Apple Inc.

Avinash Narasimhan

Li Li

David T Haggerty

Arun Godfrey Mathias

Clark P Mueller

Xiangying Yang

Vikram Bhaskara Yerrabommanahalli

Najeeb M Abdulrahiman

Raj S Chaugule

Damien R Holzapfel

Jean-Marc Padova

Chandiramohan Vasudevan

Ameya R Kasbekar

Jerrold Von Hauck

Kevin P McLaughlin

Christopher Brooke Sharp

Ben-Heng Juang

Yousuf H Vaid

He Zheng

Timothy M Sheridan

Alex M Was

Hemant Purswani

Keizo Marui

Aurelien P Raboisson

George Lin

Li Ll

Devin B Collier

David I Ahn

Kevin Mclaughlin

The described embodiments set forth techniques for management of electronic subscriber identity module (eSIM) profiles for a wireless device, including in-field replacement of provisioning (bootstrap) eSIM profiles. Public key infrastructure (PKI) information for an original equipment manufacturer (OEM) profile management server is installed in an embedded universal integrated circuit card (eUICC) of a wireless device at a time of manufacture and used subsequently by the wireless device to conduct an eSIM profile management session and verify authorization of the OEM profile management server to manage, e.g., update and/or replace, one or more eSIM profiles on the eUICC of the wireless device.

In-field remote profile management for wireless devices

A method is performed by a set of one or more servers and includes receiving, from a first user equipment (UE) to be activated with a cellular carrier for a user, and at the set of one or more servers, information identifying a second UE of the user and authentication information for authenticating the user with the cellular carrier. The method further includes authenticating the user using the authentication information; transmitting a password to the second UE at least partly in response to authenticating the user; receiving, from the first UE and at the set of one or more servers, the password; validating the password received from the first UE; and initiating a transfer of an embedded subscriber identity module (eSIM) subscription, from the second UE to the first UE, at least partly in response to validating the password.

Integrated standalone flow for cellular subscription transfer

A user equipment (UE) is configured to transmit, to a cellular carrier, a request to activate the UE with the cellular carrier. The UE is also configured to, in response to receiving an authentication request for authenticating a user of the UE, transmit, to the cellular carrier, information identifying another UE and authentication information for authenticating the user ; prompt the user, via a display of the UE, to provide, to an input system of the UE, verification information transmitted to the other UE; transmit, to the cellular carrier, the verification information; and in response to validation of the verification information by the cellular carrier, receive an embedded subscriber identity module (eSIM) subscription transferred from the other UE.

This Application sets forth techniques for provisioning and activating electronic subscriber identity modules (eSIMs) for mobile wireless devices. An eSIM is reserved during a sales order process and later activated during device activation after receipt by a user. An option for eSIM installation in place of (or in addition to) physical SIM installation is provided when purchasing the mobile wireless device. The reserved eSIM can replace a previous SIM/eSIM or be a new eSIM. During device activation, installation and activation of the eSIM occurs. Activation of the eSIM can occur before or after deactivation of a transferred SIM/eSIM. The mobile wireless device accounts for propagation delay of eSIM activation through MNO servers by disabling and re-enabling the eSIM until initial attachment to an MNO cellular wireless network succeeds or a maximum number of retry attempts is reached.

Subscription activation for mobile wireless devices

Duplicate processing of events registered at a root server is avoided. An electronic subscriber identity module (eSIM) server pushes, to a root server, data in the form of notification data portions indicating that commands or events need to be processed by a device. The device includes an embedded universal integrated circuit card (eUICC). The device pulls a notification list from the root server. The notification list includes one or more notification data portions. The device checks a given notification data portion to see if it represents a duplicate before communicating with the eSIM server to perform further processing related to the event. The device bases the check for duplication on an event history and/or on a hash value where the hash value is based on one or more eSIMs installed in the eUICC. The device is able to prioritize notification data portions before processing them.

