Method and apparatus for managing bundles of smart secure platform

A method, performed by a user equipment (UE), of managing secondary platform bundles (SPBs), includes receiving an end user selection for managing a state of at least one SPB among SPBs installed in a smart secure platform (SSP) module; checking bundle management information required to manage the state of the at least one SPB based on the end user selection; determining whether end user intent confirmation is required to manage the state of the at least one SPB according to the end user selection based on the bundle management information; and managing the state of the at least one SPB based on a result of the determining.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based on and claims priority under 35 U.S.C. § 119 to Korean Patent Application No. 10-2018-0130250, filed on Oct. 29, 2018, in the Korean Intellectual Property Office, the disclosure of which is incorporated by reference herein in its entirety.

BACKGROUND

The disclosure relates to a method and apparatus for managing bundles of a smart secure platform (SSP) in a mobile communication system.

2. Description of Related Art

To meet the increasing demand for wireless data traffic due to the commercialization of 4thgeneration (4G) communication systems, efforts have been made to develop 5thgeneration (5G) or pre-5G communication systems. For this reason, 5G or pre-5G communication systems are called ‘beyond 4G network’ communication systems or ‘post long term evolution (post-LTE)’ systems. To achieve high data rates, implementation of 5G communication systems in an ultra-high frequency or millimeter-wave (mmWave) band (e.g., a 60-GHz band) is being considered. To reduce path loss and increase a transmission distance in the ultra-high frequency band for 5G communication systems, various technologies such as beamforming, massive multiple-input and multiple-output (massive MIMO), full-dimension MIMO (FD-MIMO), array antennas, analog beamforming, and large-scale antennas are being studied. To improve system networks for 5G communication systems, various technologies such as evolved small cells, advanced small cells, cloud radio access networks (Cloud-RAN), ultra-dense networks, device-to-device (D2D) communication, wireless backhaul, moving networks, cooperative communication, coordinated multi-points (CoMP), and interference cancellation have been developed. In addition, for 5G communication systems, advanced coding modulation (ACM) technologies such as hybrid frequency-shift keying (FSK) and quadrature amplitude modulation (QAM) (FQAM) and sliding window superposition coding (SWSC), and advanced access technologies such as filter bank multi-carrier (FBMC), non-orthogonal multiple access (NOMA), and sparse code multiple access (SCMA) have been developed.

The Internet has evolved from a human-based connection network, where humans create and consume information, to the Internet of things (IoT), where distributed elements such as objects exchange information with each other to process the information. Internet of everything (IoE) technology has emerged, in which the IoT technology is combined with, for example, technology for processing big data through connection with a cloud server. To implement the IoT, various technological elements such as sensing technology, wired/wireless communication and network infrastructures, service interface technology, and security technology are required and, in recent years, technologies related to sensor networks for connecting objects, machine-to-machine (M2M) communication, and machine-type communication (MTC) have been studied. In the IoT environment, intelligent Internet technology (IT) services may be provided to collect and analyze data obtained from connected objects to create new value in human life. As existing information technology (IT) and various industries converge and combine with each other, the IoT may be applied to various fields such as smart homes, smart buildings, smart cities, smart cars or connected cars, smart grids, health care, smart home appliances, and advanced medical services.

Various attempts are being made to apply 5G communication systems to IoT networks. For example, technologies related to sensor networks, M2M communication, and MTC are being implemented by using 5G communication technology including beamforming, MIMO, and array antennas. The application of cloud RAN as the above-described big data processing technology may be an example of convergence of 5G communication technology and IoT technology. Because various services may be provided due to the development of mobile communication systems, methods capable of effectively providing these services are required.

SUMMARY

Provided are an apparatus and method capable of effectively providing services in a mobile communication system.

According to an embodiment of the disclosure, a method, performed by a user equipment (UE), of managing secondary platform bundles (SPBs) includes receiving an end user selection for managing a state of at least one SPB among SPBs installed in a smart secure platform (SSP) module; checking bundle management information required to manage the state of the at least one SPB, based on the end user selection; determining whether end user intent confirmation is required to manage the state of the at least one SPB according to the end user selection, based on the bundle management information; and managing the state of the at least one SPB, based on a result of the determining.

The managing of the state of the at least one SPB may include checking an end user consent to manage the state of the at least one SPB, when the result of the determining indicates that the end user intent confirmation is required; and determining the state of the at least one SPB, based on a result of the checking of the end user consent.

The managing of the state of the at least one SPB may include enabling, disabling, or deleting the at least one SPB.

The managing of the state of the at least one SPB may include managing the state of the at least one SPB, based on the bundle management information when the result of the determining indicates that the end user intent confirmation is not required.

The bundle management information may be received from an external server or may be pre-stored in the at least one SPB.

The bundle management information may include an indicator indicating whether the end user intent confirmation is required, or means information for the end user intent confirmation.

The indicator may include a certain string corresponding to an enabled state, a disabled state, or a deleted state of the at least one SPB the end user intent confirmation.

The means information may include biometric information, identification information, or configuration information of an end user, and the method may further include receiving an end user input, based on the means information when the result of the determining indicates that the end user intent confirmation is required; and managing the state of the at least one SPB, based on the received end user input.

The at least one SPB may be identified by a family identifier, based on a function related to the at least one SPB.

The method may further include identifying a telecom SPB to access a mobile communication network, based on the family identifier, wherein the at least one SPB is the telecom SPB identified based on the family identifier.

According to another embodiment of the disclosure, a user equipment (UE) for managing secondary platform bundles (SPBs) includes a transceiver; a smart secure platform (SSP) module; and at least one processor connected to the transceiver and configured to: receive an end user selection for managing a state of at least one SPB among SPBs installed in the SSP module; check bundle management information required to manage the state of the at least one SPB, based on the end user selection; determine whether end user intent confirmation is required to manage the state of the at least one SPB according to the end user selection, based on the bundle management information; and manage the state of the at least one SPB, based on a result of the determining.

The at least one processor may be further configured to: check an end user consent to manage the state of the at least one SPB, when the result of the determining indicates that the end user intent confirmation is required; and determine the state of the at least one SPB, based on a result of the checking of the end user consent.

The at least one processor may be further configured to enable, disable, or delete the at least one SPB.

The at least one processor may be further configured to manage the state of the at least one SPB, based on the bundle management information when the result of the determining indicates that the end user intent confirmation is not required.

The bundle management information may be received from an external server or may be pre-stored in the at least one SPB.

The bundle management information may include an indicator indicating whether the end user intent confirmation is required, or means information for checking the end user intent confirmation.

The indicator may include a certain string corresponding to an enabled state, a disabled state, or a deleted state of the at least one SPB to check the end user intent confirmation.

The means information may include biometric information, identification information, or configuration information of an end user, and the at least one processor may be further configured to: receive an end user input, based on the means information when the result of the determining indicates that the end user intent confirmation is required; and manage the state of the at least one SPB, based on the received end user input.

The at least one SPB may be identified by a family identifier, based on a function related to the at least one SPB.

The at least one processor may be further configured to identify a telecom SPB to access a mobile communication network, based on the family identifier, and the at least one SPB may be the telecom SPB identified based on the family identifier.

DETAILED DESCRIPTION

Hereinafter, the disclosure will be described in detail by explaining embodiments of the disclosure with reference to the attached drawings.

In describing embodiments of the disclosure, technical contents that are well-known in the art and not directly related to the disclosure will not be described. By omitting unnecessary descriptions, the subject matter of the disclosure will not be obscured and may be more clearly explained.

For the same reason, some elements may be exaggerated, omitted, or schematically illustrated in the drawings. In addition, the size of each element does not completely reflect a real size thereof. In the drawings, like reference numerals denote like elements. Throughout the disclosure, the expression “at least one of a, b or c” indicates only a, only b, only c, both a and b, both a and c, both b and c, all of a, b, and c, or variations thereof. In the disclosure, a controller may also be referred to as a processor.

Throughout the specification, a layer (or a layer apparatus) may also be referred to as an entity.

One or more embodiments of the disclosure and methods of accomplishing the same may be understood more readily by reference to the following detailed description of the embodiments of the disclosure and the accompanying drawings. In this regard, the embodiments of the disclosure may have different forms and should not be construed as being limited to the descriptions set forth herein, rather, these embodiments of the disclosure are provided so that this disclosure will be thorough and complete and will fully convey the concept of the disclosure to one of ordinary skill in the art, and the disclosure will only be defined by the appended claims. Throughout the disclosure, like reference numerals denote like elements.

It will be understood that blocks in flowcharts or combinations of the flowcharts may be performed by computer program instructions. Because these computer program instructions may be loaded into a processor of a general-purpose computer, a special-purpose computer, or another programmable data processing apparatus, the instructions, which are performed by a processor of a computer or another programmable data processing apparatus, create units for performing functions described in the flowchart block(s). The computer program instructions may be stored in a computer-usable or computer-readable memory capable of directing a computer or another programmable data processing apparatus to implement a function in a particular manner, and thus the instructions stored in the computer-usable or computer-readable memory may also be capable of producing manufacturing items containing instruction units for performing the functions described in the flowchart block(s). The computer program instructions may also be loaded into a computer or another programmable data processing apparatus, and thus, instructions for operating the computer or the other programmable data processing apparatus by generating a computer-executed process when a series of operations are performed in the computer or the other programmable data processing apparatus may provide operations for performing the functions described in the flowchart block(s).

In addition, each block may represent a part of a module, segment, or code that includes one or more executable instructions for executing specified logical function(s). It should also be noted that, in some alternative implementations, functions mentioned in blocks may occur out of order. For example, two consecutive blocks may also be executed simultaneously or in reverse order depending on functions corresponding thereto.

As used herein, the term “unit” denotes a software element or a hardware element such as a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC), and performs certain functions. However, the term “unit” is not limited to software or hardware. The “unit” may be formed so as to be in an addressable storage medium, or may be formed so as to operate one or more processors. Thus, for example, the term “unit” may include elements (e.g., software elements, object-oriented software elements, class elements, and task elements), processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, micro-codes, circuits, data, a database, data structures, tables, arrays, or variables. Functions provided by the elements and “units” may be combined into the smaller number of elements and “units”, or may be divided into additional elements and “units”. Furthermore, the elements and “units” may be embodied to reproduce one or more central processing units (CPUs) in a device or security multimedia card.

Specific terms used herein are provided for a better understanding of the disclosure, and may be modified to other forms without departing from the scope of the disclosure.

