English:
[0002] Many mobile devices are configured to use removable Universal Integrated Circuit Cards (UICCs) that enable the mobile devices to access services provided by Mobile Network Operators (MNOs). In particular, each UICC includes at least a microprocessor and a read-only memory (ROM), where the ROM is configured to store an MNO profile that the mobile device can utilize to register and interact with an MNO. Typically, a UICC takes the form of a small removable card (commonly referred to as a Subscriber Identity Module (SIM) card) that is configured to be inserted into a UlCC-receiving bay included in a mobile device. In more recent implementations, however, UICCs are being embedded directly into system boards of mobile devices. These embedded UICCs (eUICCs) can provide several advantages over traditional, removable UICCs. For example, some eUICCs include a rewritable memory that can facilitate installation, modification, and/or deletion of one or more eSIMs, which can provide for new and/or different servces and/or updates for accessing extended features provided by MNOs. An eUICC can store a number of MNO profiles— also referred to herein as eSIMs— and can eliminate the need to include UlCC-receiving bays in mobile devices. Moreover, eSIMs can be remotely provisioned to mobile devices, which can substantially increase flexibility when users travel to different countries, migrate their phone numbers to different MNOs, and the like.
[0003] Presently, a common approach for managing eSIMs of mobile devices is MNO-centric, and involves network equipment of an MNO, such as a provisioning server, communicating with an eUICC of a mobile device through an over-the-air (OTA) secure channel. With the OTA secure channel established between the provisioning server and the eUICC of the mobile device, the provisioning server can remotely manage an appropriate eSEVI of the eUICC included in the mobile device by sending commands to the eUICC over the OTA secure channel.
[0004] Notably, the foregoing MNO-centric provisioning technique can have a number of drawbacks. One drawback, for example, is that different MNOs, different servers of MNOs, and/or different eUICCs may use different sets of proprietary protocols with which to communicate and manage eSIMs. A format for communicating eSIM information and/or a particular sequence of commands by which a server interacts with an eUICC to communicate and manage eSIMs may vary substantially, which impedes interoperability in eSIM management by multiple MNOs and/or multiple provisioning servers across different eUICCs in different mobile devices.
[0005] Representative embodiments set forth techniques for managing the processing of electronic Subscriber Identity Module (eSIM) data at a mobile device. According to some embodiments, an eSEVI management entity of an embedded Universal Integrated Circuit Card (eUICC) included in the mobile device obtains an encrypted eSIM package. The eSEVI management entity on the eUICC can be an application that includes specific security service capabilities, such as for secure communication and encryption/decryption. The eSIM management entity on the eUICC decrypts the encrypted eSIM package to obtain contents of an eSIM. The contents of the eSIM obtained from the decryption of the encrypted eSEVI package can be formatted genetically, rather than being specifically tailored to requirements of a particular eUICC or mobile device, or for manufacturers thereof. In some embodiments, the contents of the eSEVI package can be formatted in accordance with a standardized communications protocol or specification, or in accordance with an accepted communications industry de facto standard format. The contents of the eSIM package can be formatted such that the same format applies to eSIMs for different provisioning servers, MNOs, eUICCs, mobile devices, eUICC suppliers, and/or mobile device manufacturers. The contents of the eSIM can be formatted in accordance with an abstract syntax notation (ASN), e.g., ASN. l, distinguished encoding rules (DER) format. The eSIM management entity parses the formatted contents of the eSEVI to retrieve individual eSEVI (profile) components. The eSIM package can also provide context information for handling the eSIM components. In some embodiments, the eSEVI management entity personalizes the parsed eSEVI contents for installation on the eUICC. The eSIM management entity installs each eSIM (profile) component for the eSIM in an eSIM security domain. In some embodiments, the eSIM management entity acts as a local, personalization server to provide local Trusted Service Manager (TSM) server functionality for eSIM installation that transforms "generically formatted" contents of an eSIM into a set of individual eSIM components having a specific format that matches requirements of the eUICC, the mobile device, and/or a manufacturer thereof. Representative requirements of the eUICC can include hardware requirements, software requirements, operating system (OS) requirements, or combinations of these that can determine, at least in part, a format for an eSIM stored on the eUICC (or for one or more eSIM components) and/or for management of eSEVIs stored on the eUICC.
[0006] This Summary is provided merely for purposes of summarizing some example embodiments so as to provide a basic understanding of some aspects of the subject matter described herein. Accordingly, it will be appreciated that the above- described features are merely examples and should not be construed to narrow the scope or spirit of the subject matter described herein in any way. Other features, aspects, and advantages of the subject matter described herein will become apparent from the following Detailed Description, Figures, and Claims.
[0008] The included drawings are for illustrative purposes and serve only to provide examples of possible structures and arrangements for the disclosed inventive apparatuses and methods for providing wireless computing devices. These drawings in no way limit any changes in form and detail that may be made to the embodiments by one skilled in the art without departing from the spirit and scope of the embodiments. The embodiments will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals designate like structural elements.
[0009] FIG. 1 illustrates a block diagram of different components of a system configured to implement the various techniques described herein, according to some embodiments.
[0010] FIG. 2 illustrates a block diagram of a more detailed view of particular components of the system of FIG. 1, according to some embodiments.
[0011] FIG. 3 A illustrates a sequence diagram of a method for installing an eSIM for storage on an eUICC of the mobile device of FIG. 1, according to some embodiments.
[0012] FIG. 3B illustrates a representative parsing of a portion of a standard formatted eSEVI package into eSIM content for installation on an eUICC, according to some embodiments.
[0013] FIG. 4 illustrates a flowchart of an example method for installing an eSEVI for storage on the eUICC of the mobile device of FIG. 1, according to some embodiments.
[0014] FIG. 5 illustrates a detailed view of an example computing device that can be used to implement various components described herein, according to some embodiments.
[0015] Representative applications of apparatuses and methods according to the presently described embodiments are provided in this section. These examples are being provided solely to add context and aid in the understanding of the described embodiments. It will thus be apparent to one skilled in the art that the presently described embodiments can be practiced without some or all of these specific details. In other instances, well known process steps have not been described in detail in order to avoid unnecessarily obscuring the presently described embodiments. Other applications are possible, such that the following examples should not be taken as limiting.
[0016] In accordance with various embodiments described herein, the terms "wireless communication device," "wireless device," "mobile device," "mobile station," and "user equipment" (UE) may be used interchangeably herein to describe one or more common consumer electronic devices that may be capable of performing procedures associated with various embodiments of the disclosure. In accordance with various implementations, any one of these consumer electronic devices may relate to: a cellular phone or a smart phone, a tablet computer, a laptop computer, a notebook computer, a personal computer, a netbook computer, a media player device, an electronic book device, a MiFi® device, a wearable computing device, as well as any other type of electronic computing device having wireless communication capability that can include communication via one or more wireless communication protocols such as used for communication on: a wireless wide area network (WW AN), a wireless metro area network (WMAN) a wireless local area network (WLAN), a wireless personal area network (WPAN), a near field communication (NFC), a cellular wireless network, a fourth generation (4G) Long Term Evolution (LTE), LTE Advanced (LTE-A), and/or 5G or other present or future developed advanced cellular wireless networks.
