validating module 849-1 configured to validate the third confirmation code.

[0372] The second network device 840 optionally comprises a fourth sending module 849-2 configured to, when the third confirmation code passes validation and the validation result for the target device indicates the target device is eligible for subscription transferring for the ICCID profile, send the ICCID profile to the target device.

[0373] FIG.8d is a block diagram showing a source device 850 according to an embodiment of the disclosure. As shown, the source device 850 comprises a first sending module 851 configured to send a transfer request for an ICCID profile to a first network device 830. The source device 850 comprises a first receiving module 852 configured to, when a target device is eligible for subscription transferring for the ICCID profile, receive a second message from the first network device 830. The second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

[0374] The source device 850 optionally comprises a second sending module 843 configured to, when the target device is eligible for subscription transferring for the ICCID profile, send a third message to the first network device. The third message may comprise consent for subscription transferring of the user.

[0375] The source device 850 optionally comprises a second receiving module 844 configured to, when the target device 860 is not eligible for the subscription transferring, receive a fifth message from the first network device 830. The fifth message may be for notifying the user that the target device 860 is not eligible for the subscription transferring.

[0376] FIG.8e is a block diagram showing a target device 860 according to an embodiment of the disclosure. As shown, the target device 860 comprises a first sending module 861 configured to send a request to a second network device. The request is for downloading an ICCID profile and the request comprises first information regarding the target device 860. The first information is for validating if the target device is eligible for subscription transferring for the ICCID profile. The subscription transferring is triggered by a user via a source device 850.

[0377] The target device 860 optionally comprises a first receiving module 862 configured to receive a seventh message from the second network device 840. The seventh message may comprise information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

[0378] The target device 860 optionally comprises a second receiving module 863 configured to receive a confirmation code input by a user.

[0379] The target device 860 optionally comprises a second sending module 864 configured to send a message comprising the confirmation code to the second network device 840.

[0380] The term unit or module may have conventional meaning in the field of electronics, electrical devices and / or electronic devices and may include, for example, electrical and / or electronic circuitry, devices, modules, processors, memories, logic solid state and / or discrete devices, computer programs or instructions for carrying out respective tasks, procedures, computations, outputs, and / or displaying functions, and so on, as such as those that are described herein.

[0381] With function units, the first network device 830, the second network device 840, the source device 850 or the target device 860 may not need a fixed processor or memory, any computing resource and storage resource may be arranged from the first network device 830, the second network device 840, the source device 850 or the target device 860 in the communication system. The introduction of virtualization technology and network computing technology may improve the usage efficiency of the network resources and the flexibility of the network.

[0382] Further, the exemplary overall commutation system including the terminal device (such as the source device or the target device) and the network node (such as the first network device or the second network device) will be introduced as below.

[0383] FIG.9 shows an example of a communication system 9100 in accordance with some embodiments.

[0384] In the example, the communication system 9100 includes a telecommunication network 9102 that includes an access network 9104, such as a radio access network (RAN), and a core network 9106, which includes one or more core network nodes 9108. The access network 9104 includes one or more access network nodes, such as network nodes 9110a and 9110b (one or more of which may be generally referred to as network nodes 9110), or any other similar 3rd Generation Partnership Project (3 GPP) access nodes or non-3GPP access points. Moreover, as will be appreciated by those of skill in the art, a network node is not necessarily limited to an implementation in which a radio portion and a baseband portion are supplied and integrated by a single vendor. Thus, it will be understood that network nodes include disaggregated implementations or portions thereof. For example, in some embodiments, the telecommunication network 9102 includes one or more Open-RAN (ORAN) network nodes. An ORAN network node is a node in the telecommunication network 9102 that supports an ORAN specification (e.g., a specification published by the O-RAN Alliance, or any similar organization) and may operate alone or together with other nodes to implement one or more functionalities of any node in thetelecommunication network 9102, including one or more network nodes 9110 and / or core network nodes 9108.

[0385] Examples of an ORAN network node include an open radio unit (O-RU), an open distributed unit (O-DU), an open central unit (O-CU), including an O-CU control plane (O-CU-CP) or an O-CU user plane (O-CU-UP), a RAN intelligent controller (near-real time or non-real time) hosting software or software plug-ins, such as a near-real time control application or a non-real time control application, or any combination thereof (the adjective “open” designating support of an ORAN specification). The network node may support a specification by, for example, supporting an interface defined by the ORAN specification, such as an Al, Fl, Wl, El, E2, X2, Xn interface, an open fronthaul user plane interface, or an open fronthaul management plane interface. Moreover, an ORAN access node may be a logical node in a physical node. Furthermore, an ORAN network node may be implemented in a virtualization environment (described further below) in which one or more network functions are virtualized. For example, the virtualization environment may include an O-Cloud computing platform orchestrated by a Service Management and Orchestration Framework via an O-2 interface defined by the 0-RAN Alliance or comparable technologies. The network nodes 9110 facilitate direct or indirect connection of user equipment (UE), such as by connecting UEs 9112a, 9112b, 9112c, and 9112d (one or more of which may be generally referred to as UEs 9112) to the core network 9106 over one or more wireless connections.

[0386] Example wireless communications over a wireless connection include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information without the use of wires, cables, or other material conductors. Moreover, in different embodiments, the communication system 9100 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals whether via wired or wireless connections. The communication system 9100 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar type of system.

[0387] The UEs 9112 may be any of a wide variety of communication devices, including wireless devices arranged, configured, and / or operable to communicate wirelessly with the network nodes 9110 and other communication devices. Similarly, the network nodes 9110 are arranged, capable, configured, and / or operable to communicate directly or indirectly with the UEs 9112 and / or with other network nodes or equipment in the telecommunication network 9102 to enable and / or provide network access, such as wireless network access, and / or to perform other functions, such as administration in the telecommunication network 9102.

[0388] In the depicted example, the core network 9106 connects the network nodes 9110 to one or more hosts, such as host 9116. These connections may be direct or indirect via one or more intermediary networks or devices. In other examples, network nodes may be directly coupled to hosts. The core network 9106 includes one more core network nodes (e.g., core network node 9108) that are structured with hardware and software components. Features of these components may be substantially similar to those described with respect to the UEs, network nodes, and / or hosts, such that the descriptions thereof are generally applicable to the corresponding components of the core network node 9108. Example core network nodes include functions of one or more of a Mobile Switching Center (MSC), Mobility Management Entity (MME), Home Subscriber Server (HSS), Access and Mobility Management Function (AMF), Session Management Function (SMF), Authentication Server Function (AUSF), Subscription Identifier De-concealing function (SIDF), Unified Data Management (UDM), Security Edge Protection Proxy (SEPP), Network Exposure Function (NEF), and / or a User Plane Function (UPF).

[0389] The host 9116 may be under the ownership or control of a service provider other than an operator or provider of the access network 9104 and / or the telecommunication network 9102, and may be operated by the service provider or on behalf of the service provider. The host 9116 may host a variety of applications to provide one or more service. Examples of such applications include live and pre-recorded audio / video content, data collection services such as retrieving and compiling data on various ambient conditions detected by a plurality of UEs, analytics functionality, social media, functions for controlling or otherwise interacting with remote devices, functions for an alarm and surveillance center, or any other such function performed by a server.

