Blocking the acceptance or the processing of a packet for loading a profile into a eUICC

The invention relates to a method for managing a profile for a subscription (subscription profile) in a subscriber identity module.

Mobile end devices are securely operated in radio networks by means of subscriber identity modules, also called secure elements. In particular mobile radio end devices, such as for example smartphones, as well as M2M end devices can be provided as mobile end devices.

Within the framework of arranging a subscriber identity module a subscription profile must be loaded into the subscriber identity module. Change requests regarding the subscription profile (or profile, for short) require the supplying of a changed subscription profile. In the case of plug-in SIM cards for mobile radio end devices, the change can be carried out by an exchange of the SIM card. Alternatively, a new subscription profile is loaded into the subscriber identity module, which is carried out in particular for firmly soldered subscriber identity modules (e.g. eUICC in the mobile radio region or firmly soldered M2M module) which cannot be readily exchanged. The managing of subscriptions, in particular by downloading subscription profiles and accompanying data into a subscriber identity module, is generally also referred to as subscription management.

The technical specifications [1] 12FAST.13—Embedded SIM Remote Provisioning Architecture 17 Dec. 2013″, GSMA and [2] SGP02—Remote-Provisioning-Architecture-for-Embedded-UICC-Technical-Specification-v2.0, 13 Oct. 2014, GSMA describe the download and installation of a subscription profile into an eUICC. According to [1] 12FAST.13, in the loading of a subscription profile into a subscriber identity module there are involved a subscription management data preparation SM-SP and a subscription management secure router SM-SR.

The subscription management data preparation SM-SP has subscriber-identity-module-specific information available and generates with this, starting out from the subscription profile, a load packet to be loaded into the subscriber identity module, supplies the load packet to the subscription management secure router SM-SR which in turn loads the load packet into the subscriber identity module. In the subscriber identity module the load packet is extracted and starting out from the extracted package content the profile is implemented. Changes in profiles already existing in the subscriber identity module are effected in an analogous manner. Here, the subscription management secure router SM-SR receives a load packet containing the desired changes from the subscription management data preparation SM-SP and sends it to the subscriber identity module. In the subscriber identity module the load packet is extracted, the changes in the profile are implemented starting out from the extracted package contents.

The subscription management data preparation SM-SP can send (on the way via the subscription management secure router SM-SR) load packets having profiles to be loaded or changes in already implemented profiles to the subscriber identity module in an unnoticed and unrequested manner. In some circumstances, a holder or user of the mobile end device may not wish management measures such as profile loading or profile changing to be effected unnoticed or unrequested in the subscriber identity module.

The subscription management data preparation SM-SP may in particular be operated by an issuer of the subscriber identity module.

After the delivery of the subscriber identity module to the holder or user the holder or user enters into contractual usage agreements with other parties than the issuer of the subscriber identity module, for example, with a mobile radio network operator. Some management measures carried out unnoticed or unrequested by the issuer could offend against contractual usage agreements between the other party (e.g. network operator) and the user or holder. With the existing infrastructure for managing profiles the user/holder has no means to autonomously take care of the observance of his contractual usage agreements himself and to enforce these.

The invention is based on the object of creating a method for managing a profile for a subscription (subscription profile) in a subscriber identity module, which gives the holder or user of the subscriber identity module more autonomy against an issuer of the subscriber identity module.

This object is achieved by a method according to claim 1 . Advantageous embodiments of the invention are stated in the dependent claims.

The method according to the invention for managing a profile for a subscription in a subscriber identity module comprises the steps: a) sending a management message from a server to the subscriber identity module and c) carrying out a management measure corresponding to the management message in the subscriber identity module. The method is characterized by the following step b) which is effected before step c): requesting and receiving a user input at the subscriber identity module and carrying out step c) only on the occasion of the successful carrying out of step b).

With the requirement of requesting and receiving a user input, before the management measure ordered by the management message is carried out in the subscriber identity module, it is ensured that the user has the possibility to examine upcoming management measures as to conformance with his own ideas and contractual obligations. An unnoticed carrying out of management measures which the user does not approve of is avoided. The user thus obtains the possibility to incorporate his declaration of will into the process of the management measures.

Thus, according to claim 1 , a method for managing a subscription profile in a subscriber identity module is created, which gives the holder or user of the subscriber identity module more autonomy against an issuer of the subscriber identity module.

Optionally, as a user input there is provided an authentication input, in particular a static access code such as e.g. a PIN (personal identification number) or a static password, or a one-time password or OTP.

Optionally, the user input is requested and received via an input/output interface, e.g. a touch pad or touch display, of a mobile end device in which the subscriber identity module is operated.