[0017] The wireless communication device, in some embodiments, can also operate as part of a wireless communication system, which can include a set of client devices, which can also be referred to as stations, client wireless devices, or client wireless communication devices, interconnected to an access point (AP), e.g., as part of a WLAN, and/or to each other, e.g., as part of a WPAN and/or an "ad hoc" wireless network. In some embodiments, the client device can be any wireless communication device that is capable of communicating via a WLAN technology, e.g., in accordance with a wireless local area network communication protocol. In some embodiments, the WLAN technology can include a Wi-Fi (or more generically a WLAN) wireless communication subsystem or radio, the Wi-Fi radio can implement an Institute of Electrical and Electronics Engineers (IEEE) 802.11 technology, such as one or more of: IEEE 802.11a; IEEE 802.11b; IEEE 802. l lg; IEEE 802.11-2007; IEEE 802.11η; IEEE 802.11-2012; IEEE 802.1 lac; or other present or future developed IEEE 802.11 technologies.
[0018] Additionally, it should be understood that the UEs described herein may be configured as multi-mode wireless communication devices that are also capable of communicating via different third generation (3G) and/or second generation (2G) RATs. In these scenarios, a multi-mode UE can be configured to prefer attachment to LTE networks offering faster data rate throughput, as compared to other 3G legacy networks offering lower data rate throughputs. For instance, in some implementations, a multi-mode UE may be configured to fall back to a 3G legacy network, e.g., an Evolved High Speed Packet Access (HSPA+) network or a Code Division Multiple Access (CDMA) 2000 Evolution-Data Only (EV-DO) network, when LTE and LTE-A networks are otherwise unavailable.
[0019] Representative embodiments described herein set forth techniques for managing the processing of electronic Subscriber Identity Module (eSIM) data at a mobile device. Forthcoming communication standards protocols, such as specified in the European Technical Standards Institute (ETSI) Technical Specification (TS) 103.383, require eSIM interoperability across different eUICCs. In particular, an eUICC should support the loading and installing of eSIMs (profiles) that may be generated by different profile provisioning credential holders. An eSEVI can use a standardized description format that permits loading and installation on any eUICC that complies with eSIM interoperability, e.g., as specified in ETSI TS 103.383 and/or other applicable communications standards protocols and/or de facto communications industry standard format. The standardized description format used for the eSIM can include a number of different standardized items, such as network access application (NAA) parameters, NAA algorithm parameters and keys, "over-the-air" (OTA) keys, remote applet management (RAM) and remote file management (RFM) parameters, personal identification numbers (PINs), and personal unlock keys (PUKs). Further, an interface, in terms of a file structure and associated metadata, for an eSEVI to be remotely provisioned to an eUICC should conform to a common specified type. In some embodiments, a format for contents of an eSIM can be based on abstract syntax notation (ASN. l) distinguished encoding rules (DER). To achieve eSIM interoperability, the structure for an eUICCs architecture and/or operating system (OS) may be required to be modified to accommodate new "standardized" or "generic" eSIM formats and/or eSIM processing to manage the parsing of formatted contents of an eSEVI obtained from a "standardized" eSIM package into a set of individual eSIM components in a format compatible with and/or specific to the eUICC.
[0020] According to some embodiments, an eSIM management entity of an embedded Universal Integrated Circuit Card (eUICC) included in the mobile device obtains an encrypted eSIM package having formatted contents. The contents of the eSIM package can be formatted in accordance with a communications standards protocol or specification or based on a de facto communications industry standard format. The eSIM management entity on the eUICC can be (1) an Issuer Security Domain (ISD) level application, (2) a security domain in accordance with a GlobalPlatform® specification, (3) a security domain associated with one or more profiles or eSIMs in communication with eUICC operating system (OS) installation services, and/or (4) a specialized application with specific security service capabilities, such as for secure communication and encryption/decryption. The eSIM management entity on the eUICC decrypts the encrypted eSIM package to obtain contents of an eSEVI, where the contents are formatted in a "generic" or "standard" format that applies across different eUICCs and/or mobile devices. The same format for contents of an eSIM can be used for different eUICCs and/or mobile devices (and manufacturers thereof). Similarly different provisioning servers for different MNOs can provide eSIM packages with contents that are similarly formatted accordingly. In some embodiments, the contents of the eSEVI can be formatted in accordance with a communications standards protocol or specification or a communications industry de facto standard format. In some embodiments, the contents of the eSIM are formatted in accordance with an abstract syntax notation (ASN), e.g., ASN. l, distinguished encoding rules (DER) format. The eSIM management entity parses the formatted contents of the eSIM to retrieve individual eSIM (profile) components, which can include files, e.g., elementary files (EFs) and dedicated files (DFs), applications, security domain settings, eSIM encryption/decryption keys, network access application (NAA) parameters, NAA algorithm parameters and keys, over-the-air (OTA) keys, remote applet management (RAM) and remote file management (RFM) parameters, personal identification numbers (PINs), and/or personal unlock keys (PUKs). The eSIM package can also provide context information for handling components of the eSIM, e.g., implicit file path information by which to organize one or more EFs under a common DF path, and/or an implicit record fill pattern, such as 'FF' with which to pad the contents of individual components of the eSIM to an appropriate size after parsing, such as when the contents of the eSIM are compressed to reduce a size of the eSIM package for communication between the provisioning server and the eUICC of the mobile device. In some embodiments, the eSEVI management entity on the eUICC personalizes the parsed contents of the eSIM for installation on the eUICC, such as the use of keys and/or secrets by the eUICC during installation of the contents of the eSIM on the eUICC. The eSEVI management entity installs each individual components of the eSIM (profile) in an eSIM security domain. In some embodiments, the eSIM management entity acts as a local, personalization server to provide local TSM server functionality for eSIM installation that transforms a generic or "standards formatted" eSIM package into a specific format that matches requirements of the eUICC. In some embodiments, the requirements of the eUICC include a format for an eSIM, such as an individual eSEVI component and/or an organization of eSEVI components stored on the eUICC. In some embodiments, the requirements of the eUICC include hardware requirements and/or software (such as for an eUICC operating system) requirements that influence a format for the eSFM stored on the eUICC, an organization of eSFM components on the eUICC, and/or a series of commands used to install, add, modify, update, and/or perform other eSFM management operations for the eSIM on the eUICC. In some embodiments, the eSFM management entity parses different eSFM packages, each formatted in accordance with a standard protocol, into different eSFM contents and installs the different eSFM contents in different security domains in accordance with hardware, software, and/or OS requirements for the eSFM and/or for an MNO with which the eSFM is associated. In some embodiments, the post-installation data structure for the eSIM contents stored in an associated security domain of the eUICC is formatted in a manner specific to the eUICC OS used by the eUICC. In some embodiments, eSIM management entities external to the eUICC, such as a terminal interface or a remote management server, can interface with the "personalized" eSIM on the eUICC in accordance with one or more standardized communication protocols.
