Process and communication profile management devices

Abstract

This Centralized Communication Profile Management Unit (CLPA) is: - A profile management module (MGP) capable of dynamically generating execution tasks (CLPAi) to address the need for remote management of communication profiles (PROFeid) in a security element (eUICC) embedded in a terminal (T); - The profile management module (MGP) capable of executing the above execution task (CLPAi); - A communication module (COM-NET) capable of establishing a first communication channel (CC2) between the above execution task (CLPAi) and the communication profile manager (SM-DP+) in the network; - The execution task (CLPAi) capable of obtaining the communication profile (PROFeid) from the manager (SM-DP+) through the first communication channel (CC2); - The communication module (COM-NET) capable of establishing a communication session (SC1) between the execution task (CLPAi) and the communication agent (DAG) configured to transmit to the security element (eUICC) at least one management command of the profile (PROFeid) encapsulated in at least one message transmitted by the execution task (CLPAi) in relation to the session (SC1); and - Includes a module (MI) configured to delete the execution task (CLPAi) when an action responding to the above request is performed.

Description

Technology Field

[0001] The present invention is applied to the field of communication profile management. Background Technology

[0002] As is known, the communication profile used by the terminal is supplied by the operator and stored in the terminal's secure element (SIM card, entity eSIM, eUICC).

[0003] The standard GSMA (GSM Association) defines an Entity LPA (Local Profile Administration) for managing these profiles. This Entity LPA implements the interface between the security element (e.g., eUICC) and the Profile Management Operator entity (e.g., Subscription SM-DP+ "Subscription Manager Data Preparation+").

[0004] In accordance with GSMA regulations, this entity LPA is located in the security elements of the operating system or terminal. This dual possibility regarding the location of the entity LPA can cause problems related to the management, use, and updating of the entity LPA, as well as problems related to profile management.

[0005] This entity LPA provides an interface that allows the user of the terminal to manage profiles stored in the terminal's security element, such as installing new profiles in the security element, or enabling, disabling, or deleting such profiles.

[0006] Nowadays, it is common practice to install communication terminals in vehicles to provide entertainment services. For manufacturers of such vehicles, it may not be desirable to leave the management of communication profiles for accessing these services to the user. In particular, car manufacturers fear being asked to guarantee after-sales service regarding issues related to the quality of services provided by the operator chosen by the vehicle user.

[0007] Therefore, the communication profile management mechanism known to date is not applicable to these new services. means of solving the problem

[0009] The object of the present invention is a novel communication profile management mechanism.

[0010] Accordingly, according to the first aspect, the present invention relates to a centralized communication profile management device, the device being:

[0011] - A profile management module capable of dynamically generating execution tasks to respond to remote management requests for communication profiles in a secure element embedded within a terminal;

[0012] - The profile management module capable of executing the above execution task;

[0013] - A communication module capable of establishing a first communications channel in the network between this execution task and the communication profile manager;

[0014] - This execution task capable of obtaining a communication profile from the administrator via the first communication channel;

[0015] - A communication module capable of establishing a communications session between a communication agent and an execution task, configured to transmit to a secure element at least one management command of a profile encapsulated in at least one message transmitted by the execution task in relation to this session; and

[0016] - Includes a module configured to delete the execution task when an action responding to the request is performed.

[0018] By correlation, the present invention relates to a communication profile management process executed by a centralized communication profile management device, wherein the process is

[0019] - A step of dynamically generating an execution task to respond to a remote management request of a communication profile from a security element embedded in the terminal;

[0020] - Step to execute the task;

[0021] - A step of establishing a first communication channel between an execution task and a communication profile manager in a network - The execution task can obtain a communication profile from the manager through the first communication channel -;

[0022] - A step of establishing a communication session between communication agents configured to transmit at least one management command of the profile encapsulated in at least one message transmitted by the execution task in relation to the session with the execution task and security element; and

[0023] - Includes a step to delete the execution task when an action responding to the request is performed.

[0025] According to a second aspect, the present invention relates to a communication agent comprising the following:

[0026] - A first communication module configured to set up the execution task and communication session of the centralized communication profile management device as described above; and

[0027] - A second communication module configured to transmit at least one management command of a profile encapsulated in at least one message received in this execution task in relation to this session to a security element embedded in the terminal.

