COMMUNICATION SYSTEM, DOWNLOAD REQUEST MANAGEMENT METHOD, AND PROGRAM

Abstract

To provide a method for properly managing a download request for a profile, a program, and a communication system.SOLUTION: In a communication system, a relay server SA2 issues, on receipt of a request to update a line use contract from a communication terminal T1, a session ID for managing a download request for a new profile for a communication terminal T2 to use a communication line, and manages the session ID in association with an access code of the relay server SA2. When the access code is transmitted to the communication terminal T1, the communication terminal T2 transmits a download request including the access code to the relay server SA2 via the communication terminal T1. The relay server SA2 determines whether or not the download request is reliable on the basis of a status of the session ID associated with the access code, and transmits, when it is reliable, an activation code including access information of an SM-DP+ server SA3 that stores the new profile, to the communication terminal T2.SELECTED DRAWING: Figure 8

Description

[Technical field]

[0001] The present invention relates to the technical field of a method for downloading a profile for using a communication line of a mobile communication carrier from a communication terminal. [Background technology]

[0002] Conventionally, a subscriber identity module (SIM (Subscriber Identity Module)) used in a communication terminal such as a smartphone is written with a profile (a group of information managed by a mobile communication operator) of a specific mobile communication operator at the time of manufacture, becomes a subscriber identity module dedicated to one mobile communication operator (MNO (Mobile Network Operator)), and is removably mounted in the communication terminal as a universal integrated circuit card (UICC). Therefore, when a user switches from one mobile communication operator to another, it is necessary to physically replace the original UICC with the new UICC in the communication terminal.

[0003] In contrast, an embedded subscriber identity module (eSIM) formulated by the standardization organization GSMA is manufactured in a state where it is unremovably embedded in a communication terminal as an eUICC (Embedded Universal Integrated Circuit Card). After manufacturing, the profile of a mobile communication operator can be written to the UICC via the communication line (mobile line) of the mobile communication operator by OTA (Over the air), so that a user does not need to replace it when switching mobile communication operators. Non-Patent Documents 1 and 2 disclose that a profile is downloaded from an SM (Subscription Manager)-DP (Data Preparation)+ by an LPA (Local Profile Assistant) function in a communication terminal (device) and stored in the eUICC. The communication terminal accesses the SM-DP+ using address information of the SM-DP+ provided in advance and makes a download request. The download request includes an EID (eUICC Identifier), which is a unique identifier of the eUICC. For this reason, the SM-DP+ can use the EID to identify the profile to be sent to the eUICC. [Prior art documents] [Patent documents]

[0004] [Non-Patent Document 1] GSM Association Official Document SGP.21-RSP Architecture Version 2.1 27 February 2017 [Non-Patent Document 2] GSM Association Official Document SGP.22-RSP Technical Specification Version 2.2 01 September 2017 Summary of the Invention [Problem to be solved by the invention]

[0005] Incidentally, when changing the model of a communication terminal, for example, it is necessary to download an individualized profile including existing contract information. Since the contract information includes personal information of the user of the communication terminal, it is problematic if the same profile is downloaded to multiple communication terminals, or if a profile is downloaded to a communication terminal that is not intended by the user or the mobile communication carrier. However, in the past, the address information of the SM-DP+ provided to the communication terminal and the download request associated with it have not been properly managed.

[0006] Therefore, the present invention has been made in consideration of the above points, and an object of the present invention is to provide a communication system, a download request management method, and a program capable of appropriately managing profile download requests. [Means for solving the problem]

[0007] In order to solve the above problem, the invention described in claim 1 is a communication system having one or more servers, comprising: a session ID management unit that issues a session ID for managing a download request of a new profile for a second communication terminal equipped with a subscriber identification module to use a communication line of a mobile communication carrier when a request for renewal of a line usage contract is received from a first communication terminal equipped with a subscriber identification module, and manages the issued session ID in association with access information for accessing a server that accepts the download request; a download request receiving unit that receives the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; a reliability determination unit that determines whether the download request is reliable based on a status of the session ID that is managed in association with the access information contained in the received download request; and an access information transmission unit that transmits access information for accessing a server that stores the new profile to the second communication terminal when it is determined that at least the download request is reliable.

[0008] The invention described in claim 2 is characterized in that, in the communication system described in claim 1, a subscriber identity module provided in the first communication terminal has a profile written therein for using the communication line of the mobile communication carrier.

[0009] The invention described in claim 3 is characterized in that, in the communication system described in claim 1 or 2, it further comprises a contract information management unit that manages the session ID in association with contract information required for updating the line usage contract, a contract information identification unit that identifies the contract information based on the session ID when the download request is determined to be reliable, and a profile generation unit that generates the new profile based on the identified contract information.