[0390] As a whole, the communication system 9100 of FIG.9 enables connectivity between the UEs, network nodes, and hosts. In that sense, the communication system may be configured to operate according to predefined rules or procedures, such as specific standards that include, but are not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standard (e.g., 6G); wireless local area network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards (WiFi); and / or any other appropriate wireless communication standard, such as the Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC) ZigBee, LiFi, and / or any low-power wide-area network (LPWAN) standards such as LoRa and Sigfox.

[0391] In some examples, the telecommunication network 9102 is a cellular network that implements 3 GPP standardized features. Accordingly, the telecommunications network 9102 may support network slicing to provide different logical networks to different devices that are connectedto the telecommunication network 9102. For example, the telecommunications network 9102 may provide Ultra Reliable Low Latency Communication (URLLC) services to some UEs, while providing Enhanced Mobile Broadband (eMBB) services to other UEs, and / or Massive Machine Type Communication (mMTC) / Massive loT services to yet further UEs.

[0392] In some examples, the UEs 9112 are configured to transmit and / or receive information without direct human interaction. For instance, a UE may be designed to transmit information to the access network 9104 on a predetermined schedule, when triggered by an internal or external event, or in response to requests from the access network 9104. Additionally, a UE may be configured for operating in single- or multi -RAT or multi-standard mode. For example, a UE may operate with any one or combination of Wi-Fi, NR (New Radio) and LTE, i.e. being configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Radio - Dual Connectivity (EN-DC).

[0393] In the example, the hub 9114 communicates with the access network 9104 to facilitate indirect communication between one or more UEs (e.g., UE 9112c and / or 9112d) and network nodes (e.g., network node 9110b). In some examples, the hub 9114 may be a controller, router, content source and analytics, or any of the other communication devices described herein regarding UEs. For example, the hub 9114 may be a broadband router enabling access to the core network 9106 for the UEs. As another example, the hub 9114 may be a controller that sends commands or instructions to one or more actuators in the UEs. Commands or instructions may be received from the UEs, network nodes 9110, or by executable code, script, process, or other instructions in the hub 9114. As another example, the hub 9114 may be a data collector that acts as temporary storage for UE data and, in some embodiments, may perform analysis or other processing of the data. As another example, the hub 9114 may be a content source. For example, for a UE that is a VR headset, display, loudspeaker or other media delivery device, the hub 9114 may retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, which the hub 9114 then provides to the UE either directly, after performing local processing, and / or after adding additional local content. In still another example, the hub 9114 acts as a proxy server or orchestrator for the UEs, in particular if one or more of the UEs are low energy loT devices.

[0394] The hub 9114 may have a constant / persistent or intermittent connection to the network node 9110b. The hub 9114 may also allow for a different communication scheme and / or schedule between the hub 9114 and UEs (e.g., UE 9112c and / or 9112d), and between the hub 9114 and the core network 9106. In other examples, the hub 9114 is connected to the core network 9106 and / or one or more UEs via a wired connection. Moreover, the hub 9114 may be configured to connect to an M2M service provider over the access network 9104 and / or to another UE over a direct connection. In some scenarios, UEs may establish a wireless connection with the network nodes9110 while still connected via the hub 9114 via a wired or wireless connection. In some embodiments, the hub 9114 may be a dedicated hub - that is, a hub whose primary function is to route communications to / from the UEs from / to the network node 9110b. In other embodiments, the hub 9114 may be a non-dedicated hub - that is, a device which is capable of operating to route communications between the UEs and network node 9110b, but which is additionally capable of operating as a communication start and / or end point for certain data channels.

[0395] FIG.10 shows a UE 10200 in accordance with some embodiments. As used herein, a UE refers to a device capable, configured, arranged and / or operable to communicate wirelessly with network nodes and / or other UEs. Examples of a UE include, but are not limited to, a smart phone, mobile phone, cell phone, VoIP phone, wireless local loop phone, desktop computer, PDA, wireless cameras, gaming console or device, music storage device, playback appliance, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, LEE, LME, smart device, wireless CPE, vehicle, vehicle-mounted or vehicle embedded / integrated wireless device, etc. Other examples include any UE identified by the 3GPP, including a NB-IoTUE, a MTC UE, and / or an eMTC UE.

[0396] A UE (e.g. the source device 850, the target device 860) may support device-to-device (D2D) communication, for example by implementing a 3 GPP standard for sidelink communication, Dedicated Short-Range Communication (DSRC), vehicle-to-vehicle (V2V), vehicle-to- infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, a UE may not necessarily have a user in the sense of a human user who owns and / or operates the relevant device. Instead, a UE may represent a device that is intended for sale to, or operation by, a human user but which may not, or which may not initially, be associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended for sale to, or operation by, an end user but which may be associated with or operated for the benefit of a user (e.g., a smart power meter).

[0397] The UE 10200 includes processing circuitry 10202 that is operatively coupled via a bus 10204 to an input / output interface 10206, a power source 10208, a memory 10210, a communication interface 10212, and / or any other component, or any combination thereof. Certain UEs may utilize all or a subset of the components shown in FIG.10. The level of integration between the components may vary from one UE to another UE. Further, certain UEs may contain multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0398] The processing circuitry 10202 is configured to process instructions and data and may be configured to implement any sequential state machine operative to execute instructions stored as machine-readable computer programs 824 in the memory 10210. The processing circuitry 10202 may be implemented as one or more hardware-implemented state machines (e.g., in discrete logic, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), etc.);programmable logic together with appropriate firmware; one or more stored computer programs, general-purpose processors, such as a microprocessor or digital signal processor (DSP), together with appropriate software; or any combination of the above. For example, the processing circuitry 10202 may include multiple central processing units (CPUs).

[0399] In the example, the input / output interface 10206 may be configured to provide an interface or interfaces to an input device, output device, or one or more input and / or output devices. Examples of an output device include a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smartcard, another output device, or any combination thereof. An input device may allow a user to capture information into the UE 10200. Examples of an input device include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a web camera, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smartcard, and the like. The presence-sensitive display may include a capacitive or resistive touch sensor to sense input from a user. A sensor may be, for instance, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. An output device may use the same type of interface port as an input device. For example, a Universal Serial Bus (USB) port may be used to provide an input device and an output device.

[0400] In some embodiments, the power source 10208 is structured as a battery or battery pack. Other types of power sources, such as an external power source (e.g., an electricity outlet), photovoltaic device, or power cell, may be used. The power source 10208 may further include power circuitry for delivering power from the power source 10208 itself, and / or an external power source, to the various parts of the UE 10200 via input circuitry or an interface such as an electrical power cable. Delivering power may be, for example, for charging of the power source 10208. Power circuitry may perform any formatting, converting, or other modification to the power from the power source 10208 to make the power suitable for the respective components of the UE 10200 to which power is supplied.

[0401] The memory 10210 may be or be configured to include memory such as random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, hard disks, removable cartridges, flash drives, and so forth. In one example, the memory 10210 includes one or more application programs 10214, such as an operating system, web browser application, a widget, gadget engine, or other application, and corresponding data 10216. The memory 10210 may store, for use by the UE 10200, any of a variety of various operating systems or combinations of operating systems.