[0029] Correlatively, the present invention relates to a communication process executed by a communication agent, wherein the process is

[0030] - Steps to set up the execution task and communication session of the centralized communication profile management device as mentioned above;

[0031] - Includes the step of transmitting at least one management command of a profile encapsulated in at least one message received in the execution operation in relation to the session to a security element embedded in the terminal.

[0032] Accordingly, the present invention generally proposes transmitting a communication profile management function to a centralized device of a communication network, and the device can communicate with a communication agent configured to ensure an interface between the device and a security element.

[0034] In another aspect, the present invention proposes relocating the function of the LPA to a network, and suggests that the communication agent play a minimal role as a gateway between this device and the security element.

[0035] When a terminal is embedded in a vehicle, the vehicle manufacturer can easily manage communication profiles stored in the security element of such a terminal by interacting the centralized profile management device and the information system according to the present invention.

[0036] In the context of the present invention, as is known, execution tasks are dynamically generated to respond to any request for profile management of the security element eUICC (management, auditing, installation, activation, deactivation, profile deletion) and are deleted when the task corresponding to such request is performed. Execution tasks can be implemented, for example, in the form of processes.

[0037] A communication agent according to the present invention provides the same API (Application Programming Interface) defined by the standard GSMA to a security element; if the security element intends to use a function of an LPA that calls the API standard, it later transmits a command to a centralized device in the network so that the latter executes the corresponding function of the LPA transferred to the network.

[0038] A communication agent can be viewed as a proxy. It may or may not be integrated into a terminal containing a security element. In a specific example of integration, the proxy (communication agent) may be integrated into a security element of the eUICC type.

[0039] Another objective of the present invention is a terminal including a communication agent as described above, and a security element.

[0040] In an embodiment of the present invention, the security element is an eSIM type such as that defined by GSMA or eUICC type (embedded UICC).

[0041] In an embodiment of the present invention, the command is an APDU (Application Protocol Data Unit) defined by the standard ISO 7816.

[0042] According to a specific embodiment, the execution task is configured to implement, or at least participate in, a mutual authentication mechanism between the profile manager and the security element. For example, the execution task can initiate this authentication mechanism.

[0043] According to a specific embodiment of the centralized profile management device according to the present invention, the command is, for example, a command to load a profile from a security element or to activate, deactivate, or delete a profile from a security element.

[0044] In a specific embodiment, device profile management according to the present invention comprises a CERT in which the execution task is shared between a profile manager and a security element. SM It is characterized by being configured to communicate with the profile manager in accordance with a security protocol through a first communication channel established using a certificate. In this particular embodiment, the profile management command is secured within the profile manager using this shared certificate before being transmitted through a secure communication channel established between the profile manager and the execution task. According to a particular embodiment, the execution task CLPAi is also configured to transmit the profile management command to a communication agent DAG in accordance with a security protocol in relation to an SC1 session, and this security protocol is a CERT stored in the security element eUICC. SIM It is supported using certificates. The fact that certificates are stored in a security element significantly enhances the security of the profile management process. Therefore, in this embodiment, before command profile management is transmitted to the communication agent, the centralized device decapsulates the previously received message from the profile manager and the profile manager's CERT SM CERT encapsulated in a certificate and used in the communications session SC1 SIM Encapsulate using a certificate.

[0046] The present invention allows for encryption of a first encapsulation type of a command corresponding to a first secure communication channel established between a profile manager and an execution task CLPAi, and a second encapsulation type of a command corresponding to a security protocol of a communication session SC1. The encapsulation type is a certificate (e.g., CERT) dedicated to securing communication (messages) between a first entity and a second entity. SIM, It means the use of CERTSM. Accordingly, security is enhanced.

[0047] In another specific embodiment, each encryption type uses the same certificate.

[0048] In this embodiment, the communication agent, for example, the first communication module, is configured to acquire a certificate stored in a security element and / or use this certificate to communicate with a centralized profile management device in accordance with a security protocol in relation to a session.

[0049] The present invention must establish a session between a centralized profile management device and the execution of a communication agent associated with a security element. The present invention proposes, in particular, two variations for establishing this session.

