Giesecke+devrient Mobile Security Gmbh

Giesecke & Devrient Gmbh

Gieseck+devrient Mobile Security Germany Gmbh

Giesecke-devrient Mobile Security Germany Gmbh

Nils Nitsch

Ulrich Huber

Andreas Morawietz

Tom Weber

Olaf Schneider

Volker Gerstenberger

Karl Eglof Hartel

Jorgen Hult

Gero Galka

Ulrich Wimbock

Michael Schnellinger

Anders Kokeritz

Rikard Forselius

Hrushikesh Chidley

Waleed Badawy

Markus Haubner

Jörgen Hult

Ulrich Wimböck

Anders KÖKERITZ

The invention relates to a method for setting up a subscription profile in a subscriber identity module, preferably an embedded UICC, wherein the following method steps take place in the subscriber identity module: receiving a subscription profile encrypted with a cryptographic key of a subscription server, wherein the cryptographic key for decrypting the subscription profile is unknown to the subscriber identity module at the time of receiving; storing the encrypted subscription profile without decrypting the subscription profile; receiving the cryptographic key at a time after the storing step; decrypting the encrypted subscription profile with the cryptographic key; and installing the decrypted subscription profile to set up the subscription profile in the subscriber identity module. The invention also relates to a corresponding method in a subscription server, a subscriber identity module, and a computer program product.

Method for setting up a subscription profile, method for providing a subscription profile, subscriber identity module

A method for managing subscription profiles of a security element, which is provided for use in a mobile end device and on which a profile manager and at least one first subscription profile is loaded, includes: loading a second subscription profile from a subscription management server; checking whether the at least one first loaded subscription profile satisfies a predetermined condition; and putting the at least one first subscription profile out of operation when the at least one first subscription profile satisfies the predetermined condition.

Method and devices for managing subscription profiles on a security element

The invention relates to a method for providing subscription profiles to a subscriber identity module, preferably an eUICC, by means of a subscription server, preferably an SM-DP, wherein: the subscription server has knowledge of a first subscription profile, which is installed in the subscriber identity module, has a first profile file structure and first profile data stored in the first profile file structure; and at least a portion of a second profile file structure of a second subscription profile is flagged in the subscription server and the second subscription profile is sent to the subscriber identity module, the flagged portion of the second subscription profile being sent without second profile data. The invention additionally relates to a corresponding method in a subscriber identity module, a subscriber identity module, a subscription server and a computer program product.

Method for providing subscription profiles, subscriber identity module and subscription server

A subscriber identity module (eUICC), comprises profiles for the utilization of a mobile terminal that include at least a first profile and at least a second profile, of which the second profile (Pr1, Pr2) is devised as an active profile. The first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module. The authentication command is specially parameterized for the root profile (PrR) with a specific root value of the network parameter (P2) to be activated during a change-over period. The initially active second profile (Pr1, Pr2) is deactivated during the change-over period. After the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr1, Pr2) is again activated.

Subscriber identity module which has multiple profiles and which is designed for an authentication command

A subscriber identity module (eUICC), comprises profiles for the utilization of a mobile terminal that include at least a first profile and at least a second profile, of which the second profile (Pr, Pr) is devised as an active profile. The first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module. The authentication command is specially parameterized for the root profile (PrR) with a specific root value of the network parameter (P) to be activated during a change-over period. The initially active second profile (Pr, Pr) is deactivated during the change-over period. After the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr, Pr) is again activated.

A method and a system for subscription management in a security element for a mobile end device, wherein one subscription profile is associated with one subscription. For a subscription profile, an access to functionalities of the security element is subscription-profile-specifically restricted.

Subscription management comprising subscription-specific profiles for restricting the functionalities of the security element

A system for registering an MSISDN with a device hosting the UICC and in which the UICC is or can be operated includes a UICC provisioning server operated by an UICC different from the MNO. A Local Profile Assistant LPA is installed within the device or the UICC, and enables establishment of secured data sessions between the UICC and the UICC provisioning server. A modem is installed within the device or UICC. The modem enables communication of the device within a mobile network operator MNO mobile network. An MSISDN retrieval logic is associated with the LPA. A logic is constructed to perform a retrieval sequence with the foregoing components and data.

