Flexible Remote SIM Provisioning

Abstract

A method for creating / generating, on a data generating server, a profile image to be downloaded from a profile server to an eUICC hosted on a device for the purpose of installing a profile corresponding to the profile image on the eUICC, comprising: a) generating, in the data generating server, a plurality of non-personalized profile images (PI) for a plurality of devices, each non-personalized profile image (PI) including at least one functional identifier specific to a respective device, each non-personalized profile image (PI) not including an individual global identifier specific to an individual eUICC, and storing the generated plurality of non-personalized profile images (PI) for providing (GP) to the profile server; and b) generating, in the data generating server, at least one profile data image (PD) including the at least one individual global identifier for each eUICC, and storing the generated at least one profile data image (PD) for providing (GD) to the profile server.

Description

[Technical Field]

[0001] The present invention relates to remote SIM provisioning, i.e. the provisioning of a profile of a Subscriber Identity Module (abbreviated SIM) from a remote server to an eUICC in accordance with GSMA specifications such as SGP.22 or SGP.02. [Background technology]

[0002] The GSMA specification [1] SGP.22 RSP Technical Specification, Version 2.2.2 (June 5, 2020) (abbreviated as SGP.22), particularly Chapter 3.1, "Remote Provisioning," describes remote SIM provisioning by downloading a profile to an embedded universal integrated circuit card (eUICC) hosted on a device. A device is understood to be a mobile device or mobile terminal, i.e., a device or terminal capable of communicating over a mobile network (i.e., a wireless network). According to Chapter 3.1.1, "Profile Download Initiation," a pre-defined profile already stored in the profile provisioning server SM-DP+ is reserved upon an order from an end user at a mobile network operator (MNO). Then, according to Chapter 3.1.2, "Common Mutual Authentication Procedure," a mutual authentication procedure is performed between the profile provisioning server SM-DP+ and the eUICC. Then, according to Chapter 3.1.3, "Profile Download and Installation," the reserved profile is downloaded to the eUICC via the device and installed on the eUICC. In an SGP.22 setup, the profile provisioning server is called SM-DP+.

[0003] Devices according to SGP.22 are in particular so-called consumer devices such as smartphones with mobile network connectivity, smart watches, tablet PCs and other computers with mobile network connectivity.

[0004] The document [1] SGP.22, Chapter 2.4 "eUICC Architecture," especially Figure 3, describes the architecture of the eUICC. Each profile is contained in an individual Issuer Security Domain Profile (ISD-P). Each ISD-P contains one profile. A profile has a primary technical service task: authenticating the eUICC and / or its device and / or its end user to the mobile network with which the profile is associated. An ISD-P or profile can contain additional elements such as applets or applications. Applets and applications can have service purposes beyond authentication to the mobile network, such as payment services or ticketing services. In particular, Near Field Communication (NFC) payment services can be implemented by an NFC payment applet or application in a profile or ISD-P. Currently, applets and applications available for download to an ISD-P are static and off-the-shelf. As described in [1] SGP.22, Chapter 3.1.3 "Profile Download and Installation," the profile (or content in general) downloaded to the eUICC during a remote SIM provisioning session is downloaded to the eUICC in the form of a Bounded Profile Package (BPP), as detailed in [1] SGP.22, Chapter 2.5.4 and the GSMA specification [3] SGP.21 RSP Architecture, Version 2.2 (1 September 2017). The Bounded Profile Package contains a set of Tag-Length-Value (TLV) commands for installation on the eUICC, in the following order: (1) ISD-P and ISD-P configuration, (2) metadata, (3) profile protection keys, and (4) the actual profile payload in the form of a Protection Profile Package.

[0005] The GSMA specification [2] SGP.02 Remote Provisioning Architecture for Embedded UICC Technical Specification, version 4.1 (June 5, 2020) aims to define a technical solution for remote provisioning and management of embedded UICCs (eUICCs) in machine-to-machine devices, also known as M2M devices. According to [2] SGP.02, the download and installation of a profile from a profile server includes the steps of creating an ISD-P, establishing a key, downloading the profile, and installing it.

[0006] The profile data of a profile includes some individual data that is unique to each profile, such as, for example, the International Mobile Subscriber Identity (IMSI), the authentication key Ki, the profile number International Circuit Card Identifier (ICCID), and so on.