[0010] The invention described in claim 4 is characterized in that, in the communications system described in claim 3, the system further includes a download permission determination unit that, when it is determined that the download request is reliable, acquires unique identification information of a subscriber identity module provided in the second communications terminal, and determines whether or not to permit downloading of the new profile based on manufacturer information included in the unique identification information, and when it is determined that the downloading of the new profile is permitted, the profile generation unit generates the new profile based on the contract information.

[0011] The invention described in claim 5 is characterized in that, in the communication system described in claim 1 or 2, the access information for accessing the server that accepts the download request includes an individualized resource URL (Uniform Resource Locator) on the server.

[0012] The invention described in claim 6 is a download request management method executed by one or more servers, comprising the steps of: when a request for updating a line usage contract is received from a first communication terminal equipped with a subscriber identification module, a second communication terminal equipped with a subscriber identification module issues a session ID for managing a download request of a new profile for using a communication line of a mobile communication carrier, and managing the issued session ID in association with access information for accessing a server that accepts the download request; transmitting the access information to the first communication terminal; receiving the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; determining whether the download request is reliable based on a status of the session ID managed in association with the access information included in the received download request; and when it is determined that at least the download request is reliable, transmitting access information for accessing a server that stores the new profile to the second communication terminal.

[0013] The invention described in claim 7 is characterized in that it causes a computer to function as a session ID management unit that issues a session ID for managing a download request of a new profile for a second communication terminal equipped with a subscriber identification module to use a communication line of a mobile communication carrier when a request for renewal of a line usage contract is received from a first communication terminal equipped with a subscriber identification module, and manages the issued session ID in association with access information for accessing a server that accepts the download request; a download request receiving unit that receives the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; a reliability determination unit that determines whether the download request is reliable based on the status of the session ID that is managed in association with the access information contained in the received download request; and an access information transmission unit that transmits access information for accessing a server that stores the new profile to the second communication terminal when it is determined that at least the download request is reliable. Effect of the Invention

[0014] According to the present invention, profile download requests can be appropriately managed. [Brief description of the drawings]

[0015] [Figure 1] 1 is a diagram illustrating an example of a schematic configuration of a communication system S according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a schematic configuration of communication terminals T1 and T2. [Diagram 3] FIG. 2 is a diagram illustrating an example of a software configuration within an eUICC mounted on communication terminals T1 and T2. [Figure 4] FIG. 2 is a diagram showing the data structure of an EID assigned to an eUICC. [Diagram 5] FIG. 2 is a diagram illustrating an example of a schematic configuration of an MNO server SA1. [Figure 6] 2 is a diagram illustrating an example of a schematic configuration of a relay server SA2. [Figure 7] 11 is a sequence diagram showing an example of an operation from a communication terminal T1 making a request to update a line service contract to a communication terminal T2 downloading a new profile. FIG. [Figure 8] 11 is a sequence diagram showing an example of an operation from a communication terminal T1 making a request to update a line service contract to a communication terminal T2 downloading a new profile. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0017] [1. Overview of communication system S] First, referring to Fig. 1, a schematic configuration of a communication system S according to an embodiment of the present invention will be described. Fig. 1 is a diagram showing a schematic configuration example of the communication system S according to the present embodiment. As shown in Fig. 1, the communication system S includes a communication terminal T1, a communication terminal T2, an MNO server SA1, a relay server SA2, and an SM-DP+ server SA3. The MNO server SA1 is connected to a communication line (mobile line) NW1 of a mobile communication operator and the Internet NW2. The communication line NW1 is, for example, a communication line such as a 3G, 4G, or 5G line. The relay server SA2 and the SM-DP+ server SA3 are each connected to the Internet NW2.

[0018] The communication terminal T1 (an example of a first communication terminal) and the communication terminal T2 (an example of a second communication terminal) are mobile terminals (mobile devices) such as smartphones used by the same user, and each includes an eUICC (embedded subscriber identity module). For example, the eUICC is mounted (for example, soldered) on a board so that it cannot be easily removed or replaced from the communication terminals T1 and T2. The communication terminal T1 is an old communication terminal in which a profile of a mobile communication carrier with which the communication terminal T1 has a contract to use the communication line NW1 is written (stored) in the eUICC. On the other hand, the communication terminal T2 is a new communication terminal in which such a profile has not yet been written in the eUICC. Such a profile is a profile (information group) for the communication terminals T1 and T2 to use (use during the contract) the communication line NW1 of the mobile communication carrier, and includes user contract information. The communication terminals T1 and T2 have a browser function and can connect to the Internet NW2 via a wireless LAN (Local Area Network) such as Wi-Fi (registered trademark).

