Abstract:
Methods are provided for instantiating multiple electronic subscriber identity modules (eSIMs) to an electronic universal integrated circuit card (eUICC) using a manufacturer-installed data binary large object (data blob). An eSIM package including the data blob in encrypted form is securely installed in the eUICC in a manufacturing environment. A key encryption key (KEK) associated with the eSIM package is separately provided to an original equipment manufacturer (OEM) wireless device factory. The OEM wireless device factory provides the KEK to the eUICC within a given wireless device. The eUICC uses the KEK to decrypt the eSIM package and provide the data blob. The eUICC can receive a request to instantiate a first eSIM. The eUICC can instantiate the first eSIM using data from the data blob. A user can then access network services using the wireless device. Subsequently, a second eSIM can be instantiated by the eUICC using the data blob.
Abstract:
Disclosed herein is a technique for enabling Subscriber Identity Module (SIM) toolkit commands to be properly routed within a mobile device that includes an embedded Universal Integrated Circuit Card (eUICC) configured to manage two or more electronic SIMs (eSIMs). Specifically, the technique involves a baseband component of the mobile device and the eUICC initially exchanging information about their eSIM capabilities to identify whether multiple eSIMs are active within the eUICC. During this exchange of information, the eUICC can generate a list of unique identifiers of the active eSIMs that are managed by the eUICC and provide the list of unique identifiers to the baseband component. In turn, the baseband component can update a configuration to manage the list of unique identifiers and use the list of unique identifiers to properly route SIM toolkit commands to the appropriate eSIM within the eUICC.
Abstract:
Representative embodiments described herein set forth techniques for optimizing large-scale deliveries of electronic Subscriber Identity Modules (eSIMs) to mobile devices. Specifically, instead of generating and assigning eSIMs when mobile devices are being activated—which can require significant processing overhead—eSIMs are pre-generated with a basic set of information, and are later-assigned to the mobile devices when they are activated. This can provide considerable benefits over conventional approaches that involve generating and assigning eSIMs during mobile device activation, especially when new mobile devices (e.g., smartphones, tablets, etc.) are being launched and a large number of eSIM assignment requests are to be fulfilled in an efficient manner.
Abstract:
Disclosed herein are different techniques for enabling a mobile device to dynamically support different authentication algorithms. A first technique involves configuring an eUICC included in the mobile device to implement various authentication algorithms that are utilized by MNOs (e.g., MNOs with which the mobile device can interact). Specifically, this technique involves the eUICC storing executable code for each of the various authentication algorithms. According to this technique, the eUICC is configured to manage at least one eSIM, where the eSIM includes (i) an identifier that corresponds to one of the various authentication algorithms implemented by the eUICC, and (ii) authentication parameters that are compatible with the authentication algorithm. A second technique involves configuring the eUICC to interface with an eSIM to extract (i) executable code for an authentication algorithm used by an MNO that corresponds to the eSIM, and (ii) authentication parameters that are compatible with the authentication algorithm.
Abstract:
Disclosed herein is a technique for updating firmware of an embedded Universal Integrated Circuit Card (eUICC) included in a mobile device. The technique includes the steps of (1) receiving, from a firmware provider, an indication that an updated firmware is available for the eUICC, (2) in response to the indication, providing, to the firmware provider, (i) a unique identifier (ID) associated with the eUICC, and (ii) a nonce value, (3) subsequent to providing, receiving, from the firmware provider, a firmware update package, wherein the firmware update package includes (i) authentication information, and (ii) the updated firmware, (4) subsequent to verifying the authentication information, persisting, to a memory included in the mobile device, a hash value that corresponds to the updated firmware, and (5) installing the updated firmware on the eUICC.
Abstract:
A method for establishing a secure communication channel between an off-card entity and an embedded Universal Integrated Circuit Card (eUICC) is provided. The method involves establishing symmetric keys that are ephemeral in scope. Specifically, an off-card entity, and each eUICC in a set of eUICCs managed by the off-card entity, possess long-term Public Key Infrastructure (PKI) information. When a secure communication channel is to be established between the off-card entity and an eUICC, the eUICC and the off-card entity can authenticate one another in accordance with the respectively-possessed PKI information (e.g., verifying public keys). After authentication, the off-card entity and the eUICC establish a shared session-based symmetric key for implementing the secure communication channel. Specifically, the shared session-based symmetric key is generated according to whether perfect or half forward security is desired. Once the shared session-based symmetric key is established, the off-card entity and the eUICC can securely communicate information.
Abstract:
Apparatus and methods for managing and sharing data across multiple access control clients in devices. In one embodiment, the access control clients comprise electronic Subscriber Identity Modules (eSIMs) disposed on an embedded Universal Integrated Circuit Card (eUICC). Each eSIM contains its own data. An Advanced Subscriber Identity Toolkit application maintained within the eUICC facilitates managing and sharing multiple eSIMs' data for various purposes such as sharing phonebook contacts or facilitating automatic switch-over between the multiple eSIMs (such as based on user context).
Abstract:
Methods and apparatus for the automated updating of forwarding preferences for communications in a telecommunications network. In one embodiment, the network includes a wireless (e.g., cellular) network with user mobile user devices configured to detect a change to their configuration (such as a user changing out SIM cards or virtual access clients). In response, the device causes an update to its associated communication forwarding preferences to reflect the change. If the configuration alteration meets certain criteria (e.g., changes the phone number at which the device may be reached), the device sends a forwarding message instructing a network entity (e.g., routing server) to direct communications addressed to the old phone number to the new phone number. Thus, a user with two or more user profiles (such as two different carrier accounts) may be reached at any number associated with any of the profiles, even if only one profile is currently active.
Abstract:
The described embodiments set forth techniques for managing subscription service files, e.g., Customized Applications for Mobile network Enhanced Logic (CAMEL) Application Part (CAP) files, for export and/or transfer of an electronic SIM (eSIM) from a source wireless device. As part of an eSIM procedure to transfer an eSIM, e.g., a processor of the source wireless device obtains, from one or more applet asset servers, one or more subscription service files usable to generate a version of applets associated with the eSIM. The wireless device generates an eSIM export package that includes the eSIM and at least one of the one or more of the subscription service files. The processor of the source wireless device provides the eSIM export package to the target wireless device to use to install the transferred eSIM and one or more applets based on the subscription service files on the eUICC of the target wireless device.
Abstract:
This Application describes mechanisms for enterprise remote management of cellular services provided via access credentials, e.g., subscriber identity modules (SIMs) and/or electronic SIMs (eSIMs), for wireless devices. To minimize requirements for user interaction, installation and management of business-supplied cellular service profiles on the wireless device can intercept alert notifications to reduce interruptions and allow for background management of the business-supplied cellular service profiles. Additionally, a business enterprise can use multiple, distinct services to initiate installation of an eSIM to a wireless device. When two different services attempt to install eSIMs on the wireless device in parallel, management software on the wireless device can control an order of installation and disallow duplicate installations of an identical eSIM to the wireless device. The management software can also monitor eSIM installations and manage alert notifications that occur during the eSIM installation process.