[0007] Other data may be specific to the eUICC or device type, such as the eUICC identifier or chip hardware number Equipment Identifier (EID) (hardware identifier as specified in [2] SGP.02), parts of the EID such as a country indicator, the International Mobile Equipment Identity number IMEI (mobile equipment = device = mobile terminal) or parts of the IMEI such as the Type Allocation Code TAC indicating the type of device.

[0008] Currently, eUICCs and devices are partly standardized and generic, and partly proprietary. In particular, different eUICCs and devices have different capabilities. As a result, off-the-shelf profiles, applets, and applications are generally not fully compatible with the target eUICC and / or device, i.e., the eUICC and / or device for which the profile, applet, or application is intended, out of the box. Rather, once the eUICC type, device type, and / or individual target eUICC or individual target device are known, adaptation to the off-the-shelf profile, applet, or application is required. Currently, such adaptation is often performed post-download, by commands sent to the eUICC after the profile, applet, or application has been downloaded and installed. This adaptation therefore incurs additional traffic on the mobile network, additional provisioning time, and potentially additional monetary costs.

[0009] Prior art documents [4] EP 2 910 039 and [5] EP 2 802 162 each disclose a solution to reduce the download traffic from the profile server to the eUICC by providing the device or eUICC with profile templates, so that when a new profile is required only a partial profile needs to be downloaded from the profile server.

[0010] Prior art document [6] DE 10 2015 001 815 A1 proposes creating a local copy of a profile on the eUICC and using this copy as a template for a new profile, thus reducing the download traffic from a profile server required for the new profile.

[0011] In the documents cited from the prior art above, profiles or templates need to be pre-existing on the eUICC to enable downloading and implementation of new profiles with reduced mobile network traffic between the profile server and the set of devices and eUICCs.

[0012] Prior art document [7] WO 2019 / 120609 discloses a method for adaptively generating a profile package for downloading to an eUICC and installing the profile on the eUICC. A data creation server is provided with individual profile data, such as IMSI and Ki. A profile transfer server is provided with multiple profile descriptions associated with different configurations of the eUICC and / or the target device hosting the eUICC. When the profile transfer server receives a profile download request containing configuration information for the target eUICC and / or the target device, the profile transfer server retrieves from its inventory a profile description that matches the received configuration information, retrieves the profile data from the data creation server, and generates a profile package from the profile description and profile data for downloading to the eUICC. In the solution proposed in WO 2019 / 120609, the entire profile generation and profile package generation process is performed immediately once the configuration information for the target eUICC and / or the target device is available, which can take a considerable amount of time.

[0013] Prior art document [8] EP 3629611 A1 discloses a method for downloading subscriptions of mobile radiotelephone operators to a security element, which includes an update mechanism for sequentially loading updated versions of the same profile into the security element over time as profile updates become available. Each of the subscriptions includes an electrical profile of the operator and personalization data specific to each security element. On the one hand, various versions of the operator's electrical profile are continuously generated over time, but these various versions of the electrical profile do not include personalization data. On the other hand, personalization data specific to each security element is generated. Each time a subscription is downloaded to one of the security elements, a subscription download server associates the latest version of the available electrical profile with one of the customization data, generates the latest subscription, and downloads the subscription to the security element.

[0014] [8] While the solution in EP 3629611 addresses the change over time of profiles already present in the security element (eUICC), [8] EP 3629611 does not address the problem of generating the initial profile before the type and identity of the security element and radio telephone for which the profile is to be generated are known.

[0015] Prior art document [9] US Patent Application Publication No. 2016 / 0021529 discloses a method for updating a profile management server when a server that creates a profile for an embedded universal integrated circuit card (eUICC) detects a change in information stored in a secure area of ​​the profile stored in the eUICC.

