Remote Provision Of A Subscriber Entity

• US 20190313241A1
• Filed: 07/18/2016
• Published: 10/10/2019
• Est. Priority Date: 07/18/2016
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Ahmed, Abu Shohel, Salmela, Patrik, Ullah, Kazi Wali
• Granted Patent: US 10,805,789 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier

Abstract

There is provided mechanisms for remote provision of a subscriber entity. The method is performed by the subscriber entity. A method comprises providing a request for download of a profile for remote provisioning of the subscriber entity to a subscription management entity. The method comprises verifying, using a profile handling unit of the subscriber entity, that the subscription management entity possesses a valid certificate for downloading the profile. The method comprises allowing download of the profile for remote provisioning of the subscriber entity only when the subscription management entity possesses the valid certificate.

Claims

1-26. -26. (canceled)

27. A method for remote provision of a subscriber entity, the method comprising the subscriber entity:

providing a request for download of a profile for remote provisioning of the subscriber entity to a subscription management entity;

verifying, using a profile handling unit of the subscriber entity, that the subscription management entity possesses a valid certificate for downloading the profile; and

allowing download of the profile for remote provisioning of the subscriber entity only when the subscription management entity possesses the valid certificate.

28. The method of claim 27, wherein the verifying comprises:

obtaining a candidate certificate from the subscription management entity; and

comparing the candidate certificate to a list of reference certificates, wherein the subscription management entity is determined to possess the valid certificate only when the candidate certificate matches one of the reference certificates.

29. The method of claim 28, wherein the reference certificate and the candidate certificate are signed by a common Certificate Issuer.

30. The method of claim 28, wherein the list of reference certificates defines which subscription management entities are allowed to download and install the profile on an Embedded Universal Integrated Circuit Card (eUICC).

31. The method of claim 27, further comprising preventing download of the profile for remote provisioning of the subscriber entity when the subscription management entity does not possess the valid certificate.

32. The method of claim 27:

wherein the subscription management entity is associated only with a single mobile network operator; and

wherein the certificate is specific for the subscription management entity.

33. The method of claim 27:

wherein the subscription management entity is associated with at least two mobile network operators (MNOs); and

wherein the certificate is specific for less than all of the at least two MNOs.

34. The method of claim 27, wherein the verifying is performed as a consequence of an Embedded Universal Integrated Circuit Card (eUICC) being locked to a particular set of mobile network operators and/or subscription management entities.

35. The method of claim 34, wherein information that the eUICC is locked to a particular set of mobile network operators and/or subscription management entities is defined by a boot-lock variable having value equal to True.

36. The method of claim 35, wherein the information is provided to the subscription management entity in the request for download.

37. The method of claim 35:

wherein the request for download comprises an activation code for provisioning of the subscriber entity; and

wherein the activation code comprises an address to the subscription management entity that identifies the mobile network operator providing the activation code.

38. A method for remote provision of a subscriber entity, the method comprising a subscription management entity:

receiving a request for download of a profile for remote provisioning of the subscriber entity from the subscriber entity; and

enabling a profile handling unit of the subscriber entity to verify that the subscription management entity possesses a valid certificate for downloading the profile.

39. The method of claim 38:

wherein the subscription management entity is associated only with a single mobile network operator; and

wherein the certificate is specific for the subscription management entity.

40. The method of claim 38:

wherein the subscription management entity is associated with at least two mobile network operators (MNOs); and

wherein the certificate is used by the subscription management entity for authenticating itself to the subscriber entity and is specific for only less than all of the at least two MNOs.

41. The method of claim 38:

wherein the enabling comprises providing a candidate certificate to the subscriber entity; and

wherein the subscription management entity is determined to possess the valid certificate only when the candidate certificate matches a reference certificate of the subscriber entity.

42. The method of claim 38, wherein the request for download comprises information that an Embedded Universal Integrated Circuit Card (eUICC) is locked to a particular set of mobile network operators and/or subscription management entities.

43. The method of claim 42, wherein the information is defined by a boot-lock variable having value equal to True.

44. A subscriber entity for remote provision of the subscriber entity, the subscriber entity comprising:

processing circuitry; and

memory storing instructions that, when executed by the processing circuitry, causes the subscriber entity to;

provide a request for download of a profile for remote provisioning of the subscriber entity to a subscription management entity;

verify, using a profile handling unit of the subscriber entity, that the subscription management entity possesses a valid certificate for downloading the profile; and

allow download of the profile for remote provisioning of the subscriber entity only when the subscription management entity possesses the valid certificate.

45. A subscription management entity for remote provision of a subscriber entity, the subscription management entity comprising:

processing circuitry; and

memory storing instructions that, when executed by the processing circuitry, causes the subscription management entity to;

receive a request for download of a profile for remote provisioning of the subscriber entity from the subscriber entity; and

enable a profile handling unit of the subscriber entity to verify that the subscription management entity possesses a valid certificate for downloading the profile.