Robust event handling in an electronic subscriber identity module (eSIM) notification service

Embodiments provided herein identify a certificate issuer (CI) to be relied on as a trusted third party by an electronic subscriber identity module (eSIM) server in remote SIM provisioning (RSP) transactions with an embedded universal integrated circuit card (eUICC). In an RSP ecosystem, multiple CIs may exist. Parties rely on public key infrastructure (PKI) techniques for establishment of trust. Trust may be established based on a trusted third party such as a CI. Parties need to agree on the CI in order for some PKI techniques to be useful. Embodiments provided herein describe approaches for an eUICC and an eSIM server to arrive at an agreed-on CI. Candidate or negotiated CIs may be indicated on a public key identifier (PKID) list. A PKID list is distributed, in some embodiments, by means of a discovery server, via an activation code (AC) and/or during the establishment of a profile provisioning session.

Managing embedded universal integrated circuit card (eUICC) provisioning with multiple certificate issuers (CIs)

Embodiments provided herein determine if an electronic subscriber identity module (eSIM) associated with a requested service can be installed in a secure element (SE) housed in a wireless device. Before requesting deployment of an eSIM suitable for the requested service from an eSIM delivery server, a carrier server asks that an original equipment manufacturer (OEM) server validate that an eSIM corresponding to a customer request should be deployed. The OEM server obtains information about the wireless device and information about the SE. When the carrier server requests validation, the OEM server evaluates the wireless device information and/or the SE information. If the OEM server indicates that deployment of the eSIM should proceed, the OEM server also indicates the eSIM type that is compatible with the wireless device and with the SE housed in the device.

Electronic subscriber identity module (eSIM) eligibility checking

Representative embodiments described herein set forth techniques for provisioning bootstrap electronic Subscriber Identity Modules (eSIMs) to mobile devices. According to some embodiments, a mobile device can be configured to issue, to an eSIM selection server, a bootstrap eSIM request that includes (i) metadata associated with the mobile device, and (ii) metadata associated with an electronic Universal Integrated Circuit Card (eUICC) included in the mobile device. In turn, the eSIM selection server selects and binds a particular bootstrap eSIM to the mobile device, and provides information to the mobile device that enables the mobile device to obtain the particular bootstrap eSIM from one or more eSIM servers. When the mobile device obtains the particular bootstrap eSIM, the mobile device can interface with a mobile network operator (MNO) and obtain a complete eSIM that enables the mobile device to access services provided by the MNO.

Techniques for provisioning bootstrap electronic subscriber identity modules (eSIMS) to mobile devices

Techniques for provisioning bootstrap electronic subscriber identity modules (eSIMs) to mobile devices

A pool of devices is initially associated under a single product type identifier, for example, a single stock keeping unit (SKU) identifier. Each device is associated with a secure element (SE), for example, an embedded universal integrated circuit card (eUICC). A wireless telecommunications carrier purchases a subset of the devices from the owner of the pool of devices. A policy management server receives a shipment record and associates the subset of devices with a product identifier and with a carrier-specific activation policy. The policy management server sends an electronic subscriber identity module (eSIM) reservation request to a policy evaluation server, which contacts an eSIM delivery server associated with the purchasing carrier. The eSIM delivery server reserves eSIMs for the purchased devices. When an end user buys one of the devices from the subset, the purchased device is provisioned by the eSIM delivery server with the eSIM reserved for that device.

Electronic subscriber identity module (eSIM) assignment for carrier channel devices

Methods, devices, and servers for as-needed update of a trusted list are provided herein. An electronic subscriber identity module (eSIM) server receives a request for an eSIM of a particular type from a wireless device. The eSIM server evaluates the particular type and requests an eSIM of the particular type from a second eSIM server, which is not initially trusted by a secure element (SE) of the wireless device. The eSIM server sends a policy update to the wireless device. The wireless device passes the policy update to the SE, for example, a universal integrated circuit card (UICC). The UICC updates the trusted list with an identity of the second eSIM server. When the wireless device downloads a bound profile package (BPP) containing an eSIM from the second eSIM server, the UICC validates the BPP based on the updated trusted list. The eSIM is then installed on the UICC.

Update of a trusted name list

Methods and apparatus for large scale distribution of electronic access control clients. In one aspect, a tiered security software protocol is disclosed. In one exemplary embodiment, a server electronic Universal Integrated Circuit Card (eUICC) and client eUICC software comprise a so-called 'stack' of software layers. Each software layer is responsible for a set of hierarchical functions which are negotiated with its corresponding peer software layer. The tiered security software protocol is configured for large scale distribution of electronic Subscriber Identity Modules (eSIMs).

Growing community of inventors

Cupertino, CA, United States of America

Avinash Narasimhan