[0016] Prior art document

[10] US Patent Application Publication No. 2017 / 0077975 discloses an eUICC management method, which includes the steps of: obtaining, by an eUICC, capability information of a terminal in which the eUICC is embedded; and transmitting, by the eUICC, the capability information of the terminal to an SM platform, and the SM platform managing a profile on the eUICC, generating a profile, or managing the eUICC according to the capability information of the terminal. Summary of the Invention [Problem to be solved by the invention]

[0017] The object of the present invention is to provide a flexible, adaptable and at the same time reliable method for generating and downloading profiles to an eUICC hosted on a device. Advantageously, the presented solution reduces the overall amount and / or capacity of communication required between a profile server and an eUICC during profile download and installation, so as to reduce time and / or costs and / or risk of failure due to communication interruptions. Also, the amount of profile adaptation required should be reduced or eliminated.

[0018] It would also be desirable to be able to determine exactly what the device or eUICC needs later, during provisioning, depending on the capabilities of the device or eUICC, and adapt the profiles to build a package that is perfectly, or at least broadly, compatible with the device / eUICC combination. [Means for solving the problem]

[0019] More specifically, the object of the invention is achieved by an embedded system as defined in claim 1, having the following characteristics: Embodiments of the invention are set out in the dependent claims.

[0020] A method is presented for creating and generating, on a data generation server, a profile image to be downloaded from a profile server to an eUICC hosted on a device for the purpose of installing a profile corresponding to the profile image on the eUICC, the method comprising: a) generating, in a data generation server, a plurality of non-personalized profile images for a plurality of devices, each non-personalized profile image including at least one function identifier specific to a respective device, and each non-personalized profile image not including an individual global identifier specific to an individual eUICC, and storing the generated plurality of non-personalized profile images for provision to a profile server; b) in the data generating server, generating at least one profile data image including at least one individual global identifier of each eUICC, and storing the generated at least one profile data image for providing to the profile server.

[0021] Thus, the method generates non-personalized profile images and profile data images that can be combined in a matrix-like combination manner to generate a personalized profile image for download to the eUICC. The instructions for combining to generate such a personalized profile image can be shifted to a later stage, for example, when all or at least most, or all or most essential features and functions of the target device and / or target eUICC are known. The trigger for combining to combine the personalized profile image can be a request for a profile download that includes all or most, or at least most essential features and / or functions of the target device and / or target eUICC. Profile adaptation after download of the profile to the eUICC can be reduced or eliminated.

[0022] Thus, the present invention provides a provisioning method that allows for the construction of highly compatible profiles, thereby reducing or eliminating profile adaptation after profile download, reducing overall profile download and installation time and potentially costs. Furthermore, less post-adaptation of profiles is required, reducing the risk of failure.

[0023] Preferably, the plurality of non-personalized profile images and the generated at least one profile data image are provided to a profile server.

[0024] The data generation server is implemented to execute the above-described profile creation and generation method, a) means implemented to generate a plurality of non-personalized profile images for a plurality of devices, each non-personalized profile image including at least one feature identifier specific to a respective device, each non-personalized profile image not including an individual global identifier specific to an individual eUICC, and to store the generated plurality of non-personalized profile images for provision to a profile server; b) means implemented in the data generating server to generate at least one profile data image including at least one individual global identifier of each eUICC and to store the generated at least one profile data image for providing to the profile server.

[0025] A method for generating, on a profile server, a profile image to be downloaded from the profile server to an eUICC hosted on a device for the purpose of installing a profile corresponding to the profile image on the eUICC, comprising: a-2) receiving, in a profile server, from the data generation server, a plurality of non-personalized profile images for a plurality of devices, each non-personalized profile image including at least one function identifier specific to a respective device, and each non-personalized profile image not including an individual global identifier specific to an individual eUICC or lacking at least one individual global identifier, and storing the received plurality of non-personalized profile images in the profile server; b-2) receiving, in the profile server, from the data generating server, at least one profile data image including at least one individual global identifier of each eUICC, and storing the received at least one profile data image in the profile server; c) receiving, at a profile server, a request for download of a profile to an eUICC from a device, or from an eUICC, or from a different server, or from an MNO server, or from a different device, or from a different eUICC, the request including at least one functional requirement indicator and at least one global identifier; d) selecting, at the profile server, a non-personalized profile image having a feature identifier that matches the received feature requirement indicator; e) selecting, at the profile server, a profile data image that matches the received global identifier; f) in the profile server, combining the selected non-personalized profile image and the selected profile data image to generate a profile image to be downloaded to the eUICC.