[0021] Accordingly, the eSIM management techniques described herein provide an approach for managing eSEVIs in an interoperable manner, in comparison to conventional, MNO-specific, server-specific, and/or eUICC-specific eSIM management techniques, as the eUICC can receive standardized and/or generically formatted eSIM packages and transform contents of the eSIM packages into a format that is specifically compatible with one or more requirements of the eUICC for management and/or storage of the eSIM on the eUICC. A more detailed discussion of these techniques is set forth below and described in conjunction with FIGS. 1-5, which illustrate detailed diagrams of systems and methods that can be used to implement these techniques.
[0022] FIG. 1 illustrates a block diagram of different components of a system 100 that is configured to implement the various techniques described herein, according to some embodiments. More specifically, FIG. 1 illustrates a high-level overview of the system 100, which, as shown, includes a mobile device 102, a group of base stations 112 that are managed by different MNOs 114, and a set of provisioning servers 116 that are in communication with the MNOs 114. According to the illustration of FIG. 1, the mobile device 102 can represent a mobile computing device (e.g., an iPhone® or an iPad® by Apple®), the base stations 112 can represent different radio towers that are configured to communicate with the mobile device 102, and the MNOs 114 can represent different wireless service providers that provide specific services (e.g., voice and data) to which the mobile device 102 can be subscribed.
[0023] As shown in FIG. 1, the mobile device 102 can include a main processor 104, a memory 106, an eUICC 108, and a baseband component 110. These components work in conjunction to enable the mobile device 102 to provide useful features to a user of the mobile device 102, such as localized computing, location based services, and Internet connectivity. As described in greater detail below, the eUICC 108 can be configured to store multiple eSIMs for accessing the different MNOs 114 through the base stations 112. For example, the eUICC 108 can be configured to store and manage one or more eSIMs for one or more MNOs 114 for different subscriptions to which the mobile device 102 is associated. To be able to access services provided by the MNOs, an eSIM is provisioned to the eUICC 108. In addition, eSFMs stored on the eUICC 108 can be updated, modified, activated, deactivated, and/or deleted via communication between the eUICC 108 of the mobile device 102 and applicable network equipment, such as the provisioning servers 116 (or other equivalent or similar network-based eSFM management entities). In some embodiments, eSIMs are pre-stored in the eUICC 108 in an inactive state, and during a provisioning process, the eUICC 108 obtains MNO credentials (e.g., keys, etc.), service information (e.g., carrier information, services subscribed to), and/or other information, and uses this information to activate the eSFM. In some embodiments, eSIMs are not pre-stored in the eUICC 108, and the eUICC 108 obtains one or more eSIMs from one or more associated provisioning servers 116. It is noted that provisioning servers 116 can be maintained by a manufacturer of the mobile device 102, the MNOs 114, third party entities, and the like. Communication of eSIM data between a provisioning server 116 and the eUICC 108 uses a secure communication channel, over which a series of commands between the provisioning server 116 and the eUICC 108 results in provisioning (or other management) of an eSFM to (or on) the eUICC 108. As different eUICC 108 (or UICC) manufacturers (or mobile device manufacturers) presently can require different "proprietary" protocols for formatting eSIM data and/or for managing eSIMs on an eUICC 108, such as requiring a specific series of commands, different eSFMs from different MNOs and/or different provisioning servers 116 provided to the same eUICC 108 can require different handling, which can impede eSIM interoperability. As described further herein, a provisioning server 116 can provide a "standardized" or "generically" formatted eSFM package to an eUICC 108 of a mobile device 102, and an eSIM management entity on the eUICC 108 can extract a set of eSIM components from the eSIM package to install, modify, update, or otherwise manage an eSIM on the eUICC. Although not illustrated in FIG. 1, the mobile device 102 can also be configured to include a receiving bay for a removable UICC (e.g., a SEVI card), on which an eSEVI can be managed in a similar manner using the techniques described herein.
[0024] FIG. 2 illustrates a block diagram of a more detailed view 200 of particular components of the mobile device 102 of FIG. 1, according to some embodiments. As shown in FIG. 2, the main processor 104, in conjunction with the memory 106, can implement a main operating system (OS) 202 that is configured to execute applications 204 (e.g., native OS applications and user applications). As also shown in FIG. 2, the eUICC 108 can be configured to implement an eUICC OS 206 that is configured to manage the hardware resources of the eUICC 108 (e.g., a processor and a memory embedded in the eUICC 108). The eUICC OS 206 can also be configured to manage eSIMs 208 that are stored by the eUICC 108, e.g., by activating, deactivating, modifying, or otherwise performing management of the eSIMs 208 within the eUICC 108 and providing the baseband component 110 with access to the eSIMs 208 to provide access to wireless services for the mobile device 102. The eUICC 108 OS can include an eSEVI manager 210, which can be an Issuer Security Domain (ISD) level application, a "security domain" in accordance with a GlobalPlatform specification, a security domain associated with one or more eSIMs and that calls additional eUICC OS installation services, and/or an application that implements a specific set of security services, e.g., for establishing and managing a secure channel and/or to provide encryption/decryption functions. The eSEVI manager 210 can perform management functions for various eSIMs as described further herein. According to the illustration shown in FIG. 2, each eSEVI 208 can include a number of applets 212 that define the manner in which the eSIM 208 operates. For example, one or more of the applets 212, when implemented by the baseband component 110 and the eUICC 108, can be configured to enable the mobile device 102 to communicate with an MNO 114 and provide useful features (e.g., phone calls and internet) to a user of the mobile device 102.
[0025] As also shown in FIG. 2, the baseband component 110 of the mobile device 102 can include a baseband OS 214 that is configured to manage hardware resources of the baseband component 1 10 (e.g., a processor, a memory, different radio components, etc.). According to some embodiments, the baseband component 110 can implement a manager 216 that is configured to interface with the eUICC 108 to implement various techniques described herein, which can include establishing a secure channel with a provisioning server 116 and obtaining information (such as eSIM data) from the provisioning server 116 for purposes of managing eSEVIs 208, including but not limited to provisioning, loading, installing, adding, modifying, updating, deleting, or performing other management operations for one or more eSIMs 208. As also shown in FIG. 2, the manager 216 can be configured to implement services 218, which represents a collection of software modules that are instantiated by way of the various applets 212 of activated eSIMs 208 that are included in the eUICC 108. For example, services 218 can be configured to manage different connections between the mobile device 102 and MNOs 114 according to the different eSEVIs 208 that are activated within the eUICC 108.
