Patent Description:
Due to new requirements of miniaturization and robustness, the industry has developed an evolution of the traditional UICC (Universal Integrated Circuit Card) cards, a smart card integrated in the communication device which is called "embedded UICC". This evolution envisages that the UICC is soldered (or in any case made hardly accessible) in the hosting device that can be a mobile phone, a modem, a board inserted in a device, etc..

Soldering presents distinct advantages such as the possibility of reducing the size of the UICC device and hence of the modem, the improvement of the robustness of the contacts (soldered contacts are typically more reliable than interfaces between replaceable components), the increased antitheft protection.

On the other hand, soldering a UICC (or making it hardly accessible) introduces new requirements and issues that need to be addressed, such as:.

To address the above requirements, the industry has defined a new technological standard called "embedded UICC" or "Remote SIM provisioning".

The basic concepts of the new technological standard are the following:.

In the eUICC (embedded UICC) card it is known to provide generation of profiles, in particular personalized profile package data.

A Profile is a combination of a file structure, data and applications which are stored in an eUICC. A Profile Package is a Personalised Profile using an interoperable description format which is transmitted to an eUICC in order to load and install a Profile.

For instance the consortium TCA (Trusted Connectivity Alliance) defines an interoperable format to represent a Profile Package as defined for instance in the TCA reference document "<NPL>, see download section at referredlink) and subsequent versions. Such interoperable format represents the structure of data to be built by the profile generating node, e.g. Profile Creator and to be loaded in the eUICC card in order for the eUICC to be personalized according to the content of the Profile Package. The Profile Creator is an entity in charge of creating the Profile Package based on the MNO (Mobile Network Operator) requirements.

Two families of embedded UICCs are currently defined:.

The eUICC Industrial cards are directed to application in automotive/M2M devices managed by a Service provider. Such devices are typically unattended, i.e. without the interaction of an End User. Thus the operation regarding the managing of software and profiles, e.g. Load/ Enabled/Disable/Delete are issued by a remote server, representing the service provider, since the device performs these operations unattended.

On the other hand, the eUICC Consumer cards are directed to mobile phones, smartwatches, and similar device which are typically attended. Therefore, operations for managing software and profiles are issued by the local device, representing the user intent. The device performs these operations attended, i.e. with the interaction of an End User.

In <FIG> it is shown a schematic representation of a system for managing profiles in industrial eUICC cards <NUM>, which includes a data preparation server <NUM>, e.g. a SM-DP server, responsible for the creation, generation, management and the protection of resulting profiles at the input/request of the operator. Such data preparation server <NUM> for instance may includes a database of profiles and, additionally other modules like an OTA RFM (Over The Air Remote File Management) engine and a Keys Manager. The data preparation server <NUM> provides, for instance through an OTA (Over The Air) channel, profiles P, in particular personalized profiles, to a Secure Routing server <NUM>, e.g. a SM-SR server, which is configured to secure routing of profiles and usually sends a profile download enabling command to the eUICC card <NUM>, which is embedded in a local equipment <NUM> (as visible in <FIG>), i.e. a smart card integrated in a local communication device, thus enabling download and storing of the profile P in the eUICC card <NUM>. The system <NUM> includes also a Mobile Network (MNO) operator <NUM>, which can issue for instance a profile ordering command to the data preparation server <NUM>. In <FIG> are also indicated a Certificate Issuer <NUM>, which issues Certificates for remote SIM provisioning entities and acts as a trusted third party for the purpose of authenticating the entities within the system, and an eUICC Manufacturer (EUM) <NUM> which is responsible for the initial cryptographic configuration and security architecture of the eUICC <NUM> and is the provider of eUICC products. These system components are not here described in further detail. A description of the operation of the system <NUM> can be found at https://www. com/iot/wp-content/uploads/<NUM>/<NUM>/<NUM>. -GSMA-Embedded-SIM-Remote-Provisioning-Architecture-Version-<NUM>. pdf and subsequent versions.

Thus, in the system <NUM>, the SM-DP (server <NUM>, an OTA server) contains profiles and represents the MNO. The SM-SR (server <NUM>, also an OTA server) executes commands [load/enable. ] in batches over the device installation basis, e.g. downloading profiles on all the cards on the field.

In <FIG> it is shown a schematic representation of a system for managing profiles in consumer eUICC cards <NUM>', where the data preparation server <NUM>, which is specifically a SM-DP+, i.e. Subscription Manager Data Preparation - enhanced compared to the SM-DP in SGP. <NUM>, interacts directly with the local equipment <NUM>, e.g. a mobile telephone or smartphone, and specifically with a software profile management module configured to store profiles in the eUICC <NUM> and perform operations on said profiles P stored in the eUICC <NUM>, such module being is specifically a LPA (Local Profile Assistant) software module <NUM>.