[0050] In the first variant, it may be qualified in "push" mode, and the session is established under the initiative of the centralized profile management unit. If there is a command to be sent to the centralized profile management unit as a security element, the latter sends an invitation message to the communication agent to establish a session with the centralized profile management unit.

[0051] In this manner, the profile management device according to the present invention includes a module for establishing a session configured to send an invitation message to a communication agent to invite a communication agent to establish a session with a centralized management device.

[0052] This invitation message is, for example, an SMS type message, preferably a signed and / or encrypted message.

[0054] In a second variant in which the communication agent may qualify in "pull" mode, the centralized profile management device may periodically query the centralized profile management device, and establish a session with the latter by initiating directly without a prior receipt request from the communication agent for an invitation message to initiate this session setup. Once established in relation to this session, the centralized profile management device may use these commands and send commands to the security element with intent for the security element, under the initiative of the communication agent.

[0055] According to a specific mode of a second variant embodiment, the centralized profile management device according to the present invention includes a session-setting module configured to receive an interrogation request originating from a communication agent, and in response to such a request, the session-setting module is configured to set up a session with the communication agent in response to such a request.

[0056] According to a specific embodiment, a centralized profile management device includes an interface module capable of receiving a management request by a third party, for example:

[0057] - Load the communication profile into the security element; or

[0058] - Enable, disable, or delete communication profiles in security elements.

[0060] An administration request may be transmitted by the owner of the terminal, the user of the terminal, or the management entity of the terminal, for example, by the management entity of the terminal bank to which this terminal belongs.

[0061] In certain embodiments, the process is executed by a computer program.

[0062] Accordingly, another object of the present invention is a computer program on a recording medium, which may be executed on a computer or, more generally, on a device. This program consists of instructions adapted to execute the profile management process described herein.

[0063] Each of these programs can use any programming language and can be used in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form or other basic forms.

[0064] Another object of the present invention is the instructions of the aforementioned computer program and an information medium or recording medium readable by the computer program.

[0065] Information or recording media may be any entity or device capable of storing a program. For example, the media may include storage means such as ROM, e.g. CD ROM or microelectronic circuit ROM, or disk (floppy disk) or hard drive or flash memory.

[0066] Meanwhile, the information or recording medium may be a transmittable medium, such as an electric or optical signal that can be transmitted through an electric or optical cable via a wireless link, a wireless optical link, or other means.

[0068] The program according to the present invention can be loaded, in particular, onto an internet-type network.

[0069] Alternatively, each information or recording medium may be an integrated circuit into which a program is integrated, and the circuit may be used to execute or perform one of the processes according to the present invention. Brief explanation of the drawing

[0071] Other features and advantages of the present invention will be shown in the following description with reference to the accompanying drawings illustrating exemplary embodiments without limiting characters. FIG. 1 illustrates a centralized profile management device and a communication agent according to a specific embodiment in their environment; FIG. 2 illustrates the main steps of a profile management process and a communication process according to the present invention for downloading a communication profile to a security element; and FIG. 3 shows the main steps of the profile management process and communication process according to the present invention to activate the communication profile in the security element. Specific details for implementing the invention

[0072] FIG. 1 illustrates a terminal T and a centralized communication profile management device (CLPA) according to a specific embodiment of the present invention.

[0073] In the embodiment described herein, terminal T is embedded in a vehicle and is not illustrated. In this example, terminal T is remotely managed by the vehicle manufacturer's information system SI-AUTO.

[0074] The terminal T includes a communication agent DAG according to the present invention and the security element eUICC.

[0075] The security element eUICC consists of a unique identifier ID and an encryption certificate CERT SIM It consists of. The security element can store at least one communication profile.

[0076] Figure 1 also illustrates a communication profile manager SM-DP+. This communication profile manager SM-DP+ is a profile PROF for the security element eUICC of terminal T. eid It stores multiple profiles, including . The profile manager also ensures each role that protects the profile and the role that contributes to the eUICC intended for the profile.

[0077] Terminal T, the centralized profile management unit CLPA, the automobile manufacturer's information system SI-AUTO, and the communication profile manager SM-DP+ communicate via the network NET. Each includes a communication module COM-NET for this purpose.