[0402] The memory 10210 may be configured to include a number of physical drive units, such as redundant array of independent disks (RAID), flash memory, USB flash drive, external hard disk drive, thumb drive, pen drive, key drive, high-density digital versatile disc (HD-DVD) optical disc drive, internal hard disk drive, Blu-Ray optical disc drive, holographic digital data storage (HDDS) optical disc drive, external mini-dual in-line memory module (DIMM), synchronous dynamic random access memory (SDRAM), external micro-DIMM SDRAM, smartcard memory such as tamper resistant module in the form of a universal integrated circuit card (UICC) including one or more subscriber identity modules (SIMs), such as a USIM and / or ISIM, other memory, or any combination thereof. The UICC may for example be an eUICC, integrated UICC (iUICC) or a removable UICC commonly known as ”SIM card”. The memory 10210 may allow the UE 10200 to access instructions, application programs and the like, stored on transitory or non-transitory memory media, to off-load data, or to upload data. An article of manufacture, such as one utilizing a communication system may be tangibly embodied as or in the memory 10210, which may be or comprise a device-readable storage medium 822.

[0403] The processing circuitry 10202 may be configured to communicate with an access network or other network using the communication interface 10212. The communication interface 10212 may comprise one or more communication subsystems and may include or be communicatively coupled to an antenna 10222. The communication interface 10212 may include one or more transceivers used to communicate, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or a network node in an access network). Each transceiver may include a transmitter 10218 and / or a receiver 10220 appropriate to provide network communications (e.g., optical, electrical, frequency allocations, and so forth). Moreover, the transmitter 10218 and receiver 10220 may be coupled to one or more antennas (e.g., antenna 10222) and may share circuit components, software or firmware, or alternatively be implemented separately.

[0404] In the illustrated embodiment, communication functions of the communication interface 10212 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voice communication, multimedia communication, short-range communications such as Bluetooth, near-field communication, location-based communication such as the use of the global positioning system (GPS) to determine a location, another like communication function, or any combination thereof. Communications may be implemented in according to one or more communication protocols and / or standards, such as IEEE 802.11, CDMA, WCDMA, GSM, LTE, NR, UMTS, WiMax, Ethernet, transmission control protocol / intemet protocol (TCP / IP), synchronous optical networking (SONET), Asynchronous Transfer Mode (ATM), QUIC, Hypertext Transfer Protocol (HTTP), and so forth.

[0405] Regardless of the type of sensor, a UE may provide an output of data captured by its sensors, through its communication interface 10212, via a wireless connection to a network node. Data captured by sensors of a UE can be communicated through a wireless connection to a network node via another UE. The output may be periodic (e.g., once every 15 minutes if it reports the sensed temperature), random (e.g., to even out the load from reporting from several sensors), in response to a triggering event (e.g., when moisture is detected an alert is sent), in response to a request (e.g., a user initiated request), or a continuous stream (e.g., a live video feed of a patient).

[0406] As another example, a UE comprises an actuator, a motor, or a switch, related to a communication interface configured to receive wireless input from a network node via a wireless connection. In response to the received wireless input the states of the actuator, the motor, or the switch may change. For example, the UE may comprise a motor that adjusts the control surfaces or rotors of a drone in flight according to the received input or to a robotic arm performing a medical procedure according to the received input.

[0407] A UE, when in the form of an Internet of Things (loT) device, may be a device for use in one or more application domains, these domains comprising, but not limited to, city wearable technology, extended industrial application and healthcare. Non-limiting examples of such an loT device are a device which is or which is embedded in: a connected refrigerator or freezer, a TV, a connected lighting device, an electricity meter, a robot vacuum cleaner, a voice controlled smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door / window sensor, a flood / moisture sensor, an electrical door lock, a connected doorbell, an air conditioning system like a heat pump, an autonomous vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head-mounted display for Augmented Reality (AR) or Virtual Reality (VR), a wearable for tactile augmentation or sensory enhancement, a water sprinkler, an animal- or item-tracking device, a sensor for monitoring a plant or animal, an industrial robot, an Unmanned Aerial Vehicle (UAV), and any kind of medical device, like a heart rate monitor or a remote controlled surgical robot. A UE in the form of an loT device comprises circuitry and optionally software in dependence of the intended application of the loT device in addition to other components as described in relation to the UE 10200 shown in FIG.10.

[0408] As yet another specific example, in an loT scenario, a UE may represent a machine or other device that performs monitoring and / or measurements, and transmits the results of such monitoring and / or measurements to another UE and / or a network node. The UE may in this case be an M2M device, which may in a 3 GPP context be referred to as an MTC device. As one particular example, the UE may implement the 3 GPP NB-IoT standard. In other scenarios, a UE may represent a vehicle,such as a car, a bus, a truck, a ship and an airplane, or other equipment that is capable of monitoring and / or reporting on its operational status or other functions associated with its operation.

[0409] In practice, any number of UEs may be used together with respect to a single use case. For example, a first UE might be or be integrated in a drone and provide the drone’s speed information (obtained through a speed sensor) to a second UE that is a remote controller operating the drone. When the user makes changes from the remote controller, the first UE may adjust the throttle on the drone (e.g. by controlling an actuator) to increase or decrease the drone’s speed. The first and / or the second UE can also include more than one of the functionalities described above. For example, a UE might comprise the sensor and the actuator, and handle communication of data for both the speed sensor and the actuators.

[0410] FIG.11 shows a network node 11300 in accordance with some embodiments. As used herein, network node refers to equipment capable, configured, arranged and / or operable to communicate directly or indirectly with a UE and / or with other network nodes or equipment, in a telecommunication network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR. NodeBs (gNBs)), 0-RAN nodes or components of an 0-RAN node (e.g., 0-RU, 0-DU, O-CU).

[0411] Base stations may be categorized based on the amount of coverage they provide (or, stated differently, their transmit power level) and so, depending on the provided amount of coverage, may be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station may be a relay node or a relay donor node controlling a relay. A network node may also include one or more (or all) parts of a distributed radio base station such as centralized digital units, distributed units (e.g., in an 0-RAN access node) and / or remote radio units (RRUs), sometimes referred to as Remote Radio Heads (RRHs). Such remote radio units may or may not be integrated with an antenna as an antenna integrated radio. Parts of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0412] Other examples of network nodes include multiple transmission point (multi-TRP) 5G access nodes, multi-standard radio (MSR) equipment such as MSR BSs, network controllers such as radio network controllers (RNCs) or base station controllers (BSCs), base transceiver stations (BTSs), transmission points, transmission nodes, multi-cell / multicast coordination entities (MCEs), Operation and Maintenance (O&M) nodes, Operations Support System (OSS) nodes, SelfOrganizing Network (SON) nodes, positioning nodes (e.g., Evolved Serving Mobile Location Centers (E-SMLCs)), and / or Minimization of Drive Tests (MDTs).

[0413] The network node 11300 includes a processing circuitry 11302, a memory 11304, a communication interface 11306, and a power source 11308. The network node 11300 may becomposed of multiple physically separate components (e.g., a NodeB component and a RNC component, or a BTS component and a BSC component, etc.), which may each have their own respective components. In certain scenarios in which the network node 11300 comprises multiple separate components (e.g., BTS and BSC components), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control multiple NodeBs. In such a scenario, each unique NodeB and RNC pair, may in some instances be considered a single separate network node. In some embodiments, the network node 11300 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate memory 11304 for different RATs) and some components may be reused (e.g., a same antenna 11310 may be shared by different RATs). The network node 11300 may also include multiple sets of the various illustrated components for different wireless technologies integrated into network node 11300, for example GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-wave, LoRaWAN, Radio Frequency Identification (RFID) or Bluetooth wireless technologies. These wireless technologies may be integrated into the same or different chip or set of chips and other components within network node 11300.

