Management server, wireless device and program

Abstract

This reduces the risk of profiles for WD drives being downloaded by other WD drives. [Solution] The management server includes notification means for notifying the WD of first information including access information indicating a storage server that the WD accesses to download a profile, and identification information for identifying the profile in the storage server; generation means for generating a shared value to be shared with the WD using a key sharing algorithm; and configuration means for configuring the storage server so that when the WD accesses the storage server based on the first information, the storage server requests the wireless device to provide the shared value or a value based on the shared value.

Description

Technical Field

[0001] The present disclosure relates to a technology for provisioning a profile used by a wireless device to access a mobile communication network.

Background Art

[0002] A wireless device (WD) accessing a mobile communication network implements an integrated circuit called a subscriber identity module (SIM) and uses information called a profile stored in the SIM for access to the mobile communication network. The SIM can be configured to download the profile from a network server. A SIM configured to download the profile from a network server is called an embedded universal integrated circuit card (eUICC). Also, a SIM configured to download the profile from a network server can also be called an embedded SIM (eSIM).

[0003] Non-Patent Document 1 discloses a remote SIM provisioning (RSP) architecture for consumer devices such as smartphones. Non-Patent Document 2 discloses an eSIM IoT architecture. IoT is an abbreviation for the Internet of Things. In the following description, the term wireless device (WD) is used as a general term for consumer devices such as smartphones and IoT devices.

[0004] According to Non-Patent Documents 1 and 2, information called an activation code (AC) is provided in advance to the WD or its user who downloads the profile. The AC includes access information for accessing the storage server where the profile to be downloaded by the WD is stored, and a specific identifier for identifying the profile for the WD from among the multiple profiles stored on the storage server. In Non-Patent Documents 1 and 2, the storage server is referred to as SM-DP+ (Subscription Management Data Preparation), and the specific identifier is referred to as matchingId. The WD accesses the storage server based on the access information and downloads the profile by presenting the specific identifier to the storage server. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] RSP Technical Specification, GSMA SGP.22 v3.1, December 1, 2023 [Non-Patent Document 2] eSIM IoT Technical Specification GSMA SGP.32 v1.2.1, June 27, 2024 [Overview of the project] [Problems that the invention aims to solve]

[0006] For example, if the AC (Access Control Code) notified to the first WD (Driver's License) or its user is leaked, someone other than the user of the first WD can use the second WD to download the profile for the first WD. For this reason, Non-Patent Documents 1 and 2 define a verification code (CC). When using a CC, the CC is notified to the WD or its user, and the CC is associated with the profile for that WD and stored on the storage server. When the WD accesses the storage server based on the AC, the storage server requests the WD to provide the CC. Only if the WD provides the CC associated with its profile, the storage server sends the WD's profile to the WD.

[0007] However, if AC and CC files are leaked, a profile intended for one WD could be downloaded by another WD.

[0008] This disclosure provides a technology to mitigate the risk of profiles for WD being downloaded by other WD devices. [Means for solving the problem]

[0009] According to one aspect of the present disclosure, the management server includes notification means for notifying the wireless device of first information including access information indicating a storage server that the wireless device accesses to download a profile, and identification information for identifying the profile in the storage server; generation means for generating a shared value to be shared with the wireless device using a key sharing algorithm; and configuration means for configuring the storage server so that when the wireless device accesses the storage server based on the first information, the storage server requests the wireless device to provide the shared value or a value based on the shared value. [Effects of the Invention]

[0010] According to this disclosure, the risk of a profile for a WD being downloaded by another WD can be reduced. [Brief explanation of the drawing]

[0011] [Figure 1] A system configuration diagram used to describe the embodiment. [Figure 2] Sequence diagram according to one embodiment. [Figure 3] Sequence diagram according to one embodiment. [Figure 4] Functional block diagrams of management servers in several embodiments. [Figure 5] Functional block diagrams of WD according to several embodiments. [Modes for carrying out the invention]

[0012] The embodiments will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention as defined in the claims, and not all combinations of features described in the embodiments are essential to the invention. Two or more features from the multiple features described in the embodiments may be combined arbitrarily. Furthermore, identical or similar configurations will be given the same reference numeral, and redundant descriptions will be omitted.