The LPA module <NUM> is a software running in the local equipment <NUM> and provides LPA services, such as Profile download or Profile management, to the eUICC <NUM>. The LPA consists of two parts - the LPD (Local Profile Download) 14a and the LUI (Local User Interface) 14b. The LPD 14a plays a proxy role for the efficient download of a Bound Profile Package between SM-DP+ <NUM> and eUICC <NUM>, while the LUI interface 14b allows for local profile management on the device by an end user <NUM>, also shown in <FIG> which can interact with the local equipment <NUM> through a user interface or with the MNO <NUM> through a operator interface. A Local Discovery Service (LDS) 14c is also shown as included in the LPA module <NUM>. The system <NUM>' includes also a Subscription Manager - Discovery Server (SM-DS) <NUM> to provide mechanisms that allow an SM-DP+, like the server <NUM>, to inform the Local Discovery Service 14c within any device that an SM-DP+ like server <NUM> wishes to communicate with it. A description of the operation of system <NUM>' can be found at https://www. com/aboutus/wp-content/uploads/<NUM>/<NUM>/FS. <NUM> SAS-SM Standard v3.

Thus in the consumer architecture of the system <NUM>' the SM-DP+ server (an OTA server) contains profiles and represents the MNO. The LPA (an application on the local equipment, e.g. the phone) executes commands [load, enable. ] on the user equipment phone. The user changes operator, for instance, by means of the GUI (Graphic User Interface) of the LPA.

The techniques here taken in consideration are those where MNOs (Mobile Network Operators) do not accept peer to peer profile/bundle transfer.

A possible scenario in such circumstances is that of a user desiring to perform on operation such load, enable or disable a subscription.

This operation may encounter problems. If using an integrated circuit card such as M2M eSIM, this kind of card just relies on Remote Management, i.e. the load/enable/disable initiative is started by the MNO, not the user. If using a Consumer eSIM, within a screenless device (e.g. antenna, smartmeter), no user interface is available, thus this cannot be done.

European patent applications <CIT> and <CIT> describe methods relevant to the technical field of the solution here described.

On the basis of the foregoing description, the need is felt for solutions which overcome one or more of the previously outlined drawbacks.

According to one or more embodiments, such an object is achieved through methods having the features specifically set forth in the claims that follow. Embodiments moreover concerns a related system for the remote provisioning of software modules, as well as a corresponding related computer program product, loadable in the memory of at least one computer and including software code portions for performing the steps of the method when the product is run on a computer. As used herein, reference to such a computer program product is intended to be equivalent to reference to a computer-readable medium containing instructions for controlling a computer system to coordinate the performance of the method. Reference to "at least one computer" is evidently intended to highlight the possibility for the present disclosure to be implemented in a distributed/modular fashion.

The claims are an integral part of the technical teaching of the disclosure provided herein.

As mentioned in the foregoing, the present disclosure provides solutions regarding a method for remote provisioning of software modules, which are configured to be stored in a memory of an integrated circuit card and enabled for operation, in particular a subscription profile or a bundle to be enabled in a secure platform, hosted in a local equipment configured to communicate with a remote provisioning server, in particular a data preparation server or SM-DP+ server, to download, enable or disablee said software module, comprising
using a subscriber contactless communicating device, in particular a smartcard, to initiate the download or enabling or disabling of a software module in an integrated circuit card by means of a contactless transaction, comprising the following operations:.

In variant embodiments, the solution here described may include that if the result of said checking operations is that the software module is not stored in the integrated circuit card, downloading said software module to the integrated circuit card is performed,.

In variant embodiments, the solution here described may include that said downloading includes that,.

In variant embodiments, the solution here described may include that said disabling the software module includes that.

In variant embodiments, the solution here described may include that said enabling the software module includes that.

In variant embodiments, the solution here described may include that said operation among downloading said software module to the integrated circuit card, enabling the software module and disabling the software module, in function of the result of said checking operation is performed interacting with a SM-DP server.

In variant embodiments, the solution here described may include that said contactless subscriber device is a NFC device, and performing a contactless interaction between the contactless subscriber device and the local equipment hosting the integrated circuit card includes tapping said contactless subscriber device on said local equipment.

In variant embodiments, the solution here described may include that said contactless subscriber device is a UWB device and after said performing a contactless interaction a confirmation step is performed, in particular interacting with an input means of the local equipment.

In variant embodiments, the solution here described may include that said software module is a subscriber profile.

The present disclosure provides also solutions regarding a system for remote provisioning of software modules, which are configured to be stored in a memory of an integrated circuit card and enabled for operation, in particular a subscription profile or a bundle to be enabled in a secure platform, comprising a local equipment hosting said integrated circuit card and configured to communicate with a remote provisioning server, in particular a SM-DP+ server, to download, enable or disable said software module, comprising, wherein said system further comprises a contactless subscriber device, wherein said system is configured to perform the operations of the method according to any of the previous embodiments.