[0414] The processing circuitry 11302 may comprise a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application-specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, and / or encoded logic operable and optionally software to provide, either alone or in conjunction with other network node 11300 components, such as the memory 11304, to provide network node 11300 functionality.

[0415] In some embodiments, the processing circuitry 11302 includes a system on a chip (SOC). In some embodiments, the processing circuitry 11302 includes one or more of radio frequency (RF) transceiver circuitry 11312 and baseband processing circuitry 11314. In some embodiments, the radio frequency (RF) transceiver circuitry 11312 and the baseband processing circuitry 11314 may be on separate chips (or sets of chips), boards, or units, such as radio units and digital units. In alternative embodiments, part or all of RF transceiver circuitry 11312 and baseband processing circuitry 11314 may be on the same chip or set of chips, boards, or units.

[0416] The memory 11304 may comprise any form of volatile or non-volatile computer-readable memory including, without limitation, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (for example, a hard disk), removable storage media (for example, a flash drive, a Compact Disk (CD) or a Digital Video Disk (DVD)), and / or any other volatile or nonvolatile, non-transitory device-readable and / or computer-executable memory devices that store information, data, and / or instructions that may be used by the processing circuitry 11302. Thememory 11304 may store any suitable instructions, data, or information, including a computer program 824, software, an application including one or more of logic, rules, code, tables, and / or other instructions capable of being executed by the processing circuitry 11302 and utilized by the network node 11300. The memory 11304 may be used to store any calculations made by the processing circuitry 11302 and / or any data received via the communication interface 11306. In some embodiments, the processing circuitry 11302 and memory 11304 is integrated.

[0417] The communication interface 11306 is used in wired or wireless communication of signaling and / or data between a network node, access network, and / or UE. As illustrated, the communication interface 11306 comprises port(s) / terminal(s) 11316 to send and receive data, for example to and from a network over a wired connection. The communication interface 11306 also includes radio front-end circuitry 11318 that may be coupled to, or in certain embodiments a part of, the antenna 11310. Radio front-end circuitry 11318 comprises filters 11320 and amplifiers 11322. The radio front-end circuitry 11318 may be connected to an antenna 11310 and processing circuitry 11302. The radio front-end circuitry may be configured to condition signals communicated between antenna 11310 and processing circuitry 11302. The radio front-end circuitry 11318 may receive digital data that is to be sent out to other network nodes or UEs via a wireless connection. The radio front-end circuitry 11318 may convert the digital data into a radio signal having the appropriate channel and bandwidth parameters using a combination of filters 11320 and / or amplifiers 11322. The radio signal may then be transmitted via the antenna 11310. Similarly, when receiving data, the antenna 11310 may collect radio signals which are then converted into digital data by the radio front-end circuitry 11318. The digital data may be passed to the processing circuitry 11302. In other embodiments, the communication interface may comprise different components and / or different combinations of components.

[0418] In certain alternative embodiments, the network node 11300 does not include separate radio front-end circuitry 11318, instead, the processing circuitry 11302 includes radio front-end circuitry and is connected to the antenna 11310. Similarly, in some embodiments, all or some of the RF transceiver circuitry 11312 is part of the communication interface 11306. In still other embodiments, the communication interface 11306 includes one or more ports or terminals 11316, the radio frontend circuitry 11318, and the RF transceiver circuitry 11312, as part of a radio unit (not shown), and the communication interface 11306 communicates with the baseband processing circuitry 11314, which is part of a digital unit (not shown).

[0419] The antenna 11310 may include one or more antennas, or antenna arrays, configured to send and / or receive wireless signals. The antenna 11310 may be coupled to the radio front-end circuitry 11318 and may be any type of antenna capable of transmitting and receiving data and / orsignals wirelessly. In certain embodiments, the antenna 11310 is separate from the network node 11300 and connectable to the network node 11300 through an interface or port.

[0420] The antenna 11310, communication interface 11306, and / or the processing circuitry 11302 may be configured to perform any receiving operations and / or certain obtaining operations described herein as being performed by the network node. Any information, data and / or signals may be received from a UE, another network node and / or any other network equipment. Similarly, the antenna 11310, the communication interface 11306, and / or the processing circuitry 11302 may be configured to perform any transmitting operations described herein as being performed by the network node. Any information, data and / or signals may be transmitted to a UE, another network node and / or any other network equipment.

[0421] The power source 11308 provides power to the various components of network node 11300 in a form suitable for the respective components (e.g., at a voltage and current level needed for each respective component). The power source 11308 may comprise, or be coupled to, power management circuitry to supply the components of the network node 11300 with power for performing the functionality described herein. For example, the network node 11300 may be connectable to an external power source (e.g., the power grid, an electricity outlet) via an input circuitry or interface such as an electrical cable, whereby the external power source supplies power to power circuitry of the power source 11308. As a further example, the power source 11308 may comprise a source of power in the form of a battery or battery pack which is connected to, or integrated in, power circuitry. The battery may provide backup power should the external power source fail.

[0422] Embodiments of the network node 11300 may include additional components beyond those shown in FIG.11 for providing certain aspects of the network node’s functionality, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, the network node 11300 may include user interface equipment to allow input of information into the network node 11300 and to allow output of information from the network node 11300. This may allow a user to perform diagnostic, maintenance, repair, and other administrative functions for the network node 11300.

[0423] FIG.12 is a block diagram of a host 12400, which may be an embodiment of the host 9116 of FIG.9, in accordance with various aspects described herein. As used herein, the host 12400 may be or comprise various combinations hardware and optionally software, including a standalone server, a blade server, a cloud-implemented server, a distributed server, a virtual machine, container, or processing resources in a server farm. The host 12400 may provide one or more services to one or more UEs.

[0424] The host 12400 includes processing circuitry 12402 that is operatively coupled via a bus 12404 to an input / output interface 12406, a network interface 12408, a power source 12410, and a memory 12412. Other components may be included in other embodiments. Features of these components may be substantially similar to those described with respect to the terminal devices, such that the descriptions thereof are generally applicable to the corresponding components of host 12400.

[0425] The memory 12412 may include one or more computer programs 824 including one or more host application programs 12414 and data 12416, which may include user data, e.g., data generated by a UE for the host 12400 or data generated by the host 12400 for a UE. Embodiments of the host 12400 may utilize only a subset or all of the components shown. The host application programs 12414 may be implemented in a container-based architecture and may provide support for video codecs (e.g., Versatile Video Coding (VVC), High Efficiency Video Coding (HEVC), Advanced Video Coding (AVC), MPEG, VP9) and audio codecs (e.g., FLAC, Advanced Audio Coding (AAC), MPEG, G.711), including transcoding for multiple different classes, types, or implementations of UEs (e.g., handsets, desktop computers, wearable display systems, heads-up display systems). The host application programs 12414 may also provide for user authentication and licensing checks and may periodically report health, routes, and content availability to a central node, such as a device in or on the edge of a core network. Accordingly, the host 12400 may select and / or indicate a different host for over-the-top services for a UE. The host application programs 12414 may support various protocols, such as the HTTP Live Streaming (HLS) protocol, Real-Time Messaging Protocol (RTMP), Real-Time Streaming Protocol (RTSP), Dynamic Adaptive Streaming over HTTP (MPEG-DASH), etc.