[0013] <First Embodiment> Figure 1 is a system configuration diagram illustrating an embodiment. Any two of the WD100, management server 300, and storage server 400 are configured to communicate with each other via network 200. Network 200 includes various interconnected networks such as the Internet, mobile communication networks, wireless local area networks (LANs), and wired LANs. A WD100 without a profile can access network 200, for example, via a wireless LAN. A WD100 with a profile can access network 200 via a mobile communication network.

[0014] The storage server 400 is a server that stores the profiles to be provided to the WD100, and may be, for example, the SM-DP+ described in Non-Patent Documents 1 and 2. The management server 300 is a server that manages the provisioning of profiles to the WD100. The management server 300 may be, for example, the eIM (eSIM IoT Remote Manager) described in Non-Patent Document 2.

[0015] Figure 2 is a sequence diagram of the profile provisioning process for WD100. First, through communication between WD100 and the management server 300 in S10, WD100 and the management server 300 determine one elliptic curve. Determining an elliptic curve involves determining multiple points on the elliptic curve, including the base point G. For example, if the management server 300 has multiple elliptic curves configured, the communication in S10 allows WD100 and the management server 300 to select one elliptic curve from the multiple elliptic curves configured in the management server 300, thereby determining one elliptic curve. Note that if the management server 300 is configured to use only one elliptic curve, and information indicating that elliptic curve is also stored on other servers not shown in the diagram, WD100 can obtain information indicating the elliptic curve from those servers without communicating with the management server 300 in S10.

[0016] In S11, WD100 selects one point on the elliptic curve determined in S10 and designates this as the private key S#1. Furthermore, in S11, WD100 obtains the point corresponding to the product of the private key S#1 and the base point G on the elliptic curve determined in S10, and designates this as the public key P#1. Similarly, in S12, the management server 300 selects one point on the elliptic curve determined in S10 and designates this as the private key S#2. Furthermore, in S12, the management server 300 obtains the point corresponding to the product of the private key S#2 and the base point G on the elliptic curve determined in S10, and designates this as the public key P#2. Note that the management server 300 may be configured to pre-generate a pair of private and public keys for each of one or more elliptic curves set in the management server 300. In this case, by determining one elliptic curve in S10, the private key S#2 and the public key P#2 are determined.

[0017] In S13, the management server 300 transmits the public key P#2 and signature data to WD100 for authentication of the management server 300 by WD100. This signature data may be, for example, the value obtained by performing a predetermined operation on the public key P#2 or the public key P#2 encrypted with the private key S#2. WD100 verifies the signature data received from the management server 300 with the public key P#2, and determines that the authentication of the management server 300 is successful when the verification of the signature data is successful.

[0018] In S14, WD100 transmits the public key P#1 and signature data to WD100 for authentication of WD100 by the management server 300. This signature data may be, for example, the value obtained by performing a predetermined operation on the public key P#1 or the public key #1 encrypted with the private key S#1. The management server 300 verifies the signature data received from WD100 with the public key P#1, and determines that the authentication of WD100 is successful when the verification of the signature data is successful. Note that the order of S13 and S14 may be reversed from that in FIG. 2.

[0019] In S15, the management server 300 transmits a download order message to the storage server 400. The download order message includes information for the storage server 400 to determine a profile to be downloaded to the WD100 from various profiles stored in the storage server 400.

[0020] In response to the download order, in S16, the storage server 400 notifies the management server 300 of the ICCID (Integrated Circuit Card Identifier) of the profile to be downloaded to the WD100. The ICCID is also an identifier of the profile. According to FIG. 2, the storage server 400 notifies ICCID#1 as the ICCID. In the following description, the profile identified by ICCID#1 is denoted as "profile #1". The processes of S15 and S16 correspond to the processes performed by the function "ES2+.DownloadOrder" defined in Non-Patent Documents 1 and 2, for example. Note that the processes of S15 and S16 can be executed independently of the processes of S10 to S14 performed by the management server 300 and the WD100. For example, after executing the processes of S15 and S16, the management server 300 can execute the processes of the WD100 and S10 to S14.

[0021] In S17, the management server 300 obtains a point on the elliptic curve determined in S10 corresponding to the product of the public key P#1 and the private key S#2, and sets this as the shared value SS#1. Further, in S18, the management server 300 sets the shared value SS#1 obtained in S17 as the value CC#1 of the CC to be used when the WD100 downloads profile #1.

