eUICC eSIM Instantiation via Preloaded Data Blob
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for installing electronic subscriber identity modules (eSIMs) in embedded universal integrated circuit cards (eUICCs) fail to address the needs of after-market buyers who lack eSIMs and do not provide secure provisioning in untrusted manufacturing environments, limiting flexibility and access to mobile network services.
Innovation Solution
Creating an eSIM package with a data blob that is preloaded into an eUICC in a manufacturing environment, allowing the eUICC to instantiate multiple eSIM instances without over-the-air provisioning, using unique data and encryption keys to ensure security and flexibility, including the ability to change IMSI and subscriber keys for different users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If eSIMs are provisioned over the air, then after-market buyers can conveniently obtain eSIMs for purchased wireless devices, but security and confidentiality of eSIM information may be compromised in untrusted environments
Solution Approach 1:
The eUICC is pre-configured with an eSIM package (including data blob, operating system, and personalization data) during manufacturing in a controlled environment before the device reaches the end user. This preliminary action enables the device to have eSIM capability ready without requiring insecure over-the-air provisioning later, thus resolving the contradiction between convenience and security.
2Volume of moving object
If eUICC size is reduced using wafer level chip scale packaging, then device design flexibility is improved, but physical loading of operating system and personalization data becomes difficult
Solution Approach 1:
The operating system and personalization data are pre-loaded into the eUICC during the wafer fabrication process in a controlled factory environment, before the eUICC is finalized and distributed. This preliminary action eliminates the need for later physical loading attempts, resolving the manufacturing difficulty while maintaining the small form factor benefits.
Solution Approach 2:
A controlled intermediary environment (trusted factory setting) is introduced between the data source and the eUICC programming process. This intermediary enables secure and reliable data loading during manufacturing, overcoming the limitations of physical loading in constrained wafer-level packaging scenarios.
3Reliability
If eSIM vendor is trusted but chipmaker is not trusted, then eSIM security is maintained, but eSIM information cannot be entrusted to contracted chipmaker
Solution Approach 1:
The eSIM package is segmented into separate components (data blob, operating system, personalization data) that are processed and assembled in a controlled manner during manufacturing. This segmentation allows the chipmaker to work with structured data formats while maintaining security through controlled access and processing, enabling partnership flexibility without compromising security.
Solution Approach 2:
A controlled intermediary manufacturing process is established where the eSIM package components are prepared and loaded under strict security protocols. This intermediary process acts as a bridge between the untrusted chipmaker and the trusted eSIM vendor, enabling collaboration while maintaining security through controlled data handling and processing procedures.
Data Source
AI summary
Methods are provided for instantiating multiple electronic subscriber identity modules (eSIMs) to an electronic universal integrated circuit card (eUICC) using a manufacturer-installed data binary large object (data blob). An eSIM package including the data blob in encrypted form is securely installed in the eUICC in a manufacturing environment. A key encryption key (KEK) associated with the eSIM package is separately provided to an original equipment manufacturer (OEM) wireless device factory. The OEM wireless device factory provides the KEK to the eUICC within a given wireless device. The eUICC uses the KEK to decrypt the eSIM package and provide the data blob. The eUICC can receive a request to instantiate a first eSIM. The eUICC can instantiate the first eSIM using data from the data blob. A user can then access network services using the wireless device. Subsequently, a second eSIM can be instantiated by the eUICC using the data blob.