Secure Element Profile Provisioning via Temporary IMSI Signaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cellular telecommunication networks, secure elements like UICC do not contain a subscription profile, leading to roaming costs during profile download when abroad, especially in M2M and IoT scenarios, and existing solutions require Wi-Fi access for subscription profile download, which is not universally available.
Innovation Solution
Utilizing modified standardized signaling messages to remotely configure secure elements without roaming costs, enabling subscription profile transmission using only signaling channels, and employing an enhanced secure element with a special operating system to decode and execute commands within existing authentication messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a secure element uses a bootstrap MNO for initial network access, then the terminal can connect to the network and download subscription profiles, but roaming costs are incurred when the user is abroad
Solution Approach 1:
The invention performs preliminary provisioning of a temporary IMSI and ephemeral Ki in the secure element before actual network usage. This allows the secure element to directly attach to the target MNO network without needing to roam through a bootstrap MNO, thereby eliminating roaming costs while maintaining network access capability
Solution Approach 2:
The invention introduces a temporary IMSI as an intermediary identifier that enables the secure element to bridge between the provisioning system and the target MNO network. This temporary identifier acts as a mediator that facilitates direct network attachment without requiring physical presence or roaming agreements with bootstrap operators
2Quantity of substance
If subscription profiles are downloaded using conventional methods, then profiles can be transmitted to secure elements, but Wi-Fi access is required which is not universally available
Solution Approach 1:
The invention makes the signaling messages multi-functional by enabling them to serve both as authentication credentials and as carriers for subscription profile data. This allows the same communication channel to be used for both network attachment and profile provisioning, eliminating the need for separate Wi-Fi access
Solution Approach 2:
The invention merges the authentication signaling process with the subscription profile transmission process. By embedding profile data within authentication messages (RAND/AUTN/RES), it combines two separate functions into a single integrated process that works over standard cellular signaling channels
3Loss of energy
If modified signaling messages are used for profile transmission, then roaming costs are eliminated and Wi-Fi dependency is removed, but the system complexity increases
Solution Approach 1:
The invention changes the parameters of existing signaling messages by embedding additional data fields (subscription profile information) within the standard authentication message structure. This allows new functionality to be added without requiring entirely new message types or protocols, thereby limiting the increase in system complexity
Data Source
Figure 1~2
Figure 3~11
Figure 5
AI summary
The invention concerns a method for transmitting a subscription profile from a MNO to a secure element cooperating with a terminal (10), the secure element being pre-provisioned with a temporary profile comprising a unique identifier, a first MCC and a first MNC, the method comprising: - Transmitting from a POS (BSS/OSS) of the MNO the unique identifier of the secure element to a SM-DP (403); - Creating or reserving the subscription profile at the SM-DP (403); - Provisioning in a D-HSS server (401) having the first MCC/MNC the unique identifier and a temporary IMSI (t-IMSI) comprising a second MCC, a second MNC; - Provisioning in the HSS (404) of the MNO the temporary IMSI (t-IMSI) and an ephemeral Ki (e-Ki); - At the first attempt of the secure element to connect to the D-HSS server (401) with its temporary profile, exchanging data in signaling messages between the secure element and the D-HSS (401) for provisioning the secure element with the temporary IMSI (t-IMSI); - At the next attempt of the secure element to connect to the MNO network with the temporary IMSI (t-IMSI), open an APN and send from the SM-DP (403) to the secure element the subscription profile.