[0022] In S19, the management server 300 sends a confirmation order message to the storage server 400. In this embodiment, since CC is used, the confirmation order message includes information indicating that the CC with value CC#1 should be used when WD100 downloads profile #1. In this way, the management server 300 configures the storage server 400 to request WD100 to provide CC when WD100 accesses the storage server 400 to download profile #1, using the confirmation order message. In response to the confirmation order message in S19, the storage server 400 notifies the management server 300 in S20 of a specific identifier for identifying profile #1. The specific identifier is the matchingId in Non-Patent Documents 1 and 2, and can also be referred to as specific information. The processing in S19 and S20 corresponds, for example, to the processing performed by the function "ES2+.ConfirmOrder" defined in Non-Patent Documents 1 and 2. The storage server 400 stores the CC value CC#1 associated with profile #1.

[0023] Note that processes S17 and S18 can be executed at any time after receiving the public key P#1 of WD#1 and before processing S19. For example, processes S17 and S18 can be executed before processes S15 and S16.

[0024] In S21, the management server 300 notifies the WD100 of the AC. As described above, the AC includes access information for accessing the storage server 400, such as the address or FQDN (Fully Qualified Domain Name) of the storage server 40, and a specific identifier notified by the storage server 400 in S20. The processing in S21 corresponds to the processing performed by the function "ESipa.TransferEimPackage" defined in Non-Patent Documents 1 and 2, for example.

[0025] In S22, WD100 accesses the storage server 400 based on the access information contained in AC and presents the specific identifier contained in AC to the storage server 400. In response to the presentation of the specific identifier, in S23, the storage server 400 notifies the management server 300 of the ICCID#1 associated with profile #1 identified by the specific identifier. Also, as a result of the processing in S19, the storage server 400 is configured to use CC when WD100 downloads profile #1, so in S23, the storage server 400 requests WD100 to present CC. The processing in S22 and S23 corresponds, for example, to the processing performed by the function "ES9+.AuthenticateClient" defined in Non-Patent Documents 1 and 2.

[0026] In S24, WD100 finds a point on the elliptic curve determined in S10 that corresponds to the product of the public key P#2 and the private key S#1, and sets this as the shared value SS#1. Furthermore, in S25, WD100 sets the shared value SS#1 obtained in S24 as the CC value CC#1 used when downloading profile #1. Note that the processes in S24 and S25 can be executed at any time after receiving the public key P#2 from management server #1 and before processing in S26.

[0027] The shared value SS#1 is generated according to the elliptic curve Diffie-Hellman (ECDH) key sharing algorithm, and the shared value SS#1 obtained by the management server 300 in S17 is the same as the shared value SS#1 obtained by WD100 in S24. More specifically, the shared value SS#1 is the product of the secret key S#1, the secret key S#2, and the base point G on the elliptic curve determined in S10.

[0028] In S26, WD100 sends the hash value of value CC#1 to the storage server 400. In S27, the storage server 400 determines whether the hash value of the CC value CC#1 stored in association with profile #1 is the same as the hash value received from WD100 in S26. If they are the same, in S28, the storage server 400 starts sending profile #1 to WD100. The processing in S26-S28 corresponds, for example, to the processing performed by the function "ES9+.GetBoundProfilePackage" defined in Non-Patent Documents 1 and 2. If the two hash values ​​do not match in S27, the storage server 400 does not send profile #1 to WD100. Furthermore, in this embodiment, WD100 sends the hash value of value CC#1 to the storage server 400. However, it is also possible to send value CC#1 itself to the storage server 400, and the storage server 400 compares the value of CC stored in association with profile #1 with the value of CC received from WD100.

[0029] As described above, according to this embodiment, WD100 and the management server 300 generate the same shared value according to the key sharing algorithm and use this as the CC value. Therefore, the management server 300 does not need to notify WD100 or its users of the CC value itself, and the risk of CC leakage can be reduced. Therefore, the risk of WD100's profile being downloaded by other WDs can be reduced.

[0030] In step S19 of the sequence in Figure 2, the management server 300 notifies the storage server 400 of the CC value CC#1, but it may also be configured to notify the storage server 400 of the hash value of the value CC#1. In this case, the storage server 400 stores the hash value of the value CC#1 in association with profile #1, and in step S27, it determines whether the value received from WD100 matches the hash value stored in association with profile #1.