Optionally, as a management measure there is provided a loading of a management message for loading a profile into the subscriber identity module, or/and an implementing of a profile in the subscriber identity module. In other words, e.g., the user obtains an intervention possibility and is prompted to make an input before a loading profile is loaded into the subscriber identity module. Alternatively or additionally, the user obtains, e.g., an intervention possibility and is prompted to make an input before an already loaded loading profile is implemented in the subscriber identity module. Depending on the concrete individual case, e.g., the load packet first is loaded in unhindered manner into the subscriber identity module, and only then the consent of the user is sought by means of his input. The user can now check the content of the load packet and approve or object the implementation of the load packet, depending on the content of the load packet, with his input. In another individual case, the consent of the user has already been sought before a load packet is loaded into the subscriber identity module. Here, the user can already refuse the loading of the load packet.

Optionally, as a management measure there is provided a loading of a management message for altering or/and an altering of a profile already implemented in the subscriber identity module. In this case, optionally, the management message first is loaded into the subscriber identity module. Then an input of the user is requested. Here, the user has the possibility to check the contents of the changing and, depending on the content, to allow (approval) or to prevent (objection) the changing.

Optionally, step a) is carried out as sending the management message from a data preparation server via a security router to the subscriber identity module.

Optionally, step c) comprises the following substeps: c1) releasing the management measure on the part of the subscriber identity module and c2) carrying out the management measure. The releasing is effected, optionally, in reaction to the receiving of an approving input on the part of the user, i.e. an approving declaration of will, e.g., by inputting “confirm” via a respective menu guidance on the touch display of the end device.

According to one embodiment of the invention, the user has the possibility to define exception criteria, so that certain management measures are carried out without any user input, also in unnoticed manner in the background.

According to the embodiment, the method further comprises the following step of, which is effected before step b), evaluating the management message as to whether an exception criterion is satisfied, wherein, if the exception criterion is satisfied by the management message, step b) is skipped and immediately step c) is carried out. For example, the exception criterion is satisfied by updates of the already implemented active profile. The exception criterion is not satisfied, for example, by management measures which relate to a different profile than the active profile, or which come from a different network operator or relate to a different network operator than the one which maintains the currently implemented active profile.

Optionally, the exception criterion was created on the basis of a user input received at an earlier time. With this earlier user input the user, for example, has defined and stored which management measures can be carried out without user input.

Hereinafter the invention will be explained more closely on the basis of embodiment examples and with reference to the drawings, in which are shown:

FIG. 1 a diagram for loading a load packet for loading a profile from a data preparation server via a security router into a subscriber identity module, according to the prior art;

FIGS. 2( a ) to 2( c ) show a diagram for loading a load packet for loading a profile from a data preparation server via a security router into a subscriber identity module, according to an embodiment of the invention.

FIG. 1 shows a diagram for loading a management message in the form of a load packet M from a data preparation server SM-DP into a subscriber identity module eUICC, according to the prior art. The load packet M comprises a load sequence PL for implementing a subscription profile P in the subscriber identity module eUICC. The data preparation server SM-DP sends the load packet M to a security router SM-SR which in turn sends the load packet M to the subscriber identity module eUICC. By processing the load sequence PL from the load packet M the profile P is implemented in the subscriber identity module eUICC.

FIGS. 2( a ) to 2( c ) show a diagram for loading a management message in the form of a load packet M for loading a profile P from a data preparation server SM-DP via a security router SM-SR into a subscriber identity module eUICC, according to an embodiment of the invention. (a) First the data preparation server SM-DP sends the load packet M to the subscriber identity module eUICC. First, at the subscriber identity module eUICC either the acceptance of the load packet M or the processing of the load packet M is blocked (prevented). (b) Instead, (b1) a user of the end device ME is prompted by the subscriber identity module eUICC, via the end device ME in which the subscriber identity module eUICC is operated, to effect an input at the end device ME, e.g. to input a PIN (personal identification number) or a one-time password OTP. (b2) The user effects the requested input, e.g. by the input of PIN or OTP. (b3) The input, e.g. PIN or OTP, is forwarded to the subscriber identity module eUICC for verification. In the case of a successful verification (c), (c1) the blocking of accepting or processing the load packet M is removed. (c2) Consequently, the load packet M is loaded into the subscriber identity module eUICC and subsequently processed or the loaded but blocked load packet M is processed. By processing the load packet M the load sequence PL is worked through and the profile P is implemented in the subscriber identity module eUICC.

[1] 12FAST.13—Embedded SIM Remote Provisioning Architecture 17 Dec. 2013, GSMA

[2] SGP02-Remote-Provisioning-Architecture-for-Embedded-UICC-Technical-Specification-v2.0, 13 Oct. 2014, GSMA