[0426] FIG.13 is a block diagram illustrating a virtualization environment 13500 in which functions implemented by some embodiments may be virtualized. In the present context, virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to any device described herein, or components thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components. Some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines (VMs) implemented in one or more virtual environments 13500 hosted by one or more of hardware nodes, such as a hardware computing device that operates as a network node, UE, core network node, or host. Further, in embodiments in which the virtual node does not require radio connectivity (e.g., a core network node or host), then the node may be entirely virtualized. In some embodiments, the virtualization environment 13500includes components defined by the O-RAN Alliance, such as an O-Cloud environment orchestrated by a Service Management and Orchestration Framework via an 0-2 interface.

[0427] Applications 13502 (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) are run in the virtualization environment Q400 to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein.

[0428] Hardware 13504 includes processing circuitry, memory that stores software and / or instructions executable by hardware processing circuitry, and / or other hardware devices as described herein, such as a network interface, input / output interface, and so forth. Software may be executed by the processing circuitry to instantiate one or more virtualization layers 13506 (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 13508A and 13508B (one or more of which may be generally referred to as VMs 13508), and / or perform any of the functions, features and / or benefits described in relation with some embodiments described herein. The virtualization layer 13506 may present a virtual operating platform that appears like networking hardware to the VMs 13508.

[0429] The VMs 13508 comprise virtual processing, virtual memory, virtual networking or interface and virtual storage, and may be run by a corresponding virtualization layer 13506. Different embodiments of the instance of a virtual appliance 13502 may be implemented on one or more of VMs 13508, and the implementations may be made in different ways. Virtualization of the hardware is in some contexts referred to as network function virtualization (NFV). NFV may be used to consolidate many network equipment types onto industry standard high volume server hardware, physical switches, and physical storage, which can be located in data centers, and customer premise equipment.

[0430] In the context of NFV, a VM 13508 may be a software implementation of a physical machine that runs programs as if they were executing on a physical, non-virtualized machine. Each of the VMs 13508, and that part of hardware 13504 that executes that VM, be it hardware dedicated to that VM and / or hardware shared by that VM with others of the VMs, forms separate virtual network elements. Still in the context of NFV, a virtual network function is responsible for handling specific network functions that run in one or more VMs 13508 on top of the hardware 13504 and corresponds to the application 13502.

[0431] Hardware 13504 may be implemented in a standalone network node with generic or specific components. Hardware 13504 may implement some functions via virtualization. Alternatively, hardware 13504 may be part of a larger cluster of hardware (e.g. such as in a data center or CPE) where many hardware nodes work together and are managed via management and orchestration 13510, which, among others, oversees lifecycle management of applications 13502. In someembodiments, hardware 13504 is coupled to one or more radio units that each include one or more transmitters and one or more receivers that may be coupled to one or more antennas. Radio units may communicate directly with other hardware nodes via one or more appropriate network interfaces and may be used in combination with the virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station. In some embodiments, some signaling can be provided with the use of a control system 13512 which may alternatively be used for communication between hardware nodes and radio units.

[0432] FIG.14 shows a communication diagram of a host 14602 communicating via a network node 14604 with a UE 14606 over a partially wireless connection in accordance with some embodiments. Example implementations, in accordance with various embodiments, of the UE (such as a UE 9112a of FIG.9), network node (such as network node 9110a of FIG.9), and host (such as host 9116 of FIG.9 and / or host 12400 of FIG.12) discussed in the preceding paragraphs will now be described with reference to FIG.14.

[0433] Like host 12400, embodiments of host 14602 include hardware, such as a communication interface, processing circuitry, and memory. The host 14602 also includes software, which is stored in or accessible by the host 14602 and executable by the processing circuitry. The software includes a host application that may be operable to provide a service to a remote user, such as the UE 14606 connecting via an over-the-top (OTT) connection 14650 extending between the UE 14606 and host 14602. In providing the service to the remote user, a host application may provide user data which is transmitted using the OTT connection 14650.

[0434] The network node 14604 includes hardware enabling it to communicate with the host 14602 and UE 14606. The connection 14660 may be direct or pass through a core network (like core network 9106 of FIG.9) and / or one or more other intermediate networks, such as one or more public, private, or hosted networks. For example, an intermediate network may be a backbone network or the Internet.

[0435] The UE 14606 includes hardware and software, which is stored in or accessible by UE 14606 and executable by the UE’s processing circuitry. The software includes a client application, such as a web browser or operator-specific “app” that may be operable to provide a service to a human or non-human user via UE 14606 with the support of the host 14602. In the host 14602, an executing host application may communicate with the executing client application via the OTT connection 14650 terminating at the UE 14606 and host 14602. In providing the service to the user, the UE's client application may receive request data from the host's host application and provide user data in response to the request data. The OTT connection 14650 may transfer both the request data and the user data. The UE's client application may interact with the user to generate the user data that it provides to the host application through the OTT connection 14650.

[0436] The OTT connection 14650 may extend via a connection 14660 between the host 14602 and the network node 14604 and via a wireless connection 14670 between the network node 14604 and the UE 14606 to provide the connection between the host 14602 and the UE 14606. The connection 14660 and wireless connection 14670, over which the OTT connection 14650 may be provided, have been drawn abstractly to illustrate the communication between the host 14602 and the UE 14606 via the network node 14604, without explicit reference to any intermediary devices and the precise routing of messages via these devices.

[0437] As an example of transmitting data via the OTT connection 14650, in step 14608, the host 14602 provides user data, which may be performed by executing a host application. In some embodiments, the user data is associated with a particular human user interacting with the UE 14606. In other embodiments, the user data is associated with a UE 14606 that shares data with the host 14602 without explicit human interaction. In step 14610, the host 14602 initiates a transmission carrying the user data towards the UE 14606. The host 14602 may initiate the transmission responsive to a request transmitted by the UE 14606. The request may be caused by human interaction with the UE 14606 or by operation of the client application executing on the UE 14606. The transmission may pass via the network node 14604, in accordance with the teachings of the embodiments described throughout this disclosure. Accordingly, in step 14612, the network node 14604 transmits to the UE 14606 the user data that was carried in the transmission that the host 14602 initiated, in accordance with the teachings of the embodiments described throughout this disclosure. In step 14614, the UE 14606 receives the user data carried in the transmission, which may be performed by a client application executed on the UE 14606 associated with the host application executed by the host 14602.

[0438] In some examples, the UE 14606 executes a client application which provides user data to the host 14602. The user data may be provided in reaction or response to the data received from the host 14602. Accordingly, in step 14616, the UE 14606 may provide user data, which may be performed by executing the client application. In providing the user data, the client application may further consider user input received from the user via an input / output interface of the UE 14606. Regardless of the specific manner in which the user data was provided, the UE 14606 initiates, in step 14618, transmission of the user data towards the host 14602 via the network node 14604. In step 14620, in accordance with the teachings of the embodiments described throughout this disclosure, the network node 14604 receives user data from the UE 14606 and initiates transmission of the received user data towards the host 14602. In step 14622, the host 14602 receives the user data carried in the transmission initiated by the UE 14606.

[0439] One or more of the various embodiments improve the performance of OTT services provided to the UE 14606 using the OTT connection 14650, in which the wireless connection 14670forms the last segment. More precisely, in some embodiments herein, the proposed solution can enhance the subscription transferring flow to allow the CSP to check if it is the desired target device to take over the subscription to be transferred, without device to device communication. In some embodiments herein, the proposed solution can involve the end user to re-confirm it is the desired target device transferring the subscription before the downloading of the new ICCID profile. In some embodiments herein, the proposed solution can ensure the confirmation code is delivered only when it is really needed, which can enhance the security. In some embodiments herein, the proposed solution can mitigate security risks and minimize the possibility of an attacker intercepting the confirmation code.

