Integrated SIM Credential Installation via Virtual iSIM Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing process for provisioning an MNO profile in an integrated SIM (iSIM) is complex and insecure, as it requires sequential operations in secure and non-secure environments, prolonging production time and introducing security risks due to the need for chip makers to share sensitive information.
Innovation Solution
A virtual iSIM is generated and managed by an In-Factory Binding Box (IFBB), allowing manufacturers to securely obtain credentials without identifying information, using a virtual TRE key pair and remote activation server, ensuring secure storage and management of sensitive data within a controlled environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the existing sequential process for provisioning MNO profile is used, then security is maintained through secure environment operations, but production time is prolonged and complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-generating virtual iSIMs and their associated virtual TRE key pairs before actual device production. The In-Factory Binding Box creates these virtual credentials in advance, allowing the remote activation server to prepare RSP credentials bound to virtual keys beforehand. This preliminary preparation eliminates the need for sequential secure environment operations during actual device provisioning, significantly reducing production time while maintaining security through the virtualization layer.
Solution Approach 2:
The patent introduces an intermediary approach by using virtual iSIMs as a mediator between the secure remote activation server and the physical devices. The virtual TRE key pairs act as an intermediate layer that allows credential binding to occur in a secure environment without requiring direct access to sensitive assets during device manufacturing. This intermediary virtualization layer decouples the security-critical binding operation from the physical device production flow, enabling parallel processing and reducing overall production time.
2Ease of manufacture
If chip makers share sensitive information with module makers, then credential loading can proceed, but security risks increase due to exposure of sensitive assets
Solution Approach 1:
The patent applies the copying principle by creating virtual copies of iSIMs with virtual TRE key pairs that mimic the structure and function of real credentials without containing actual sensitive assets. The In-Factory Binding Box generates these virtual credentials that can be freely shared and processed during manufacturing. The actual sensitive credentials remain secured on the remote activation server, while the virtual copies enable seamless credential loading operations throughout the supply chain without exposing sensitive information.
Solution Approach 2:
The virtual iSIM system serves as an intermediary that eliminates the need for chip makers to share sensitive information with module makers. The virtual TRE key pairs act as placeholders that allow the module maker to perform credential loading operations without ever encountering the actual sensitive assets. The remote activation server mediates the entire process by binding RSP credentials to the virtual keys and distributing them securely, removing the security risk associated with information sharing while maintaining manufacturing ease.
3Reliability
If virtual iSIMs are used to decouple from credentials, then security is enhanced and production flexibility increases, but system complexity increases
Solution Approach 1:
The patent applies universality by designing the virtual iSIM system to perform multiple functions within a unified framework. The In-Factory Binding Box simultaneously generates virtual TRE key pairs, creates virtual iSIM identifiers, and prepares output files for remote activation. The remote activation server universally handles both virtual and real credential binding operations through the same interface. This multi-functionality reduces the need for separate specialized systems for each operation, thereby managing complexity while delivering security and flexibility benefits.
Solution Approach 2:
The patent merges the functions of virtual iSIM generation, credential binding, and device provisioning into a single integrated workflow managed by the In-Factory Binding Box and remote activation server. Rather than maintaining separate systems for virtual credential management and physical device provisioning, the patent combines these operations into a unified process where virtual TRE key pairs serve as the common interface. This merging reduces operational complexity by eliminating the need for multiple separate systems and interfaces.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Aspects of the present disclosure are directed toward a virtual bound credential, created by the steps of generating by an In-Factory Binding Box a virtual iSIM, wherein the virtual iSIM comprises a virtual iSIM identifier and a virtual TRE key, wherein the virtual TRE key comprises a virtual TRE public part and a virtual TRE private part; preparing by the In-Factory Binding Box an output file comprising the virtual vTRE_ID and the virtual TRE public part of the virtual TRE Key that corresponds to the virtual iSIM, and binding, by a remote activation server, the output file with a RSP credential to form the virtual bound credential.