[0019] The MNO server SA1 is a server operated by a mobile communication carrier, supports a contract between the mobile communication carrier and the users of the communication terminals T1 and T2, and manages the contract information of the users who have made the contract. Here, the contract between the mobile communication carrier and the users of the communication terminals T1 and T2 is a service contract (line service contract) for the communication line NW1 of the mobile communication carrier. The relay server SA2 is a server having a function for enabling appropriate management of a profile download request. That is, in the past, a profile download request was sent from the communication terminals T1 and T2 to the SM-DP+ server SA3, and the profile was provided to the communication terminals T1 and T2, but in this embodiment, the download request from the communication terminals T1 and T2 is once received and processed by the relay server SA2, so that the download request is appropriately managed and controlled.

[0020] In this embodiment, an example is shown in which the relay server SA2 is configured separately from the MNO server SA1 and the SM-DP+ server SA3, but the function of the relay server SA2 may be incorporated into the MNO server SA1. Alternatively, the function of the relay server SA2 may be incorporated into the SM-DP+ server SA3. The SM-DP+ server SA3 is a server that provides the profile to the communication terminals T1 and T2 of users who have completed their line usage contracts, and stores the profile in association with (linked to) an identifier called a MatchingID.

[0021] Fig. 2 is a diagram showing an example of a schematic configuration of the communication terminals T1 and T2. As shown in Fig. 2, the communication terminals T1 and T2 are configured to include an I / F unit 1, a wireless communication unit 2, a storage unit 3, an operation / display unit 4, and a control unit 5. The I / F unit 1 serves as an interface with the eUICC. Examples of this interface include SPI (Serial Peripheral Interface), I 2 C (Inter-Integrated Circuit), or an ISO 7816 interface. The wireless communication unit 2 is a communication module for connecting to the Internet NW2 via a wireless LAN (Local Area Network) such as Wi-Fi (registered trademark), or for connecting to the communication line NW1.

[0022] FIG. 3 is a diagram showing an example of the software configuration in an eUICC mounted on communication terminals T1 and T2. In FIG. 3, an ISD (Issuer Security Domain)-R (Root) serves as an administrator of an ISD-P (Profile). The ISD-R enables the generation or deletion of an ISD-P. The ISD-R is generated, for example, only once in a factory when the eUICC is manufactured. An ECASD (eUICC Certificate Authority Security Domain) serves to securely generate keys for the ISD-R and ISD-P. The ECASD manages the EID of the eUICC. The EID of the eUICC is an individual identifier (unique identification information) assigned to the eUICC. FIG. 4 is a diagram showing the data structure of the EID of the eUICC. As shown in FIG. 4, the EID includes an identifier, a country code, a manufacturer number, manufacturer information, an individual number, and a check digit. The manufacturer of an eUICC to which an EID is assigned can be identified, for example, by the country code and manufacturer number included in the EID.

[0023] The ISD-P plays the role of managing the mobile carrier's profile. After the manufacture of the eUICC, the ISD-P can be generated in the market for each download of the mobile carrier's profile. The mobile carrier's profile includes information such as the File System, MNO-SD (Security Domain), SSD (Supplementary Secure Domain), and Application. The File System includes information such as the ICCID (Integrated Circuit Card Identifier), IMSI (International Mobile Subscriber Identity), and MSISDN (Mobile Subscriber International Subscriber Directory Number: the telephone number of the subscriber user). The MNO-SD plays the role of managing the area managed by the mobile carrier. The MNO-SD makes it possible to create or delete the SSD. The SSD plays the role of managing the application. The SSD makes it possible to create or delete the application. The application plays the role of a service provider.

[0024] The profiles of mobile communication carriers can be stored in the eUICC, for example, by distinguishing between different mobile communication carriers. In the example of Fig. 3, they are represented as Profile 1 to Profile n and ISD-P1 to ISD-Pn, and one of these multiple Profiles 1 to n, Profile 1 (shown by a solid line in the figure), is in an enabled state (i.e., available state). The communication line NW1 of the mobile communication carrier that manages the enabled Profile 1 becomes available for communication by the eUICC.

[0025] The storage unit 3 is composed of, for example, a non-volatile memory, and stores an operating system, applications, and the like. This application performs a browser function and a profile management function. The profile management function has an LPA function for downloading a profile of a mobile communication operator from the SM-DP+ server SA3. The LPA function may be installed in an eUICC mounted on the communication terminals T1 and T2. The storage unit 3 also stores access information of the MNO server SA1. The access information of the MNO server SA1 is access information for accessing the MNO server SA1, and indicates the address of the MNO server SA1 (for example, a URL (Uniform Resource Locator)). The operation / display unit 4 includes an operation unit for receiving input from a user, and a display unit having a display for displaying information.

[0026] The control unit 5 is composed of, for example, a CPU (Central Processing Unit), a RAM (Random Access Memory), and a ROM (Read Only Memory). The control unit 5 of the communication terminal T1, which has already acquired a profile for using the communication line NW1 and written it to the eUICC, accesses the MNO server SA1 using a browser function according to the access information of the address of the MNO server SA1, and transmits to the MNO server SA1 a renewal request (application for contract renewal) for the line usage contract specified by the user on the contract procedure page provided by the MNO server SA1. The renewal request includes contract information required for renewal of the line usage contract.

