Remote SIM Credential Provisioning Using Temporary Subscriber Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for provisioning Remote Subscriber Identity Module (SIM) credentials to secure elements like eUICC and iUICC require certified and secure environments at multiple manufacturing sites, leading to complex traceability and supply chain constraints, especially for iUICC, which are impractical and slow down production.
Innovation Solution
A method for remote provisioning of RSP credentials using a temporary subscriber identity over a mobile network's signaling channel, allowing secure elements to request and obtain credentials from remote servers without pre-storing them, eliminating the need for certified environments and complex traceability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RSP credentials are loaded at the chip manufacturer site, then security is ensured through certified environment, but supply chain complexity increases due to need for separate Stock Keeping Units for different EUM
Solution Approach 1:
The patent extracts the RSP credentials loading operation from the chip manufacturer site and relocates it to the device manufacturer site. This is achieved by introducing a new mechanism where the device manufacturer can securely load credentials using a key pair stored in the secure element, eliminating the need for certified environments at chip manufacturer sites and reducing supply chain complexity.
Solution Approach 2:
The patent introduces a key pair mechanism as an intermediary that enables secure credential loading at the device manufacturer site without requiring a certified environment. The private key stored in the secure element acts as a mediator that allows the device manufacturer to authenticate and load credentials securely, replacing the need for physical certified environments.
2Device complexity
If RSP credentials are loaded at the device manufacturer site, then supply chain constraints are reduced, but security cannot be ensured without certified environment which makes it unrealistic for numerous device manufacturers
Solution Approach 1:
The patent enables the device manufacturer to perform secure credential loading themselves without requiring external certification or third-party intervention. The secure element's built-in key pair allows the device manufacturer to autonomously authenticate and load credentials, making the security mechanism self-contained and applicable to any device manufacturer without needing certified environments.
Solution Approach 2:
The patent replaces the physical certified environment requirement with a cryptographic mechanism. Instead of relying on physical security infrastructure (certified environments), the solution uses digital authentication through key pairs stored in the secure element, substituting mechanical/physical security with cryptographic security that can be implemented anywhere.
3Ease of manufacture
If 2-step personalization is used to allow loading in non-secured environment, then certified environment requirement is removed, but traceability of unique secure cryptographic keys becomes complex requiring differentiated stocks for each OEM/ODM
Solution Approach 1:
The patent creates a universal mechanism where a single key pair stored in the secure element can be used by any device manufacturer (OEM/ODM) to load credentials. This universal approach eliminates the need for differentiated stocks and complex traceability for each manufacturer, as the same cryptographic mechanism works universally across all device manufacturers without requiring unique key management for each.
Data Source
Figure 1
Figure 2
AI summary
A method for obtaining credentials required for Remote Subscriber Identify Module Provisioning, RSP, of a secure element cooperating with a terminal, the method comprising: - sending (202), by the secure element via a telecommunication interface of the terminal, a request to a first remote server on a signaling channel of a mobile network; - receiving (209), by the secure element, a temporary subscriber identity after sending of the request; - obtaining (211; 215) said credentials, wherein at least one of the credentials is obtained from a second remote server, using the temporary subscriber identity ; - requesting (217), from a subscription manager server, a subscriber profile associated with a permanent subscriber identity, using RSP based on said obtained credentials.