Subscriber profile transfer method, subscriber profile transfer system, and user equipment

Patent metadata

Field	Value
Publication number	US-10003965-B2
Application number	US-201414914814-A
Country	US
Kind code	B2
Filing date	Aug 25, 2014
Priority date	Aug 26, 2013
Publication date	Jun 19, 2018
Grant date	Jun 19, 2018

Abstract

An eUICC 100 embedded in an UE 200 authenticates an AUTN transmitted from an HSS 300 , and calculates a transfer key TK by using a secret key K. The eUICC 100 acquires a transfer Token by decoding an enc Token by using the transfer key TK, and acquires a new Customer ID by decoding an enc New ID by using the transfer key TK. The eUICC 100 transmits a user auth resp in response to a User auth+transfer Setup Req including the AUTN, the enc Token, and the enc New ID to the HSS 300 . The eUICC 100 generates a shared-Secret Key shared between the eUICC 100 and an HSS 400 by using the transfer Token, and executes an attach procedure for the HSS 400 by using the generated shared-Secret Key and the new Customer ID.

First claim

The invention claimed is:

1. A subscriber profile transfer method of transferring a subscriber profile associated with user equipment from a first operator to a second operator by using
the user equipment,
an embedded subscriber identification module that is a subscriber identification module embedded in the user equipment,
a first subscriber server managed by the first operator, and
a second subscriber server managed by the second operator,
the method comprising the steps of:
causing the embedded subscriber identification module to transmit a transfer request for the subscriber profile to the user equipment, the transfer request including a module transfer identifier associated with the embedded subscriber identification module, an operator-transfer temporary number associated with a transfer of the subscriber profile, a subscriber transfer identifier indicating that the transfer is authenticated by a user of the user equipment, and a new operator identifier for identifying the second operator;
causing the user equipment to transmit a transfer request including a new subscriber server identifier for identifying the second subscriber server, the subscriber transfer identifier, and the operator-transfer temporary number to the first subscriber server, and to transmit a transfer preparation command including the new operator identifier, the module transfer identifier, and the operator-transfer temporary number to the embedded subscriber identification module;
causing the first subscriber server to transmit a transfer request including a subscriber identifier associated with the user equipment to the second subscriber server via a secure channel established with the second subscriber server, and to receive a response including a new subscriber identifier for identifying the user equipment in the second operator from the second subscriber server;
causing the first subscriber server
to generate a transfer key by using a secret key held by the first subscriber server and the embedded subscriber identification module,
to generate an encoded token by encoding a transfer token that is a temporary operator for transfer by using the transfer key,
to generate an encoded new identifier by encoding the new subscriber identifier by using the transfer key,
to generate a message authentication code including the operator-transfer temporary number, the encoded token, and the encoded new identifier, and
to transmit a user-authentication transfer-setup request including an authentication token generated using the message authentication code, the encoded token, and the encoded new identifier to the embedded subscriber identification module;

causing the embedded subscriber identification module
to authenticate the authentication token and calculate the transfer key,
to acquire the transfer token by decoding the encoded token by using the transfer key,
to acquire the new subscriber identifier by decoding the encoded new identifier by using the transfer key, and
to transmit a user authentication response to the user-authentication transfer-setup request to the first subscriber server;

causing the first subscriber server to transmit the transfer token to the second subscriber server via the secure channel;
causing the second subscriber server to transmit a message including the new operator identifier, the new subscriber identifier, and a message authentication code including the transfer token to the embedded subscriber identification module according to a predetermined key exchange protocol; and
causing each of the embedded subscriber identification module and the second subscriber server to generate a shared secret key using the transfer token, the shared secret key shared between the embedded subscriber identification module and the second subscriber server, and execute an attach procedure by using the generated shared secret key and the new subscriber identifier.

2. A subscriber profile transfer system of transferring a subscriber profile associated with user equipment from a first operator to a second operator by using
the user equipment,
an embedded subscriber identification module that is a subscriber identification module embedded in the user equipment,
a first subscriber server managed by the first operator, and
a second subscriber server managed by the second operator,
wherein
the embedded subscriber identification module transmits a transfer request for the subscriber profile to the user equipment, the transfer request including a module, transfer identifier associated with the embedded subscriber identification module, an operator-transfer temporary number associated with a transfer of the subscriber profile, a subscriber transfer identifier indicating that the transfer is authenticated by a user of the user equipment, and a new operator identifier for identifying the second operator,
the user equipment transmits a transfer request including a new subscriber server identifier for identifying the second subscriber server, the subscriber transfer identifier, and the operator-transfer temporary number to the first subscriber server, and transmits a transfer preparation command including the new operator identifier, the module transfer identifier, and the operator-transfer temporary number to the embedded subscriber identification module,
the first subscriber server transmits a transfer request including a subscriber identifier associated with the user equipment to the second subscriber server via a secure channel established with the second subscriber server, and receives a response including a new subscriber identifier for identifying the user equipment in the second operator from the second subscriber server,
the first subscriber server
generates a transfer key by using a secret key held by the first subscriber server and the embedded subscriber identification module,
generates an encoded token by encoding a transfer token that is a temporary operator for transfer by using the transfer key,
generates an encoded new identifier by encoding the new subscriber identifier by using the transfer key,
generates a message authentication code including the operator-transfer temporary number, the encoded token, and the encoded new identifier, and
transmits a user-authentication transfer-setup request including an authentication token generated using the message authentication code, the encoded token, and the encoded new identifier to the embedded subscriber identification module,

the embedded subscriber identification module
authenticates the authentication token and calculates the transfer key,
acquires the transfer token by decoding the encoded token by using the transfer key, acquires the new subscriber identifier by decoding, the encoded new identifier by using the transfer key, and
transmits a user authentication response to the user-authentication transfer-setup request to the first subscriber server,

the first subscriber server transmits the transfer token to the second subscriber server via the secure channel,
the second subscriber server transmits a message including the new operator identifier, the new subscriber identifier, and a message authentication code including the transfer token to the embedded subscriber identification module according to a predetermined key exchange protocol, and
each of the embedded subscriber identification module and the second subscriber server generates a shared secret key by using the transfer token, the shared secret key being shared between the embedded subscriber identification module and the second subscriber server, and executes an attach procedure by using the generated shared secret key and the new subscriber identifier.

3. The subscriber profile transfer system according to claim 2 , wherein
the second subscriber server generates the message according to a Diffie-Hellman key e

Assignees

• Ntt Docomo Inc

Inventors

• Koshimizu Takashi
• Aono Hiroshi
• Zugenmaier Alf

Classifications

• H04W8/18

  Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/0844

  with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys · CPC title

• H04W60/04

  using triggered events · CPC title

• H04W12/06

  Authentication · CPC title