[0440] In an example scenario, factory status information may be collected and analyzed by the host 14602. As another example, the host 14602 may process audio and video data which may have been retrieved from a UE for use in creating maps. As another example, the host 14602 may collect and analyze real-time data to assist in controlling vehicle congestion (e.g., controlling traffic lights). As another example, the host 14602 may store surveillance video uploaded by a UE. As another example, the host 14602 may store or control access to media content such as video, audio, VR or AR which it can broadcast, multicast or unicast to UEs. As other examples, the host 14602 may be used for energy pricing, remote control of non-time critical electrical load to balance power generation needs, location services, presentation services (such as compiling diagrams etc. from data collected from remote devices), or any other function of collecting, retrieving, storing, analyzing and / or transmitting data.

[0441] In some examples, a measurement procedure may be provided for the purpose of monitoring data rate, latency and other factors on which the one or more embodiments improve. There may further be an optional network functionality for reconfiguring the OTT connection 14650 between the host 14602 and UE 14606, in response to variations in the measurement results. The measurement procedure and / or the network functionality for reconfiguring the OTT connection may be implemented in software and hardware of the host 14602 and / or UE 14606. In some embodiments, sensors (not shown) may be deployed in or in association with other devices through which the OTT connection 14650 passes; the sensors may participate in the measurement procedure by supplying values of the monitored quantities exemplified above, or supplying values of other physical quantities from which software may compute or estimate the monitored quantities. The reconfiguring of the OTT connection 14650 may include message format, retransmission settings, preferred routing etc.; the reconfiguring need not directly alter the operation of the network node 14604. Such procedures and functionalities may be known and practiced in the art. In certain embodiments, measurements may involve proprietary UE signaling that facilitates measurements of throughput, propagation times, latency and the like, by the host 14602. The measurements maybe implemented in that software causes messages to be transmitted, in particular empty or ‘dummy’ messages, using the OTT connection 14650 while monitoring propagation times, errors, etc.

[0442] Although the computing devices described herein (e.g., UEs, network nodes, hosts) may include the illustrated combination of hardware components, other embodiments may comprise computing devices with different combinations of components. It is to be understood that these computing devices may comprise any suitable combination of hardware and / or software needed to perform the tasks, features, functions and methods disclosed herein. Determining, calculating, obtaining or similar operations described herein may be performed by processing circuitry, which may process information by, for example, converting the obtained information into other information, comparing the obtained information or converted information to information stored in the network node, and / or performing one or more operations based on the obtained information or converted information, and as a result of said processing making a determination. Moreover, while components are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, computing devices may comprise multiple different physical components that make up a single illustrated component, and functionality may be partitioned between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of the components may be partitioned between the processing circuitry and the communication interface. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0443] In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium 822. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium 822, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer-readable storage medium 822 or not, the processing circuitry can be configured to perform the described functionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and / or by end users and a wireless network generally.

[0444] Embodiment 1. A host configured to operate in a communication system to provide an over- the-top (OTT) service, the host comprising:

[0445] processing circuitry configured to provide user data; and

[0446] a network interface configured to initiate transmission of the user data to a network node in a cellular network for transmission to a user equipment (UE), the network node having a communication interface and processing circuitry, the processing circuitry of the network node configured to perform any of the operations performed by the network node as described above to transmit the user data from the host to the UE or manage / facilitate the transmission of the user data from the host to the UE.

[0447] Embodiment 2. The host of the previous embodiment, wherein:

[0448] the processing circuitry of the host is configured to execute a host application that provides the user data; and

[0449] the UE comprises processing circuitry configured to execute a client application associated with the host application to receive the transmission of user data from the host.

[0450] Embodiment 3. A method implemented in a host configured to operate in a communication system that further includes a network node and a user equipment (UE), the method comprising:

[0451] providing user data for the UE; and

[0452] initiating a transmission carrying the user data to the UE via a cellular network comprising the network node, wherein the network node performs the operations performed by the network node as described above to transmit the user data from the host to the UE or manage / facilitate the transmission of the user data from the host to the UE.

[0453] Embodiment 4. The method of the previous embodiment, further comprising, at the network node, transmitting the user data provided by the host for the UE.

[0454] Embodiment 5. The method of any of the previous 2 embodiments, wherein the user data is provided at the host by executing a host application that interacts with a client application executing on the UE, the client application being associated with the host application.

[0455] Embodiment 6. A communication system configured to provide an over-the-top (OTT) service, the communication system comprising:

[0456] a host comprising:

[0457] processing circuitry configured to provide user data for a user equipment (UE), the user data being associated with the over-the-top service; and

[0458] a network interface configured to initiate transmission of the user data toward a cellular network node for transmission to the UE, the network node having a communication interface and processing circuitry, the processing circuitry of the network node configured to perform any of the operations performed by the network node as described above transmit the user data from the host to the UE or manage / facilitate the transmission of the user data from the host to the UE.

[0459] Embodiment 7. The communication system of the previous embodiment, further comprising:

[0460] the network node; and / or

[0461] the user equipment.

[0462] Embodiment 8. The communication system of the previous 2 embodiments, wherein:

[0463] the processing circuitry of the host is configured to execute a host application, thereby providing the user data; and

[0464] the host application is configured to interact with a client application executing on the UE, the client application being associated with the host application.

[0465] Embodiment 9. A host configured to operate in a communication system to provide an over-the-top (OTT) service, the host comprising:

[0466] processing circuitry configured to initiate receipt of user data; and

[0467] a network interface configured to receive the user data from a network node in a cellular network, the network node having a communication interface and processing circuitry, the processing circuitry of the network node configured to perform any of the operations performed by the network node as described above to receive the user data from the UE for the host manage / facilitate the reception of the user data from the UE for the host.

[0468] Embodiment 10. The host of the previous 2 embodiments, wherein:

[0469] the processing circuitry of the host is configured to execute a host application, thereby providing the user data; and

[0470] the host application is configured to interact with a client application executing on the UE, the client application being associated with the host application.

[0471] Embodiment 11. The host of they of the previous 2 embodiments, wherein the initiating receipt of the user data comprises requesting the user data.

[0472] Embodiment 12. A method implemented by a host configured to operate in a communication system that further includes a network node and a user equipment (UE), the method comprising:

[0473] at the host, initiating receipt of user data from the UE, the user data originating from a transmission which the network node has received from the UE, wherein the network node performs the operations performed by the network node as described above to receive the user data from the UE for the host manage / facilitate the reception of the user data from the UE for the host.

[0474] Embodiment 13. The method of the previous embodiment, further comprising at the network node, transmitting the received user data to the host.

[0475] Embodiment 14. A host configured to operate in a communication system to provide an over-the-top (OTT) service, the host comprising:

[0476] processing circuitry configured to provide user data; and

[0477] a network interface configured to initiate transmission of the user data to a cellular network for transmission to a user equipment (UE), wherein the UE comprises a communication interface and processing circuitry, the communication interface and processing circuitry of the UE being configured to perform any of the operations performed by the UE as described above to receive the user data from the host.

[0478] Embodiment 15. The host of the previous embodiment, wherein the cellular network further includes a network node configured to communicate with the UE to transmit the user data to the UE from the host.

