Subscriber identity module which has multiple profiles and which is designed for an authentication command

Patent metadata

Field	Value
Publication number	US-11716620-B2
Application number	US-202117485642-A
Country	US
Kind code	B2
Filing date	Sep 27, 2021
Priority date	Dec 1, 2015
Publication date	Aug 1, 2023
Grant date	Aug 1, 2023

Abstract

A subscriber identity module (eUICC), comprises profiles for the utilization of a mobile terminal that include at least a first profile and at least a second profile, of which the second profile (Pr1, Pr2) is devised as an active profile. The first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module. The authentication command is specially parameterized for the root profile (PrR) with a specific root value of the network parameter (P2) to be activated during a change-over period. The initially active second profile (Pr1, Pr2) is deactivated during the change-over period. After the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr1, Pr2) is again activated.

First claim

The invention claimed is:

1. A subscriber identity module (eUICC), comprising profiles, stored in a non-transitory memory, for utilization of a mobile terminal in mobile communication networks, wherein the profiles comprise at least a first profile and at least a second profile, of which the second profile (Pr1, Pr2) is devised as an initially active second profile,
the subscriber identity module devised to receive and to process an authentication command (AUTHENTICATE) parameterized with a network parameter (P2), and as a result of this to compute authentication data for a mobile communication network determined by a network value of the network parameter (P2),
wherein the first profile is a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated a duration of processing of the authentication command (AUTHENTICATE) received at the subscriber identity module, said authentication command being specially parameterized for the root profile (PrR) with a predefined specific root value of the network parameter (P2) to be activated during a change-over period, wherein the initially active second profile (Pr1, Pr2) is deactivated during the change-over period, and wherein after the end of the change-over period, the first profile (PrR) is automatically deactivated and the second profile (Pr1, Pr2) is automatically activated; and
wherein as the first profile, one of the following is provided: an emergency profile for outputting an emergency call in an emergency situation in an emergency call network; a test profile for carrying out an end-device test on a test network; a service profile for calling a service network of a service provider.

2. The subscriber identity module according to claim 1 , wherein as a value of the network parameter (P2) there is provided: P2=P3G as a network value for network 3G, P2=P2G as a network value for network 2G, a value P2=PR different from P2=P3G and P2=P2G and different from further pre-allocated values as a root value for a transient activation of the root profile.

3. The subscriber identity module according to claim 1 , wherein an application protocol data unit (APDU) command is provided as an authentication command.

4. The subscriber identity module according to claim 1 , wherein as the first profile, a profile of a manufacturer of the subscriber identity module is provided, and as the second profile, a profile of an owner of the subscriber identity module is provided, in particular of a network provider.

5. The subscriber identity module according to claim 1 , wherein a profile (P) comprises respectively an authentication key (Ki), and wherein the authentication command (AUTHENTICATE) is devised for computing, originating from the authentication key (Ki-1, Ki-2, Ki-R) of a currently active profile (Pr1, Pr2, PrR), the authentication data.

6. The subscriber identity module according to claim 1 , wherein the profile (Pr1, Pr2, PrR) comprises respectively an Issuer Security Domain (ISD-P1, ISD-P2, ISD-R).

7. The subscriber identity module according to claim 1 , which further comprises an Issuer Security Domain Root (ISD-R) which is devised in particular as an end point situated in the subscriber identity module of a channel provided for provisioning the subscriber identity module between a Sub Man Secure Router (SM-SR) and the subscriber identity module and wherein the first profile has an Issuer Security Domain (ISD-R).

Assignees

• Giesecke & Devrient Mobile Security Gmbh

Inventors

• Huber Ulrich
• Nitsch Nils

Classifications

• H04W12/06 Primary

  Authentication · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L67/303

  Terminal profiles · CPC title

• H04W4/90

  Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS] · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title