[0026] The method may be supplemented with the further additional step of f) downloading the generated profile image to the eUICC and installing the profile on the eUICC from the downloaded profile image.

[0027] The method may further comprise the step of creating a profile package from the profile image and providing and / or downloading the profile image in the form of the profile package to the eUICC for download.

[0028] The profile package may include metadata, and the capability indicators are or are also included in the metadata.

[0029] The profile server according to the invention comprises means for carrying out the above method, and the profile server in particular a-2) means implemented in a profile server for receiving, from a data generation server, a plurality of non-personalized profile images for a plurality of devices, each non-personalized profile image including at least one function identifier specific to a respective device, each non-personalized profile image not including an individual global identifier specific to each eUICC or lacking at least one individual global identifier, and storing the received plurality of non-personalized profile images (PI) in the profile server; b-2) means implemented in the profile server for receiving from the data generating server at least one profile data image including at least one individual global identifier of each eUICC, and for storing the received at least one profile data image in the profile server; c) means implemented in a profile server for receiving a request for download of a profile to an eUICC from a device, or from an eUICC, or from a different server, or from an MNO server, or from a different device, or from a different eUICC, the request comprising at least one functional requirement indicator and at least one global identifier; d) means implemented in the profile server for selecting a non-personalized profile image having a feature identifier that matches the received feature requirement indicator; e) means implemented in the profile server for selecting a profile data image that matches the received global identifier; f) means implemented in the profile server for combining the selected non-personalized profile image and the selected profile data image to generate a profile image to be downloaded to the eUICC.

[0030] A system comprising a data generation server and a profile server. The data generation server and the profile server can be separate servers, for example, SM-DP and SM-SR. Alternatively, the data generation server and the profile server can be partial servers of the same server, for example, a partial server of an SM-DP+ server.

[0031] At least one identical global identifier may be, for example, International Mobile Subscriber Identity (IMSI), an authentication key Ki, and profile number, ICCID, or part thereof.

[0032] The at least one different functional identifier may be, for example: the chip hardware identifier EID of the eUICC, The device's International Mobile Equipment Identity (IMEI), Device Type Allocation Code TAC, an identifier of a network technology, the network technology being one of the group of network technologies consisting of 2G technology, 3G technology, 4G technology, 5G technology, GSM, UMTS, CMDA, and LTE; GSMASGP.22 compliant device capability indicators, and Any one or more of the UICC capability indicators compliant with GSMASGP.22, or part thereof.

[0033] The following list is the device capabilities defined by the GSMA in SGP.22: The capability identifier may include any one or more of the device capability identifiers listed below. DeviceCapabilities::=SEQUENCE gsmSupportedReleaseVersionTypeOPTIONAL utranSupportedReleaseVersionTypeOPTIONAL cdma2000onexSupportedReleaseVersionTypeOPTIONAL cdma2000hrpdSupportedReleaseVersionTypeOPTIONAL cdma2000ehrpdSupportedReleaseVersionTypeOPTIONAL eutranEpcSupportedReleaseVersionTypeOPTIONAL contactlessSupportedReleaseVersionTypeOPTIONAL rspCrlSupportedVersionVersionTypeOPTIONAL nrEpcSupportedReleaseVersionTypeOPTIONAL nr5gcSupportedReleaseVersionTypeOPTIONAL eutran5gcSupportedReleaseVersionTypeOPTIONAL

[0034] The capability identifier is or includes any one or more of the UICC capabilities defined in Annex H, ASN.1 Definition (Normative), UICC Capability Definition section of the SGP.22 specification.

[0035] According to some embodiments, the data generating server and the profile server: SGP.02SM-DP server and SGP.02SM-SR server or similar server infrastructure, SGP.22SM-DP+ or similar server infrastructure.

[0036] In the above-described invention, the functional requirement indicators and global identifiers are used to determine which profile images to generate and / or download. The profile server configuration of the profile server from which the profile images are downloaded to the eUICC also influences the selection of profile images for profile generation and / or download. The profile server configuration can control the selection of which profile image to download. What is downloaded depends on how the profile server indicators are set. The settings controlling the profile server configuration indicators can be controlled at the profile type level. It is also possible to change the indicator settings via API / UI. Therefore, after changing such indicators, it becomes possible to generate and download profile image versions that were not possible before the change. [Brief explanation of the drawings]

[0037] Embodiments of the present invention will now be described with reference to the accompanying drawings, wherein like parts are referred to by like reference numerals throughout.