[0479] Embodiment 16. The host of the previous 2 embodiments, wherein:

[0480] the processing circuitry of the host is configured to execute a host application, thereby providing the user data; and

[0481] the host application is configured to interact with a client application executing on the UE, the client application being associated with the host application.

[0482] Embodiment 17. A method implemented by a host operating in a communication system that further includes a network node and a user equipment (UE), the method comprising:

[0483] providing user data for the UE; and

[0484] initiating a transmission carrying the user data to the UE via a cellular network comprising the network node, wherein the UE performs any of the operations performed by the UE as described above to receive the user data from the host.

[0485] Embodiment 18. The method of the previous embodiment, further comprising:

[0486] at the host, executing a host application associated with a client application executing on the UE to receive the user data from the UE.

[0487] Embodiment 19. The method of the previous embodiment, further comprising:

[0488] at the host, transmitting input data to the client application executing on the UE, the input data being provided by executing the host application,

[0489] wherein the user data is provided by the client application in response to the input data from the host application.

[0490] Embodiment 20. A host configured to operate in a communication system to provide an over-the-top (OTT) service, the host comprising:

[0491] processing circuitry configured to utilize user data; and

[0492] a network interface configured to receipt of transmission of the user data to a cellular network for transmission to a user equipment (UE),

[0493] wherein the UE comprises a communication interface and processing circuitry, the communication interface and processing circuitry of the UE being configured to perform any of the operations performed by the UE as described above to transmit the user data to the host.

[0494] Embodiment 21. The host of the previous embodiment, wherein the cellular network further includes a network node configured to communicate with the UE to transmit the user data from the UE to the host.

[0495] Embodiment 22. The host of the previous 2 embodiments, wherein:

[0496] the processing circuitry of the host is configured to execute a host application, thereby providing the user data; and

[0497] the host application is configured to interact with a client application executing on the UE, the client application being associated with the host application.

[0498] Embodiment 23. A method implemented by a host configured to operate in a communication system that further includes a network node and a user equipment (UE), the method comprising:

[0499] at the host, receiving user data transmitted to the host via the network node by the UE, wherein the UE performs any of the operations performed by the UE as described above to transmit the user data to the host.

[0500] Embodiment 24. The method of the previous embodiment, further comprising:

[0501] at the host, executing a host application associated with a client application executing on the UE to receive the user data from the UE.

[0502] Embodiment 25. The method of the previous embodiments, further comprising:

[0503] at the host, transmitting input data to the client application executing on the UE, the input data being provided by executing the host application,

[0504] wherein the user data is provided by the client application in response to the input data from the host application.

[0505] The term unit or module may have conventional meaning in the field of electronics, electrical devices and / or electronic devices and may include, for example, electrical and / or electronic circuitry, devices, modules, processors, memories, logic solid state and / or discrete devices, computer programs or instructions for carrying out respective tasks, procedures, computations, outputs, and / or displaying functions, and so on, as such as those that are described herein.

[0506] According to an aspect of the disclosure it is provided a computer program being tangibly stored on a computer readable storage medium and including instructions which, when executed on at least one processor, cause the at least one processor to carry out any of the methods as described above.

[0507] According to an aspect of the disclosure it is provided a computer-readable storage medium storing instructions which when executed by at least one processor, cause the at least one processor to carry out any of the methods as described above.

[0508] In addition, the present disclosure may also provide a carrier containing the computer program as mentioned above, wherein the carrier is one of an electronic signal, optical signal, radio signal, or computer readable storage medium. The computer readable storage medium can be, for example, an optical compact disk or an electronic memory device like a RAM (random access memory), a ROM (read only memory), Flash memory, magnetic tape, CD-ROM, DVD, Blue-ray disc and the like.

[0509] The techniques described herein may be implemented by various means so that an apparatus implementing one or more functions of a corresponding apparatus described with an embodiment comprises not only prior art means, but also means for implementing the one or more functions of the corresponding apparatus described with the embodiment and it may comprise separate means for each separate function, or means that may be configured to perform two or more functions. For example, these techniques may be implemented in hardware (one or more apparatuses), firmware (one or more apparatuses), software (one or more modules), or combinations thereof. For a firmware or software, implementation may be made through modules (e.g., procedures, functions, and so on) that perform the functions described herein.

[0510] Exemplary embodiments herein have been described above with reference to block diagrams and flowchart illustrations of methods and apparatuses. It will be understood that each block of the block diagrams and flowchart illustrations, and combinations of blocks in the block diagrams and flowchart illustrations, respectively, can be implemented by various means including computer program instructions. These computer program instructions may be loaded onto a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions which execute on the computer or other programmable data processing apparatus create means for implementing the functions specified in the flowchart block or blocks.

[0511] Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are contained in the above discussions, these should not be construed as limitations on the scope of the subject matter described herein, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0512] While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any implementation or of what may be claimed, but rather as descriptions of features that may be specific to particular embodiments of particular implementations. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a sub-combination or variation of a sub-combination.

[0513] It will be obvious to a person skilled in the art that, as the technology advances, the inventive concept can be implemented in various ways. The above described embodiments are given for describing rather than limiting the disclosure, and it is to be understood that modifications and variations may be resorted to without departing from the spirit and scope of the disclosure as those skilled in the art readily understand. Such modifications and variations are considered to be within the scope of the disclosure and the appended claims. The protection scope of the disclosure is defined by the accompanying claims.

Claims

CLAIMS1. A method (300) performed by a first network device (830; 800), comprising: receiving (302) a first message from a second network device (840; 800), wherein the first message comprises first information regarding a target device (860; 800) and second information indicating the target device is trying to download an integrated circuit card identity, ICCID, profile; validating (304) if the target device is eligible for subscription transferring for the ICCID profile based on the first information; and when the target device is eligible for the subscription transferring, sending (312) a second message to a source device (850; 800), wherein the subscription transferring is triggered by a user via the source device, wherein the second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

2. The method according to claim 1, wherein the second message is sent to the source device (850; 800) via a push server or a Short Message Service, SMS, or an Application Programming Interface, API.

3. The method according to claim 1 or 2, wherein the second message comprises the first information and / or subscription information associated with the ICCID profile.

4. The method according to any of claims 1-3, comprising: receiving (322) a third message from the source device (850; 800), wherein the third message comprises consent for subscription transferring of the user; and sending (324) a fourth message comprising the first confirmation code associated with the ICCID profile to the user.

5. The method according to claim 4, wherein the fourth message is sent to the user via a push server or an SMS, or an API.

6. The method according to claim 4 or 5, wherein the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

7. The method according to claim 6, wherein when the address for receiving the first confirmation code associated with the ICCID profile comprises an electronic mail address, the fourth message is sent to the user via a simple mail transfer protocol, SMTP, server, or when the address for receiving the first confirmation code associated with the ICCID profile comprises a phone number, the fourth message is sent to the user via an SMS, orwhen the address for receiving the first confirmation code associated with the ICCID profile comprises a push notification address, the fourth message is sent to the user via the push notification address.

8. The method according to any of claims 1-7, comprising: when the target device (860; 800) is not eligible for the subscription transferring, sending (332) a fifth message to a source device (850; 800), wherein the fifth message is for notifying a user that the target device (860; 800) is not eligible for the subscription transferring.

9. The method according to any of claims 1-8, comprising: sending (342) a sixth message to the second network device (840; 800), wherein the sixth message comprises a validation result for the target device (860; 800).

