eSIM Profile Transfer Using Key Release to Prevent Cloning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing embedded SIM card standards, such as eSIM and SSP, do not allow for the secure transfer of network access profiles between devices, posing a significant security risk of profile cloning that undermines network operator security.
Innovation Solution
A method involving a first and second mobile device with security modules that generate a secret key, encrypt the network access profile, and transfer it through a secure logical communication channel, ensuring the profile is deleted from the source device and decrypted only by the destination device, thus preventing cloning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a network access profile is transferred from one mobile device to another, then the user can easily transfer their access profile to new equipment, but the risk of profile cloning increases and network security is compromised
Solution Approach 1:
The source security module deletes the network access profile before transferring it to the destination device. This preliminary deletion action ensures that the profile cannot be cloned, as it no longer exists in the source device to be copied, while still enabling seamless transfer to the new device through secure encrypted communication channels
Solution Approach 2:
A secure logical communication channel acts as an intermediary between the source and destination security modules during profile transfer. This intermediary channel uses encryption to protect the profile data during transmission, preventing unauthorized interception and cloning while enabling the transfer operation
2Reliability
If the network access profile is encrypted and transferred through a secure channel, then cloning is prevented, but the complexity of the transfer mechanism increases
Solution Approach 1:
The security modules autonomously manage the encryption and decryption of the network access profile during transfer. The source module encrypts the profile before transmission, and the destination module automatically decrypts it, eliminating the need for manual security configuration and reducing operational complexity despite the enhanced security measures
Solution Approach 2:
The encryption of the network access profile is performed in advance before the transfer operation. This preliminary encryption action simplifies the transfer process by ensuring security is already in place, rather than requiring complex real-time security protocols during the actual transfer
Data Source
Figure 1~2
AI summary
The invention relates to a method for protecting a network access profile against cloning, a first mobile equipment (10) comprising a security module (101), called "first security module", said first security module comprising said network access profile, a second mobile equipment (11) being designed to receive said network access profile, said second mobile equipment comprising a security module (111), called "second security module", said first security module, respectively said second security module, being designed to establish a logic communication channel with the second security module, respectively the first security module, said method comprising the following steps, implemented by the first security module: - generating (E01) a secret key, - using said secret key to encrypt (E03) a data packet associated with the network access profile, and sending said encrypted packet to the second security module through the logic communication channel, - receiving (E05), from the second security module, an acknowledgement of receipt representative of the correct reception of said encrypted data packet, - deleting (E06) the data packet associated with the network access profile, and then sending (E07) the secret key to the second security module through the logic communication channel.