[0038] [Figure 1] 1 illustrates a data generation server and a profile server that process non-personalized profile images and profile data images according to one embodiment of the present invention. [Figure 2] It is a different form factor or eUICC. DETAILED DESCRIPTION OF THE INVENTION

[0039] FIG. 1 illustrates a data generation server and a profile server that process non-personalized profile images PI and profile data images PD according to one embodiment of the present invention.

[0040] The data generation server and the profile server may for example both be part of an SGP.22 compliant SM-DP+ server, or a similar server compliant with SGP.02.

[0041] The data generation server generates a plurality of non-personalized profile images PI and provides them to the profile server (GP). The data generation server also generates a plurality of profile data images PD and provides them to the profile server (GD).

[0042] Step c) At the profile server, receive a request for downloading a profile to the eUICC from the device, or from the eUICC, or from a different server, or from an MNO server, or from a different device, or from a different eUICC, the request including at least one functional requirement indicator and at least one global identifier. Step d) In the profile server, a non-personalized profile image PI having a feature identifier that matches the received feature requirement indicator (SI). Step e) In the profile server, select a profile data image PD that matches the received global identifier (SD). Step f) In the profile server, the selected non-personalized profile image PI and the selected profile data image PD are combined (C) to generate a profile image PP to be downloaded to the eUICC. In a further step (AD), the selected non-personalized profile image PI and the selected profile data image PD are combined (C) to generate a profile image PP, after which an adaptation can be performed on the generated profile image PP.

[0043] Figure 2 shows different form factors of an eUICC: from left to right: a plug-in SIM card, a more formally embedded UICC or eUICC, and an integrated UICC or iUICC that is built into the chipset of a mobile device.

[0044] The present invention is generally independent of the form factor of the eUICC and is applicable to eUICCs having any of the eUICC form factors shown in Figure 2, as well as eUICCs having further form factors.

[0045] Mobile devices hosting the eUICC can have a variety of form factors, such as smartphones, smartwatches, tablet PCs, and in-vehicle M2M devices.

[0046] (Prior art document) [1] GSMA SGP.22RSP Technical Specification, Version 2.2.2, June 5, 2020 [2] SGP.02 Remote Provisioning Architecture for Embedded UICC Technical Specification, Version 4.1, June 5, 2020 [3] GSMA SGP.21RSP Architecture, Version 2.2, September 1, 2017 [4] European Patent No. 2910039 [5] EP 2802162 [6] DE 102015001815 [7] International Publication No. 2019 / 120609 [8] EP 3629611 [9] U.S. Patent Application Publication No. 2016 / 0021529

[10] U.S. Patent Application Publication No. 2017 / 0077975

Claims

1. 1. A method for generating, on a data generation server, a profile image to be downloaded from a profile server to an eUICC hosted on a device for the purpose of installing a profile corresponding to the profile image on the eUICC, the method comprising: a) generating, in a data generation server, a plurality of non-personalized profile images (PI) for a plurality of devices, each non-personalized profile image (PI) including at least one feature identifier unique to a respective device, each non-personalized profile image (PI) not including an individual global identifier unique to an individual eUICC, and storing the generated non-personalized profile images (PI) for provision to the profile server (GP); b) generating, in the data generating server, at least one profile data image (PD) including at least one individual global identifier of each eUICC, and storing the generated at least one profile data image (PD) for provision to the profile server (GD).

2. a-1) providing the plurality of non-personalized profile images (PI) to the profile server (GP); The method of claim 1, further comprising the step of: b-1) providing (GD) said generated at least one profile data image (PD) to said profile server.

3. 10. A data generation server implemented to perform the profile creation and generation method of claim 1, comprising: a) means implemented to generate a plurality of non-personalized profile images (PI) for a plurality of devices, each non-personalized profile image (PI) including at least one feature identifier unique to a respective device, each non-personalized profile image (PI) not including an individual global identifier unique to an individual eUICC, and to store the generated non-personalized profile images (PI) for provision to the profile server (GP); b) a data generating server including means implemented to generate at least one profile data image (PD) including at least one individual global identifier of each eUICC in the data generating server and to store the generated at least one profile data image (PD) for providing (GD) to the profile server.