[0027] FIG. 3B illustrates a diagram 350 of a representative parsing of a portion of a standardized, formatted eSIM package by the eSIM manager 210 (which is part of the eUICC OS 206) of the eUICC 108. The eSIM package (and/or contents therein) can be formatted in a format that is parsable by any compliant eUICC OS 206 or eSIM manager 210. In some embodiments, the eSEVI package (and/or contents therein) is formatted in accordance with an ASN. l DER encoded format. FIG. 3B illustrates a representative ASN. l DER encoded portion of contents of an eSEVI package, shown in a human readable structure. The eSIM manager 210 can parse the ASN.1 formatted eSIM contents of the eSIM package to produce an eSIM component for eSIM installation on the eUICC 108. In particular, FIG. 3B illustrates an elementary file (EF) for an integrated circuit card identifier (ICCID). After parsing by the eSIM manager 210, the ASN. l formatted input becomes a set of eSIM contents, namely a file control parameter (FCP) and file data (the ICCID value). The FCP can include a data group identifier (DGI) and a type length value (TLV) for the ICCID EF. The eSIM package parsed by the eSIM manager 210, in some embodiments, can include context information that may or may not be included with an eSIM component. For example, context handling of eSIM contents by the eSFM manager 210 can be standardized. A representative context-handling example includes implicit file path information, such as when a sequence of EFs is created under a common DF path (or folder). Another representative context-handling example includes implicit file record fill patterns to use when creating eSIM contents for installation on the eUICC 108, such as when a fixed-length file record of the eSFM 208 is padded with a particular pattern, e.g., 'FF', to result in a particular length value for the file record (with the 'FF' fill pattern not included in the encrypted, formatted eSIM package to reduce its size). In some embodiments, after parsing, the eSFM manager 210 can "personalize" eSIM contents and/or handle eSIM data for installation on the eUICC 108 in a proprietary manner, e.g., a manner in which keys and/or secrets are used at the eUICC 108 during eSIM installation can be determined by the eSFM manager and not subject to interoperability requirements.
[0028] Returning to FIG. 3A, in step 308, the eSIM manager 210 installs components of the eSIM 208 in the eSIM security domain 310 associated with the eSIM 208. The eSIM manager 210 can act as a local (to the mobile device 102) "personalization" sever during installation of the eSIM 208, e.g., to achieve at least in part functionality provided by a provisioning server 140 (or equivalent network based equipment) to manage the eSIM 208 on the eUICC 108 of the mobile device 102. Functions provided by the eSIM manager 210 can be comparable to remote management commands provided by the provisioning server 140 in order to manage the eSFM 208 on the eUICC 108. For example, commands such as "SELECT path", "CREATE file (EF/DF)", "UPDATE record", "LOAD security domain", "INSTALL security domain", "LOAD application", and "INSTALL application" can be realized by the eSFM manager 210 locally on the eUICC 108 of the mobile device 102 to manage the eSIM 208. The eSF manager 210 can receive the eSIM package, via a secure connection, and the eSF manager 210 can install the eSIM 208 on the eUICC 108 without requiring receipt of a series of commands from the provisioning server 140 during installation of the eSIM 208. The eSF manager 210 can decrypt, parse, personalize, process, load, install, verify, and perform other management functions for the eSIM 208 autonomously or with minimal communication with the provisioning server 140. The eSIM manager 210 can notify the provisioning server 140 upon successful installation of the eSIM 208. In some embodiments, the eSIM manager 210 can regenerate a series of commands equivalent to communication between the provisioning server 140 and a "legacy" eUICC OS to realize at least a portion of the process by which the eSIM 208 is installed on the eUICC 108. In some embodiments, the eSIM manager uses a "new" series of commands to achieve the same results as would be achieved by a series of "legacy" commands to install the eSEVI 208 on the eUICC 108. In some embodiments, the eUICC 108 stores a set of command scripts that can be executed whole or in part to perform at least a portion of installation of the eSIM 208 on the eUICC 108. In some embodiments, the eUICC performs at least some "personalized" functions in a proprietary manner while installing the eSIM 208 on the eUICC 108. Representative functions can include personalization of one or more keys and/or NAA secrets or other security actions. In addition, file formats for storage of the eSEVI 208 on the eUICC 108 can be "personalized" in a proprietary manner, e.g., based on a SIM card specific vendor personalization facility. In some embodiments, the post-installation data structure used to store the eSIM 208 on the eUICC platform can be specific to the eUICC OS; however, data of the eSEVI 208 can be viewed and/or managed via a standard interface, such as a terminal to UlCC/eUICC interface. Thus, the eSIM 208 can be stored differently for each eSEVI 208 but can be presented via standard interfaces in a "uniform" manner. For example, eSIM management by "off-card" entities, such as by a remote management server and/or via a terminal interface, can conform to a common standardized management interface, such as ETSI TS 103.383 and/or TS 103.384. In some embodiments, selection of an eSIM 208 via an interface can behave in accordance with a legacy interface specification for a UICC, such as specified in the international standard ISO/IEC 7816, which is a standard managed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
[0029] FIG. 5 illustrates a detailed view of a computing device 500 that can be used to implement the various components described herein, according to some embodiments. In particular, the detailed view illustrates various components that can be included in the mobile device 102 illustrated in FIG. 1. As shown in FIG. 5, the computing device 500 can include a processor 502 that represents a microprocessor or controller for controlling the overall operation of computing device 500, which in some embodiments can represent the main processor 104 of FIG. 1. The computing device 500 can also include a user input device 508 that allows a user of the computing device 500 to interact with the computing device 500. For example, the user input device 508 can take a variety of forms, such as a button, keypad, dial, touch screen, audio input interface, visual/image capture input interface, input in the form of sensor data, etc. Still further, the computing device 500 can include a display 510 (screen display) that can be controlled by the processor 502 to display information to the user. A data bus 516 can facilitate data transfer between at least a storage device 540, the processor 502, and a controller 513. The controller 513 can be used to interface with and control different equipment through and equipment control bus 514. The computing device 500 can also include a network/bus interface 511 that couples to a data link 512. In the case of a wireless connection, the network/bus interface 511 can include a wireless transceiver.
[0030] The computing device 500 also include a storage device 540, which can comprise a single disk or a plurality of disks (e.g., hard drives), and includes a storage management module that manages one or more partitions within the storage device 540. In some embodiments, storage device 540 can include flash memory, semiconductor (solid state) memory or the like. The computing device 500 can also include a Random Access Memory (RAM) 520 and a Read-Only Memory (ROM) 522. The ROM 522 can store programs, utilities or processes to be executed in a non- volatile manner. The RAM 520 can provide volatile data storage, and stores instructions related to the operation of the computing device 500. The computing device 500 can further include a secure element 550, which can represent the eUICC 108 illustrated in FIGS. 1, 2 and 3A and described in detail herein.
[0031] The various aspects, embodiments, implementations or features of the described embodiments can be used separately or in any combination. Various aspects of the described embodiments can be implemented by software, by hardware, or by a combination of hardware and software. The described embodiments can also be embodied as computer readable code on a computer readable medium. The computer readable medium is any data storage device that can store data, which can thereafter be read by a computer system. Examples of the computer readable medium include read-only memory, random-access memory, CD-ROMs, DVDs, magnetic tape, hard disk drives, solid state drives, and optical data storage devices. The computer readable medium can also be distributed over network-coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.
[0032] The foregoing description, for purposes of explanation, used specific nomenclature to provide a thorough understanding of the described embodiments. However, it will be apparent to one skilled in the art that the specific details are not required in order to practice the described embodiments. Thus, the foregoing descriptions of specific embodiments are presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the described embodiments to the precise forms disclosed. It will be apparent to one of ordinary skill in the art that many modifications and variations are possible in view of the above teachings.