[0027] The control unit 5 of the communication terminal T1 receives an access code of the relay server SA2 provided by the MNO server SA1 in response to an update request to the MNO server SA1. The access code is access information for accessing the relay server SA2 that accepts a download request of a new profile for the communication terminal T2 to use the communication line NW1, and includes an individualized resource URL (Uniform Resource Locator) on the relay server SA2. In other words, the resource URL is different for each user.

[0028] Meanwhile, the control unit 5 of the communication terminal T2, which has not yet acquired a profile for using the communication line NW1, acquires an access code of the relay server SA2 from the communication terminal T1 in accordance with a user operation, accesses the relay server SA2 according to the access code using a browser function, and transmits to the relay server SA2 the EID of the eUICC included in the communication terminal T2 together with a download request for a new profile (including the access code of the relay server SA2).Then, the control unit 5 of the communication terminal T2 receives the activation code provided by the relay server SA2 in response to the download request to the relay server SA2.

[0029] Here, the activation code is information required to download a new profile, and includes access information of the SM-DP+ server SA3 and a character string for identifying the above-mentioned MatchingID. The access information of the SM-DP+ server SA3 is access information for accessing the SM-DP+ server SA3, and indicates the address (e.g., URL) of the SM-DP+ server SA3. The control unit 5 of the communication terminal T2 accesses the SM-DP+ server SA3 according to the access information of the SM-DP+ server SA3 using the LPA function to download the new profile, stores the downloaded profile in the eUICC, and enables the profile stored in the eUICC to perform communication using the communication line NW1.

[0030] FIG. 5 is a diagram showing an example of a schematic configuration of the MNO server SA1. As shown in FIG. 5, the MNO server SA1 is configured with a communication unit 11, a storage unit 12, a control unit 13, and the like. The communication unit 11 is a communication module for connecting to the communication line NW1 and the Internet NW2. The storage unit 12 stores a server program and data. The control unit 13 is configured with, for example, a CPU, a RAM, a ROM, and the like, and executes various processes according to, for example, a server program stored in the storage unit 12. The server program causes the control unit 13 to function as a contract information management unit 131, an access code / session ID processing unit 132, a contract information identification unit 133, a download permission determination unit 134, a profile generation unit 135, and a profile registration unit 136.

[0031] The storage unit 12 also has a user database (DB) 121. In the user database 121, a UID (user identification information), a password, a name, a telephone number, an email address, and contract information are registered for each user. The UID and password are user authentication information and are used for logging in. The contract information includes the user's telephone number and information on the communication terminal using the communication line NW1. The storage unit 12 also stores a list indicating manufacturers of eUICCs (hereinafter referred to as a "manufacturer list"). Here, one or more manufacturers indicated in the manufacturer list are, for example, companies selected by the mobile communication carrier as manufacturers that meet the selection criteria of the mobile communication carrier, and the manufacturer list in this case is referred to as a "permitted manufacturer list". Alternatively, the manufacturer list may indicate companies selected by the mobile communication carrier as manufacturers that do not meet the selection criteria of the mobile communication carrier, and the manufacturer list in this case is referred to as a "non-permitted manufacturer list". Note that the selection criteria stipulate various predetermined conditions for the eUICC, such as security measures.

[0032] When there is a request to update the line usage contract from the communication terminal T1, the contract information management unit 131 registers the contract information required to update the line usage contract in the user database 121 in response to the update request, and transmits an update response instruction to the relay server SA2. Such an update response instruction includes an instruction to the relay server SA2 to generate an access code for the relay server SA2 and an instruction to issue a session ID. The session ID is identification information for managing a download request of a new profile for the communication terminal T2 to use the communication line NW1, and may be, for example, a random number of a predetermined length.

[0033] The access code / session ID processing unit 132 receives the access code and session ID of the relay server SA2 provided by the relay server SA2 in response to the update instruction. The access code / session ID processing unit 132 then records and manages the session ID in association with contract information required for updating the line usage contract, and transmits the access code of the relay server SA2 to the communications terminal T1. When it is determined (determined by the relay server SA2) that the download request transmitted from the communications terminal T2 to the relay server SA2 together with the EID of the eUICC is reliable, the contract information identification unit 133 acquires the session ID provided by the relay server SA2 and identifies the contract information based on the session ID.

[0034] When it is determined that the download request is reliable, the download permission determination unit 134 acquires the EID of the eUICC included in the communication terminal T2 provided by the relay server SA2, and determines whether or not to permit the communication terminal T2 to download a new profile for using the communication line NW1 based on the manufacturer information and manufacturer list included in the EID. This makes it possible to prevent, for example, a mobile communication operator's profile from being written to an eUICC with insufficient security measures, and to avoid risks such as leakage of a key for connecting to the mobile communication operator's communication line NW1.