A secure element (SE) refers to a single-chip security module storing security information (e.g., a mobile communication network access key, user identification information such as an identification or a passport, credit card information, or an encryption key) and including and capable of operating a control module using the stored security information (e.g., a network access control module such as a universal subscriber identity module (USIM), an encryption module, or a key generation module). The SE may be used for various electronic devices (e.g., smartphones, tablets, wearable devices, automobiles, and Internet of things (IoT) devices) to provide a security service (e.g., mobile communication network access, payment, or user authentication) via the control module by using the security information.

The SE may be divided into, for example, a universal integrated circuit card (UICC), an embedded secure element (eSE), and a smart secure platform (SSP) in which the UICC is integrated with the eSE, and be subdivided, based on a method for connection to or installation in an electronic device, into a removable SE, an embedded SE, and an integrated SE integrated into a specific device or system-on-chip (SoC).

The UICC is a smart card inserted into, for example, a mobile communication device and is also called a UICC card. The UICC may include an access control module for accessing a network of a mobile operator. Examples of the access control module include a universal subscriber identity module (USIM), a subscriber identity module (SIM), and an Internet protocol (IP) multimedia service identity module (ISIM). A UICC including the USIM is generally called a USIM card. Likewise, a UICC including the SIM module is generally called a SIM card. The SIM module may be installed when the UICC is manufactured, or a user may download a SIM module of a desired mobile communication service in the UICC card at a desired timing. A plurality of SIM modules may be downloaded and installed in the UICC card, and at least one of the SIM modules may be selected and used. The UICC card may be embedded or not embedded in a user equipment. A UICC embedded in the user equipment is called an embedded UICC (eUICC) and, particularly, a UICC integrated into an SoC including a communication processor or an application processor of the user equipment, or a single processor structure in which the two processors are integrated is called an integrated UICC (iUICC). In general, the eUICC or the iUICC may refer to a UICC card embedded in the user equipment and capable of remotely downloading and selecting a SIM module. As used herein, a UICC card capable of remotely downloading and selecting a SIM module is called an eUICC or iUICC. That is, a UICC card capable of remotely downloading and selecting a SIM module and embedded or not embedded in a user equipment is called an eUICC or iUICC. The downloaded SIM module information is called an eUICC or iUICC profile, or more simply, a profile.

The eSE refers to an embedded SE embedded in an electronic device. In general, the eSE may be produced exclusively for a user equipment manufacturer based on a request thereof, and include an operating system and a framework. The eSE may remotely download and install an applet-type service control module therein and be used for various security services, e.g., an e-wallet, ticketing, an e-passport, and a digital key. As used herein, a single-chip SE attached to an electronic device to remotely download and install a service control module therein is called an eSE.

The SSP may integrally support UICC and eSE functions in a single chip, and be divided into a removable SSP (rSSP), an embedded SSP (eSSP), and an integrated SSP (iSSP) integrated into a SoC. The SSP may include one primary platform (PP) and one or more secondary platform bundles (SPBs) operating on the PP, and the PP may include at least one of a hardware platform or a low-level operating system (LLOS) and each SPB may include at least one of a high-level operating system (HLOS) or applications driven on the HLOS. The SPB may be simply called a bundle. The bundle may access resources, e.g., a central processing unit (CPU) or a memory, of the PP via a primary platform interface (PPI) provided by the PP, and thus be driven on the PP. The bundle may include a communication application such as a SIM, USIM, or ISIM, and also include various applications such as an e-wallet, ticketing, an e-passport, and a digital key. As used herein, the SSP may also be called a smart secure medium.

The SSP may be used as the above-described UICC or eSE based on a remotely downloaded and installed bundle, or include UICC and eSE functions by installing and simultaneously operating a plurality of bundles in a single SSP. That is, when a bundle including a profile operates, the SSP may be used as the UICC to access a network of a mobile operator. Such a UICC bundle may operate by remotely downloading and selecting at least one profile like the eUICC or iUICC. When a bundle including a service control module including an application capable of providing a service such as an e-wallet, ticketing, an e-passport, or a digital key operates on the SSP, the SSP may be used as the eSE. A plurality of service control modules may be integrally installed and operated in one bundle, or be installed and operated in independent bundles.

As used herein, the SSP is a chip-type security module capable of integrally supporting UICC and eSE functions in a single chip and dividable into an rSSP, an eSSP, and an iSSP integrated into a SoC. The SSP may download and install the bundle from an external bundle management server (e.g., an SPB manager (SPBM)) by using over the air (OTA) technology.

The method of downloading and installing the bundle in the SSP by using OTA technology may be equally applied to an rSSP attachable to and detachable from a device, an eSSP installed in a user equipment, and an iSSP included in a SoC installed in a device.

As used herein, the term “UICC” may be used interchangeably with the term “SIM”, and the term “eUICC may be used interchangeably with the term “eSIM”.

As used herein, an SPB may be a bundle driven on a PP of an SSP by using resources of the PP and, for example, a UICC bundle may refer to a software-type package of an application, a file system, an authentication key value, etc., which are generally stored in a UICC, and a HLOS for operating the same.

As used herein, a USIM profile may refer to a profile, or a software-type package of information included in a USIM application in the profile.

As used herein, an operation of enabling a bundle by a user equipment or an external server may refer to an operation of changing a corresponding profile to an enabled state in such a manner that the device may receive a service provided by the bundle (e.g., a communication service, a credit card payment service, or a user authentication service via a mobile operator). When enabled, the bundle may be expressed as an “enabled bundle”. An enabled bundle may be encrypted and stored in the SSP or in an external storage space.

The enabled bundle may be changed to an active state based on an input from outside the bundle (e.g., a user input, a push, a request of an application in the user equipment, an authentication request of the mobile operator, or a PP management message) or an operation in the bundle (e.g., a timer or polling). The active bundle may mean that the bundle is loaded from inside the SSP or from the external storage space to a driving memory in the SSP, security information is processed using a secure CPU in the SSP, and a security service is provided to the user equipment.

As used herein, an operation of disabling a bundle by a user equipment or an external server may refer to an operation of changing the bundle to a disabled state in such a manner that the device may not receive a service provided by the bundle. When disabled, a corresponding profile may be expressed as a “disabled bundle”. An enabled bundle may be encrypted and stored in the SSP or in an external storage space.

As used herein, an operation of deleting a bundle by a user equipment or an external server may refer to an operation of changing the bundle to a deleted state in such a manner that the device or the external server may no longer enable or disable the bundle. When deleted, the bundle may be expressed as a “deleted bundle”.

As used herein, a bundle management server may have a function of generating a bundle based on a request of a service provider or another bundle management server, encrypting the generated bundle, generating a bundle remote management command, or encrypting the generated bundle remote management command. The bundle management server providing the above-described function may be expressed as at least one of a SPB manager (SPBM), a remote bundle manager (RBM), an image delivery server (IDS), a subscription manager data preparation (SM-DP), an SM-DP plus (SM-DP+), a manager bundle server, a managing SM-DP+, a bundle encryption server, a bundle generation server, a bundle provisioner (BP), a bundle provider, or a bundle provisioning credential (BPC) holder.

As used herein, a bundle management server may function to download, install, or update a bundle in an SSP and manage a key and a certificate for remotely managing the state of the bundle. The bundle management server providing the above-described function may be expressed as at least one of an SPBM, an RBM, an IDS, a subscription manager secure routing (SM-SR), an SM-SR plus (SM-SR+), an off-card entity of an eUICC profile manager, a profile management credential (PMC) holder, or an eUICC manager (EM).

As used herein, a mediation server may be expressed as at least one of an SPBM, an RBM, an SPB discovery sever (SPBDS), a bundle discovery sever (BDS), a subscription manager discovery service (SM-DS), a discovery service (DS), a root SM-DS, or an alternative SM-DS. The mediation server may receive an event register request from one or more bundle management servers or mediation servers. One or more mediation servers may be used in combination and, in this case, a first mediation server may receive an event register request not only from a bundle management server but also from a second mediation server. The function of the mediation server may be integrated with that of the bundle management server.

As used herein, the bundle management server may collectively refer to a function of generating, encrypting, and transmitting a bundle or a bundle remote management command, and a function of configuring an SSP and managing an installed bundle. The bundle management server may also function as the mediation server. Therefore, in various embodiments of the disclosure described below, operations of the bundle management server and the mediation server may be performed by one bundle management server. Alternatively, the functions may be performed by a plurality of separate bundle management servers. In the following description, the bundle management server or the mediation server may be expressed as a bundle server. The bundle server may be one of the bundle management server and the mediation server, or include both of the bundle management server and the mediation server.

As used herein, the bundle management server and the mediation server may be called an SPBM or an RBM. The bundle server may also be called the bundle management server.

As used herein, the term “user equipment” may refer to a mobile station (MS), a user equipment (UE), a user terminal (UT), a wireless terminal, an access terminal (AT), a terminal, a subscriber unit, a subscriber station (SS), a wireless device, a wireless communication device, a wireless transmit/receive unit (WTRU), a mobile node, or a mobile device, and the device may also be called other names. Various examples of the user equipment include cellular phones, smartphones having a wireless communication function, personal digital assistants (PDAs) having a wireless communication function, wireless modems, portable computers having a wireless communication function, photographing devices, e.g., digital cameras, having a wireless communication function, gaming devices having a wireless communication function, music-recordable and -reproducible home appliances having a wireless communication function, Internet home appliances capable of wireless Internet access and browsing, and portable units or devices having a combination of functions of the above-mentioned devices. The user equipment may include a machine to machine (M2M) device or a machine type communication (MTC) device, but is not limited thereto. As used herein, the user equipment may also be called an electronic device.

An SSP capable of downloading and installing a bundle may be integrated into the electronic device. When the SSP is not integrated into the electronic device, an SSP physically separate from the electronic device may be inserted into and connected to the electronic device. For example, the SSP may be inserted into the electronic device in the form of a card. For example, the electronic device may include a user equipment and, in this case, the user equipment may be a device including an SSP capable of downloading and installing a bundle. The SSP may be integrated into the user equipment but, when the SSP is separate from the user equipment, the SSP may be inserted into and connected to the user equipment.

The user equipment or the electronic device may include software or an application installed in the user equipment or the electronic device to control the SSP. The software or the application may also be called, for example, a local bundle assistant (LBA) or a local bundle manager (LBM).

