Method for setting up a subscription profile, method for providing a subscription profile, subscriber identity module

Patent metadata

Field	Value
Publication number	US-12114166-B2
Application number	US-202017612440-A
Country	US
Kind code	B2
Filing date	May 19, 2020
Priority date	May 24, 2019
Publication date	Oct 8, 2024
Grant date	Oct 8, 2024

Abstract

The invention relates to a method for setting up a subscription profile in a subscriber identity module, preferably an embedded UICC, wherein the following method steps take place in the subscriber identity module: receiving a subscription profile encrypted with a cryptographic key of a subscription server, wherein the cryptographic key for decrypting the subscription profile is unknown to the subscriber identity module at the time of receiving; storing the encrypted subscription profile without decrypting the subscription profile; receiving the cryptographic key at a time after the storing step; decrypting the encrypted subscription profile with the cryptographic key; and installing the decrypted subscription profile to set up the subscription profile in the subscriber identity module. The invention also relates to a corresponding method in a subscription server, a subscriber identity module, and a computer program product.

First claim

The invention claimed is:

1. A method for setting up a subscription profile in a subscriber identity module, wherein the following method steps take place in the subscriber identity module:
receiving a subscription profile encrypted with a cryptographic key of a subscription server,
wherein the cryptographic key for decrypting the subscription profile is unknown to the subscriber identity module at the time of receiving;
storing the encrypted subscription profile without decrypting the subscription profile;
receiving the cryptographic key at a time after the storing step;
decrypting the encrypted subscription profile with the cryptographic key; and
installing the decrypted subscription profile to set up the subscription profile in the subscriber identity module;
wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile are decoupled in time from receiving the cryptographic key;
wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile is coordinated to occur in context of a contract conclusion.

2. The method according to claim 1 , wherein the encrypted subscription profile is received from a subscription server.

3. The method according to claim 1 , wherein the encrypted subscription profile is received from a publisher of the subscriber identity module.

4. The method according to claim 1 , wherein the cryptographic key for decrypting the encrypted subscription profile is received from a subscription server at a time after the storing step.

5. The method according to claim 1 , wherein the cryptographic key for decrypting the encrypted subscription profile is received from a second subscriber identity module at a time after the storing step.

6. The method according to claim 1 , wherein the cryptographic key for decrypting the encrypted subscription profile in the subscriber identity module is obtained from a first part received from a second subscriber identity module at a time after the storing step and a second part received from a subscription server at a time after the storing step in the subscriber identity module.

7. A method for providing subscription profiles for a subscriber identity module by means of a subscription server, wherein in the subscription server the following method steps take place:
creating a subscription profile for a subscriber identity module;
encrypting the created subscription profile with a cryptographic key unknown to the subscriber identity module;
providing the encrypted subscription profile for inserting the encrypted subscription profile into the subscriber identity module;
sending a cryptographic key or a first key part suitable for decrypting the subscription profile at a time after providing the encrypted subscription profile; and
receiving a confirmation from the subscriber identity module that the subscription profile has been decrypted and installed;
wherein the subscription profile is decrypted and installed at a time decoupled in time from sending the cryptographic key or the first key part;
wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile is coordinated to occur in context of a contract conclusion.

8. The method according to claim 7 , wherein the inserting is from the subscription server or a publisher of the subscriber identity module.

9. The method according to claim 7 , wherein the sending of the cryptographic key or the first key part is from the subscription server directly to the subscriber identity module; or
wherein the sending of the cryptographic key from the subscription server occurs directly to a second subscriber identity module, the second subscriber identity module sending the cryptographic key to the subscriber identity module for decrypting the subscription profile.

10. The method according to claim 7 , wherein sending the first key part from the subscription server further comprises:
sending the first key part from the subscription server directly to the subscriber identity module;
sending a second key part from the subscription server directly to a second subscriber identity module,
wherein the cryptographic key for decrypting the encrypted profile is formed from the first key part and the second key part.

11. The method according to claim 1 , wherein the method steps comprise a creating function and/or an enable function and/or a disable function according to the technical specification SGP02-Remote-Provisioning-Architecture-for-Embedded-UICC, version 2.0.

12. A subscriber identity module comprising an encrypted subscription profile stored in the subscriber identity module with:
a decryption function adapted to decrypt an encrypted subscription profile after receiving a cryptographic key; and
an installation function arranged to install the decrypted subscription profile in the subscriber identity module, thereby setting up the subscription profile in the subscriber identity module;
wherein the decryption function and the installation function are configured to be decoupled in time from receiving the cryptographic key;
wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile is coordinated to occur in context of a contract conclusion.

13. The subscriber identity module according to claim 12 , wherein the decryption function and the installation function are realized by a functionality of an operating system of the subscriber identity module or by an applet,
wherein the functionality of the operating system or the applet is arranged to start after receiving the cryptographic key or key part.

14. The subscriber identity module according to claim 12 , further comprising:
a data storage for storing the subscription profiles,
an interface arranged for communication with the subscription server, preferably via a terminal device comprising the subscriber identity module,
an interface arranged for communication with a network server; and
means arranged to perform the method according to for setting up a subscription profile in a subscriber identity module, preferably an embedded UICC, wherein the following method steps take place in the subscriber identity module:
receiving a subscription profile encrypted with a cryptographic key of a subscription server,
wherein the cryptographic key for decrypting the subscription profile is unknown to the subscriber identity module at the time of receiving;
storing the encrypted subscription profile without decrypting the subscription profile;
receiving the cryptographic key at a time after the storing step;
decrypting the encrypted subscription profile with the cryptographic key; and
installing the decrypted subscription profile to set up the subscription profile in the subscriber identity module;
wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile is coordinated to occur in context of a contract conclusion.

15. A non-transitory computer readable storage medium comprising a computer program product executably installed in a subscriber identity module and comprising means for performing the method steps of claim 1 .

16. The method according to claim 1 , wherein decrypting the encrypted subscription profile and installing the decrypted subscription profile is initiated by an external command.

Assignees

• Giesecke & Devrient Mobile Security Gmbh
• Gieseck Devrient Mobile Security Germany Gmbh

Inventors

• Nitsch Nils

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W8/183

  Processing at user equipment or user record carrier · CPC title

• H04W12/40

  Security arrangements using identity modules · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04W12/35 Primary

  Protecting application or service provisioning, e.g. securing SIM application provisioning · CPC title