[0035] When the download permission determination unit 134 determines that download of the new profile is permitted, the profile generation unit 135 generates a new profile and an activation code based on the contract information identified by the contract information identification unit 133. The profile registration unit 136 transmits a profile registration instruction to the SM-DP+ server SA3 together with the new profile generated by the profile generation unit 135, the EID of the eUICC included in the communication terminal T2, and the Matching ID. In response to the profile registration instruction, the SM-DP+ server SA3 stores the new profile in association with the EID and Matching ID. Furthermore, the profile registration unit 136 transmits the activation code generated by the profile generation unit 135 to the relay server SA2.

[0036] FIG. 6 is a diagram showing an example of a schematic configuration of the relay server SA2. As shown in FIG. 6, the relay server SA2 is configured with a communication unit 21, a storage unit 22, a control unit 23, and the like. The communication unit 21 is a communication module for connecting to the Internet NW2. The storage unit 22 stores a server program and data. The control unit 23 is configured with, for example, a CPU, a RAM, a ROM, and the like, and executes various processes according to, for example, a server program stored in the storage unit 22. The server program causes the control unit 23 to function as an access code generation unit 231, a session ID management unit 232, an access code / session ID transmission unit 233, a download request reception unit 234, a reliability determination unit 235, an EID / session ID transmission unit 236, and an activation code processing unit 237 (an example of an access information transmission unit).

[0037] When there is a request to update the line usage contract from the communication terminal T1, the access code generation unit 231 receives an update response instruction from the MNO server SA1 and generates an access code for the relay server SA2. When there is a request to update the line usage contract from the communication terminal T1, the session ID management unit 232 receives an update response instruction from the MNO server SA1 and issues a session ID, records the issued session ID in association with the access code of the relay server SA2, and manages the status of the session ID.

[0038] Here, the status of the session ID is managed for each session ID, and may be a valid / invalid flag indicating whether or not to respond to a download request, or a counter indicating the number of times a download request has been received. For example, the valid / invalid flag is configured such that when a download request including the access code of relay server SA2 is received, the valid / invalid flag is set to invalid (e.g., 0), and thereafter, even if a download request including the same access code is received, the download request is not accepted. The counter indicating the number of times a download request has been received is incremented by one each time a download request including the same access code is received.

[0039] The access code / session ID sending unit 233 sends to the MNO server SA1 the access code generated by the access code generating unit 231 and the session ID issued by the session ID managing unit 232. The download request receiving unit 234 receives the EID of the eUICC included in the communication terminal T2 together with a download request for a new profile (including the access code of the relay server SA2) sent by the communication terminal T2 that has acquired the access code of the relay server SA2 via the communication terminal T1.

[0040] The reliability determination unit 235 determines whether or not a download request received by the download request receiving unit 234 is reliable based on the status of a session ID managed in association with an access code included in the download request. For example, if the valid / invalid flag is set to invalid, the download request is determined to be unreliable. Alternatively, if a counter indicating the number of times the download request has been received exceeds a threshold value (e.g., 3 times), the download request is determined to be unreliable.

[0041] When the reliability determination unit 235 determines that the download request is reliable, the EID / session ID transmission unit 236 transmits to the MNO server SA1 the session ID managed in association with the access code included in the download request received by the download request receiving unit 234, and the EID received together with the download request.

[0042] The activation code processing unit 237 receives the activation code transmitted from the MNO server SA1 and transmits the activation code to the communication terminal T2. That is, it is desirable for the activation code processing unit 237 to transmit the activation code to the communication terminal T2 when the reliability determination unit 235 determines that the download request is reliable and the download permission determination unit 134 determines that the download of the new profile is permitted.

[0043] [2. Operation of communication system S] Next, the operation of the communication system S according to this embodiment will be described with reference to Figs. 7 and 8. Figs. 7 and 8 are sequence diagrams showing an example of the operation from a request for updating the line usage contract by the communication terminal T1 to downloading a new profile by the communication terminal T2. As a prerequisite for this operation, the communication terminal T1 accesses the MNO server SA1 via the communication line NW1 according to the access information of the MNO server SA1, and transmits a login request to the MNO server SA1. The login request includes user authentication information input by the user. When the MNO server SA1 receives the login request from the communication terminal T1, it performs user authentication based on the user authentication information, and if the user authentication information is registered in the user database 121, the user of the communication terminal T1 is authenticated. If the user is authenticated, as shown in Fig. 7, the MNO server SA1 transmits a contract procedure page related to the line usage contract to the communication terminal T1 via the communication line NW1 (step S1).