[0079] This network NET is, for example, an internet network or a cellular phone network of the 2G, 3G, 4G, or 5G type.

[0080] In the embodiments described herein, centralized device CLPA profile management includes a profile management module MGP, and this module is:

[0081] - For example, an interface sub-module IF capable of receiving a management request RAQ from the owner of terminal T or the automobile manufacturer's information system SI-AUTO;

[0082] - A sub-module MI for managing execution tasks capable of creating, executing, and deleting execution tasks CLPAi to manage the communication profile of the security element eUICC in the network NET; and

[0083] - Includes a sub-module MES for session setup capable of establishing and canceling a communication session SC1 between the execution task CLPAi and the communication agent DAG. In the embodiment described herein, this communication session SC1 complies with the TLS protocol and the CERT certificate of the security element eUICC. SIM Uses

[0084] CERT SIM The certificate secures the exchange of communication session SC1 between the communication agent DAG and the centralized profile management unit CLPA.

[0085] In the embodiment described herein, the centralized profile management device CLPA can establish a communication channel CC2 between the execution task CLPAi and the communication profile manager SM-DP+.

[0086] In the embodiments described herein, this communication channel CC2 is secure and runs the TLS protocol; to ensure exchange between the centralized device CLPA and the communication profile manager SM-DP+, the certificate CERT of the communication profile manager SM-DP+ SM을 Use

[0087] The TLS protocol can be replaced with other encryption protocols.

[0088] Certificates other than those used to protect communication channel CC2 and communication session SC1 may also be used to secure the exchange between the communication profile manager SM-DP+ and the security element eUICC of terminal T.

[0089] As will be explained later, the secure communication channel CC2 can be utilized by the execution task CLPAi to download the communication profile PROF from the communication profile manager SM-DP+, for example, the profile PROF for the security element eUICC of terminal T eid You can use .

[0090] The message sent from the execution task CLPAi to the communication agent DAG encapsulates profile management commands for the security element eUICC. In the example implementation described here, these commands are APDU commands.

[0091] These commands can be specifically as follows:

[0092] - APDU command to install a profile on the security element eUICC, e.g., profile PROF eid;

[0093] - APDU command to enable, disable, or delete profiles installed on the security element eUICC.

[0095] The communication agent DAG includes a module COM-SIM configured to transmit profile management commands (e.g., APDU commands) encapsulated in messages received from the centralized communication profile management device CLPA to the security element eUICC.

[0096] Profile management commands are transmitted via secure communication channel CC2 using the CERT certificate shared between the security element eUICC and the communication profile manager SM-DP+. 3을 It is initially protected within the Communication Profile Manager SM-DP+ using this method. This ensures double encryption to enhance command security.

[0097] The transmission of profile management commands between the centralized device CLPA and the communication agent DAG is the CERT certificate of the security element eUICC. SIM을 It is secured by using (encapsulation of commands within the message). As already mentioned above, once a command is initially secured using the CERT3 certificate within the communication profile manager SM-DP+, double encryption of the command is also guaranteed in relation to the communication session SC1.

[0098] Using communication channel CC2, management commands transmitted between the communication profile manager SM-DP+ and the centralized device CLPA are the certificate CERT of the communication profile manager SM-DP+. SM을 It can be safely encapsulated using.

[0099] Therefore, before sending profile management commands to the communication agent DAG, the centralized device CLPA, the certificate CERT SM Encapsulated as, decapsulates previously received messages originating from the communication profile manager SM-DP+, and CERT used during communication session SC1. SIMIt encapsulates this using a certificate to ensure transmission between the centralized device CLPA and the communication agent DAG.

[0100] In the embodiments described herein, the execution task CLPAi of the centralized device CLPA is configured to execute or participate in a mutual authentication mechanism between the end profile manager and the security element.

[0101] The MES submodule for establishing a session of the centralized device CLPA can establish and cancel a communication session SC1 between the execution task CLPAi and the communication agent DAG.

[0102] In the embodiments described herein, the sub-module MES can operate according to "pull" mode and "push" mode.

[0103] In "push" mode, this submodule for setting up session MES sends an invitation message to invite the communication agent DAG to set up communication session SC1 using the centralized management unit CLPA to invite this communication agent DAG.

