Subscriber identity module which has multiple profiles and which is designed for an authentication command

Patent metadata

Field	Value
Publication number	US-2018367992-A1
Application number	US-201615779256-A
Country	US
Kind code	A1
Filing date	Nov 30, 2016
Priority date	Dec 1, 2015
Publication date	Dec 20, 2018
Grant date	—

Abstract

A subscriber identity module (eUICC), comprises profiles for the utilization of a mobile terminal that include at least a first profile and at least a second profile, of which the second profile (Pr 1, Pr 2 ) is devised as an active profile. The first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module. The authentication command is specially parameterized for the root profile (PrR) with a specific root value of the network parameter (P 2 ) to be activated during a change-over period. The initially active second profile (Pr 1, Pr 2 ) is deactivated during the change-over period. After the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr 1, Pr 2 ) is again activated.

First claim

1 .- 9 . (canceled)

10 . A subscriber identity module (eUICC),
comprising profiles for the utilization of a mobile terminal in mobile communication networks, wherein the profiles comprise at least a first profile and at least a second profile, of which the second profile (Pr 1 , Pr 2 ) is devised as an active profile, devised to receive and to process an authentication command (AUTHENTICATE) parameterized with a network parameter (P 2 ), and as a result of this to compute authentication data for a mobile communication network determined by a network value of the network parameter (P 2 ), wherein the first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module said authentication command being specially parameterized for the root profile (PrR) with a specific root value (FF; b 3 b 2 b 1 =111; . . . ) of the network parameter (P 2 ) to be activated during a change-over period, wherein the initially active second profile (Pr 1 , Pr 2 ) is deactivated during the change-over period, and wherein after the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr 1 , Pr 2 ) is again activated.

11 . The subscriber identity module according to claim 10 , wherein the change-over period is limited in time to the duration of the processing of the authentication command.

12 . The subscriber identity module according to claim 10 , wherein as a value of the network parameter (P 2 ) there is provided: P 2 =P3G as a network value for network 3G, P 2 =P2G as a network value for network 2G, a value P 2 =PR different from P 2 =P3G and P 2 =P2G possibly further network values and preferably different from further pre-allocated values as a root value for the transient activation of the root profile.

13 . The subscriber identity module according to claim 10 , wherein an APDU command is provided as an authentication command.

14 . The subscriber identity module according to claim 10 , wherein as first profile a profile of an owner of the subscriber identity module is provided, and as second profile a profile of an owner of the subscriber identity module is provided, in particular of a network provider.

15 . The subscriber identity module according to claim 10 , wherein as first profile one of the following is provided: an emergency profile for outputting an emergency call in an emergency situation in an emergency call network;
a test profile for carrying out an end-device test on a test network; a service profile for calling a service network of a service provider.

16 . The subscriber identity module according to claim 10 , wherein the profile (P) comprises respectively an authentication key (Ki), and wherein the authentication command (AUTHENTICATE) is devised for computing, originating from the authentication key (Ki- 1 , Ki- 2 , Ki-R) of the currently active profile (Pr 1 , Pr 2 , PrR), the authentication data.

17 . The subscriber identity module according to claim 10 , wherein the profile (Pr 1 , Pr 2 , PrR) comprises respectively an Issuer Security Domain (ISD-P 1 , ISD-P 2 , ISD-R).

18 . The subscriber identity module according to claim 10 , which further comprises an Issuer Security Domain Root (ISD-R) which is devised in particular as an end point situated in the subscriber identity module of the channel provided for provisioning the subscriber identity module between the Sub Man Secure Router (SM-SR) and the subscriber identity module and wherein the first profile has an Issuer Security Domain (ISD-R), which is identical to the Issuer Security Domain Root (ISD-R).

Assignees

• Giesecke & Devrient Mobile Security Gmbh

Inventors

• Huber Ulrich
• Nitsch Nils

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W4/90

  Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS] · CPC title

• H04L67/303

  Terminal profiles · CPC title