MSISDN registration

A method for the communicating of a subscriber identity module, implemented or implementable in an end device, in which at least one profile is adapted for the utilization of the mobile end device in a mobile communication network, vis-&#xe0;-vis a server, in which method a message from the subscriber identity module is sent to the server. Before the sending of the message, a step of the establishing of a technology is carried out in the subscriber identity module in which there is established, which technology the profile corresponds to, and the sending is carried out compliant with the technology. The communicating can involve the notifying of a profile change effected in the subscriber identity module.

Communicating a subscriber identity module to a server, in particular upon changing profiles

A loading package is adapted for loading a profile for a subscription into a subscriber identity module. A loading sequence through the implementation of which in the subscriber identity module the profile is set up in the subscriber identity module. A profile loading counter sequence is generated on the basis of a counter reading of a profile loading counter maintained at a data preparation server; is adapted to load into the subscriber identity module a profile loading counter with the generated counter reading; and is loaded into the subscriber identity module before the loading sequence. The profile loading counter sequence is further adapted if no implemented profile loading counter is present in the subscriber identity module, to implement the profile-loading counter in the subscriber identity module with a counter reading which determines an admissible number of times which the loading package may be loaded into the subscriber identity module.

Restricting the number of times a subscription profile for an EUICC can be downloaded

A method for managing a profile for a subscription in a subscriber identity module comprises the steps of (a) sending a management message from a server to the subscriber identity module; (c) carrying out a management measure corresponding to the management message in the subscriber identity module; wherein the following step b) which is effected before step c): (b) requesting and receiving a user input at the subscriber identity module; and carrying out step (c) only on the occasion of a successful carrying out of step (b).

Blocking the acceptance or the processing of a packet for loading a profile into a eUICC

A method for loading a profile for a mobile radio subscription from a data preparation server into a subscriber identity module, comprises the steps: (a) providing a profile at the data preparation server; (b) generating a single executable program code module of the profile provided according to (a), which program code module is arranged such that by executing the executable program code module the profile is installed in the subscriber identity module; (c') loading the single executable program code module into the subscriber identity module. A method for installing a profile in the subscriber identity module, comprises the steps: (d) sending an APDU command from the data preparation server to the subscriber identity module; (e) in reaction to a reception of the APDU command at the subscriber identity module, executing the executable program code module and by executing installing the profile in the subscriber identity module.

Method for loading a profile

A method is provided for activating a subscription on a security element which is part of a mobile end device, and is insertable or permanently installed therein. The method comprises the following steps: receiving a request from the security element by a mobile radio system to communicate over a mobile radio network of the mobile radio system; establishing the position of the mobile end device; and checking by the mobile radio system whether the established position of the mobile end device falls within a predefined range of allowed positions, wherein the subscription on the security element is activated and thereby the security element enabled to communicate over the mobile radio network if the established position of the mobile end device falls within the predefined range of allowed positions.

Methods and apparatuses for activating a subscription for communication over a mobile radio network

A method comprises the following steps: supplying the subscription on the security element of the user's mobile end device, with the subscription being held available on a background system by a service or product provider as one subscription of a plurality of subscriptions and enabling communication over a mobile radio network; and accessing the mobile radio network by the security element by means of the subscription supplied on the security element. While the security element accessing the mobile radio network the position of the mobile end device is determined at time intervals in order to check whether the position of the mobile end device falls within a predefined range of allowed positions and, if the established position of the mobile end device does not fall within the predefined range of allowed positions, the access of the security element to the mobile radio network is interrupted.

Methods and apparatuses for supplying a subscription for communication over a mobile radio network

A subscriber identity module for authenticating a subscriber on a communication network includes: a first set of subscriber identity data for authenticating the subscriber; a second set of subscriber identity data for authenticating the subscriber, with the first set of subscriber identity data differing from the second set of subscriber identity data; and a means for managing the first and second sets of subscriber identity data, with the managing being realized by management functions. The subscriber identity module can be extended to a method for managing the subscriber identity module, to a use of the subscriber identity module in a mobile end device, and to a system comprising subscriber end devices and a remote entity.

Growing community of inventors

Markt Schwaben, Germany

Nils Nitsch