[0104] More specifically, in a specific embodiment, the information system SI-AUTO transmits a management request to the centralized profile management device CLPA. After receiving the request through the centralized device CLPA, the submodule MES for establishing a session transmits a message MINV to the communication agent DAG associated with the security element eUICC to invite the central device CLPA to establish a communication session SC1.

[0106] In a modified implementation of push mode, a management request is transmitted from the terminal to the information system SI-AUTO. The information system receives this request and transmits it to the centralized profile management device CLPA as previously described.

[0107] In another specific embodiment, a submodule for setting up the session MES transmits these invitation messages MINV directly to the communication agent DAG (e.g., in the form of a signed and / or encrypted SMS verifiable by the communication agent DAG).

[0108] A submodule for establishing an MES session in "pool" mode is configured to receive a query request from a communication agent DAG and, in response to such request, establish a communication session SC1 with the communication agent DAG when the centralized profile management unit CLPA has at least one management profile command to send to the security element eUICC.

[0109] In the embodiment described herein, the interface submodule IF of the centralized profile management device CLPA is configured to receive a management request RAQ, for example, from the owner of terminal T or from the automotive manufacturer's information system SI-AUTO.

[0110] In practice, this interface submodule IF can communicate with the software application of terminal T or the information system SI-AUTO. This software application can be qualified as an external agent AE. It provides the user with a communication profile manager SM-DP+ profile that can be downloaded to a given security element eUICC. It also provides a menu that allows the user to enable, disable, or delete the profile installed on the security element.

[0111] With reference to FIG. 2, the main steps of a profile management process and the main steps of a communication process according to a specific embodiment of the present invention for installing a profile on a security element will be described.

[0112] User creates new profile PROF in the security element eUICC of terminal T eid It is more accurately assumed that one intends to download.

[0113] This action triggers the transmission of a RACT_DWLD request to download the profile to the automotive manufacturer's information system SI-AUTO, and this request includes the identifier eid of this security element and the identifier PROF of this profile eid and includes an activation code, and this activation code CA enables the information system SI_AUTO to verify the validity of the request.

[0114] Upon receiving this request, the external agent AE of the information system SI-AUTO transmits a RADM_DWLD management request (step S20) to the profile management module MGP of the centralized profile management unit CLPA. In the example described herein, this request is the downloadProfile(eid) request defined in the document, "GSMA SGP.22 RSP Technical Specification Version 2.2" (hereinafter [1]).

[0116] The sub-module MI for managing execution tasks profiles the security element eUICC in SM-DP+. eid Create an execution task CLPAi (step M30) to download.

[0117] The submodule MES for establishing a session sends an SMS-signed and / or encrypted MINV to the communication agent DAG associated with the security element eUICC to invite the establishment of the communication session SC1 using the execution task CLPAi (step M40).

[0118] A secure communications session TLS SC1 is established (eksrP D50) between the communications agent DAG and the execution task CLPAi, and this session is the certificate CERT of the security element eUICC. SIM Uses

[0119] During step C60, the execution task CLPAi queries the security element eUICC to obtain information to provide to the communication profile manager SM-DP+. In the embodiment described herein, the execution task CLPAi uses the function GetEUICCInfo of [1].

[0120] During step C70, execute task CLPAi for this manager's certificate CERT SM을 Use the communication profile manager SM-DP+ to generate the communication channel TLS CC2.

[0121] During step C80, the execution task CLPAi performs a mutual authentication mechanism between the security element eUICC and the communication profile manager SM-DP+. In the embodiment described herein, this step uses the functions ES10b.GetEUICCCchallenge, ES9+.InitiateAuthentication, ES10b.AuthenticateServer and ES9+.AuthenticateClient [1].

[0122] In a specific embodiment, not shown herein, the function ES10b.GetEUICCCchallenge is performed between steps C60 and C70, but not during step C80.

[0123] The execution task CLPAi downloads a profile from the profile manager SP-DP+ over the communication channel TLS CC2 (step C90). In the embodiment described herein, the GetBoundProfilePackage function of ES9+.[1] is used for this purpose.