中文:
[0002]很多移动设备被配置为使用使得移动设备能够访问由移动网络运营商(MNO)提供的服务的可移除通用集成电路卡(UICC)。具体地,每个UICC至少包括微处理器和只读存储器(ROM),其中ROM被配置为存储MNO配置文件,移动设备可使用此MNO配置文件来向MNO注册并与其进行交互。通常,UICC采取小的可移除卡的形式(通常称为用户身份模块(SIM)卡),其被配置为插入到包括在移动设备中的UICC接收底座内。然而,在最近的具体实施中,将UICC直接嵌入到移动设备的系统板中。这些嵌入式UICC(eUICC)可提供优于传统的可移除UICC的若干优点。例如,一些eUICC包括可重写存储器,所述可重写存储器可以便于安装、修改和/或删除一个或多个eSIM,这可以提供新的和/或不同的服务和/或更新以用于访问由MNO提供的扩展功能。eUICC可以存储多个MNO配置文件(在本文中也称为eSIM),并且可以消除在移动设备中包括UICC接收底座的需要。此外,eSIM可以被远程地供应给移动设备,当用户前往不同的国家、将他们的电话号码迁移到不同的MNO等时,移动设备可以大大提高灵活性。
[0003]目前,用于管理移动设备的eSIM的通用方法是以MNO为中心,并且涉及MNO的诸如配置服务器的网络设备通过空中(OTA)安全信道与移动设备的eUICC进行通信。通过在配置服务器与移动设备的eUICC之间建立OTA安全信道,配置服务器可以通过经由OTA安全信道向eUICC发送命令来远程地管理移动设备中所包含的eUICC的适当eSIM。
[0004]值得注意的是,上述以MNO为中心的供应技术可能具有许多缺点。例如,一个缺点是不同的MNO、MNO的不同服务器和/或不同的eUICC可以使用不同的专有协议集合来对eSIM进行通信和管理。用于传达eSIM信息的格式和/或服务器与eUICC交互以对eSIM进行通信和管理所使用的特定命令序列可能会发生显著变化,这阻碍了由多个MNO和/或多个配置服务器在不同的移动设备中跨不同eUICC实现的eSIM管理的互操作性。
[0005]代表性实施方案阐述了用于管理移动设备处的电子用户身份模块(eSIM)的处理的技术。根据一些实施方案,被包括在移动设备中的嵌入式通用集成电路卡(eUICC)的eSIM管理实体获得加密的eSIM包。eUICC上的eSIM管理实体可以是包括特定安全服务功能(诸如,安全通信和加密/解密)的应用程序。eUICC上的eSIM管理实体对加密的eSIM包进行解密,以获得eSIM的内容。通过对加密的eSIM包进行解密而获得的eSIM的内容可以一般地格式化,而不是根据特定eUICC或移动设备的要求或其制造商的要求来特别定制。在一些实施方案中,可以根据标准化通信协议或规范,或根据所接受的通信行业实际上标准格式来格式化eSIM包的内容。eSIM包的内容可以格式化,使得对于不同的配置服务器、MNO、eUICC、移动设备、eUICC供应商和/或移动设备制造商来说,eSIM适用相同的格式。可以根据抽象语法符号(ASN)(例如ASN.1)区分的编码规则(DER)格式来格式化eSIM的内容。eSIM管理实体对eSIM的格式化内容进行解析,以检索单独的eSIM(配置文件)部件。eSIM包还可以提供用于处理eSIM部件的上下文信息。在一些实施方案中,eSIM管理实体个性化解析的eSIM内容以安装在eUICC上。eSIM管理实体将eSIM的每个eSIM(配置文件)部件安装在eSIM安全域内。在一些实施方案中,eSIM管理实体充当本地个性化服务器,以提供本地可信服务管理器(TSM)服务器功能以用于进行eSIM安装,所述功能将eSIM的“一般格式化”的内容转换为具有匹配eUICC、移动设备和/或其制造商的要求的特定格式的一组单独eSIM部件。eUICC的代表性要求可以包括硬件要求、软件要求、操作系统(OS)要求或这些的组合,这些要求可以至少部分地确定存储在eUICC上的eSIM(或一个或多个eSIM部件)的格式和/或用于管理存储在eUICC上的eSIM。
[0006]提供本发明内容的目的仅为概述一些示例性实施方案以便提供对本文所述主题的一些方面的基本了解。因此,应当认识到,上文描述的特征只是示例,不应认为其以任何方式缩窄本文所述主题的范围或实质。本文所述主题的其他特征、方面和优点将根据以下具体实施方式、附图和权利要求书而变得显而易见。
[0008]所包括的附图用于说明性目的,并且仅提供用于提供无线计算设备的所公开的本发明的装置和方法的可能的结构和布置的示例。这些附图决不限制本领域的技术人员在不脱离实施方案的实质和范围的前提下可对实施方案进行的在形式和细节方面的任何更改。所述实施方案通过下面结合附图的具体描述将更易于理解,其中类似的附图标号表示类似的结构元件。
[0009]图1示出了根据一些实施方案的被配置为实现本文所述的各种技术的系统的不同部件的框图。
[0010]图2示出了根据一些实施方案的图1的系统的特定部件的更详细视图的框图。
[0011]图3A示出了根据一些实施方案的用于存储的eSIM安装在图1的移动设备的eUICC上的方法的序列图。
[0012]图3B示出了根据一些实施方案的为了安装在eUICC上而将标准格式化的eSIM包的一部分解析为eSIM内容的代表性解析。
[0013]图4示出了根据一些实施方案的用于将用于存储的eSIM安装在图1的移动设备的eUICC上的示例性方法的流程图。
[0014]图5示出了根据一些实施方案的可用于实现本文所述的各个部件的示例性计算设备的详细视图。
[0015]在本部分中提供了根据本发明所述的实施方案的装置和方法的代表性应用。提供这些示例仅是为了添加上下文并有助于理解所述实施方案。对于本领域的技术人员因此将显而易见的是,本发明所述的实施方案可在不具有这些具体细节中的一些或全部具体细节的情况下被实施。在其他情况下,未详细描述熟知的工艺步骤,以便避免不必要地模糊本发明所述的实施方案。其他应用也是可能的,使得以下示例不应被视为是限制性的。
[0016]根据本文所述的各种实施方案,术语“无线通信设备”、“无线设备”、“移动设备”、“移动站”、和“用户装置(UE)”在本文中可互换使用,以描述可能够执行与本公开的各种实施方案相关联的过程的一个或多个普通的消费电子设备。根据各种具体实施,这些消费电子设备中的任一种消费电子设备可涉及:蜂窝电话或智能电话、平板电脑、膝上型计算机、笔记本计算机、个人计算机、上网本计算机、媒体播放器设备、电子书设备、设备、可穿戴计算设备、以及具有无限通信能力的任何其他类型的电子计算设备,该无限通信能力可包括经由一种或多种无线通信协议的通信,该无线通信协议诸如用于在以下网络上进行通信的协议:无线广域网(WWAN)、无线城域网(WMAN)、无线局域网(WLAN)、无线个人区域网(WPAN)、近场通信(NFC)、蜂窝无线网络、第四代(4G)长期演进(LTE)、高级LTE(LTE-A)、和/或5G或其他当前或将来开发的高级蜂窝无线网络。