[0044] When the communication terminal T1 receives the contract procedure page from the MNO server SA1, the communication terminal T1 displays the contract procedure page on the display by using a browser function (step S2). The contract procedure page thus displayed has selection items related to the usage contract of the communication line NW1. For example, when the user wishes to change the model from the communication terminal T1 to the communication terminal T2, or when the user wishes to use the communication line NW1 with a second communication terminal T2 in addition to the communication terminal T1, the user selects a selection item corresponding to the renewal of the line usage contract. As a result, the user inputs contract information (renewal information) required for renewal of the line usage contract from the input field displayed on the contract procedure page, and then, when the execute button for the renewal is selected, the communication terminal T1 transmits a request for renewal of the line usage contract to the MNO server SA1 via the communication line NW1 (step S3). The request for renewal of the line usage contract includes the contract information required for renewal of the line usage contract.

[0045] Next, when the MNO server SA1 receives an update request from the communication terminal T1, the MNO server SA1 (contract information management unit 131) registers contract information required for updating the line usage contract in response to the update request in the user database 121 (step S4). Next, the MNO server SA1 (contract information management unit 131) transmits an update response instruction, including an instruction to generate an access code for the relay server SA2 and an instruction to issue a session ID, to the relay server SA2 via the Internet NW2 (step S5).

[0046] Next, when the relay server SA2 receives an update instruction from the MNO server SA1, the relay server SA2 (access code generating unit 231) generates an access code for the relay server SA2 (step S6). Next, the relay server SA2 (session ID managing unit 232) issues a session ID and records the issued session ID in association with the access code for the relay server SA2 (step S7). After that, the status of the issued session ID is managed by the relay server SA2.

[0047] Next, the relay server SA2 (access code / session ID transmission unit 233) transmits the access code generated in step S6 and the session ID issued in step S7 to the MNO server SA1 via the Internet NW2 (step S8). The relay server SA2 may generate a one-time password for user authentication in accordance with the security policy of the relay server SA2, record the generated access code and session ID in association with each other, and transmit the one-time password together to the MNO server SA1. The one-time password is a password that can be used only once or for a certain period of time.

[0048] Next, when the MNO server SA1 receives the access code and session ID from the relay server SA2, the MNO server SA1 (access code / session ID processing unit 132) records the session ID in association with contract information required for updating the line usage contract (step S9). Next, the MNO server SA1 (access code / session ID processing unit 132) transmits the access code of the relay server SA2 to the communication terminal T1 via the communication line NW1 (step S10). Here, the MNO server SA1 may encode the access code of the relay server SA2 to generate a QR code (registered trademark), and transmit the QR code (registered trademark) to the communication terminal T1. When the MNO server SA1 receives the one-time password from the relay server SA2, the one-time password may be transmitted to, for example, the email address of the user of the communication terminal T1 or T2, depending on the policy of the mobile communication operator.

[0049] Next, when the communication terminal T1 receives the access code from the MNO server SA1, the communication terminal T1 displays the access code on the display (step S11). Note that, when a QR code (registered trademark) generated from the access code of the relay server SA2 is received, the QR code (registered trademark) is displayed on the communication terminal T1. Next, when the user performs an operation to have the communication terminal T2 read the access code (for example, the QR code (registered trademark)) displayed on the communication terminal T1, as shown in FIG. 8, the communication terminal T2 acquires the access code (step S12). Note that the access code may be transmitted from the communication terminal T1 to the communication terminal T2 by contactless communication between the communication terminal T1 and the communication terminal T2. Next, the communication terminal T2 acquires an EID from an eUICC mounted therein (step S13).

[0050] Next, communication terminal T2 accesses relay server SA2 via Internet NW2 according to the access code acquired in step S12, and transmits a download request (a request to download a new profile) including the access code acquired in step S11 and the EID acquired in step S13 to relay server SA2 (step S14). Note that when the one-time password is received and displayed by communication terminal T1, if the one-time password is input by the user to communication terminal T2, the one-time password is transmitted to relay server SA2 together with the request to download a new profile.

[0051] Next, when the relay server SA2 receives a download request from the communication terminal T2, the relay server SA2 (trustworthiness determination unit 235) identifies a session ID that is managed in association with the access code included in the received download request (step S15). At this time, the status of the session ID (e.g., a valid / invalid flag, or a counter indicating the number of times of reception) is updated. Next, the relay server SA2 (trustworthiness determination unit 235) determines whether the received download request is trustworthy, as described above, based on the status of the session ID identified in step S15 (step S16).

[0052] If the received download request is determined to be unreliable (step S16: NO), information indicating a refusal to download the new profile (download refusal notification) is returned to the communication terminal T2 (step S17). On the other hand, if the received download request is determined to be reliable (step S16: YES), the relay server SA2 (EID / session ID transmission unit 236) transmits the session ID identified in step S15 and the EID included in the download request to the MNO server SA1 via the Internet NW2 (step S18).

[0053] When a one-time password is received together with a download request for a new profile, the received one-time password is compared with the one-time password associated with the access code included in the download request, and only if they match, it may be determined whether the download request is reliable. If both one-time passwords do not match, information indicating a refusal to download the new profile (download refusal notice) is returned to the communication terminal T2.