[0031] In this embodiment, the public key P#1 and public key P#2 were exchanged during mutual authentication (S13 and S14) between WD100 and the management server 300 to generate the shared value SS#1. However, it is also possible to configure the system to exchange public key P#1 and public key P#2 independently of mutual authentication. For example, public key P#2 and public key P#1 could be registered on a server (not shown), and WD100 could obtain public key P#2 from that server, or the management server 300 could obtain public key P#1 from that server.

[0032] Furthermore, although the shared value was generated according to the ECDH key sharing algorithm in this embodiment, any other key sharing algorithm can also be used to generate the shared value. Generally, a key sharing algorithm generates a shared value based on one public value shared by two devices (base point G in the embodiment) and secret values ​​secretly held by each of the two devices (secret key S#1 and secret key S#2 in the embodiment). Each of the two devices sends the result of a calculation between its secret value and public value (public key P#1 or public key P#2 in the embodiment) to the other device, and generates a shared value by calculating the result received from the other device with its secret value.

[0033] Therefore, for example, the secret value in the key sharing algorithm may be set to the value of the secret key held by WD100 and the management server 300 for mutual authentication, or a value obtained by performing a predetermined operation on said secret key, and the public value may be set to an arbitrary value exchanged between WD100 and the management server 300 during mutual authentication, and the shared value may be set according to the DH key sharing algorithm. The public value may be, for example, the value of the public key of WD100 or a value obtained by performing a predetermined operation on the public key of WD100. The public value may also be the value of the public key of the management server 300 or a value obtained by performing a predetermined operation on the public key of the management server 300. Furthermore, the public value may be a value obtained by performing an operation on the public key value of WD100 and the public key value of the management server 300. It may also be set up so that the public value is determined by communication in S10.

[0034] <Second Embodiment> Next, the second embodiment will be described, focusing on the differences from the first embodiment. In the first embodiment, the shared value SS#1 obtained by the key sharing algorithm was used as the CC value itself. Therefore, the CC value used by the management server 300 when causing the WD100 to download the profile is always the same. If the same management server 300 continues to manage the provisioning of profiles to the WD100, only the same CC will be used, which may increase the risk of CC leakage. This embodiment reduces the risk of CC leakage compared to the first embodiment.

[0035] Figure 3 is a sequence diagram of the profile provisioning process for WD100. Note that the same processing steps as in the sequence shown in Figure 2 are assigned the same step numbers, and their explanations are generally omitted. When the management server 300 obtains the shared value SS#1 in S17, it obtains the value CC#1 in S50 based on the ICCID#1, which is the ICCID value notified in S16, and the shared value SS#1. Similarly, when WD100 obtains the shared value SS#1 in S24, it obtains the value CC#1 in S51 based on the ICCID#1, which is the CCID value notified in S23, and the shared value SS#1. How the value CC#1 is obtained based on the value ICCID#1 and the shared value SS#1, that is, the function f() in Figure 3, can be determined in advance. Alternatively, the function f() to be used can be determined dynamically, for example, in S10. Alternatively, the management server 300 can publish information about the function f() to be used in advance, and WD100 can determine which function f() to use based on that information.

[0036] Since the ICCID value differs for each profile, generating a CC value based on the ICCID value and the shared value SS#1 allows WD100 to use a different CC value for each profile download. Therefore, the risk of CC leakage can be reduced.

[0037] In this embodiment, the ICCID value was used to make the CC value different for each download, but it is also possible to configure the system to use a different value to make the CC value different for each download. For example, the management server 300 can determine one or more values ​​by any method, for example, randomly, before processing S19, and then in S50, it can determine the CC value based on those one or more values ​​and the shared value SS#1. In this case, the management server 300 can, for example, notify the WD100 of the AC value in S21, and also notify the WD100 of the one or more values ​​it has determined, so that the WD100 can determine the CC value. Furthermore, it is also possible to configure the system to determine a value to make the CC value different for each download through the processing in S10, or through another process not shown in Figure 3 in which the WD100 and the management server 300 communicate.

[0038] <Example configuration of management server 300> Figure 4 is a schematic diagram of the management server 300. The management server 300 includes, for example, one or more processors and one or more memory devices. The one or more memory devices may include volatile memory devices and non-volatile memory devices. The notification unit 30, generation unit 31, and configuration unit 32 shown in Figure 4 can be realized by one or more processors executing computer programs stored in one or more memory devices.