[0124] The execution task CLPAi is a Certificate CERT SIM에A message secured by is transmitted to the communication agent DAG via a TLS SC1 session, and this message encapsulates an APDU command to install a profile on the security element eUICC. This command is transmitted to the security element eUICC via the module COM-SIM. In the embodiment described herein, the execution task CLPAi transmits the profile to the security element eUICC by utilizing the LoadBoundProfilePackage of function [1].

[0125] If the download is performed correctly, the execution task CLPAi sends the message ES9+.HandleNotification that it has been successfully installed to the communication profile manager SM-DP+ (step C110) and sends the notification message ES10BRemoveNotificationfromList to the security element eUICC (step C120).

[0127] During step C130, the execution task CLPAi terminates the communication session SC1.

[0128] During step C140, the execution task terminates communication channel CC2 via the communication profile manager SM-DP+.

[0129] During step M140, the MES submodule of the profile management module transmits the external agent AE of the information system SI-AUTO information according to the information downloaded from the security element eUICC for the requested profile.

[0130] The submodule MI for managing execution tasks terminates / deletes execution task CLPAi (step M50).

[0131] FIG. 3 shows the profile management process of a communication process and the key steps of the key steps according to a specific embodiment of the present invention to activate the profile in the security element.

[0132] Automotive manufacturers profile PROF in the security element eUICC of terminal T eidIt is more accurately assumed that the intention is to activate it.

[0133] To this end, he used the external agent AE of the information system SI-AUTO to enable profiles (eid, PROF) to the profile management module MGP (more precisely, the interface sub-module IF) of the centralized profile management unit CLPA. eid Send an administration request RADM_ACT for ) (step S200). In the example described here, this request is the enableProfile(eid) request from [1].

[0134] The MI submodule for managing execution tasks is the profile PROF in the security element eUICC. eid Create execution task CLPAi (step M300) to activate it.

[0135] The submodule MES for establishing a session (step M400) invites the communication agent DAG associated with the security element eUICC to establish a communication session SC1 using the execution task CLPAi by signing MINV.

[0136] A secure communication session TLS SC1 is established between the communication agent DAG and the execution task CLPAi (step D500), and this session is the certificate CERT of the security element eUICC. SIM Uses

[0137] The execution task CLPAi sends a message to the communication agent DAG via Session TLS SC1, which is a message secured by the certificate CERTSIM (step C1000), and this message encapsulates a command APDU to enable the profile in the security element eUICC. This command APDU is sent to the security element eUICC via the module COM-SIM. In the embodiment described herein, the execution task CLPAi utilizes the ES10cEnable of function [1] to enable the profile PROF in the security element eUICC eid Activates.

[0138] If activation is performed correctly, the execution task CLPAi terminates the communication session SC1 (step C1300).

[0139] The submodule MI for managing execution tasks terminates / deletes execution task CLPAi (step M500).

[0140] During step M140, the MES submodule of the profile management module profile PROF eid Based on the information activated in the security element eUICC, it transmits the information system SI-AUTO information to the external agent AE.