[0054] Next, when the MNO server SA1 receives the EID and session ID from the relay server SA2, the MNO server SA1 (contract information identification unit 133) identifies the contract information associated with the received session ID (step S19). Next, the MNO server SA1 (download permission determination unit 134) identifies the manufacturer based on the manufacturer information included in the received EID (step S20).

[0055] Next, the MNO server SA1 (download permission determination unit 134) determines whether or not to permit downloading of the new profile based on the manufacturer list stored in the storage unit 12 and the manufacturer identified in step S20 (step S21). Here, when the permitted manufacturer list is used as the manufacturer list, if the permitted manufacturer list includes (is indicated by) the manufacturer identified in step S20, it is determined that downloading of the profile is permitted. On the other hand, when the unpermitted manufacturer list is used as the manufacturer list, if the manufacturer identified in step S20 is not included (is not indicated by) the unpermitted manufacturer list, it is determined that downloading of the profile is permitted.

[0056] Then, if it is determined that the download of the new profile is not permitted (step S21: NO), information indicating a refusal to download the new profile (download refusal notification) is returned from the MNO server SA1 to the relay server SA2 (step S22). Next, information indicating a refusal to download the new profile (download refusal notification) is returned from the relay server SA2 to the communication terminal T2 (step S23). On the other hand, if it is determined that the download of the new profile is permitted (step S21: YES), the MNO server SA1 (profile generation unit 135) generates a new profile and an activation code based on the contract information identified in step S19 (step S24).

[0057] Next, the MNO server SA1 (profile registration unit 136) transmits a profile registration instruction together with the new profile generated in step S24, the received EID, and the Matching ID to the SM-DP+ server SA3 via the Internet NW2 (step S25). Next, upon receiving the profile registration instruction from the MNO server SA1, the SM-DP+ server SA3 stores the received new profile in association with the EID and Matching ID (step S26).

[0058] Next, the MNO server SA1 (profile registration unit 136) transmits information indicating permission to download the new profile (download permission notification) together with the activation code generated in step S24 to the relay server SA2 via the Internet NW2 (step S27). Next, upon receiving the activation code and the information indicating permission to download from the MNO server SA1, the relay server SA2 (activation code processing unit 237) transmits the activation code and the information indicating permission to download to the communication terminal T2 via the Internet NW2 (step S28).

[0059] The above-mentioned processes of steps S20 and S21 may be omitted. In this case, when the MNO server SA1 identifies the contract information in step S19, it generates a new profile and an activation code based on the contract information (step S24) and proceeds to step S25. That is, in this case, if the relay server SA2 determines that the download request is reliable, a new profile and an activation code are generated and transmitted to the communication terminal T2.

[0060] Next, when the communication terminal T2 receives the activation code and information indicating download permission from the MNO server SA1, it starts a download sequence for the new profile. In the download sequence, the communication terminal T2 accesses the SM-DP+ server SA3 via the Internet NW2 according to the access information for the SM-DP+ server SA3 included in the activation code, and transmits a download request for the new profile (including a Matching ID) to the SM-DP+ server SA3. This download request (second time) includes a Matching ID and is different from the download request (first time) transmitted from the communication terminal T2 in step S14.

[0061] Then, when the SM-DP+ server SA3 receives a download request from the communication terminal T2, it acquires a new profile associated with the Matching ID included in the download request, and transmits the acquired new profile to the communication terminal T2 via the Internet NW2. In this way, the communication terminal T2 writes the downloaded new profile into the eUICC using the ISD-R, activates the new profile, performs a connection process to the communication line NW1 using the activated new profile, and then performs communication using the communication line NW1.

[0062] As described above, according to the above embodiment, when a request for updating the line usage contract is made from the communication terminal T1 in the communication system S, the relay server SA2 issues a session ID for managing a download request of a new profile for the communication terminal T2 to newly use the communication line NW1, and manages the issued session ID in association with the access code of the relay server SA2. Then, when the access code of the relay server SA2 is transmitted to the communication terminal T1, the communication terminal T2, which has acquired the access code via the communication terminal T1, transmits a download request including the access code to the relay server SA2. The relay server SA2 is configured to determine whether the download request is reliable or not based on the status of the session ID that is managed in association with the access code contained in the download request, and transmits an activation code including access information of the SM-DP+ server SA3 that stores the new profile to the communication terminal T2 when it is determined that at least the download request is reliable, so that the download request of the new profile when updating the line usage contract can be appropriately managed and controlled. This makes it possible to prevent the same profile from being downloaded to a plurality of communication terminals T1 and T2, and to prevent a profile from being downloaded to a communication terminal that is not intended by the user and the mobile communication carrier.