As used herein, a bundle identifier may include a bundle ID (or SPB ID), a bundle family ID (or SPB family ID), a bundle matching ID, or an event ID. The bundle ID (or SPB ID) may refer to a unique identifier of each bundle. The bundle family ID may refer to an identifier for identifying the type of a bundle (e.g., a telecom bundle for accessing a mobile operator network). The bundle identifier may be used as a bundle index value by a bundle management server. As used herein, an SSP ID may be a unique identifier of an SSP integrated into a user equipment, and may also be called an SSPID. As in an embodiment of the disclosure, when an SSP chip is not separate from a user equipment, the SSP ID may serve as a user equipment ID. The SSP ID may refer to a specific bundle ID (or SPB ID) in the SSP. In more detail, the SSP ID may refer to a bundle ID of a management bundle or a loader (or SPB loader (SPBL)) for installing and managing enabling, disabling, and deletion of another bundle in an SSP. The SSP may have a plurality of SSP IDs, and the plurality of SSP IDs may be values derived from a single unique SSP ID.

As used herein, a loader (or SPBL) may refer to a management bundle for installing and managing enabling, disabling, and deletion of another bundle in an SSP. An LBA of a user equipment or a remote server may install, enable, disable, or delete a specific bundle via the loader. The loader may also be called an SSP. The loader may also be called an LBA.

As used herein, a bundle provisioning credential (BPC) may be a means used for mutual authentication between a bundle management server and an SSP, bundle encryption, and signature. The BPC may include at least one of a symmetric key, a Rivest-Shamir-Adleman (RSA) certificate and a private key, an elliptic curve cryptography (ECC) certificate and a private key, or a root certification authority (CA) and a certificate chain. When a plurality of profile management servers are present, different BPCs for the plurality of profile management servers may be stored in the SSP or be used.

As used herein, a profile management credential (PMC) may be a means used for mutual authentication between a profile management server and an eUICC, transmit data encryption, and signature. The PMC may include at least one of a symmetric key, an RSA certificate and a private key, an ECC certificate and a private key, or a root CA and a certificate chain. When a plurality of profile management servers are present, different PMCs for the plurality of profile management servers may be stored in the eUICC or be used.

As used herein, an event may be a term collectively indicating bundle download, remote bundle management, and another bundle or SSP management/processing command. The event may also be called a remote bundle provisioning (RBP) operation or an event record, and each event may be indicated by an event ID (or EventID), a matching ID (or MatchingID), or data including at least one of an address (e.g., a fully qualified domain name (FQDN), an IP address, or a uniform resource locator (URL)) of a bundle management server or a mediation server having the event stored therein, or an ID of each server. Bundle download may be used interchangeably with bundle installation. An event type may be used as a term indicating whether a specific event corresponds to bundle download, remote bundle management (e.g., delete, enable, disable, replace, or update), or another bundle or SSP management/processing command, and may also be called, for example, an operation type (or OperationType), an operation class (or OperationClass), an event request type, an event class, or an event request class.

As used herein, a bundle image (or an image) may be used interchangeably with a bundle or used as a term indicating a data object of a specific bundle, and may also be called a bundle tag-length-value (TLV) or a bundle image TLV. When the bundle image is encrypted using an encryption parameter, the bundle image may be called a protected bundle image (PBI)) or a PBI TLV. When the bundle image is encrypted using an encryption parameter decryptable only by a specific SSP, the bundle image may be called a bound bundle image (BBI) or a BBI TLV. The bundle image TLV may be a data set for expressing profile information in a tag-length-value (TLV) format.

As used herein, local bundle management (LBM) may also be called bundle local management, local management, a local management command, a local command, an LBM package, a bundle local management package, a local management package, a local management command package, or a local command package. LBM may be used to install an arbitrary bundle, change the state (e.g., enabled, disabled, or deleted) of a specific bundle, or update the content of a specific bundle (e.g., a bundle nickname or bundle metadata) via, for example, software installed in a user equipment. LBM may include one or more local management commands and, in this case, the local management commands may be directed to the same or different bundles.

As used herein, remote bundle management (RBM) may also be called bundle remote management, remote management, a remote management command, a remote command, an RBM package, a bundle remote management package, a remote management package, a remote management command package, or a remote command package. RBM may be used to install an arbitrary bundle, change the state (e.g., enabled, disabled, or deleted) of a specific bundle, or update the content of a specific bundle (e.g., a bundle nickname or bundle metadata). RBM may include one or more remote management commands and the remote management commands may be directed to the same or different bundles.

As used herein, a target bundle may be used as a term indicating a bundle to which a local or remote management command is directed.

As used herein, bundle rules may be used as a term indicating information required to be checked by a user equipment to locally or remotely manage a target bundle. The bundle rules may be used interchangeably with a term such as bundle policies, rules, or policies.

As used herein, a subscriber may be used as a term indicating a service provider who owns a user equipment, or an end user who owns a user equipment. In general, the former may be called an M2M device, and the latter may be called a consumer device. The M2M device may refer to a user equipment not owned by an end user but rented or leased by the end user from a service provider and, in this case, the end user may be different from or the same as the service provider.

As used herein, a subscriber intent may be used as a term collectively indicating intents of a subscriber to locally and remotely manage a bundle. For local management, the subscriber intent may be used as a term indicating an end user intent and, for remote management, the subscriber intent may be used as a term indicating a service provider intent.

As used herein, an end user consent may be used as a term indicating whether an end user accepts local or remote management.

As used herein, a certificate or a digital certificate may refer to a digital certificate used for mutual authentication based on an asymmetric key including a pair of a public key (PK) and a secret key (SK). Each certificate may include one or more PKs, a PK identifier (PKID) corresponding to each PK, and an ID and a digital signature of a certificate issuer (CI) who has issued the certificate. The CI may also be called a certification issuer, a certificate authority (CA), or a certification authority. As used herein, a PK and a PKID may be used interchangeably with a specific PK or a certificate including the PK, a part of a specific PK or a part of a certificate including the PK, an operation result value (e.g., a hash value) of a specific PK or an operation result value (e.g., a hash value) of a certificate including the PK, an operation result value (e.g., a hash value) of a part of a specific PK or an operation result value (e.g., a hash value) of a part of a certificate including the PK, or a storage space in which data is stored.

When certificates (primary certificates) issued by one CI are used to issue other certificates (secondary certificates) or the secondary certificates are used to hierarchically issue tertiary or further certificates, correlations among the certificates may be called a certificate chain or a certificate hierarchy and, in this case, a CI certificate initially used to issue the certificates may be called, for example, a root of certificate, a root certificate, a root CI, root CI certificate, a root CA, or a root CA certificate.

As used herein, a service provider may refer to a company for requesting a bundle management server to generate a bundle, and providing a service via the bundle to a user equipment. For example, the service provider may refer to a mobile operator for providing a network access service via a bundle including a communication application, and collectively indicate a business supporting system (BSS), an operational supporting system (OSS), a point of sale (POS) terminal, and other information technology (IT) systems of the mobile operator. The service provider is not limited to representing one specific company and may be used as a term indicating an association or consortium of one or more companies or a representative of the association or consortium. The service provider may also be called, for example, an operator (or OP or Op.), a bundle owner (BO), or an image owner (IO), and each service provider may configure or receive allocation of at least one name and/or object identifier (OID). When the service provider indicates an association, consortium, or representative of one or more companies, a name or OID of an arbitrary association, consortium, or representative may be a name or OID shared by all companies belonging to the association or consortium or all companies cooperating with the representative.

As used herein, authentication and key agreement (AKA) may refer to an authentication algorithm for accessing 3GPP and 3GPP2 networks.

As used herein, K (or a value K) may be an encryption key value stored in an eUICC used for an AKA authentication algorithm.

As used herein, OPc may be a parameter value stored in an eUICC used for an AKA authentication algorithm.

As used herein, a network access application (NAA) may be an application program stored in a UICC to access a network, e.g., USIM or ISIM. The NAA may also be a network access module.

As used herein, a telecom bundle may be a bundle including at least one NAA or having a function of remotely downloading and installing at least one NAA. The telecom bundle may include a telecom bundle ID indicating the telecom bundle.

In the following description of the disclosure, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the disclosure unclear.

A method and apparatus for installing and managing bundles online via a remote server, according to various embodiments of the disclosure, will now be described.

According to embodiments of the disclosure, an apparatus and method capable of remotely installing a control module in a security module installed in an electronic device, and providing a security service (e.g., mobile communication network access, payment, user authentication, or a digital key) via the control module by using the security information stored in the security module.

FIG. 1is a schematic diagram illustrating a mobile communication network connection method of a user equipment using an SSP120having installed therein a telecom bundle including a profile, and operations of various types of bundles, according to an embodiment of the disclosure.

As illustrated inFIG. 1, the SSP120may be integrated into an SoC130of a user equipment110. In this case, the SoC130may be a communication processor, an application processor, or a processor in which the two processors are integrated. The SSP120may be replaced by an rSSP122provided as an independent chip not integrated into the SoC130, or an eSSP124previously embedded in the user equipment110.

A bundle including a profile means that it includes ‘access information’ usable to access a specific mobile operator. For example, the access information may include a subscriber identifier such as an international mobile subscriber identity (IMSI), and a value K or Ki required together with the subscriber identifier for network authentication.

The user equipment110may perform authentication with an authentication system (e.g., a home location register (HLR)) of a mobile operator or an authentication center (AuC) by using at least one of telecom bundles140and150installed in the SSP120. For example, the authentication process may be an AKA process. When successfully authenticated, the user equipment110may use a mobile communication service, e.g., phone calling or use of mobile data, by using a mobile operator network160of a mobile communication system. The telecom bundles140and150may store different pieces of authentication information, and the user equipment110may use a mobile communication network by operating the two bundles simultaneously or in a time-division manner based on a configuration.

The user equipment110may use an online payment service via an application of the user equipment110or an offline payment service via an external credit card POS device by using a payment bundle170installed in the SSP120, and use an authentication service to authenticate an identity of an owner of the user equipment110by using an e-ID bundle180.

FIG. 2is a conceptual diagram illustrating the internal structure of an SSP210according to an embodiment of the disclosure. The SSP210may correspond to the SSP120ofFIG. 1, and thus a repeated description therebetween will not be provided herein.

InFIG. 2, the SSP210may include one PP220and one or more SPBs230and240operating on the PP220. The PP220may include hardware (not shown) and at least one LLOS222. The SPB230may include an HLOS232and one or more applications234operating on the HLOS232. Each of the SPBs230and240may access resources, e.g., a CPU or a memory, of the PP220by using a PPI250, and thus be driven in the SSP210.