In variant embodiments, the system here described may include that said local equipment is an equipment configured to operate with a mobile communication network and is one among a mobile communication terminal, a M2M machine and a vehicle communication system.

The present disclosure provides also solutions regarding a computer-program product that can be loaded into the memory of at least one processor and comprises portions of software code for implementing the method of any of the previous embodiments.

Embodiments of the present disclosure will now be described with reference to the annexed drawings, which are provided purely by way of non-limiting example and in which:.

In the following description, numerous specific details are given to provide a thorough understanding of embodiments. The embodiments can be practiced without one or several specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification is not necessarily all referring to the same embodiment.

Figures parts, elements or components which have already been described with reference to <FIG> are denoted by the same references previously used in such Figures; the description of such previously described elements will not be repeated in the following in order not to overburden the present detailed description.

In brief, the solution here described provides using a subscriber contactless communicating device, in particular a smartcard, for instance operating according to NFC or UWB, to trigger the provisioning or enabling or disabling of a software module in an integrated circuit card by means of a contactless transaction.

Following the contactless interaction, such as a card tap, between the contactless device and the device comprising the integrated circuit card, in particular by placing the contactless subscriber device within the communication range determined by a corresponding contactless interface in the host device, after a mutual authentication between the contactless device and the IC card in the host device, a subscriber identifier, i.e. identifying subscription to a certain profile or software bundle, stored in the subscriber contactless communicating device is sent to the IC card. The IC card checks the subscriber identifier against identifications stored in the card,
performing one operation among downloading the software module, enabling the software module or disabling the software module in function of the result of said checking operation, i.e. the subscriber identifier is respectively not already stored, disabled or enabled.

In <FIG> is schematically described a system for remote provisioning configured to operate with the method of the solution here proposed.

The system, indicated as a whole with the reference <NUM>'', corresponds to that shown in <FIG>. However, a subscriber contactless device <NUM> is provided which is actionable by the user <NUM>, e.g. a NFC card in which is stored a subscriber identifier, representing a subscription to the local equipment <NUM>. Such local equipment <NUM> in its turn further includes a contactless interface <NUM>, e.g. a NFC interface, including a NFC transceiver, in order to communicate with the subscriber contactless device <NUM> when such subscriber contactless device <NUM> is placed within the communication range determined by the corresponding contactless interface <NUM> in the host device, i.e. local equipment <NUM>. Near-Field-Communication (NFC) may refer to to a set of communication protocols for communication between two electronic devices over a distance of <NUM> or less, for instance according to ECMA-<NUM> and ISO/IEC <NUM> standards. In variant embodiments, UWB technology may be used, with a UWB tag as the device storing the subscriber identity <NUM> and an UWB module, for instance inside a vehicle, operating as the contactless interface <NUM> allowing access to a local equipment <NUM> which may be the mobile communication system of the vehicle or another equipment using a M2M card.

In <FIG> it is shown a flow diagram illustrating operations of an embodiment of the method here described, indicated with the reference number <NUM>.

The method includes in a step <NUM> performing a contactless interaction between the subscriber contactless device <NUM>, e.g. a NFC card, and the local equipment <NUM>, e. g a smartphone or tablet, comprising the integrated circuit card <NUM>, for instance an eSIM. This is embodiments is performed by placing the contactless subscriber device within the communication range determined by a corresponding contactless interface, e.g. NFC interface <NUM>, associated to the local equipment <NUM>.

Then an operation <NUM> of starting a mutual authentication between the subscriber contactless device <NUM> and the integrated circuit card <NUM> in the local equipment <NUM> is performed. The integrated circuit card <NUM> jointly with the local equipment <NUM> and the contactless interface <NUM> may considered equivalent to a contactless reader, in particular a NFC reader, and mutual authentication protocol between contactless tag and reader may be applied. Authentication information to perform the mutual authentication may be stored also in the integrated circuit card <NUM>, i.e. the subscriber contactless device <NUM> and integrated circuit card <NUM> may store and execute mutually cooperating encryption algorithm to perform such mutual authentication certificate based, such as digital signature, inSign, ETSI-MSS, or two (or multi) factors.

Then, an operation <NUM> of sending a subscriber identifier SID stored in the subscriber contactless communicating device <NUM> to the integrated circuit card <NUM> is performed, asking the integrated circuit card to perform a check operation on such subscriber identifier SID. The subscriber identifier SID is a identity code or number identific a specific subscription, e.g. a specific profile P.

With <NUM> is then indicated an operation of checking at the integrated circuit card <NUM> the subscriber identifier SID comparing with other subscriber identities stored in the card <NUM>. In particular, the subscriber identities stored in the card <NUM> correspond to profiles P and the card is able to detect whethere are absent, disabled or enabled.