[0063] In the above embodiment, an eUICC mounted on a board so as not to be easily removed or replaced from the communication terminals T1 and T2 has been described as an example of a subscriber identity module, but the present invention may be applied to an IC card such as a SIM card that is removable from the communication terminals T1 and T2. In the above embodiment, the MNO server SA1 is configured to transmit the access code of the relay server SA2 to the communication terminal T2, but the relay server SA2 may transmit the access code to the communication terminal T2 by the MNO server SA1 transmitting the IP address of the communication terminal T1 to the relay server SA2. In the above embodiment, the communication terminal T1 may access the MNO server SA1 via the Internet NW2 according to the access information of the MNO server SA1 and transmit a login request to the MNO server SA1. In this case, when the MNO server SA1 receives a login request from the communication terminal T1, it performs user authentication based on the user authentication information and transmits a contract procedure page related to the line usage contract to the communication terminal T1 via the Internet NW2, and in response to this, the communication terminal T1 may transmit an update request for the line usage contract to the MNO server SA1 via the Internet NW2. In this case, the above embodiment is applicable even if the communication terminal T1 does not obtain a profile for using the communication line NW1 and write it to the eUICC. [Explanation of symbols]

[0064] 1 I / F section 2 Wireless Communication Section 3 Storage section 4 Operation / display section 5. Control section 11,21 Communications Department 12,22 Storage section 13,23 Control section 131 Contract Information Management Department 132 Access code / session ID processing unit 133 Contract Information Identification Department 134 Download permission decision unit 135 Profile Generation Unit 136 Profile Registration Section 231 Access Code Generation Unit 232 Session ID Management Unit 233 Access code / session ID sender 234 Download request receiving unit 235 Reliability Judgment Department 236 EID Session ID sender 237 Activation code processing section SA1 MNO Server SA2 Relay Server SA3 SM-DP+ Server T1, T2 communication terminal NW1 communication line NW2 Internet

Claims

1. A communication system comprising one or more servers, a session ID management unit which, when a request for updating a line usage contract is received from a first communication terminal having a subscriber identity module, issues a session ID for managing a download request of a new profile for a second communication terminal having the subscriber identity module to use a communication line of a mobile communication carrier, and manages the issued session ID in association with access information for accessing a server that accepts the download request; a download request receiving unit that receives the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; a reliability determination unit that determines whether the received download request is reliable based on a status of the session ID that is managed in association with the access information included in the received download request; an access information transmitting unit that transmits, to the second communication terminal, access information for accessing a server that stores the new profile, when at least the download request is determined to be reliable; A communication system comprising:

2. 2. The communication system according to claim 1, wherein a profile for utilizing a communication line of the mobile communication carrier is written in a subscriber identity module provided in the first communication terminal.

3. a contract information management unit that manages the session ID in association with contract information required for updating the line usage contract; a contract information identification unit that identifies the contract information based on the session ID when the download request is determined to be reliable; a profile generating unit that generates the new profile based on the specified contract information; The communication system according to claim 1 or 2, further comprising:

4. a download permission determination unit that, when it is determined that the download request is reliable, acquires unique identification information of a subscriber identity module included in the second communication terminal, and determines whether or not to permit downloading of the new profile based on manufacturer information included in the unique identification information; 4. The communication system according to claim 3, wherein the profile generating section generates the new profile based on the contract information when it is determined that downloading of the new profile is permitted.

5. 3. The communication system according to claim 1, wherein the access information for accessing the server that accepts the download request includes a personalized resource URL (Uniform Resource Locator) on the server.

6. 1. A method for managing download requests executed by one or more servers, comprising: a step of, when a request for updating a line usage contract is received from a first communication terminal having a subscriber identity module, a second communication terminal having a subscriber identity module issuing a session ID for managing a download request of a new profile for using a communication line of a mobile communication carrier, and managing the issued session ID in association with access information for accessing a server that accepts the download request; transmitting the access information to the first communication terminal; receiving the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; determining whether the received download request is reliable based on a status of the session ID managed in association with the access information included in the received download request; transmitting, to the second communication terminal, access information for accessing a server that stores the new profile, when at least the download request is determined to be reliable; 23. A method for managing a download request, comprising:

7. a session ID management unit which, when a request for updating a line usage contract is received from a first communication terminal having a subscriber identity module, issues a session ID for managing a download request of a new profile for a second communication terminal having the subscriber identity module to use a communication line of a mobile communication carrier, and manages the issued session ID in association with access information for accessing a server that accepts the download request; a download request receiving unit that receives the download request including the access information transmitted by the second communication terminal that has acquired the access information via the first communication terminal; a reliability determination unit that determines whether the received download request is reliable based on a status of the session ID that is managed in association with the access information included in the received download request; A program characterized by causing a computer to function as an access information sending unit that sends access information for accessing a server that stores the new profile to the second communication terminal when at least the download request is determined to be reliable.

Images