FIG. 3is a schematic diagram illustrating an example of a certificate hierarchy (or a certificate chain) of certificates issued by a CI, and an example of a PK and a CI digital signature included in each certificate, according to an embodiment of the disclosure.

Referring toFIG. 3, the CI may generate a CI PK313and a CI SK to be used by the CI, generate a CI certificate311including the CI PK313, and attach, to the CI certificate311, a digital signature generated using the CI SK, i.e., a CI signature315.

Referring toFIG. 3, the CI certificate311may be used to issue (see reference numeral391) an object1certificate331. Object1may be, for example, an SPBM. Object1may generate an object1PK333and an object1SK to be used by object1, generate the object1certificate331including the object1PK333, and request and receive a CI digital signature335from the CI by using the CI SK. In this case, the object1certificate331may include a CI identifier337corresponding to the CI PK313required to be used to verify the CI signature335included in the object1certificate331. The CI identifier337may include at least one of a CI PKID, a CI ID, a CI object ID, or an object universally unique identifier (UUID).

Referring toFIG. 3, the CI certificate311may be used to issue (see reference numeral393) an object2certificate351. Object2may be, for example, an SSP maker. Object2may generate an object2PK353and an object2SK to be used by object2, generate the object2certificate351including the object2PK353, and request and receive a CI digital signature355from the CI by using the CI SK. In this case, the object2certificate351may include the CI identifier337corresponding to the CI PK313required to be used to verify the CI signature355included in the object2certificate351. The CI identifier337may include at least one of a CI PKID, a CI ID, a CI object ID, or an object UUID. The CI signatures335and355included in the object1certificate331and the object2certificate351may have different values, but the CI PKID337has the same value.

Referring toFIG. 3, the object2certificate351may be used to issue (see reference numeral395) an object3certificate371. Object3may be, for example, an SSP produced by an SSP maker, or an SPBL included in the SSP. Object3may generate an object3PK373and an object3SK to be used by object3, generate the object3certificate371including the object3PK373, and request and receive an object3digital signature375from object2by using the object2SK, i.e., the CI SK. In this case, the object3certificate371may include an issuer identifier377corresponding to the object2PK353required to be used to verify the object3signature375included in the object3certificate371. The issuer identifier377may include at least one of an issuer PKID, an object ID, or an object UUID.

The object1certificate331, the object2certificate351, and the object3certificate371illustrated inFIG. 3may have the same CI certificate311as a root certificate or a root of certificate. Therefore, for mutual authentication, object1, object2, and object3may require the CI certificate311or the CI PK313included therein. More specifically, in the example of FIG.3, for mutual authentication between object1and object2using digital certificates and signatures, object1may require the signature355of object2, the object2certificate351, and the CI PK313, and object2may require the signature335of object1, the object1certificate331, and the CI PK313. In the example ofFIG. 3, for mutual authentication between object1and object3using digital certificates and signatures, object1may require the signature375of object3, the object3certificate371, the object2certificate351, and the CI PK313, and object3may require the signature335of object1, the object1certificate331, and the CI PK313. In this case, with respect to the object3certificate371, the object2certificate351may be called a sub CI or sub CA certificate.

FIG. 4is a schematic diagram illustrating an example of elements inside and outside a user equipment410to download and install bundles in an SSP430, according to an embodiment of the disclosure.

InFIG. 4, the user equipment410may be a device including the SSP430and having an LBA412installed therein to control the SSP430. The SSP430may be integrated into or removable from the user equipment410. The SSP430may include a PP431, an SPBL433, and one or more SPBs435,437, and439. The SPBs435,437, and439may not have been installed in the SSP430at a timing of release of the user equipment410, but may be remotely downloaded and installed after release.

Referring toFIG. 4, the SPBs435,437, and439may have different bundle family IDs441and442. The SSP430or the SPBL433may generate and manage certificate information to be used to download and install the SPBs435,437, and439for which the different bundle family IDs441and442are allocated. In this case, the certificate information separately managed based on the bundle family IDs441and442may be present on a certificate hierarchy of certificates issued by different CIs. When a bundle is downloaded and installed from a bundle management server451or453, the SSP430or the SPBL433may select certificate information configured for the bundle family ID441or442allocated to the bundle, and transmit the information to the bundle management server451or453. The certificate information471,473may be a certificate or a PK of a CI in the certificate hierarchy, and be an identifier corresponding to the certificate and the PK (e.g., a CI ID, a CI object ID, an object UUID, or a CI PKID). The bundle management server451can receive a bundle from a service provider461. The bundle management server453can receive a bundle from a service provider463.

FIG. 5is a schematic diagram illustrating an example of a general procedure in which a subscriber530subscribes to a service via a service provider540and prepares a bundle in a bundle management server550, according to an embodiment of the disclosure.

InFIG. 5, a user equipment500may be a device including an SSP510and having an LBA520installed therein to control the SSP510. Although not shown inFIG. 5, a bundle requested by the service provider540may have been generated by and stored in the bundle management server550, and the service provider540may have at least one of a bundle ID (or SPB ID) of the generated bundle, a bundle family ID (or SPB family ID) of the generated bundle, or an address (or SPBM address) of the bundle management server550.

Referring toFIG. 5, in operation5001, the subscriber530may select and subscribe to a service provided by the service provider540(e.g., a data service through a mobile communication network). In this case, to use the service provided by the service provider540, the subscriber530may optionally transmit, to the service provider540, an SSP ID of the SSP510of the user equipment500in which a bundle is to be installed. In operation5003, the service provider540and the bundle management server550may perform a bundle download preparation procedure. In operation5003, the service provider540may optionally transmit, to the bundle management server550, the SSP ID of the SSP510in which a bundle is to be installed, and transmit, to the bundle management server550, at least one of a bundle ID (or SPB ID) or a bundle family ID (or SPB family ID) of a specific bundle capable of providing the service selected by the subscriber530from among bundles prepared in the bundle management server550. In operation5003, the bundle management server550may select a bundle having the received bundle ID or one of bundles having the received bundle family ID, and transmit an identifier of the selected bundle to the service provider540. The service provider540or the bundle management server550may newly generate a bundle matching ID capable of identifying the selected bundle. The bundle management server550may connect and manage the received SSP ID and the selected bundle. In operation5003, the bundle management server550may transmit an SPBM address from which the selected bundle may be downloaded and, in this case, the SPBM address may be an address of the bundle management server550or another bundle management server in which the prepared bundle is stored, or an address of another bundle management server capable of storing and obtaining download information (e.g., a server address) of the prepared bundle.

Referring toFIG. 5, in operation5005, the service provider540may transmit prepared bundle download information to the subscriber530. The bundle download information may optionally transmit at least one of the SPBM address at which the bundle is prepared, the bundle matching ID of the prepared bundle, or the bundle family ID (or SPB family ID) of the prepared bundle.

Referring toFIG. 5, in operation5006, the bundle download information may be transmitted to the LBA520. The bundle download information may be at least one of the SPBM address to be accessed by the LBA520, a bundle identifier of the bundle prepared in operation5003, or a bundle family ID (or SPB family ID) of the prepared bundle. The bundle identifier may include at least one of the bundle matching ID generated in operation5003, or a bundle event ID. The bundle identifier may include the bundle family ID of the prepared bundle. The bundle event ID may include at least one of the bundle matching ID of the bundle prepared in operation5003, or the SPBM address. The bundle download information may be input (e.g., as a scanned QR code or a direct text input) by the subscriber530to the LBA520. The bundle download information may be input by the subscriber530or the service provider540via an information providing server (not shown) to the LBA520by using a push input. The LBA520may receive the bundle download information by accessing an information providing server (not shown) previously configured for the user equipment500.

FIG. 6is a schematic diagram illustrating the configuration of a user equipment600and an example of a cooperation method between a service provider630, a bundle management server640, and an end user650, according to an embodiment of the disclosure.

Referring toFIG. 6, the user equipment600may include at least one LBA610and at least one SSP620.

As in operations6001and6003, the end user650may give a command to the SSP620via the LBA610in the user equipment600. Alternatively, the LBA610may directly give a command to the SSP620without an input of the end user650based on operation6003. As used herein, the above-described bundle management operation6001or6003by the end user650or the user equipment600may be called local management.

In operation6005, the service provider630may request the bundle management server640to remotely manage a bundle. In operation6007, the bundle management server640may give a remote management command via the LBA610to the SSP620. As used herein, the above-described bundle management operation6005or6007by the service provider630may be called remote management.

In operation6009, the SSP620may check bundle policies to process the received local or remote management command. The LBA610or the bundle management server640may also check the bundle policies. The method of checking the bundle policies will be described in detail below.

FIG. 7is a schematic diagram illustrating an example of a general procedure in which a user equipment700performs bundle local management, according to an embodiment of the disclosure.

InFIG. 7, descriptions of the user equipment700, an LBA710, an SSP720, a service provider730, a bundle management server740, and an end user750, which are provided above in relation toFIGS. 1 to 6, will not be repeated herein.

Referring toFIG. 7, in operation7001, the end user750may express, to the LBA710, an end user intent to start specific local management. Operation7001may use a general user interface used for interaction between an end user and a user equipment. For example, the end user750may input specific data (e.g., a scanned QR code) to the LBA710or select a specific menu of the LBA710. When the user equipment700performs a local management operation not requiring the end user intent based on bundle policies, operation7001may be omitted.

In operation7003, the LBA710may transmit a local management request to the SSP720. When a local management operation requiring the end user intent based on the bundle policies is performed, operation7003may reflect the end user intent of operation7001. When a local management operation not requiring the end user intent based on the bundle policies is performed, the LBA710may directly perform operation7003without performing operation7001.

In operation7005, the SSP720may check bundle policies of a target bundle to perform local management. In operation7005, the LBA710and/or the bundle management server740may also check the bundle policies. For example, for a local management operation for installing a bundle, the SSP720may receive, via the LBA710from the bundle management server740, bundle metadata and/or a part of bundle policies of a bundle to be installed. As another example, in addition to bundle policies stored in the SSP720, the SSP720may receive the entirety or a part of the bundle policies from the LBA710. The operation of checking the bundle policies by the SSP720will be described in detail below. When the LBA710autonomously performs local management without the end user intent, and when the result of checking the bundle policies indicates that the local management requires the end user intent, the SSP720may terminate the local management by performing operation7015. When local management is performed on a bundle for which local management is not allowed based on the bundle policies, the SSP720may terminate the local management by performing operation7015.

