Electronic access client distribution apparatus and methods

• US 9,419,970 B2
• Filed: 10/10/2014
• Issued: 08/16/2016
• Est. Priority Date: 04/26/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Haggerty, David T., McLaughlin, Kevin P., Hauck, Jerrold Von, Mathias, Arun
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US14/512,137
• Publication Number:
  US 20150031413A1
• Time in Patent Office: 676 Days
• US Class Current: 1/1
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Apparatus and methods for distributing access control clients. In one exemplary embodiment, a network infrastructure is disclosed that enables delivery of electronic subscriber identity modules (eSIMs) to secure elements (e.g., electronic Universal Integrated Circuit Cards (eUICCs), etc.) The network architecture includes one or more of: (i) eSIM appliances, (ii) secure eSIM storages, (iii) eSIM managers, (iv) eUICC appliances, (v) eUICC managers, (vi) service provider consoles, (vii) account managers, (viii) Mobile Network Operator (MNO) systems, (ix) eUICCs that are local to one or more devices, and (x) depots. Moreover, each depot may include: (xi) eSIM inventory managers, (xii) system directory services, (xiii) communications managers, and/or (xiv) pending eSIM storages. Functions of the disclosed infrastructure can be flexibly partitioned and/or adapted such that individual parties can host portions of the infrastructure. Exemplary embodiments of the present invention can provide redundancy, thus ensuring maximal uptime for the overall network (or the portion thereof).

Claims

1. A method for distributing electronic Subscriber Identity Modules (eSIMs) to destination devices, the method comprising:

by an eSIM server;

receiving a request to allocate eSIMs for a plurality of destination devices, wherein the request includes associated identifying information for each destination device of the plurality of destination devices; and

in response to the request, and for each destination device of the plurality of destination devices;

identifying an available eSIM to allocate to the destination device based on the associated identifying information,

allocating the available eSIM to the destination device,

encrypting the available eSIM to yield an encrypted eSIM for the destination device, and

transmitting the encrypted eSIM to one or more eSIM depots to enable the encrypted eSIM to be provided to the destination device by way of at least one of the one or more eSIM depots.

2. The method of claim 1, wherein the identifying information comprises an International Mobile Equipment Identity (IMEI) or an electronic Universal Integrated Circuit Card (eUICC) card serial number (CSN).

3. The method of claim 1, wherein the request is issued in response to a change in a wireless network service associated with the plurality of destination devices.

4. The method of claim 1, further comprising, for each destination of the plurality of destination devices:

maintaining metadata for the encrypted eSIM for tracking the encrypted eSIM.

5. The method of claim 1, further comprising:

deleting the encrypted eSIM from the eSIM server.

6. The method of claim 1, further comprising:

deactivating the encrypted eSIM prior to distributing the encrypted eSIM to the corresponding destination device.

7. The method of claim 1, further comprising:

maintaining state information associated with the encrypted eSIM.

8. An electronic Subscriber Identity Module (eSIM) server, comprising:

a hardware processor; and

a memory configured to store instructions that, when executed by the hardware processor, cause the eSIM server to;

receive a request to allocate eSIMs for a plurality of destination devices, wherein the request includes associated identifying information for each destination device of the plurality of destination devices; and

in response to the request, and for each destination device of the plurality of destination devices;

identify an available eSIM to allocate to the destination device based on the associated identifying information,

allocate the available eSIM to the destination device,

encrypt the available eSIM to yield an encrypted eSIM for the destination device, and

transmit the encrypted eSIM to one or more eSIM depots to enable the encrypted eSIM to be provided to the destination device by way of at least one of the one or more eSIM depots.

9. The eSIM server of claim 8, wherein the identifying information comprises an International Mobile Equipment Identity (IMEI) or an electronic Universal Integrated Circuit Card (eUICC) card serial number (CSN).

10. The eSIM server of claim 8, wherein the request is issued in response to a change in a wireless network service associated with the plurality of destination devices.

11. The eSIM server of claim 8, wherein the hardware processor further causes the eSIM server to:

delete the encrypted eSIM from the eSIM server.

12. The eSIM server of claim 8, wherein the hardware processor further causes the eSIM server to:

deactivate the encrypted eSIM prior to distributing the encrypted eSIM to the corresponding destination device.

13. The eSIM server of claim 8, wherein the hardware processor further causes the eSIM server to:

maintain state information associated with the encrypted eSIM.

14. The eSIM server of claim 8, wherein the hardware processor further causes the eSIM server to:

maintain metadata for the encrypted eSIM for tracking the encrypted eSIM.

15. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors included in an electronic Subscriber Identity Module (eSIM) server, cause the eSIM server to carry out steps that include:

receiving a request to allocate eSIMs for a plurality of destination devices, wherein the request includes associated identifying information for each destination device of the plurality of destination devices; and

in response to the request, and for each destination device of the plurality of destination devices;

identifying an available eSIM to allocate to the destination device based on the associated identifying information,

allocating the available eSIM to the destination device,

encrypting the available eSIM to yield an encrypted eSIM for the destination device, and

transmitting the encrypted eSIM to one or more eSIM depots to enable the encrypted eSIM to be provided to the destination device by way of at least one of the one or more eSIM depots.

16. The non-transitory computer-readable medium of claim 15, wherein the identifying information comprises an International Mobile Equipment Identity (IMEI) or an electronic Universal Integrated Circuit Card (eUICC) card serial number (CSN).

17. The non-transitory computer-readable medium of claim 15, wherein the request is issued in response to a change in a wireless network service associated with the plurality of destination devices.

18. The non-transitory computer-readable medium of claim 15, wherein the steps further include:

deleting the encrypted eSIM from the eSIM server.

19. The non-transitory computer-readable medium of claim 15, wherein the steps further include:

deactivating the encrypted eSIM prior to distributing the encrypted eSIM to the corresponding destination device.

20. The non-transitory computer-readable medium of claim 15, wherein the steps further include:

maintaining state information associated with the encrypted eSIM.