Giesecke+devrient Mobile Security Gmbh

Giesecke & Devrient Gmbh

Giesecke+devrient Mobile Security America, Inc.

Smarttrust Ab

Giesecke-Devrient Mobile Security Germany Gmbh

Thomas Larsson

Ulrich Huber

Dieter Weiss

Klaus Vedder

Jens Rudolph

Ulrich Dietz

Jorgen Hult

Leif Östling

Michael Tagscherer

Ivan De Figueiredo, Jr

Daniel Daksiewicz

Michael Meyer

Jari Nyholm

Ivan De Figueiredo Junior

Ivan Figueiredo

Dieter Weiß

Methods and devices are arranged for managing reset and re-downloaded profiles Over-the-Air on an eUICC. An operator system imports a profiles list from a server, each entry in the list comprising a flag indicating whether the corresponding profile has been downloaded onto the eUICC. Upon receiving, from a mobile network operator, MNO, a request to update a profile on the eUICC, the request comprising a profile identifier and an OTA campaign, the operator system performs a backlog of the OTA campaign for the profile indicated by the profile identifier under consideration of the flag in the corresponding profile entry.

Backlog mechanism for subscriber profiles on EUICCs

A method for downloading a profile from a subscription management server (SM-DP+) to a security enclave comprised in an enterprise mobile radio device.

Profile download to enterprise mobile radio device

A method for performing a switch from a first mobile network to a second mobile network by a mobile terminal comprising a secure element includes the following steps: attaching to the first mobile network using a first subscription profile; downloading a second subscription profile from a subscription management server including a command script defining a sequence of commands; attaching to the second mobile network; and executing the sequence of commands defined by the command script.

Methods and devices for performing a mobile network switch

A method for using a network and a secure element, whereby the secure element of a device receives a request for usages data from the device. The secure element sends the usage data to the device in response to the request. The usage data enable the device to use the network. The secure element applies a timer to measure a delay time. The device shall only use the network, after the delay time has expired. The secure element prevents the usage of the network by the device until the delay time has expired.

Method and secure element for using a network

A method for providing a secure element having a processor and a memory of a mobile terminal with a target subscription profile for communicating via a target mobile network comprises the steps of: providing as a first part of the target subscription profile a subscription management interface to the secure element; implementing the subscription management interface on the secure element; and providing as a second part of the target subscription profile subscription data in a format defined by the operator of the target mobile network to the secure element, wherein the subscription management interface allows the secure element to process the subscription data and to implement the target subscription profile thereon for allowing access to the target mobile network. A corresponding secure element, mobile terminal and subscription management backend system includes features associated with the method.

Methods and devices for providing a secure element with a subscription profile

A profile management engine receives, from a mobile device management (MDM) server configured to manage one or more mobile devices, an activation request to activate a subscription for a mobile device of the plurality of mobile devices. The profile management engine generates a download request for preparing a download of an electronic subscriber profile to the mobile device, transmits the download request to a subscription management system of a network operator, and subsequently receives a download response from the subscription management system. The download response includes an identifier that identifies an electronic subscriber profile generated for the mobile device. The profile management engine generates an activation response including information for downloading the electronic subscriber profile generated for the mobile device, and transmits the activation response to the MDM server to enable the MDM server to trigger download of the electronic subscriber profile from the subscription management system to the mobile device.

Embedded SIM profile download and management system

A method of performing a switch from a first mobile network to a second mobile network by a mobile terminal comprising a secure element comprises the steps of: (a) requesting attachment to the first mobile network using a first identification data element, preferably a first IMSI, of a first subscription profile; (b) requesting attachment to the second mobile network using a second identification data element, preferably a second IMSI, of a second subscription profile; and (c) requesting attachment to the first mobile network. The second mobile network or another mobile network uses a confirmation data element, wherein the confirmation data element has the same format as the first and the second identification data element and is configured such that the attachment request is forwarded to a subscription management server in order to inform the subscription management server whether the attachment to the second mobile network was successful.