[0017]在一些实施方案中,无线通信设备还可作为无线通信系统的一部分来操作,该无线通信系统可包括也可被称为站、客户端无线设备、或客户端无线通信设备的一组客户端设备,其被互连到接入点(AP)例如作为WLAN的一部分,和/或彼此互连例如作为WPAN和/或“自组织”无线网络的一部分。在一些实施方案中,客户端设备可为能够经由WLAN技术(例如,根据无线局域网通信协议)来进行通信的任何无线通信设备。在一些实施方案中,WLAN技术可包括Wi-Fi(或更一般地,WLAN)无线通信子系统或无线电部件,该Wi-Fi无线电设备可实现电气电子工程师协会(IEEE)802.11技术,诸如以下各项中的一者或多者:IEEE802.11a;IEEE 802.11b;IEEE 802.11g;IEEE 802.11-2007;IEEE 802.11n;IEEE 802.11-2012;IEEE 802.11ac;或者其他现有的或者将来开发的IEEE 802.11技术。
[0018]另外,应当理解,本文所述的UE可被配置作为还能够经由不同的第三代(3G)和/或第二代(2G)RAT进行通信的多模无线通信设备。在这些情况下,多模UE可被配置为与提供较低数据速率吞吐的其他3G传统网络相比更偏好附接到提供较快数据速率吞吐的LTE网络。例如,在一些实施方式中,多模UE可被配置为在LTE和LTE-A网络以其他方式不可用时回退到3G传统网络,例如演进型高速分组接入(HSPA+)网络、或码分多址(CDMA)2000演进-仅数据(EV-DO)网络。
[0019]本文描述的代表性实施方案阐述了用于管理移动设备处的电子用户身份模块(eSIM)的处理的技术。即将发布的通信标准协议,诸如欧洲技术标准协会(ETSI)技术规范(TS)103.383中所指定,要求跨不同eUICC实现eSIM互操作。具体地,eUICC应该支持对可由不同配置文件供应凭证持有者生成的eSIM(配置文件)的加载和安装。eSIM可以使用允许加载和安装在符合eSIM互操作的任何eUICC上的标准化描述格式,例如,如ETSI TS 103.383和/或其他适用通信标准协议和/或实际上通信行业标准格式中所指定。用于eSIM的标准化描述格式可以包括多个不同的标准化项目,诸如网络接入应用(NAA)参数、NAA算法参数和密钥、“空中”(OTA)密钥、远程小应用程序管理(RAM)和远程文件管理(RFM)参数、个人识别号(PIN)和个人解锁密钥(PUK)。此外,就文件结构和相关联的元数据而言,eSIM被远程地供应到eUICC所用的接口应当符合常见指定类型。在一些实施方案中,eSIM内容的格式可以基于抽象语法符号(ASN.1)区分的编码规则(DER)。为了实现eSIM互操作,可能需要修改eUICC的架构和/或操作系统(OS)的结构,以使其适应新的“标准化”或“通用”eSIM格式和/或eSIM处理,以管理从“标准化”eSIM包中获得的eSIM的格式化内容以与eUICC兼容和/或特定于eUICC的格式解析到一组单独的eSIM部件。
[0020]根据一些实施方案,被包括在移动设备中的嵌入式通用集成电路卡(eUICC)的eSIM管理实体获得具有格式化内容的加密eSIM包。可以根据通信标准协议或规范,或者可以基于实际上通信行业标准格式来格式化eSIM包的内容。eUICC上的eSIM管理实体可以是(1)发布者安全域(ISD)级应用程序,(2)依据规范的安全域,(3)与一个或多个配置文件或eSIM相关联的安全域,所述一个或多个配置文件或eSIM与eUICC操作系统(OS)安装服务进行通信,和/或(4)具有特定安全服务能力的专用应用程序,诸如用于安全通信和加密/解密。eUICC上的eSIM管理实体对加密的eSIM包进行解密,以获得eSIM的内容,其中所述内容以适用于不同的eUICC和/或移动设备的“通用”或“标准”格式来格式化。eSIM内容的相同格式可以用于不同的eUICC和/或移动设备(及其制造商)。类似地,不同MNO所用的不同配置服务器可以向eSIM包提供相应地以类似方式格式化的内容。在一些实施方案中,可以根据通信标准协议或规范或通信行业实际上标准格式来格式化eSIM的内容。在一些实施方案中,根据抽象语法符号(ASN)(例如,ASN.1)区分的编码规则(DER)格式来格式化eSIM的内容。eSIM管理实体解析eSIM的格式化内容,以检索单独的eSIM(配置文件)部件,所述eSIM(配置文件)部件可以包括文件(例如,基本文件(EF)和专用文件(DF))、应用程序、安全域设置、eSIM加密/解密密钥、网络接入应用(NAA)参数、NAA算法参数和密钥、空中(OTA)密钥、远程小应用程序管理(RAM)和远程文件管理(RFM)参数、个人识别号(PIN)和/或个人解锁密钥(PUK)。eSIM包还可以提供:上下文信息,所述上下文信息用于处理eSIM的部件,例如在共用DF路径下组织一个或多个EF所用的隐含文件路径信息;和/或隐式记录填充模式,诸如‘FF’,在解析之后,诸如当压缩eSIM的内容以减小用于在配置服务器与移动设备的eUICC之间进行通信的eSIM包的大小时,‘FF’用于将eSIM的各个部件的内容填充到适当的大小。在一些实施方案中,eUICC上的eSIM管理实体对eSIM的解析内容进行个性化以用于安装在eUICC上,诸如在eUICC上安装eSIM内容期间,eUICC使用密钥和/或秘密。eSIM管理实体将eSIM(配置文件)的各个部件安装在eSIM安全域中。在一些实施方案中,eSIM管理实体充当本地个性化服务器,以提供本地TSM服务器功能以用于进行eSIM安装,所述功能将通用的或“标准格式化”的eSIM包转换为匹配eUICC要求的特定格式。在一些实施方案中,eUICC的要求包括eSIM诸如单独eSIM部件的格式和/或存储在eUICC上的eSIM部件的组织。在一些实施方案中,eUICC的要求包括硬件要求和/或软件(诸如对于eUICC操作系统来说)要求,这些要求影响了存储在eUICC上的eSIM的格式、eSIM部件在eUICC上的组织和/或用于在eUICC上针对eSIM进行的安装、添加、修改、更新和/或执行其他eSIM管理操作的一系列命令。在一些实施方案中,eSIM管理实体将根据标准协议而格式化的不同eSIM包解析成不同的eSIM内容,并根据针对eSIM和/或针对eSIM相关联的MNO的硬件、软件和/或OS要求而将不同的eSIM内容安装在不同的安全域中。在一些实施方案中,以特定于由eUICC使用的eUICC OS的方式来格式化存储在eUICC的相关联的安全域中的eSIM内容的安装后数据结构。在一些实施方案中,位于eUICC外部的eSIM管理实体,诸如终端接口或远程管理服务器,可以根据一个或多个标准化通信协议而与eUICC上的“个性化”eSIM交接。
[0021]因此,与传统的特定于MNO的、特定于服务器的和/或特定于eUICC的eSIM管理技术相比,本文所述的eSIM管理技术提供了以可互操作方式管理eSIM的方法,因为eUICC可以接收标准化的和/或一般格式化的eSIM包,并将eSIM包的内容转换为与eUICC的一个或多个要求特别兼容的格式,用于在eUICC上管理和/或存储eSIM。这些技术的更详细的讨论在下面示出并结合图1至图5进行描述,其示出了可用于实现这些技术的系统和方法的详细的图示。
