eUICC Profile Container with App Security Domain for Third-Party Applets

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing subscriber identity modules (eUICCs) are limited by dependency on specific network operators for managing and installing applets, restricting the flexibility and independence of third-party service applications.

Innovation Solution

A subscriber identity module architecture with an application security domain within a profile container allows for the independent installation and management of third-party applets, secured through authentication and encryption, enabling communication with a profile server.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If applications are managed within the profile container under network operator control, then authentication security is maintained, but third-party application independence and flexibility are restricted

Engineering Contradiction:

Improvethird-party application independenceVSAvoidauthentication security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent divides the security management into separate domains: the profile container maintains network operator control for authentication, while the application security domain provides independent management for third-party applications. This segmentation allows each domain to operate with appropriate security controls without interfering with the other.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The application security domain acts as an intermediary layer between third-party applications and the profile container. It provides a secure interface that allows applications to be loaded and managed independently while maintaining security boundaries with the network operator's authentication system.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If a separate application security domain is created within the profile container, then third-party application independence is enabled, but device complexity increases

Engineering Contradiction:

Improveapplication management flexibilityVSAvoidsecurity domain structure

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The application security domain is nested within the profile container structure, allowing the complex security domain to be contained within the existing profile container framework. This nesting approach enables additional functionality without requiring a completely separate architectural layer.

Inventive Principle:

Principle #7Nested doll (Nesting)

3Adaptability or versatility

If applications can be loaded and managed from the profile server, then service diversity is improved, but security risk exposure increases

Engineering Contradiction:

Improveservice diversityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The application security domain serves as a secure intermediary that receives applications from the profile server and manages them in an isolated environment. This intermediary layer provides security boundaries that prevent direct exposure of the device to potential malicious applications while still enabling diverse services.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The application security domain is configured with security controls and isolation mechanisms in advance before applications are loaded. This pre-established security framework cushions against potential security risks by containing applications in a controlled environment with predefined security boundaries.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentEP4054223B1Subscriber identity module with or set up for application

Publication Date: 2026.01.28 GIESECKE DEVRIENT MOBILE SECURITY GERMANY GMBH

Figure 1~3

AI summary

The invention provides a subscriber identity module (eUICC) for authenticating a mobile device to a mobile network, comprising at least one profile container (ISD-P) configured to allow a profile to be loaded, installed, and managed from a profile server (SM-DP+). The subscriber identity module is characterized by at least one application security domain (ACSD) created within the profile container (ISD-P), configured to allow applications to be loaded, installed, and managed from the same profile server (SM-DP+).