When the result of checking the bundle policies indicates that an end user intent confirmation is further required for the local management, in operation7007, the SSP720may transmit an end user intent confirmation request to the LBA710. In operation7009, the LBA710may check the end user intent confirmation of the end user750. Operation7009may be performed, for example, by outputting a screen for simply selecting “Yes/No”, by receiving a personal identification number (PIN) (or PIN code) preset by the end user750or the service provider730, by receiving biometric information (e.g., fingerprint or iris information) of the end user750, or by using various other means provided by the user equipment700. The means used to check the end user intent confirmation in operation7009may be configured in the bundle policies. In operation7011, the LBA710may transmit, to the SSP720, the result of checking the end user intent confirmation (e.g., accept or reject). When the end user intent confirmation is not required for the local management based on the bundle policies, operations7007to7011may be omitted. When the result of checking the end user intent confirmation indicates that the end user750rejects the local management or does not respond within a certain time, the SSP720may terminate the local management by performing operation7015. When the end user intent confirmation is not required or the result of checking the end user intent confirmation indicates that the end user750accepts the local management, the SSP720may perform operation7013.

In operation7013, the SSP720may perform the local management. Operation7013may also be performed by the LBA710and/or the bundle management server740. For example, for a local management operation for installing a bundle, the SSP720may receive and install a bundle via the LBA710from the bundle management server740.

In operation7015, the SSP720may notify the LBA710of the result of performing the local management (e.g., success or failure).

In operation7017, the LBA710may notify the end user750of the result of performing the local management (e.g., success or failure). When the result of performing the local management is not required to be notified to the end user750, operation7017may be omitted.

Referring toFIG. 7, when the bundle local management is performed, the user equipment700may determine whether the end user intent and the end user intent confirmation are required based on the bundle policies, and accept/execute or reject a local management command based on the determination result.

FIG. 8is a schematic diagram illustrating an example of a general procedure in which a user equipment800performs bundle remote management, according to an embodiment of the disclosure.

InFIG. 8, descriptions of the user equipment800, an LBA810, an SSP820, a service provider830, a bundle management server840, and an end user850, which are provided above in relation toFIGS. 1 to 6, will not be repeated herein.

Referring toFIG. 8, in operation8001, the service provider830may transmit a bundle remote management request to the bundle management server840.

In operation8003, the bundle management server840may transmit a specific bundle remote management request via the LBA810to the SSP820. The bundle remote management request may further include a bundle remote management command and the entirety or a part of information required to perform bundle remote management (e.g., an ID or a family ID of a target bundle to be remotely managed, and a remote management command type such as enable/disable/delete). The bundle remote management command and the entirety or the part of the information required to perform bundle remote management may be transmitted in operation8003or in operation8015.

In operation8005, the SSP820may check bundle policies of the target bundle to perform remote management. In operation8005, the LBA810and/or the bundle management server840may also check the bundle policies. For example, for a remote management operation for installing a bundle, the SSP820may receive, via the LBA810from the bundle management server840, bundle metadata and/or a part of bundle policies of a bundle to be installed. As another example, in addition to bundle policies stored in the SSP820, the SSP820may receive the entirety or a part of the bundle policies from the LBA810or the bundle management server840. The operation of checking the bundle policies by the SSP820will be described in detail below. When remote management is performed on a bundle for which remote management is not allowed based on the bundle policies, the SSP820may terminate the remote management by performing operation8017.

When the result of checking the bundle policies indicates that a subscriber intent verification is required for the remote management, in operation8007, the SSP820may verify a subscriber intent. Operation8007may also be performed by the user equipment800, the service provider830, and/or the bundle management server840. Operation8007may be performed, for example, by verifying a digital signature and certificate of the service provider830for arbitrary data (e.g., the remote management request message of operation8001or an arbitrary character string generated by the bundle management server840or the SSP820), by verifying a credential key previously provided from the service provider830to a bundle installed in the bundle management server840, the LBA810, the SSP820, and/or the user equipment800, or by using various other means provided by the user equipment800, the bundle management server840, and the service provider830. The means used to verify the subscriber intent in operation8007may be configured in the bundle policies or, when not configured in the bundle policies, an arbitrary means accepted/selected by the user equipment800, the bundle management server840, or the service provider830may be used. When the result of checking the bundle policies indicates that the subscriber intent verification is not required for the remote management, operation8007may be omitted. When the subscriber intent verification fails, the SSP820may terminate the remote management by performing operation8017. When the subscriber intent verification is not required or the subscriber intent verification succeeds, the SSP820may perform operation8009. Although operation8007is performed before operation8009or8013inFIG. 8, it should be noted that operation8007may be performed after operation8009or8013based on implementation. Operation8007may be performed integrally with operation8003,8005, or8015. For example, when a digital signature of the service provider830needs to be verified to verify the subscriber intent in operation8007, operation8007may be substituted by the checking of the bundle policies in operation8005, the transmitting of the bundle remote management request in operation8003, or checking of a digital signature generated for the bundle remote management command by the service provider830in operation8015.

When the result of checking the bundle policies indicates that an end user consent is further required for the remote management, in operation8009, the SSP820may transmit an end user consent request to the LBA810. In operation8011, the LBA810may check the end user consent of the end user850. Operation8011may be performed, for example, by outputting a screen for simply selecting “Yes/No”, by receiving a PIN (or PIN code) preset by the end user850or the service provider830, by receiving biometric information (e.g., fingerprint or iris information) of the end user850, or by using various other means provided by the user equipment800. The means used to check the end user consent in operation8011may be configured in the bundle policies or, when not configured in the bundle policies, an arbitrary means accepted/selected by the user equipment800, the bundle management server840, or the service provider830may be used. In operation8013, the LBA810may transmit, to the SSP820, the result of checking the end user consent (e.g., accept or reject). When the end user consent is not required for the remote management based on the bundle policies, operations8009to8013may be omitted. When the result of checking the end user consent indicates that the end user850rejects the remote management or does not respond within a certain time, the SSP820may terminate the remote management by performing operation8017. When the end user consent is not required or the result of checking the end user consent indicates that the end user850accepts the remote management, the SSP820may perform operation8015.

In operation8015, the SSP820may perform the remote management. Operation8015may also be performed by the LBA810and/or the bundle management server840. For example, for a remote management operation for installing a bundle, the SSP820may receive and install a bundle via the LBA810from the bundle management server840.

In operation8017, the SSP820may notify the LBA810of the result of performing the remote management (e.g., success or failure).

In operation8019, the LBA810may notify the end user850of the result of performing the remote management (e.g., success or failure). When the result of performing the remote management is not required to be notified to the end user850, operation8019may be omitted.

In operation8021, the LBA810may notify the bundle management server840of the result of performing the remote management (e.g., success or failure).

In operation8023, the bundle management server840may notify the service provider830of the result of performing the remote management (e.g., success or failure).

Referring toFIG. 8, when the bundle remote management is performed, the user equipment800may determine whether the subscriber intent verification and the end user consent are required based on the bundle policies, and accept/execute or reject a remote management command based on the determination result.

FIG. 9is a schematic diagram illustrating an example of configuring bundle policies910, according to an embodiment of the disclosure.

Referring toFIG. 9, the bundle policies910may be represented by a series of parameters. Although the bundle policies910are expressed in the form of a table inFIG. 9for convenience of explanation, the bundle policies910are not limited to the table and may be configured as a list of parameters. It should be noted that values of the parameters shown inFIG. 9merely represent an example of the bundle policies for convenience of explanation and may be vary for different bundles.

The bundle policies910may include a bundle identifier911for identifying each bundle. The bundle identifier911may be a character string or a numeric string indicating the name or a bundle ID of each bundle. Although not shown inFIG. 9, the bundle identifier911may further include a family ID (or FID) of each bundle.

The bundle policies910may include a “Visible to End User” indicator913indicating whether each bundle is allowed to be displayed to an end user. When a bundle is allowed to be displayed to the end user, a screen (not shown) of an LBA may display the bundle to the end user, and the “Visible to End User” indicator913may be represented by a character string, a numeric string, and/or a Boolean value indicating “Yes”. When the bundle is not allowed to be displayed to the end user, the screen (not shown) of the LBA may not display the bundle to the end user, and the “Visible to End User” indicator913may be represented by a character string, a numeric string, and/or a Boolean value indicating “No”.

The bundle policies910may include a “Command” type915including a list of types of a local or remote management command to be received by each bundle. Each remote management command may be represented by a character string or a numeric string indicating the command. Although the local or remote management command has five types such as “install”, “enable”, “disable”, “delete”, and “update” inFIG. 9, the “Command” type915of the local or remote management command is not limited thereto and may be extended to various other bundle management command types. Although each local or remote management command is separately specified inFIG. 9, one or more local or remote management commands may be grouped and specified together. For example, commands may be categorized into two types such as “install” and “Etc. (or Others)” to separately express commands corresponding to bundle installation and the other commands, or all commands may be categorized into one type such as “All”.

The bundle policies910may include a “Local Management” configuration917indicating detailed local management configurations of each command based on the command type915.

More specifically, the “Local Management” configuration917may further include an “Allowed” indicator917aindicating whether each local management command is allowed. When a local management command of a bundle is allowed, the “Allowed” indicator917amay be represented by a character string, a numeric string, or a Boolean value indicating “Yes”. When the local management command of the bundle is not allowed, the “Allowed” indicator917amay be represented by a character string, a numeric string, or a Boolean value indicating “No”.

The “Local Management” configuration917may further include an “End User Intent” indicator917bindicating whether an end user intent is required to execute each local management command. When the local management command of the bundle is required to be started by an end user, the “End User Intent” indicator917bmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Required”. When the local management command of the bundle is not required to be started by the end user, and the user equipment can autonomously start it, the “End User Intent” indicator917bmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Not Required”. When the “Allowed” indicator917aindicates that the local management command of the bundle is not allowed, the “End User Intent” indicator917bmay be represented by a character string, a numeric string, or a Boolean value indicating “Not Applicable (N/A)”.

The “Local Management” configuration917may further include an “End User Intent Confirmation” indicator917cindicating whether an end user intent confirmation is required to execute each local management command. When the end user intent confirmation is required to execute the local management command of the bundle, the “End User Intent Confirmation” indicator917cmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Required”, and a means for the end user intent confirmation may be further configured as necessary. For example, a screen for selecting “Yes/No” may be output to the end user (see “Yes or No” of reference numeral917c), biometric information (e.g., fingerprint/iris information) of the end user may be received (see “Fingerprint” of reference numeral917c), a PIN designated by the end user may be received (see “PIN” of reference numeral917c), or various other checking means may be used. Although the end user intent confirmation is indicated as being “Required”, when the means for the end user intent confirmation is not specified or the specified means for the end user intent confirmation is not usable by a user equipment, the user equipment may arbitrarily select one of usable checking means. When the end user intent confirmation is not required to execute the local management command of the bundle, the “End User Intent Confirmation” indicator917cmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Not Required”. When the “Allowed” indicator917aindicates that the local management command of the bundle is not allowed, the “End User Intent Confirmation” indicator917cmay be represented by a character string, a numeric string, or a Boolean value indicating “N/A”.