A method of performing a switch from a first mobile network to a second mobile network by a mobile terminal comprising a secure element includes the steps of: (a) attaching to the first mobile network using a first attachment message containing a first identification data element, preferably a first IMSI, of a first subscription profile; and (b) attaching to the second mobile network by an attachment process including a second attachment message containing a second identification data element, preferably a second IMSI, of a second subscription profile. The second mobile network is configured to monitor at least parts of the attachment process, to determine the second identification data element contained therein and to forward this information to a subscription management server in order to confirm the successful attachment of the secure element to the second mobile network.

A method for managing, e.g. subscriptions on a security element of, a mobile device comprises the steps of recognizing a new network and initiating a management step. In order to recognize the new network, information about a network selected by the mobile device is captured. Then, the captured information is evaluated in order to recognize the new network. Further, it is determined whether the captured information satisfies a specified stability condition. If this is the case, the management step is initiated.

Mobile device management

A method of providing a secure element of a mobile terminal with a subscription profile in which the mobile terminal is configured to communicate with a cellular communications network and the subscription profile comprises a network specific portion related to the cellular communications network or a different cellular communications network as well as a hardware specific portion related to the hardware of the mobile terminal and/or the secure element. The method comprises the steps of: assembling the subscription profile, wherein the network specific portion of the subscription profile is provided by a first server and the hardware specific portion of the subscription profile is provided by a second server; and providing the subscription profile over-the-air to the secure element. A corresponding secure element, mobile terminal and subscription management backend system involves features of the method.

Methods and devices for OTA subscription management

Methods and devices in a mobile communications system for over the air management of mobile stations contain a secure identification element such as a subscriber identity module. A standard challenge-response authentication procedure is implemented in a mobile communications system not for its intended authentication purpose, but for providing a mobile station with subscription data. The standard challenge-response authentication procedure is modified in that the challenge is used as a carrier for subscription data. The challenge containing the subscription data is provided to the mobile station in response to a request of the mobile station to be allowed access or attachment to the mobile communications system containing a special mode indicator data element, which indicates to the mobile communications system that the mobile station is requesting subscription data and suitably forwarded to a data providing unit configured to provide subscription data.

Methods and devices for OTA management of subscriber identity modules

A method and an identification module SIM of a device in a mobile communication system wherein the SIM provides a first subscriber identity to the device and receives updates for a list of forbidden networks stored in a memory of the identification module. The SIM uses the received updates as a list of available networks for a second subscriber identity and provides the second subscriber identity to the device.

Method and identification module for network selection

The ODA database () contains SIM card () information related to the cards that shall be activated. When a SIM card () is inserted into a mobile equipment, such as a mobile telephone, and the mobile equipment is switched on, the ODA () is connected to the SIM card for updating the SIM card with a card definition file. The ODA () is arranged to be connected to a HLR/AUC () in order to transfer information stored on the updated SIM card, and the HLR/AUC is arranged to set up a subscription for the SIM card.

Method for activating SIM cards

When deactivating a subscription and SIM card, the SIM card is connected to the ODA database, an instruction to deactivate the SIM card and cancel the subscription is transferred to the ODA, information in the memory of the SIM card including the IMSI (International Mobile Subscriber Identity) of the SIM card, is transferred to the ODA, which is arranged to be connected to the network, including a HLR/AUC. The ODA retrieves the subscription information, and replaces the IMSI of the SIM card with a temporary IMSI called IMSI-T. The ODA stores the information in the memory of the SIM card together with the IMSI-T in the database. The ODA also stores the information together with the IMSI-T and transfers to the network an instruction to cancel the subscription in the network. The SIM card may be reactivated using the information stored in the ODA database and on the SIM card including the IMSI-T.

Growing community of inventors

Älvsjö, Sweden

Thomas Larsson