[0022]图1示出了根据一些实施方案的被配置为实现本文所述的各种技术的系统100的不同部件的框图。更具体地,图1示出了系统100的高级概述,如图所示,该系统包括移动设备102、由不同MNO 114管理的一组基站112以及与MNO 114进行通信的一组配置服务器116。根据图1的图示,移动设备102可表示移动计算设备(例如,的或),基站112可表示被配置为与移动设备102通信的不同无线电塔,并且MNO 114可表示提供移动设备102可订阅的特定服务(例如,语音和数据)的不同无线服务提供商。
[0023]如图1所示,移动设备102可包括主处理器104、存储器106、eUICC 108和基带部件110。这些部件协同工作以使移动设备102能够向移动设备102的用户提供有用的特征,例如局部计算、基于位置的服务,以及互联网连接。如下文更详细地描述,eUICC 108可被配置为存储用于通过基站112访问不同MNO 114的多个eSIM。例如,eUICC 108可以被配置为针对移动设备102所关联的不同用户存储和管理一个或多个MNO 114的一个或多个eSIM。为了能够访问MNO提供的服务,向eUICC 108供应eSIM。另外,可以经由移动设备102的eUICC 108与诸如配置服务器116(或者其他等效的或类似的基于网络的eSIM管理实体)的适用网络设备之间的通信来更新、修改、激活、去激活和/或删除存储在eUICC 108上的eSIM。在一些实施方案中,eSIM在非活动状态下预先存储在eUICC 108中,并且在供应过程期间,eUICC 108获得MNO凭证(例如,密钥等)、服务信息(例如,运营商信息、订阅的服务)和/或其他信息,并使用此信息来激活eSIM。在一些实施方案中,eSIM不预先存储在eUICC 108中,并且eUICC 108从一个或多个相关联的配置服务器116获得一个或多个eSIM。应当指出的是,配置服务器116可由移动设备102的制造商、MNO 114、第三方实体等来维护。在配置服务器116与eUICC 108之间的eSIM数据的通信使用安全通信信道,通过该安全通信信道,配置服务器116与eUICC108之间的一系列命令导致eSIM被供应(或其他管理)到eUICC 108(或eUICC 108上)。由于不同的eUICC 108(或UICC)制造商(或移动设备制造商)目前可能需要不同的“专有”协议来格式化eSIM数据和/或管理eUICC 108上的eSIM,诸如需要特定的一系列命令,因此从不同的MNO和/或不同的配置服务器116提供给相同的eUICC 108的不同的eSIM可能需要不同的处理,这可能会妨碍eSIM的互用性。如本文进一步描述的,配置服务器116可以向移动设备102的eUICC 108提供“标准化”或“一般”格式化的eSIM包,并且eUICC 108上的eSIM管理实体可以从eSIM包中提取一组eSIM部件以在eUICC上安装、修改、更新或以其他方式管理eSIM。尽管图1中未示出,但移动设备102还可以被配置为包括用于可移除UICC(例如,SIM卡)的接收底座,在该接收底座上,可以使用本文所述的技术以类似的方式管理eSIM。
[0024]图2示出了根据一些实施方案,图1中移动设备102的特定部件的更详细视图200的框图。如图2所示,结合存储器106的主处理器104可以实现被配置为执行应用程序204(例如,本地OS应用程序和用户应用程序)的主操作系统(OS)202。同样如图2所示,eUICC 108可以被配置为实现eUICC OS 206,后者被配置为管理eUICC 108的硬件资源(例如,嵌入在eUICC 108中的处理器和存储器)。eUICC OS 206还可以被配置为例如通过激活、去激活、修改或以其他方式执行eUICC 108内的eSIM 208的管理并且向基带部件110提供对eSIM 208的访问来管理由eUICC 108存储的eSIM 208,以提供对用于移动设备102的无线服务的访问。eUICC 108操作系统可以包括eSIM管理器210,eSIM管理器可以是发布者安全域(ISD)级应用程序、依据规范的“安全域”、与一个或多个eSIM相关联并且呼叫额外的eUICC OS安装服务的安全域和/或实现特定的一组安全服务的应用程序,例如用于建立和管理安全信道和/或提供加密/解密功能。eSIM管理器210可以如本文进一步描述的那样对各种eSIM执行管理功能。根据图2所示的图示,每个eSIM 208可以包括多个小应用程序212,该多个小应用程序定义eSIM 208的操作方式。例如,小应用程序212中的一个或多个在由基带部件110和eUICC 108实现时,可被配置为使移动设备102能够与MNO 114通信并且向移动设备102的用户提供有用的特征(例如电话呼叫和互联网)。
[0025]同样如图2所示,移动设备102的基带部件110可包括基带OS 214,该基带OS被配置为管理基带部件110的硬件资源(例如处理器、存储器、不同的无线电部件等)。根据一些实施方案,基带部件110可以实现管理器216,所述管理器被配置为与eUICC 108交接以实现本文所述的各种技术,所述技术可以包括与配置服务器116建立安全信道并从配置服务器116获得信息(诸如eSIM数据),以用于管理eSIM 208,包括但不限于为一个或多个eSIM 208配置、加载、安装、添加、修改、更新、删除或执行其他管理操作。同样如图2所示,管理器216可被配置为实现服务218,这些服务表示利用包括在eUICC 108中的被激活eSIM 208的各种小应用程序212而被实例化的软件模块集合。例如,服务218可以被配置为根据在eUICC 108内被激活的不同eSIM 208来管理移动设备102与MNO 114之间的不同连接。
[0027]图3B示出了由eUICC 108的eSIM管理器210(该eSIM管理器是eUICC OS 206的一部分)对标准化的格式化的eSIM包的一部分进行的代表性解析的图350。能够以可由任何兼容的eUICC OS 206或eSIM管理器210解析的格式来格式化eSIM包(和/或其中的内容)。在一些实施方案中,根据ASN.1DER编码格式来格式化eSIM包(和/或其中的内容)。图3B示出了以人可读结构示出的eSIM包的内容的代表性ASN.1DER编码部分。eSIM管理器210可以解析eSIM包的ASN.1格式化的eSIM内容,以产生eSIM部件用于在eUICC 108上进行eSIM安装。具体地,图3B示出了用于集成电路卡标识符(ICCID)的基本文件(EF)。在由eSIM管理器210解析之后,ASN.1格式化的输入成为一组eSIM内容,即文件控制参数(FCP)和文件数据(ICCID值)。FCP可以包括ICCID EF的数据组标识符(DGI)和类型长度值(TLV)。在一些实施方案中,由eSIM管理器210解析的eSIM包可以包括eSIM部件中可能包括或不包括的上下文信息。例如,eSIM管理器210的eSIM内容的上下文处理可以是标准化的。代表性的上下文处理示例包括隐式文件路径信息,例如当在共用DF路径(或文件夹)下创建EF序列时。另一个代表性的上下文处理示例包括在创建用于安装在eUICC 108上的eSIM内容时,例如在eSIM 208的固定长度文件记录用特定模式例如‘FF’填充时使用的隐式文件记录填充模式,导致文件记录具有特定长度值(在加密的格式化的eSIM包中未包含‘FF’填充模式,以减小其大小)。在一些实施方案中,在解析之后,eSIM管理器210可以以专有方式来“个性化”eSIM内容和/或处理eSIM数据以用于安装在eUICC 108上,例如,在eSIM安装过程中在eUICC 108处使用密钥和/或秘密的方式可由eSIM管理器确定,并且不受互操作性要求的约束。