The bundle policies910may include a “Remote Management” configuration919indicating detailed remote management configurations of each command based on the command type915.

More specifically, the “Remote Management” configuration919may further include an “Allowed” indicator919aindicating whether each remote management command is allowed. When a remote management command of a bundle is allowed, the “Allowed” indicator919amay be represented by a character string, a numeric string, or a Boolean value indicating “Yes”. When the remote management command of the bundle is not allowed, the “Allowed” indicator919amay be represented by a character string, a numeric string, or a Boolean value indicating “No”.

The “Remote Management” configuration919may further include an “End User Consent” indicator919bindicating whether an end user consent is required to execute each remote management command. When the remote management command of the bundle requires the end user consent, the “End User Consent” indicator919bmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Required”, and a means for the end user consent may be further configured as necessary. For example, similarly to the example of the “End User Intent Confirmation” indicator917c, a screen for selecting “Accept/Reject” may be output to the end user (see “Accept or Reject” of reference numeral919b), biometric information (e.g., fingerprint/iris information) of the end user may be received (see “Fingerprint” of reference numeral919b), a PIN designated by the end user may be received (see “PIN” of reference numeral919b), or various other checking means may be used. Although the end user consent is indicated as being “Required”, when the means for the end user consent is not specified or the specified means for the end user consent is not usable by a user equipment, the user equipment may arbitrarily select one of usable checking means. When the remote management command of the bundle does not require the end user consent, the “End User Consent” indicator919bmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Not Required”. When the “Allowed” indicator919aindicates that the remote management command of the bundle is not allowed, the “End User Consent” indicator919bmay be represented by a character string, a numeric string, or a Boolean value indicating “N/A”.

The “Remote Management” configuration919may further include a “Subscriber Intent Verification” indicator919cindicating whether a subscriber intent verification is required to execute each remote management command. When the subscriber intent verification is required to execute the remote management command of the bundle, the “Subscriber Intent Verification” indicator919cmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Required”, and a means for the subscriber intent verification may be further configured as necessary. For example, security information such as a credential key of a subscriber may be checked (see “Credential Key” of reference numeral919c), a digital signature using a digital certificate of the subscriber may be checked (see “Signed Token” of reference numeral919c), or various other verification means may be used. Although the subscriber intent verification is indicated as being “Required”, when the means for the subscriber intent verification is not specified or the specified means for the subscriber intent verification is not usable by a user equipment and/or a bundle management server, the device and/or the bundle management server may arbitrarily select one of usable verification means. When the subscriber intent verification is not required to execute the remote management command of the bundle, the “Subscriber Intent Verification” indicator919cmay be represented by a character string, a numeric string, and/or a Boolean value indicating “Not Required”. When the “Allowed” indicator919aindicates that the remote management command of the bundle is not allowed, the “Subscriber Intent Verification” indicator919cmay be represented by a character string, a numeric string, or a Boolean value indicating “Not Applicable (N/A)”.

FIG. 10is a schematic diagram illustrating an example of a procedure in which a user equipment1020performs bundle local management, according to an embodiment of the disclosure.

Referring toFIG. 10, the user equipment1020may have a first bundle1011installed therein. The current embodiment of the disclosure assumes that the first bundle1011is currently disabled. The first bundle1011may further include bundle policies1010. The entirety or a part of the bundle policies1010may be included not only in a bundle but also in the user equipment1020, an LBA (not shown), and/or a bundle management server (not shown).

Because the first bundle1011is configured to be displayed to an end user (see reference numeral1013), in operation1021, the first bundle1011may be displayed on an LBA configuration screen1020aof the user equipment1020. In operation1023, the end user may attempt to locally enable the first bundle1011using a command1015.

Because a local management configuration1017of the first bundle1011does not require an end user intent confirmation for an enable operation, in operation1025, the first bundle1011may be displayed as being enabled on an LBA configuration screen1020bof the user equipment1020without an additional input of the end user after operation1023. In operation1027, the end user may attempt to locally disable the first bundle1011.

Because the local management configuration1017of the first bundle1011does not require an end user intent confirmation for a disable operation, in operation1029, the first bundle1011may be displayed as being disabled on an LBA configuration screen1020cof the user equipment1020without an additional input of the end user after operation1025. In operation1031, the end user may attempt to locally delete the first bundle1011.

Because the local management configuration1017of the first bundle1011requires an end user intent confirmation such as a PIN input for a delete operation, in operation1033, an LBA configuration screen1020dof the user equipment1020may request the end user to input a PIN. In operation1035, the end user may input a PIN. The operation of requesting the PIN of the end user in operation1035may be substituted by an operation of requesting biometric information (e.g., fingerprint/iris information) or a selection (e.g., “Yes/No”) of the end user, based on the configuration of the bundle policies1010.

When the PIN input by the end user in operation1035is valid, the user equipment1020may delete the first bundle1011. When no more bundle is left in the user equipment1020, an LBA configuration screen1020eof the user equipment1020may display no bundle. Although a local management configuration1017is described herein, a remote management configuration1019by a subscriber is also possible.

FIG. 11is a schematic diagram illustrating another example of a procedure in which a user equipment1120performs bundle local management, according to an embodiment of the disclosure.

Referring toFIG. 11, the user equipment1120may have installed therein a second bundle1111for providing a communication service. The current embodiment of the disclosure assumes that the second bundle1111is currently disabled. The second bundle1111may further include bundle policies1110. The entirety or a part of the bundle policies1110may be included not only in a bundle but also in the user equipment1120, an LBA (not shown), and/or a bundle management server1130.

Because the second bundle1111is configured not to be displayed to an end user (see reference numeral1113), in operation1121, the second bundle1111may be hidden on an LBA configuration screen1120aof the user equipment1120. Because a local management configuration1117of the second bundle1111allows the user equipment1120to locally enable or disable the second bundle1111without an end user intent, in operation1123, the user equipment1120may locally enable the second bundle1111without any input of the end user using a command1115.

Because the local management configuration1117of the second bundle1111does not require an end user intent confirmation for an enable operation, in operation1125, the second bundle1111may be enabled in a hidden state on an LBA configuration screen1120bof the user equipment1120without an additional input of the end user after operation1123. In operation1127, the user equipment1120may receive and install a third bundle11110from the bundle management server1130by using the communication service provided by the second bundle1111. Because the local management configuration1117of the third bundle11110does not require an end user intent confirmation for a bundle install operation, in operation1129, the installed third bundle11110may be displayed on an LBA configuration screen1120bof the user equipment1120without an additional input of the end user after operation1127. In operation1131, the user equipment1120may locally disable the second bundle1111.

Because the local management configuration1117of the second bundle1111does not require an end user intent confirmation for a disable operation, in operation1133, the second bundle1111may be disabled in a hidden state on an LBA configuration screen1120cof the user equipment1120without an additional input of the end user after operation1131. Although a local management configuration1117is described herein, a remote management configuration1119by a subscriber is also possible.

FIG. 12is a schematic diagram illustrating an example of a procedure in which a user equipment1220performs bundle local management and bundle remote management, according to an embodiment of the disclosure.

Referring toFIG. 12, the user equipment1220may have a fourth bundle1211installed therein. The current embodiment of the disclosure assumes that the fourth bundle1211is currently enabled. The fourth bundle1211may further include bundle policies1210. The entirety or a part of the bundle policies1210may be included not only in a bundle but also in the user equipment1220, an LBA (not shown), and/or a bundle management server1230.

Because the fourth bundle1211is configured to be displayed to an end user (see reference numeral1213) but not to be allowed for local management (see reference numeral1217), in operation1221, the fourth bundle1211may be displayed on an LBA configuration screen1220aof the user equipment1220and a disable/delete operation1215thereof may be inactivated not to be selected by the end user.

In operation1223, a service provider1240may request the bundle management server1230to remotely disable the fourth bundle1211. In operation1225, the bundle management server1230may request the user equipment1220to remotely disable the fourth bundle1211. Because a remote management configuration1219of the fourth bundle1211does not require an end user consent and a subscriber intent verification for a disable operation, in operation1227, the fourth bundle1211may be displayed as being disabled on an LBA configuration screen1220bof the user equipment1220without an additional operation of the bundle management server1230or the end user after operation1225.

In operation1229, the service provider1240may request the bundle management server1230to remotely delete the fourth bundle1211. Because the remote management configuration1219of the fourth bundle1211requires a subscriber intent verification such as a credential key verification for a remote delete operation, operation1229may further use a first key to be verified by the bundle management server1230and/or a second key to be verified by the user equipment1220, to remotely delete the fourth bundle1211.

In operation1231, the bundle management server1230may verify a subscriber intent by verifying the first key provided by the service provider1240. When the first key is valid, in operation1233, the bundle management server1230may request the user equipment1220to remotely delete the fourth bundle1211. Because the remote management configuration1219of the fourth bundle1211requires a subscriber intent verification such as a credential key verification for a remote delete operation, operation1233may further use the second key to be verified by the user equipment1220, to remotely delete the fourth bundle1211. Although the second key is provided by the service provider1240inFIG. 12, the second key may be generated by the bundle management server1230as necessary.

In operation1235, the user equipment1220may verify the subscriber intent by verifying the second key provided by the bundle management server1230. When the second key is valid, because the remote management configuration1219of the fourth bundle1211requires an end user consent for a remote delete operation, in operation1237, an LBA configuration screen1220cof the user equipment1220may request an end user consent by outputting a screen for selecting “Accept/Reject”. The operation of requesting the end user consent by outputting the screen for selecting “Accept/Reject” in operation1237may be substituted by an operation of requesting a PIN or biometric information (e.g., fingerprint/iris information) of the end user, based on the configuration of the bundle policies1210.