Claims

Claim 1 In a centralized communication profile management device (CLPA), a communication profile (PROF) in a security element (eUICC) embedded in a terminal (T) eid A profile management module (MGP) capable of dynamically generating an execution task (CLPAi) to respond to remote management requests of; the profile management module (MGP) capable of executing the execution task (CLPAi); a communication module (COM-NET) capable of establishing a first communication channel (CC2) between the execution task (CLPAi) and a communication profile manager (SM-DP+) on a network; and the communication profile (PROF) from the communication profile manager (SM-DP+) through the first communication channel (CC2). eid A centralized communication profile management device comprising: an execution task (CLPAi) capable of obtaining ); a communication module (COM-NET) capable of establishing a communication session (SC1) between the execution task (CLPAi) and a communication agent (DAG) configured to transmit at least one management command of the profile (PROFeid) encapsulated in at least one message transmitted by the execution task (CLPAi) in relation to the communication session (SC1) to the security element (eUICC); and a submodule (MI) configured to delete the execution task (CLPAi) when an operation responding to the request is performed. Claim 2 A centralized communication profile management device according to claim 1, wherein the execution task (CLPAi) is configured to implement or at least participate in a mutual authentication mechanism between the communication profile manager (SM-DP+) and the security element (eUICC). Claim 3 A centralized communication profile management device according to claim 1, wherein at least one management command is a command for loading the profile into at least the security element and / or activating, deactivating, or deleting the profile in the security element (eUICC). Claim 4 A centralized communication profile management device according to any one of claims 1 to 3, wherein the execution operation (CLPAi) is configured to communicate with the agent (DAG) in relation to the communication session (SC1) according to a security protocol, and the security protocol uses a certificate (CERTSIM) stored in the security element (eUICC). Claim 5 A centralized communication profile management device according to any one of claims 1 to 3, wherein the execution operation (CLPAi) is configured to communicate with the communication profile manager (SM-DP+) in the first communication channel (CC2) according to a security protocol, and the security protocol uses a certificate (CERTSM) stored in the communication profile manager (SM-DP+). Claim 6 A centralized communication profile management device characterized by including, in any one of claims 1 to 3, a module (MES) for establishing a session configured to send an invitation message (MINV) intended to invite the communication agent to establish the session together with the centralized communication profile management device (CLPA) to the communication agent (DAG). Claim 7 In paragraph 6, the centralized communication profile management device, wherein the invitation message is a signed and / or encrypted message of the SMS type. Claim 8 A centralized communication profile management device according to any one of claims 1 to 3, comprising a module (MES) for establishing a session configured to receive a query request originating from the communication agent (DAG), wherein the module (MES) is configured to establish the session with the communication agent in response to the request. Claim 9 In paragraph 1, from a third party, - the communication profile (PROF eid Loading ) into the above security element (eUICC), or - the communication profile (PROF) in the above security element (eUICC) eid A centralized communication profile management device characterized by including an interface module (IF) capable of receiving management requests for enabling, disabling, or deleting ). Claim 10 In a communication agent (DAG), a first communication module (COM-NET) configured to establish a communication session (SC1) by an execution task (CLPAi) of a centralized communication profile management device (CLPA) according to claim 1; and a profile (PROF) encapsulated in at least one message received from the execution task associated with the session. eid A communication agent comprising a second communication module (COM-SIM) (CLPAi) configured to transmit at least one management command of ) to a security element (eUICC) embedded in the terminal (T). Claim 11 A communication agent according to claim 10, characterized in that it is configured to acquire a certificate (CERTSIM) stored in the security element (eUICC) and / or use this certificate (CERTSIM) to communicate with the centralized communication profile management device (CLPA) associated with the session in accordance with a security protocol. Claim 12 A terminal (T) comprising a communication agent (DAG) and a security element (eUICC) according to either claim 10 or 11. Claim 13 In a communication profile management method executed by a centralized communication profile management device (CLPA), a communication profile (PROF) in a security element (eUICC) embedded in a terminal (T) eid A step of dynamically generating an execution task (CLPAi) to respond to a remote management request of ); a step of executing said execution task (CLPAi); a step of establishing a first communication channel (CC2) between said execution task (CLPAi) and a communication profile manager (SM-DP+) in a network - said execution task (CLPAi) receives the communication profile (PROF) from the communication profile manager (SM-DP+) through said first communication channel (CC2) eid ) can be obtained -; the profile (PROF) encapsulated in at least one message transmitted by the execution task (CLPAi) in connection with the communication session (SC1) with the execution task (CLPAi) and the security element (eUICC). eid A communication profile management method comprising: a step of establishing a communication session (SC1) between communication agents (DAGs) configured to transmit at least one management command of ); and a step of deleting the execution task (CLPAi) when an action responding to the request is performed. Claim 14 A communication method executed by a communication agent (DAG), comprising: a step of establishing a communication session (SC1) with an execution task (CLPAi) of a centralized communication profile management device (CLPA) according to claim 1; and a profile (PROF) encapsulated in at least one message received from the execution task (CLPAi) associated with the session. eid A communication method comprising the step of transmitting at least one management command of ) to a security element (eUICC) embedded in a terminal (T). Claim 15 A computer program stored on a computer-readable storage medium, comprising instructions for executing a communication profile management method according to paragraph 13 when executed by a computer. Claim 16 A computer program stored on a computer-readable storage medium, comprising instructions for executing a communication method according to claim 14 when executed by a computer.

Images