[0039] Although the management server 300 in Figure 4 is a single device, the management server 300 may be implemented by multiple devices that can communicate with each other. Furthermore, Figure 4 shows only the functional blocks necessary for understanding this disclosure, and the management server 300 may have functional blocks other than those shown in Figure 4.

[0040] The notification unit 30 notifies the WD100 of the AC (first information) that the WD100 will use to download the profile. The AC includes access information indicating the storage server 400 that the WD100 will access to download the profile, and a specific identifier (or specific information) for identifying the profile that the WD100 will download from the storage server 400.

[0041] The generation unit 31 generates a shared value to be shared with WD100 using a key sharing algorithm. The configuration unit 32 configures the storage server 400 so that when WD100 accesses the storage server 400 based on AC, the storage server requests WD100 to present the shared value or a value based on the shared value. The value based on the shared value may be, for example, the hash value of the shared value. Alternatively, the value based on the shared value may be a value obtained by performing an operation on the shared value and another value. Furthermore, the value based on the shared value may be a value associated with the profile downloaded by WD100, for example, the ICCID value.

[0042] The generation unit 31 obtains, for example, a first calculated value from WD100 based on a public value shared with WD100 and a first secret value secretly held by WD100, and calculates a shared value based on the second secret value secretly held by the management server 300 in the storage unit 33 and the first calculated value. In the first and second embodiments, the public value is the base point G, the first secret value is the value of the secret key S#1, the first calculated value is the value of the public key P#1, and the second secret value is the value of the secret key S#2. However, depending on the key exchange algorithm used, the first secret value may be a value obtained by performing a predetermined operation on the secret key S#1, the second secret value may be a value obtained by performing a predetermined operation on the value of the secret key S#2, and the public value may be a value shared between the management server 300 and WD100 in any way. The storage unit 33 also stores the public key P#2 corresponding to the secret key S#2.

[0043] <Example configuration of wireless device 100> Figure 5 is a schematic diagram of the wireless device 100. The wireless device 100 includes a communication unit 10, a processing unit 11, and a SIM 12. The processing unit 11 includes, for example, one or more processors and one or more memory devices. The one or more memory devices may include volatile memory devices and non-volatile memory devices. The processing unit 11 functions as an acquisition unit 1, a generation unit 2, and a presentation unit 3 by having one or more processors execute computer programs stored in the one or more memory devices. The communication unit 10 is responsible for communication processing via, for example, the network 200. When the communication unit 10 accesses the network 200 via a mobile communication network, it uses a profile stored in the SIM 12.

[0044] The acquisition unit 1 acquires AC (first information) from the management server 300, which includes access information indicating the storage server 400 to access in order to download the profile to be stored in the SIM 12, and a specific identifier (specific information) for identifying the profile in the storage server 400.

[0045] The generation unit 2 generates a shared value to be shared with the management server 300 using a key sharing algorithm. The presentation unit 3, upon accessing the storage server 400 based on AC, presents the shared value or a value based on the shared value to the storage server 400 in response to a request from the storage server 400. The value based on the shared value may be, for example, the hash value of the shared value. Alternatively, the value based on the shared value may be a value obtained by performing an operation on the shared value and another value. Furthermore, the value based on the shared value may be a value associated with the profile downloaded by WD100, for example, the ICCID value.

[0046] The generation unit 2 obtains, for example, a second calculated value from the management server 300 based on a public value shared with the management server 300 and a second secret value secretly held by the management server 300, and calculates a shared value based on the first secret value and the second calculated value secretly held by a storage unit (not shown) of the processing unit 11 of the WD100. In the first and second embodiments, the public value is the base point G, the second secret value is the value of the secret key S#2, the second calculated value is the value of the public key P#2, and the first secret value is the value of the secret key S#1. However, depending on the key exchange algorithm used, the first secret value may be a value obtained by performing a predetermined operation on the secret key S#1, the second secret value may be a value obtained by performing a predetermined operation on the value of the secret key S#2, and the public value may be a value shared between the management server 300 and the WD100 in any way. The storage unit (not shown) of the processing unit 11 also stores the public key P#1 corresponding to the secret key S#1.