The operation of verifying the first key and the second key in operations1231and1235may be substituted by an operation of verifying a digital signature and/or a token including the digital signature (e.g., a signed token), based on the configuration of the bundle policies1210. The subscriber intent verification may not be performed by both of the bundle management server1230and the user equipment1220, and may be performed only by one of the two as necessary. Operations1231and1235may further include one or more message exchanges. For example, in operation1231, when the service provider1240does not transmit the first key and/or the second key to request to remotely delete the fourth bundle1211, the bundle management server1230may request and additionally receive the first key and/or the second key from the service provider1240to perform the subscriber intent verification based on the remote management configuration1219. Likewise, in operation1233, when the bundle management server1230does not transmit the first key and/or the second key to request to remotely delete the fourth bundle1211, the user equipment1220may request and additionally receive the first key and/or the second key from the bundle management server1230to perform the subscriber intent verification based on the remote management configuration1219.

In operation1239, the end user may accept that the fourth bundle1211is to be remotely deleted. Thereafter, the user equipment1220may remotely delete the fourth bundle1211. When no more bundle is left in the user equipment1220, an LBA configuration screen1220dof the user equipment1220may display no bundle.

FIG. 13is a schematic diagram illustrating another example of a procedure in which a user equipment1320performs bundle local management and bundle remote management, according to an embodiment of the disclosure.

Referring toFIG. 13, the user equipment1320may have a fifth bundle1311installed therein. The current embodiment of the disclosure assumes that the fifth bundle1311is currently enabled. The fifth bundle1311may further include bundle policies1310. The entirety or a part of the bundle policies1310may be included not only in a bundle but also in the user equipment1320, an LBA (not shown), and/or a bundle management server1330.

The fifth bundle1311may be configured to be displayed to an end user (see reference numeral1313) and to be allowed for enable and disable operations1315of local management (see reference numeral1317). In this case, in operation1321, the fifth bundle1311may be displayed on an LBA configuration screen1320aof the user equipment1320and, unlike the embodiment ofFIG. 12in which non-allowed local management operations are inactivated for the end user, not only the disable operation but also a non-allowed delete operation may be displayed as being allowed to the end user. A process for the non-allowed delete operation will be described below in relation to operation1339.

In operation1323, a service provider1340may request the bundle management server1330to remotely disable the fifth bundle1311. In operation1325, the bundle management server1330may request the user equipment1320to remotely disable the fifth bundle1311. Because a remote management configuration1319of the fifth bundle1311does not require an end user consent and a subscriber intent verification for a remote disable operation, in operation1327, the fifth bundle1311may be displayed as being disabled on an LBA configuration screen1320bof the user equipment1320without an additional operation of the bundle management server1330or the end user after operation1325.

In operation1329, the service provider1340may request the bundle management server1330to remotely delete the fifth bundle1311. In operation1331, the bundle management server1330may request the user equipment1320to remotely delete the fifth bundle1311. Because the remote management configuration1319of the fifth bundle1311does not allow the remote delete operation, in operation1333, the user equipment1320may reject to remotely delete the fifth bundle1311. Although the user equipment1320rejects a remote management command inFIG. 13, when the bundle management server1330knows of the bundle policies1310and a current state of the fifth bundle1311, the bundle management server1330may also reject the remote management command of operation1329. When the bundle management server1330rejects the remote management command, operation1333may not be unnecessarily performed.

Because the remote delete operation of the fifth bundle1311is rejected, in operation1335, the fifth bundle1311may be continuously displayed as being disabled on an LBA configuration screen1320cof the user equipment1320. In operation1337, the end user may attempt to locally delete the fifth bundle1311.

Because a local management configuration1317of the fifth bundle1311does not allow the local delete operation, in operation1339, an LBA configuration screen1320dof the user equipment1320may display, to the end user, that the delete operation of the fifth bundle1311is not allowed.

Although the local or remote management command of the fifth bundle1311is rejected by the bundle management server1330or the user equipment1320when the bundle policies1310do not allow the local or remote management command in operation1329,1333, or1339ofFIG. 13, the local or remote management command of the fifth bundle1311may be equally rejected when a result of checking the bundle policies1310indicates that an end user intent confirmation, an end user consent, and/or a subscriber intent verification fails. For example, when verification of the key fails in operation1231or1235ofFIG. 12, the remote management command may be rejected as in operation1333or1335ofFIG. 13. As another example, when verification of the PIN of the end user fails in operation1033ofFIG. 10, the local management command may be rejected as in operation1339ofFIG. 13.

Although bundle policies are described as information stored in each bundle in the afore-described embodiments of the disclosure, the entirety or a part of the bundle policies may be stored in a user equipment (more specifically, an SSP, an SPBL, or an LBA) as necessary. For example, among the bundle policies, a means for an end user intent confirmation and a means for an end user consent may be stored in the LBA, a means for determining whether local and remote management commands are allowed and a means for a subscriber intent verification may be stored in the SSP, and the other bundle policies may be stored in the bundle. When the entirety or a part of the bundle policies are all stored in the user equipment and the bundle, and when the bundle policies stored in the user equipment differ from the bundle policies stored in the bundle, the user equipment may reject to install the bundle, accept to install but give a priority of application to the bundle policies stored in the user equipment compared to the bundle policies stored in the bundle, or accept to install but give a priority of application to the bundle policies stored in the bundle compared to the bundle policies stored in the user equipment.

When means for an end user intent confirmation, an end user consent, and a subscriber intent verification are specified in the bundle policies, the means may not always be input means supported by the user equipment, a bundle management server, and/or a service provider. For example, a bundle policy requiring a fingerprint input to check an end user consent may be configured for a user equipment having no fingerprint reader. As another example, a bundle policy requiring a digital certificate and a digital signature to verify a subscriber intent may be configured for a service provider having no digital certificate. When the capabilities of the user equipment, the bundle management server, and/or the service provider conflict with the requirements of the bundle policies as described above, the device or the bundle management server may reject to perform the bundle policies, regard the bundle policies as being successfully performed (unconditional success), or substitute the bundle policies with other means. For example, the user equipment may substitute the fingerprint input with a PIN (or PIN code) input, and the bundle management server may substitute the digital signature with a credential key. To prevent the conflict between the capabilities of the user equipment, the bundle management server, and/or the service provider and the bundle policies, the capabilities of the user equipment, the bundle management server, and/or the service provider may be considered to configure the bundle policies. For example, for an operation for installing an arbitrary bundle, the user equipment, the bundle management server, and the service provider may negotiate and check capabilities thereof in advance, and configure bundle policies to use means supported by the three. The above-described example will now be described with reference toFIGS. 14A and 14B.

FIG. 14Ais a schematic diagram illustrating an example of a procedure in which a user equipment1400, a service provider1430, and a bundle management server1440configure bundle policies based on capability negotiation, according to an embodiment of the disclosure.

Referring toFIG. 14A, in operation14001, an end user1450may subscribe to a service of the service provider1430.

In operation14003, the service provider1430and the bundle management server1440may generate bundle download information for downloading an arbitrary bundle.

In operation14005, the service provider1430may provide the bundle download information to the end user1450.

In operation14007, the end user1450may input the bundle download information to an LBA1410.

In operation14009, the bundle management server1440and the service provider1430may perform certificate and capability negotiation. More specifically, in operation14009, the bundle management server1440and the service provider1430may exchange digital certificate (or CI certificate) information to be used in a bundle download and installation procedure, and exchange information about means usable for an end user intent confirmation, an end user consent, and a subscriber intent verification. Operation14009may be performed immediately after or integrally with operation14003as necessary.

In operation14011, the LBA1410and an SSP1420in the user equipment1400may perform certificate and capability negotiation with the bundle management server1440. More specifically, in operation14011, the user equipment1400and the bundle management server1440may exchange the digital certificate (or CI certificate) information to be used in the bundle download and installation procedure, and exchange the information about the means usable for the end user intent confirmation, the end user consent, and the subscriber intent verification. Operation14011may not always be performed separately from operation14009, and be performed integrally with operation14009as necessary.

In operation14013, the user equipment1400, the bundle management server1440, and the service provider1430may prepare bundle policies. The entirety or a part of the bundle policies may be stored in a bundle, the LBA1410, the SSP1420, or the bundle management server1440. Operation14013may not always be performed after operation14011, and a part of operation14013may be performed immediately after or integrally with operation14009as necessary. For example, remote management policies of the bundle policies may be configured after the capability negotiation of the bundle management server1440and the service provider1430, and local management policies of the bundle policies may be configured after the capability negotiation of the user equipment1400and the bundle management server1440.

In operation14015, the user equipment1400, the bundle management server1440, and the service provider1430may start to download a bundle.

FIG. 14Bis a schematic diagram illustrating another example of a procedure in which a user equipment1400, a service provider1430, and a bundle management server1440configure bundle policies based on capability negotiation, according to an embodiment of the disclosure.

Referring toFIG. 14B, in operation14101, an end user1450may subscribe to a service of the service provider1430. Although not shown inFIG. 14B, in operation14101, the end user1450may receive capability information of the user equipment1400from the user equipment1400, and provide the capability information of the user equipment1400to the service provider1430when subscribing to the service. The capability information of the user equipment1400may further include information about means usable by the user equipment1400for an end user intent confirmation, an end user consent, and a subscriber intent verification. Although the capability information of the user equipment1400is transmitted from the end user1450to the service provider1430inFIG. 14B, the capability information of the user equipment1400may be directly transmitted from the user equipment1400to the service provider1430or the bundle management server1440. For example, the end user1450subscribes to the service of the service provider1430by accessing the service provider1430or the bundle management server1440by using the user equipment1400, the user equipment1400may transmit the capability information of the user equipment1400to the service provider1430or the bundle management server1440as a part of the service subscription procedure.

In operation14103, the bundle management server1440and the service provider1430may perform certificate and capability negotiation. More specifically, in operation14103, the bundle management server1440and the service provider1430may exchange digital certificate (or CI certificate) information to be used in a bundle download and installation procedure, and exchange information about means usable for an end user intent confirmation, an end user consent, and a subscriber intent verification. In operation14103, the capability information of the user equipment1400, which is received from the end user1450in operation14101, may also be exchanged. Operation14103may be performed integrally with operation14105as necessary.

In operation14105, the user equipment1400, the bundle management server1440, and the service provider1430may prepare bundle policies. The entirety or a part of the bundle policies may be stored in a bundle, an LBA1410, an SSP1420, or the bundle management server1440.

In operation14107, the service provider1430and the bundle management server1440may generate bundle download information for downloading an arbitrary bundle. Operation14107may be performed before or integrally with operation14105as necessary.

In operation14109, the service provider1430may provide the bundle download information to the end user1450.

In operation14111, the end user1450may input the bundle download information to the LBA1410.