4. 1. A method for generating, on a profile server, a profile image (PP) to be downloaded from the profile server to an eUICC hosted on a device for the purpose of installing a profile corresponding to the profile image (PP) on the eUICC, the method comprising: a-2) receiving, in the profile server, from a data generation server, a plurality of non-personalized profile images (PI) for a plurality of devices, each non-personalized profile image (PI) including at least one function identifier unique to a respective device, and each non-personalized profile image (PI) not including an individual global identifier unique to an individual eUICC or lacking at least one individual global identifier, and storing the received plurality of non-personalized profile images (PI) in the profile server; b-2) receiving, in the profile server, from the data generating server, at least one profile data image (PD) including at least one individual global identifier of each eUICC, and storing the received at least one profile data image (PD) in the profile server; c) receiving, at the profile server, a request for download of a profile to the eUICC from the device, or from the eUICC, or from a different server, or from an MNO server, or from a different device, or from a different eUICC, the request including at least one functional requirement indicator and at least one global identifier; d) selecting (SI) at the profile server a non-personalized profile image (PI) having a feature identifier that matches the received feature requirement indicator; e) selecting (SD) in said profile server a profile data image (PD) that matches said received global identifier; f) in the profile server, combining (C) the selected non-personalized profile image (PI) and the selected profile data image (PD) to generate a profile image (PP) to be downloaded to the eUICC.

5. The method of claim 4, further comprising the steps of: f) downloading the generated profile image (PP) to the eUICC; and installing a profile from the downloaded profile image (PP) to the eUICC.

6. The method according to claim 4 or 5, further comprising the step of creating a profile package from the profile image (PP) and providing and / or downloading the profile image (PP) to the eUICC in the form of the profile package for downloading.

7. The method of claim 6 , wherein the profile package includes metadata, and the functional requirement indicators are included in the metadata.

8. A profile server implementing means for performing the method of claim 4, comprising: a-2) means for receiving, from a data generating server, a plurality of non-personalized profile images (PI) for a plurality of devices, each non-personalized profile image (PI) including at least one functional identifier unique to a respective device, each non-personalized profile image (PI) not including an individual global identifier unique to an individual eUICC or lacking at least one individual global identifier, and storing the received plurality of non-personalized profile images (PI) in the profile server; b-2) means implemented to receive from said data generating server at least one profile data image (PD) including at least one individual global identifier of each eUICC, and to store said received at least one profile data image (PD) in said profile server; c) means implemented to receive a request for download of a profile to the eUICC from the device, or from the eUICC, or from a different server, or from an MNO server, or from a different device, or from a different eUICC, the request comprising at least one functional requirement indicator and at least one global identifier; d) means implemented to select a non-personalized profile image (PI) having a feature identifier that matches the received feature requirement indicator; e) means implemented to select a profile data image (PD) that matches the received global identifier; f) a profile server including means implemented to combine the selected non-personalized profile image (PI) and the selected profile data image (PD) and generate a profile image (PP) to be downloaded to the eUICC.

9. A system comprising: a data generating server according to claim 3; and a profile server according to claim 8.

10. The at least one unique global identifier is: International Mobile Subscriber Identity (IMSI), an authentication key Ki, and Profile number ICCID, 6. The method according to any one of claims 1, 2, 4 and 5, wherein at least one of

11. The at least one functional identifier comprises: a chip hardware identifier EID of the eUICC; the International Mobile Equipment Identity (IMEI) of said device; a type allocation code TAC of said device, an identifier of a network technology, the network technology being one of the group of network technologies consisting of 2G technology, 3G technology, 4G technology, 5G technology, GSM, UMTS, CMDA, and LTE; a device capability indicator compliant with GSMA SGP.22; and UICC Functional Indicator compliant with GSMA SGP.22 6. The method according to any one of claims 1, 2, 4 and 5, wherein at least one of

12. An SGP.02 SM-DP server or similar server infrastructure; 4. The data generation server of claim 3, which is SGP.22 SM-DP+ or similar server infrastructure.

13. The profile server of claim 8, which is an SGP.02 SM-SR server or similar server infrastructure.

Images