10. The method according to any of claims 1-9, wherein the first information comprises at least one of: an embedded universal integrated circuit card identifier, an international mobile equipment identity, or a type allocation code.

11. The method according to any of claims 1-10, wherein the first network device (830; 800) comprises an entitlement configuration server and / or the second network device (840; 800) comprises an enhanced subscription manager data preparation server.

12. A method (400) performed by a second network device (840; 800), comprising: receiving (402) a request from a target device (860; 800), wherein the request is for downloading an integrated circuit card identity, ICCID, profile and the request comprises first information regarding the target device (860; 800); and sending (406) a first message comprising the first information and second information to a first network device (830; 800), wherein the second information indicates the target device (860; 800) is trying to download the ICCID profile.

13. The method according to claim 12, comprising: sending (404) a seventh message to the target device (860; 800), wherein the seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile.

14. The method according to claim 12 or 13, comprising: receiving (412) an eighth message comprising a second confirmation code from the target device (860; 800); validating (414) the second confirmation code; and when the second confirmation code passes validation, sending (416) the ICCID profile to the target device (860; 800).

15. The method according to any of claims 12-14, comprising: receiving (422) a sixth message from the first network device (830; 800), wherein the sixth message comprises a validation result for the target device (860; 800); receiving (424) a ninth message comprising a third confirmation code from the target device (860; 800); validating (426) the third confirmation code; and when the third confirmation code passes validation and the validation result for the target device (860; 800) indicates the target device is eligible for subscription transferring for the ICCID profile, sending (428) the ICCID profile to the target device (860; 800).

16. The method according to any of claims 12-15, wherein the first information comprises at least one of: an embedded universal integrated circuit card identifier, an international mobile equipment identity, or a type allocation code.

17. The method according to any of claims 12-16, wherein the first network device (830; 800) comprises an entitlement configuration server and / or the second network device (840; 800) comprises an enhanced subscription manager data preparation server.

18. A method (500) performed by a source device, comprising: sending (502) a transfer request for an integrated circuit card identity, ICCID, profile to a first network device (830; 800); when a target device is eligible for subscription transferring for the ICCID profile, receiving (504) a second message from the first network device (830; 800), wherein the second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

19. The method according to claim 18, wherein the second message is received from the first network device (830; 800) via a push server or a Short Message Service or an Application Programming Interface.

20. The method according to claim 18 or 19, wherein the second message comprises first information regarding the target device (860; 800) and / or subscription information associated with the ICCID profile.

21. The method according to any of claims 18 or 19, comprising: when the target device (860; 800) is eligible for subscription transferring for the ICCID profile, sending (514) a third message to the first network device (830; 800), wherein the third message comprises consent for subscription transferring of the user.

22. The method according to claim 21, wherein the third message comprises the address for receiving the first confirmation code associated with the ICCID profile.

23. The method according to claim 22, wherein the address for receiving the first confirmation code associated with the ICCID profile comprises an electronic mail address or a phone number or a push notification address.

24. The method according to any of claims 18-23, comprising: when the target device is not eligible for the subscription transferring, receiving (522) a fifth message from the first network device (830; 800), wherein the fifth message is for notifying the user that the target device (860; 800) is not eligible for the subscription transferring.

25. The method according to any of claims 18-24, wherein the first information comprises at least one of: an embedded universal integrated circuit card identifier, an international mobile equipment identity, or a type allocation code.

26. The method according to any of claims 18-25, wherein the first network device (830; 800) comprises an entitlement configuration server.

27. A method (600) performed by a target device (860; 800), comprising: sending (602) a request to a second network device (840; 800), wherein the request is for downloading an integrated circuit card identity, ICCID, profile and comprises first information regarding the target device (860; 800), wherein the first information is for validating if the target device (860; 800) is eligible for subscription transferring for the ICCID profile, wherein the subscription transferring is triggered by a user via a source device (850; 800).

28. The method according to claim 27, comprising: receiving (612) a seventh message from the second network device (840; 800), wherein the seventh message comprises information indicating that a first confirmation code associated with the ICCID profile is needed to continue subscription transferring for the ICCID profile; receiving (614) a confirmation code input by a user; and sending (616) a message comprising the confirmation code to the second network device (840; 800).

29. The method according to claim 27 or 28, wherein the first information comprises at least one of: an embedded universal integrated circuit card identifier, an international mobile equipment identity, or a type allocation code.

30. The method according to any of claims 27-29, wherein the second network device (840; 800) comprises an enhanced subscription manager data preparation server.

31. A first network device (830; 800), comprising: a processor (821); and a memory (822) coupled to the processor (821), said memory (822) containing instructions executable by said processor (821), whereby said first network device (800) is operative to receive a first message from a second network device (840; 800), wherein the first message comprises first information regarding a target device (860; 800) and second information indicating the target device (860; 800) is trying to download an integrated circuit card identity, ICCID, profile; validate if the target device (860; 800) is eligible for subscription transferring for the ICCID profile based on the first information; and when the target device (860; 800) is eligible for the subscription transferring, send (312) a second message to a source device (850; 800), wherein the subscription transferring is triggered by a user via the source device (850; 800), wherein the second message is for requesting consent for subscription transferring from the user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile32. The first network device (830; 800) according to claim 31, wherein the first network device (800) is operative to perform the method of any one of claims 2 to 11.

33. A second network device (840; 800), comprising: a processor (821); and a memory (822) coupled to the processor (821), said memory (822) containing instructions executable by said processor (821), whereby said second network device (800) is operative to: receive a request from a target device (860; 800), wherein the request is for downloading an integrated circuit card identity (ICCID) profile and the request comprises first information regarding the target device (860; 800); and send a first message comprising the first information and second information to a first network device (830; 800), wherein the second information indicates the target device (860; 800) is trying to download the ICCID profile.

34. The second network device (840; 800) according to claim 33, wherein the second network device (840; 800) is operative to perform the method of any one of claims 13 to 17.

35. A source device (850; 800), comprising: a processor (821); and a memory (822) coupled to the processor (821), said memory (822) containing instructions executable by said processor (821), whereby said source device (800) is operative to:send a transfer request for an integrated circuit card identity, ICCID, profile to a first network device (830; 800); when a target device is eligible for subscription transferring for the ICCID profile, receive a second message from a first network device (830; 800), wherein the second message is for requesting consent from a user and / or requesting the user to enter an address for receiving a first confirmation code associated with the ICCID profile.

36. The source device (850; 800) according to claim 35, wherein the source device (800) is operative to perform the method of any one of claims 19 to 26.

37. A target device (860; 800), comprising: a processor (821); and a memory (822) coupled to the processor (821), said memory (822) containing instructions executable by said processor (821), whereby said target device (800) is operative to: send a request to a second network device (840; 800), wherein the request is for downloading an integrated circuit card identity, ICCID, profile and comprises first information regarding the target device, wherein the first information is for validating if the target device (860; 800) is eligible for subscription transferring for the ICCID profile, wherein the subscription transferring is triggered by a user via a source device (850; 800).

38. The target device (860; 800) according to claim 37, wherein the target device (860; 800) is operative to perform the method of any one of claims 28 to 30.

39. A computer-readable storage medium (822) storing instructions which when executed by at least one processor (821), cause the at least one processor (821) to perform the method according to any one of claims 1 to 30.

40. A computer program (824) comprising instructions which when executed by at least one processor (821), cause the at least one processor (821) to perform the method according to any of claims 1 to 30.

Images