Subscriber identification module pooling

Patent metadata

Field	Value
Publication number	US-2016174069-A1
Application number	US-201414572209-A
Country	US
Kind code	A1
Filing date	Dec 16, 2014
Priority date	Dec 16, 2014
Publication date	Jun 16, 2016
Grant date	—

Abstract

Pools of cellular devices share same provisioning profiles for cellular (over-the-air) provisioning connectivity. Conceptually, a limited pool of one or more provisioning profiles is setup in an MNO's backend equipment. Multiple cellular devices are each configured with a same provisioning profile from the pool. In practice, the number of provisioning profiles in a pool may be orders of magnitude less than the number of cellular devices configured to use the provisioning profiles in the pool.

First claim

1 . A cellular device comprising:
a card comprising storage that stores a provisioning profile comprising a shared International Mobile Subscriber Identity (IMSI) and a shared secure key, wherein the shared IMSI and the shared secure key are also stored by an MNO apparatus operated by a Mobile Network Operator (MNO) to service a cellular network provided by the MNO, the card further comprising instructions that, when executed by a processor of the cellular device or the card, dynamically generate, and store to the storage, the shared IMSI and the shared secret key; the provisioning profile in the card, including the shared IMSI and the shared secure key, having been assigned to a plurality of other cards to enable other cellular devices comprising the respective cards to complete an authentication procedure via the cellular network with the MNO apparatus using the same shared IMSI and the same shared secure key, wherein the authentication procedure is compliant with a standard cellular communication protocol; a radio configured to connect to cellular networks; and the storage storing additional instructions that, when the cellular device is operating, are executed by the processor to cause the processor to use the shared IMSI and the shared secure key to perform the authentication procedure with the MNO apparatus to establish a channel, via the radio, with the cellular network.

2 . A cellular device according to claim 1 , wherein the standard cellular communication protocol comprises one of: Global System for Mobile (GSM), 3GPP (3rd Generation Partnership Project), 3GPP2, Universal Mobile Telecommunications System (UMTS), Long-Term Evolution (LTE), Time Division Synchronous Code Division Multiple Access (TD-SCDMA), single-carrier Radio Transmission Technology (1×RTT), Enhanced Voice-Data Optimized (or “Only”) (EV-DO), EVolution Data and Voice (EV-DV), mobile WiMax, WiBro (Wireless Broadband), and Ultra Mobile Broadband (UMB).

3 . A cellular device according to claim 1 , wherein the processor receives a subscriber profile via the channel, the subscriber profile comprising a unique IMSI and a unique key, activates the subscriber profile, and deactivates the provisioning profile.

4 . (canceled)

5 . A cellular device according to claim 1 , wherein the processor generates the shared IMSI to be within a range of shared IMSIs.

6 . A cellular device according to claim 5 , wherein the card stores a master key that is also stored by the other cards and by the MNO apparatus, and wherein the generating further comprises computing the shared secret key based on the master key and based on the shared IMSI.

7 . A cellular device comprising:
storage that stores a provisioning profile comprising a shared International Mobile Subscriber Identity (IMSI) and a shared secure key, wherein the shared IMSI and the shared secure key are also stored by a Mobile Network Operator (MNO) apparatus operated by an MNO to service a cellular network provided by the MNO; the provisioning profile, in the storage, including the shared IMSI and the shared secure key, having been assigned to a plurality of other cards to enable other cellular devices comprising the respective cards to complete an authentication procedure via the cellular network with the MNO apparatus using the same shared IMSI and the same shared secure key, wherein the authentication procedure is compliant with a standard cellular communication protocol; a radio configured to connect to cellular networks; the storage storing instructions that, when the cellular device is operating, are executed by a processor of the cellular device to cause the processor to use the shared IMSI and the shared secure key to perform the authentication procedure with the MNO apparatus to establish a channel, via the radio, with the cellular network; and the storage storing additional instructions that, when executed by the processor, cause the processor to perform the authentication process with the MNO apparatus, wherein as part of the authentication process a sequence number associated with the provisioning profile is received by the cellular device via the channel, and the sequence number is either not used for authentication or is determined to be sufficient for authentication if the sequence number is greater, by any amount, than a previously received sequence number.

8 . A cellular device according to claim 1 , wherein when the authentication procedure has completed and resulted in an authentication, the cellular device is granted privileges to a limited set of one or more services at the MNO.

9 . A cellular device according to claim 8 , wherein the limited set of one or more services consists of only services provided by the MNO that are necessary to provision and activate a subscriber profile.

10 . A cellular device comprising:
a card comprising storage that stores a first provisioning profile comprising a first shared International Mobile Subscriber Identity (IMSI) and a first shared secure key, the storage further storing a second provisioning profile comprising a second shared IMSI and a second shared secret key, the first and second shared IMSIs and the first and second shared secure keys having been assigned to a plurality of other cards to enable other cellular devices comprising the respective cards to complete an authentication procedure via the cellular network with the MNO apparatus, wherein the authentication procedure is compliant with a standard cellular communication protocol; a radio configured to connect to cellular networks; and the storage storing instructions that, when the cellular device is operating, are executed by a processor to (i) cause the processor to use the first shared IMSI and the first shared secure key to perform the authentication procedure with the MNO apparatus, and (ii) determine that the performance of the authentication procedure using the first shared IMSI and the first shared secure key did not result in authentication with the cellular network and in response use the second shared IMSI and the second shared secure key to perform the authentication process.

11 . A method comprising:
enabling a same provisioning IMSI and associated provisioning secret key, and a same second provisioning IMSI and associated second provisioning secret key to all be concurrently available for use by each of multiple cards to authenticate with a cellular network, each card configured with instructions that, when the cards are operating, facilitate communication with cellular networks, wherein cellular devices are respectively comprised of the cards; authenticating some of the cellular devices on the cellular network using the provisioning secret key and the provisioning IMSI, and authenticating other of the cellular devices on the cellular network using the second provisioning secret key and the second provisioning IMSI; and each time one of the cellular devices is authenticated with the provisioning secret key and the provisioning IMSI or with the second provisioning secret key and the second provisioning IMSI, provisioning the corresponding authenticated cellular device with a corresponding unique subscriber profile comprised of a unique IMSI and a unique secret key.

12 . (canceled)

13 . A method according to claim 11 , wherein the cellular network comprises a Authentication Center (AuC), a Home Location Register (HLR), and an Access Point Name (APN) for a provisioning data network, the method further comprising authenticating a cellular device with the AuC, and in response activating a corresponding subscriber profile in the HLR, the authenticating by the AuC providing access rights to the cellular device tha

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Bruner John
• Choe Calvin
• Guday Shai

Classifications

• H04L63/102

  Entity profiles · CPC title

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04W8/18 Primary

  Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data · CPC title

• H04W12/06

  Authentication · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title