[0047] For example, the secret key S#1 of the embodiment corresponding to the first secret value may be stored in a tamper-resistant SIM12. When the secret key S#1 is stored in the SIM12, the generation unit 2 reads the secret key S#1 from the SIM12 and generates the shared value SS#1. When the secret key S#1 is stored in the SIM12, the operation to generate the shared value SS#1 or the operation to generate the CC value CC#1 may be performed within the SIM12. In this case, the generation unit 2 notifies the SIM12 of the information necessary to generate the shared value SS#1, namely the public key P#1 of the embodiment. The generation unit 2 then obtains the shared value SS#1 from the SIM12 and generates the CC value CC#1. Alternatively, the generation unit 2 notifies the SIM12 of the information necessary to generate the CC value CC#1, namely the public key P#1 and the ICCID value of the embodiment. The generation unit 2 then obtains the value CC#1 from the SIM12.

[0048] Furthermore, the Disclosure provides a program executable on one or more processors. The program, when executed on one or more processors of a device or apparatus, includes instructions that cause the device or apparatus to function, for example, as a management server 300 or WD100. Furthermore, the Disclosure provides a non-temporary computer-readable storage medium storing the program. Furthermore, the Disclosure provides a method for the WD100 or management server 300 to perform the processes illustrated in Figures 2 and 3. Furthermore, the Disclosure provides a program for causing a device having one or more processors to execute these methods, and a non-temporary computer-readable storage medium storing the program.

[0049] This configuration reduces the risk of WD profiles being downloaded by other WDs. Therefore, it becomes possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs): "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0050] The invention is not limited to the embodiments described above, and various modifications and changes are possible within the scope of the gist of the invention. [Explanation of Symbols]

[0051] 30: Notification section, 31: Generation section, 32: Configuration section

Claims

1. It is a management server, Notification means for notifying the wireless device of first information including access information indicating a storage server that the wireless device accesses to download a profile, and identification information for identifying the profile on the storage server, A generation means for generating a shared value to be shared with the wireless device using a key sharing algorithm, A configuration means for configuring the storage server such that when the wireless device accesses the storage server based on the first information, the storage server requests the wireless device to provide the shared value or a value based on the shared value, A management server equipped with these features.

2. The generation means obtains a first calculated value based on a public value and a first secret value secretly held by the wireless device, and determines the shared value based on a second secret value secretly held by the management server and the first calculated value. The first secret value is a value based on the first secret key of the wireless device used for authentication of the wireless device by the management server, The management server according to claim 1, wherein the second secret value is a value based on the second secret key of the management server used for authentication of the management server by the wireless device.

3. The first secret value is the value of the first secret key, The second secret value is the value of the second secret key, The management server according to claim 2, wherein the first calculated value is the value of the first public key of the wireless device, which is the pair of the first secret key.

4. The management server according to claim 3, wherein the key sharing algorithm is an elliptic curve Diffie-Hellman key sharing algorithm.

5. The management server according to claim 1, wherein the value based on the shared value is a value based on the shared value and the profile identifier.

6. The management server according to claim 5, wherein the identifier of the profile is an integrated circuit card identifier (ICCID).

7. A program that, when executed on one or more processors of a device having one or more processors, causes the device to function as a management server according to any one of claims 1 to 6.

8. A wireless device, An acquisition means for obtaining first information from a management server, which includes access information indicating a storage server to be accessed in order to download the profile, and identification information for identifying the profile on the storage server. A generation means that generates a shared value to be shared with the management server using a key sharing algorithm, When accessing the storage server based on the first information, a presentation means presents the shared value or a value based on the shared value to the storage server, A wireless device equipped with these features.

9. The generation means obtains a second calculated value based on the public value and a second secret value secretly held by the management server, and determines the shared value based on the first secret value secretly held by the wireless device and the second calculated value. The first secret value is a value based on the first secret key of the wireless device used for authentication of the wireless device by the management server, The wireless device according to claim 8, wherein the second secret value is a value based on the second secret key of the management server used for authentication of the management server by the wireless device.

10. The first secret value is the value of the first secret key, The second secret value is the value of the second secret key, The wireless device according to claim 9, wherein the second calculated value is the value of the second public key of the management server, which is the pair of the second secret key.

11. The wireless device according to claim 10, wherein the key sharing algorithm is an elliptic curve Diffie-Hellman key sharing algorithm.

12. The wireless device according to claim 8, wherein the value based on the shared value is a value based on the shared value and the profile identifier.

13. The wireless device according to claim 12, wherein the identifier of the profile is an integrated circuit card identifier (ICCID).

14. A program that, when executed on one or more processors of a device having one or more processors, causes the device to function as a wireless device according to any one of claims 8 to 13.

Images