[0028]回到图3A,在步骤308中,eSIM管理器210将eSIM 208的部件安装在与eSIM 208相关联的eSIM安全域310中。eSIM管理器210可以在安装eSIM 208期间充当(移动设备102的)本地“个性化”服务器,例如,以便至少部分地实现由配置服务器140(或等效的基于网络的设备)提供的功能,从而管理移动设备102的eUICC 108上的eSIM 208。由eSIM管理器210提供的功能可以与由配置服务器140提供的远程管理命令相当,以便管理eUICC 108上的eSIM208。例如,诸如“选择路径”、“创建文件(EF/DF)”、“更新记录”、“加载安全域”、“安装安全域”、“加载应用程序”、和“安装应用程序”的命令可以由eSIM管理器210在移动设备102的eUICC 108上本地实现来管理eSIM 208。eSIM管理器210可以经由安全连接接收eSIM包,并且eSIM管理器210可以将eSIM 208安装在eUICC 108上,而不需要在安装eSIM 208期间从配置服务器140接收一系列命令。eSIM管理器210可以自主地或者与配置服务器140进行最少的通信来解密、解析、个性化、处理、加载、安装、验证和执行eSIM 208的其他管理功能。在成功安装eSIM 208时,eSIM管理器210可以通知配置服务器140。在一些实施方案中,eSIM管理器210可以重新生成与配置服务器140与“传统”eUICC OS之间的通信相当的一系列命令,以实现eSIM 208安装在eUICC 108上的过程的至少一部分。在一些实施方案中,eSIM管理器使用“新”的一系列命令来实现与通过一系列“传统”命令将eSIM 208安装在eUICC 108上所实现的结果相同的结果。在一些实施方案中,eUICC 108存储可以全部或部分执行以执行eSIM208在eUICC 108上的至少一部分安装的一组命令脚本。在一些实施方案中,在将eSIM 208安装在eUICC 108上时,eUICC以专有方式执行至少一些“个性化”功能。代表性功能可以包括一个或多个密钥和/或NAA秘密或其他安全措施的个性化。此外,用于在eUICC 108上存储eSIM 208的文件格式能够以专有方式例如基于特定于SIM卡的供应商个性化设施进行“个性化”。在一些实施方案中,用于将eSIM 208存储在eUICC平台上的安装后数据结构可以是eUICC OS特有的;然而,eSIM 208的数据可以经由诸如到UICC/eUICC接口的终端的标准接口来查看和/或管理。因此,eSIM 208可以针对每个eSIM 208以不同的方式存储,但能够以“统一”的方式经由标准接口呈现。例如,由“卡外”实体诸如由远程管理服务器和/或经由终端接口实现的eSIM管理可以符合诸如ETSI TS 103.383和/或TS 103.384之类的公共标准化管理接口。在一些实施方案中,经由接口选择eSIM 208可以根据UICC的传统接口规范来执行,诸如国际标准ISO/IEC 7816中所指定,国际标准ISO/IEC 7816是由国际标准化组织(ISO)和国际电工委员会(IEC)联合管理的标准。
[0029]图5示出了根据一些实施方案的可用于实现本文所述的各个部件的计算设备500的详细视图。具体地,该详细视图示出了图1所示移动设备102中可包括的各个部件。如图5所示,计算设备500可以包括处理器502,所述处理器表示用于控制计算设备500的整体操作的微处理器或控制器,微处理器或控制器在一些实施例中可以表示图1的主处理器104。计算设备500还可包括允许计算设备500的用户与计算设备500进行交互的用户输入设备508。例如,用户输入设备508可采取多种形式,诸如按钮、小键盘、拨号盘、触摸屏、音频输入接口、视觉/图像捕获输入接口、传感器数据形式的输入等。更进一步地,计算设备500可包括可由处理器502控制以向用户显示信息的显示器510(屏幕显示器)。数据总线516可促进至少存储设备540、处理器502和控制器513之间的数据传输。该控制器513可用于通过装置控制总线514来与不同设备进行交互并对其进行控制。该计算设备500还可以包括耦接至数据链路512的网络/总线接口511。在无线连接的情况下,网络/总线接口511可包括无线收发器。
[0030]该计算设备500还包括存储设备540,该存储设备可包括单个磁盘或多个磁盘(例如,硬盘驱动器),并包括管理存储设备540内的一个或多个分区的存储管理模块。在一些实施方案中,该存储设备540可包括闪存存储器、半导体(固态)存储器等。该计算设备500还可以包括随机存取存储器(RAM)520和只读存储器(ROM)522。该ROM 522可存储将以非易失性方式执行的程序、实用程序、或过程。RAM 520可提供易失性数据存储并存储与计算设备500的操作相关的指令。计算设备500还可以包括安全元件550,该安全元件可表示图1、图2和图3A中所示并在本文中详细描述的eUICC 108。
[0031]可单独地或以任何组合方式来使用所述实施方案的各个方面、实施方案、具体实施、或特征。可由软件、硬件、或硬件与软件的组合来实现所述实施方案的各个方面。所述实施方案还可体现为计算机可读介质上的计算机可读代码。计算机可读介质为可存储数据的任何数据存储装置,所述数据之后可由计算机系统读取。该计算机可读介质的示例包括只读存储器、随机存取存储器、CD-ROM、DVD、磁带、硬盘驱动器、固态驱动器、和光学数据存储设备。该计算机可读介质还可分布在网络耦接的计算机系统中,使得计算机可读代码以分布式方式被存储和执行。
[0032]为了进行解释,前述描述使用了特定命名以提供对所述实施方案的彻底理解。然而,对于本领域的技术人员而言将显而易见的是,实践所述实施方案不需要这些具体细节。因此,对特定实施方案的前述描述是出于例示和描述的目的而呈现的。这些描述不旨在被认为是穷举性的或将所述的实施方案限制为所公开的精确形式。对于本领域的普通技术人员而言将显而易见的是,根据上述教导内容,许多修改和变型是可能的。