Embedded UICC Subscription Profiles With Deferred Key Release
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing subscription profiles in subscriber identity modules, such as eUICCs, require synchronous installation and configuration, which limits flexibility and security, especially when profiles need to be updated or changed after the module is delivered to a user.
Innovation Solution
The method decouples the setup of subscription profiles from their installation by encrypting the profiles with a cryptographic key unknown to the module, storing them without decryption, and providing the key at a later time for decryption and installation, allowing flexible configuration and enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the subscription profile is encrypted with a cryptographic key unknown to the subscriber identity module and stored without decryption, then security against manipulation is enhanced, but the profile cannot be installed or configured until the key is provided
Solution Approach 1:
The subscription profile is encrypted and stored in advance in the subscriber identity module before the cryptographic key is available. This preliminary storage of encrypted data allows the module to be prepared and delivered to the user beforehand, while the actual decryption and configuration occur later when the key is provided, thus enhancing security without permanently blocking installation
Solution Approach 2:
The cryptographic key is separated from the encrypted subscription profile. The profile is stored in the subscriber identity module without the key, effectively extracting the decryption capability from the storage location. This separation ensures that even if the profile is compromised, it cannot be used without the key, while still allowing the profile structure to be in place and ready for future configuration
2Productivity
If synchronous installation and configuration of subscription profiles is required, then the profile can be immediately used, but flexibility for updates and changes after delivery is limited
Solution Approach 1:
The profile configuration process is made dynamic rather than static. Instead of requiring immediate synchronous installation and configuration, the system allows the profile to be stored in encrypted form and configured asynchronously when needed. This dynamic approach enables flexible updates and changes after delivery while still allowing immediate usage in cases where the key is available at the time of delivery
3Loss of time
If the subscription profile is decrypted and installed immediately upon receipt, then the profile can be configured without delay, but security during storage is reduced
Solution Approach 1:
The profile is preemptively encrypted before storage to prevent potential security breaches. By applying encryption as a preliminary protective measure during storage, the system eliminates the security risk associated with storing decrypted profiles, while the decryption process can be quickly performed later when the key is available, thus preventing security issues without permanently delaying configuration
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for setting up a subscription profile in a subscriber identity module, preferably an embedded UICC, wherein the following method steps are carried out in the subscriber identity module: receiving a subscription profile encrypted by a cryptographic key of a subscription server, wherein the cryptographic key for decrypting the subscription profile is unknown to the subscriber identity module at the time of receipt; storing the encrypted subscription profile without decrypting the subscription profile; receiving the cryptographic key at a time after the storing step; decrypting the encrypted subscription profile using the cryptographic key; and installing the decrypted subscription profile for setting up the subscription profile in the subscriber identity module. The invention additionally relates to a corresponding method in a subscription server, a subscriber identity module and a computer program product.