In operation14113, the LBA1410and the SSP1420in the user equipment1400may perform certificate and capability negotiation with the bundle management server1440. More specifically, in operation14113, the user equipment1400and the bundle management server1440may exchange the digital certificate (or CI certificate) information to be used in the bundle download and installation procedure, and exchange the information about the means usable for the end user intent confirmation, the end user consent, and the subscriber intent verification. The entirety or a part of operation14113may be performed integrally with operation14101or14103as necessary.

In operation14115, the user equipment1400, the bundle management server1440, and the service provider1430may start to download a bundle.

According to an embodiment of the disclosure, a user equipment and a bundle management server may configure bundle policies based on capabilities thereof. When a certain bundle is locally or remotely managed, a consent or a verification of an end user and/or a service subscriber may be checked based on bundle policies, and then the local or remote management may be accepted or rejected.

FIG. 15is a block diagram of a user equipment1500according to an embodiment of the disclosure.

As illustrated inFIG. 15, the user equipment1500may include a transceiver1510and at least one processor1520. The user equipment1500may further include an SSP1530. For example, the SSP1530may be an rSSP inserted into the user equipment1500, or an eSSP or iSSP embedded in the user equipment1500. The at least one processor1520may also be called a controller.

However, the user equipment1500is not limited to the elements illustrated inFIG. 15, and may include a larger or smaller number of elements compared to those illustrated inFIG. 15. According to an embodiment of the disclosure, the transceiver1510, the at least one processor1520, and a memory (not shown) may be configured as a single chip. When the SSP1530is embedded, the single chip may further include the SSP1530.

According to an embodiment of the disclosure, the transceiver1510may transmit and receive, to and from a bundle management server, signals, information, and data according to various embodiments of the disclosure. The transceiver1510may include a radio-frequency (RF) transmitter for up-converting a frequency of and amplifying a signal to be transmitted, and an RF receiver for low-noise-amplifying and down-converting a frequency of a received signal. However, the RF transmitter and the RF receiver are merely examples and the elements of the transceiver1510are not limited thereto. The transceiver1510may receive a signal through a wireless channel and output the signal to the at least one processor1520, and transmit a signal output from the at least one processor1520, through a wireless channel.

According to an embodiment of the disclosure, the transceiver1510may receive, from the bundle management server, at least a message related to bundle installation, or a message including a bundle remote management request. The transceiver1510may transmit a bundle installation result or a bundle remote management result.

The at least one processor1520is an element for controlling the user equipment1500. The processor1520may control overall operations of the user equipment1500according to the afore-described embodiments of the disclosure.

According to an embodiment of the disclosure, the processor1520may compare a received bundle package or a bundle remote management command to bundle policies to determine whether the bundle package or the bundle remote management command is processable by the SSP1530, and input the bundle package or the bundle remote management command to the SSP1530, and the SSP1530may install or manage a bundle, and generate a bundle installation result or a remote management result.

According to an embodiment of the disclosure, the at least one processor1520may compare a bundle local management command received from an end user to the bundle policies to determine whether the bundle local management command is processable by the SSP1530, and input the bundle local management command to the SSP1530, and the SSP1530may install or manage a bundle, and generate a local management result.

According to an embodiment of the disclosure, the at least one processor1520may control the transceiver1510to receive a bundle or a bundle remote management command from a profile server, install the bundle or process the bundle remote management command, and transmit a bundle installation result or a remote management result to the bundle management server.

The SSP1530according to various embodiments of the disclosure may download and install a bundle. The SSP1530may manage the bundle and the bundle policies.

According to an embodiment of the disclosure, the SSP1530may operate under the control of the processor1520. Alternatively, the SSP1530may include a processor or a controller for installing a bundle, or have installed therein an application for installing a bundle. A part of the application may be installed in the processor1520.

The user equipment1500may further include a memory (not shown) for storing data such as basic programs, application programs, or configuration information for operating the user equipment1500. The memory may include at least one of flash memory, a hard disk, a multimedia card micro, a memory card (e.g., a secure digital (SD) or extreme digital (XD) card), magnetic memory, a magnetic disc, an optical disc, random access memory (RAM), static RAM (SRAM), read-only memory (ROM), programmable ROM (PROM), or electrically erasable programmable ROM (EEPROM). The processor1520may perform various operations by using various programs, contents, and data stored in the memory.

FIG. 16is a block diagram of a bundle management server1600according to an embodiment of the disclosure.

According to an embodiment of the disclosure, the bundle management server1600may include a transceiver1610and at least one processor1620. However, the bundle management server1600is not limited to the elements illustrated inFIG. 16, and the bundle management server1600may include a larger or smaller number of elements compared to those illustrated inFIG. 16. According to an embodiment of the disclosure, the transceiver1610, the at least one processor1620, and a memory (not shown) may be configured as a single chip.

According to an embodiment of the disclosure, the transceiver1610may transmit and receive, to and from the user equipment1500(seeFIG. 15), signals, information, and data according to various embodiments of the disclosure. For example, the transceiver1610may transmit and/or receive, to and/or from the user equipment1500, bundle information or information related to bundle remote management.

The transceiver1610may include an RF transmitter for up-converting a frequency of and amplifying a signal to be transmitted, and an RF receiver for low-noise-amplifying and down-converting a frequency of a received signal. However, the RF transmitter and the RF receiver are merely examples and the elements of the transceiver1610are not limited thereto. The transceiver1610may receive a signal through a wireless channel and output the signal to the at least one processor1620, and transmit a signal output from the at least one processor1620, through a wireless channel.

According to an embodiment of the disclosure, the transceiver1610may receive a bundle download request message or a bundle remote management request message from the user equipment1500.

The bundle download request message or the bundle remote management request message according to an embodiment of the disclosure may include information about the user equipment1500and/or the SSP1530(seeFIG. 15), and may further include the entirety or a part of bundle information or bundle policy information.

For example, the transceiver1610according to an embodiment of the disclosure may transmit a bundle installation package or a bundle remote management command to the user equipment1500.

The bundle installation package or the bundle remote management command according to an embodiment of the disclosure may further include the entirety or a part of the bundle information or the bundle policy information.

The at least one processor1620is an element for controlling the bundle management server1600. The processor1620may control overall operations of the bundle management server1600according to the afore-described embodiments of the disclosure.

For example, the at least one processor1620according to an embodiment of the disclosure determine bundle policies based on the information about the user equipment1500and/or the SSP1530, which is received from the user equipment1500, and control the transceiver1610to transmit the bundle installation package or the bundle remote management command to the user equipment1500, based on the bundle policies.

The bundle management server1600may further include a memory (not shown) for storing data such as basic programs, application programs, or configuration information for operating the bundle management server1600. The memory may include at least one of flash memory, a hard disk, a multimedia card micro, a memory card (e.g., an SD or XD card), magnetic memory, a magnetic disc, an optical disc, RAM, SRAM, ROM, PROM, or EEPROM. The processor1620may perform various operations by using various programs, contents, and data stored in the memory.

In the afore-described embodiments of the disclosure, each element included in the disclosure is expressed in a singular or plural form based on a specific embodiment of the disclosure. However, the singular or plural form is appropriately selected for a specific situation for convenience of explanation and does not limit the scope of the disclosure, and an element expressed in a plural form may represent a singular element and an element expressed in a singular form may represent plural elements.

While the disclosure has been particularly shown and described with reference to embodiments thereof, it will be understood that various changes may be made therein without departing from the scope of the disclosure. Therefore, the scope of the disclosure should not be limited to the afore-described embodiments of the disclosure but be defined by the following claims and equivalents thereof.

It should be understood that various embodiments of the disclosure and terms used herein are not intended to limit the disclosed technologies to particular forms but, on the contrary, cover various modifications, equivalents, and/or alternatives thereof. In the drawings, like reference numerals denote like elements. As used herein, the singular forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Throughout the disclosure, the expression “A or B”, “at least one of A and/or B”, “A, B or C”, or “at least one of A, B and/or C” may include all possible combinations of the listed items. The expressions such as “first”, “second”, “1st”, and “2nd” used herein may refer to various different elements regardless of the order or priority thereof, and are merely used to distinguish one element from another without limiting the elements. When a certain element (e.g., a first element) is referred to as being “(functionally or communicatively) connected” or “coupled” to another element (e.g., a second element), the certain element may be connected to the other element directly or via still another element (e.g., a third element).

As used herein, the term “module” may include a unit configured as hardware, software, or firmware, and be used interchangeably with, for example, the term “logic”, “logic block”, “component”, or “circuit. A module may be an integrated component, the smallest unit which performs one or more functions, or a part thereof. For example, the module may be configured as an application-specific integrated circuit (ASIC).

Various embodiments of the disclosure may be implemented by a software (e.g., a program) including instructions stored in a machine-readable (e.g., computer-readable) storage medium (e.g., embedded or external memory). The machine refers to a device capable of fetching instructions stored in the storage medium, and operating based on the fetched instructions, and may include the user equipment1500according to various embodiments of the disclosure. When the instructions are executed by a processor (e.g., the processor1520ofFIG. 15), functions corresponding to the instructions may be performed directly by the processor or by other elements under the control of the processor. The instructions may include codes created or executed by a compiler or an interpreter.

The machine-readable storage medium may be provided in the form of a non-transitory storage medium. When a storage medium is ‘non-transitory’, it means that the storage medium is tangible but does not include signals (e.g., electromagnetic waves), and it does not limit that data is semi-permanently or temporarily stored in the storage medium.

According to an embodiment of the disclosure, services may be effectively provide in a mobile communication system.

The methods according to various embodiments of the disclosure may be included and provided in a computer program product. The computer program product may be traded between a seller and a buyer. The computer program product may be distributed in the form of a machine-readable storage medium (e.g., a compact disc-read only memory (CD-ROM)), or be distributed online via an application store (e.g., Google Play™). When distributed online, at least a part of the computer program product may be at least temporarily stored or created in a storage medium such as a server of a manufacturer, a server of an application store, or memory of a relay server. Each element (e.g., a module or a program) according to various embodiments of the disclosure may be configured as singular or plural entities, and some of the above-described sub-elements may be omitted or new sub-elements may be added. Alternatively or additionally, some elements (e.g., modules or programs) may be integrated into one element, and may equally or similarly perform functions of each of the individual elements before being integrated. Operations of modules, programs, or other elements according to various embodiments of the disclosure may be performed sequentially, in parallel, repeatedly, or heuristically, and at least some operations may be omitted or be performed in a different order or other operations may be added.