The checking operation <NUM> as an output selects performing one operation among downloading <NUM> the software module, e.g. the profile P, enabling <NUM> the software module and disabling <NUM> the software module in function of the result of said checking operation <NUM>, i.e. if it is detected that the software module, i.e. profile P, is respectively absent, already present disabled or already present enabled.

Each of operations <NUM>, <NUM>, <NUM> scenario involves interaction with a remote provisioning server, in particular SM-DP+ server <NUM>, like in <FIG>, although in variant embodiments SM-SR like in <FIG> may be used.

Operations <NUM>-<NUM> and <NUM> are described in further detail with reference to the sequence diagram of <FIG>, which represents actions T1. T8 performed by some of the entities or nodes of the system <NUM>'' schematically represented in <FIG>. Specifically are shown transactions among the subscribed contactless device <NUM>, the local equipment <NUM>, the integrated circuit card <NUM>, in the example an eSIM, the remote server <NUM>, a SM-DP+, and a mobile communicationn network <NUM>.

In a first transaction T1 the user <NUM> performs operation <NUM>, i.e. taps the subscribed contactless device <NUM>. As it is known tapping a NFC card means bringing the NFC circuit in close proximity, within the range allowed by the NFC technology for communication, with a corresponding NFC interface in the local equipment <NUM>. In variant embodiments, where the subscriber device <NUM> is a device equipped with a UWB communicating module, the range allowed by the UWB is far greater, therefore the interaction is better defined as placing the subscriber device <NUM> within the communication range of the corresponding interface in the local equipment <NUM>.

Then in transaction T2 a mutual authentication between the subscribed contactless device <NUM> and the eSIM card <NUM> is performed, in particular through the local equipment <NUM> and interface <NUM>, performing operation <NUM>. The subscribed contactless device <NUM> then sends T3 a message to eSIM card <NUM> asking to check subscriber identifier SID, which is performed as operation <NUM> in <FIG>. Since the subscriber identifier SID does not match the ones the eSIM card <NUM> has on-board, i.e. the profile corresponding to the subscriber identifier SID received is absent, the eSIM card <NUM> replies in a transaction T4 with its card identifier, in particular eUICC Identifier, EID to the local equipment <NUM>. The local equipment <NUM> is configured to, upon receiving the eUICC Identifier EID from the card <NUM>, to perform a transaction T5 sending a Profile Downloading Request providing the server <NUM>, SM-DP+, with SID identifier. The server <NUM> responds to the Profile Downloading Request preparing and sending in a transaction T6, an encrypted profile, specifically a Protected Profile Package, to the local equipment <NUM>.

Then the profile P in a transaction T7 is loaded by means of the LPA in the integrated circuit card <NUM>. The eSIM <NUM> in a transaction T7 enables the profile P and connects to the mobile network <NUM>, i.e. the local equipment <NUM> with the eSIM <NUM> can operate, e.g. exchange phone calls and data, with the mobile network <NUM> according to the subscription defined in profile P.

Thus operation <NUM> substantially corresponds to transactions T4-T8 in <FIG>.

Operations <NUM>-<NUM> and <NUM> are described in further detail with reference to the sequence diagram of <FIG>, which represents actions T1. T17 performed by some of the entities or nodes of the system <NUM>'' schematically represented in <FIG>. In a first transaction T1 the user <NUM> performs operation <NUM>, i.e. taps the subscribed contactless device <NUM>. Then in transaction T2 a mutual authentication between the subscribed contactless device <NUM> and the eSIM card <NUM> is performed, in particular through the local equipment <NUM> and interface <NUM>, performing operation <NUM>. The subscribed contactless device <NUM> then sends T3 a message to eSIM card <NUM> asking to check subscriber identifier SID, which is performed as operation <NUM> in <FIG>. In a first transaction T1 the user <NUM> performs operation <NUM>, i.e. taps the subscribed contactless device <NUM>. Then in transaction T2 a mutual authentication between the subscribed contactless device <NUM> and the eSIM card <NUM> is performed, in particular through the local equipment <NUM> and interface <NUM>, performing operation <NUM>. The the subscribed contactless device <NUM> then sends T3 a message to eSIM card <NUM> asking to check subscriber identifier SID, which is performed as operation <NUM> in <FIG>.

Since in this case the subscriber identifier SID matches an identification the eSIM has already on-board, i.e. a profile P with the subscriber identifier SID is already present and it is enabled, the eSIM <NUM> issues a reply T14 comprising a corresponding information to the local equipment <NUM>. The local equipment <NUM> in a transaction T17 communicates to the eSIM card <NUM> that the profile P is to be disabled, i.e. requests disabling, and consequently the eSIM card <NUM> disables the profile P.

Operations <NUM>-<NUM> and <NUM>, are described in further detail with reference to the sequence diagram of <FIG>, which represents actions T1. T27 performed by some of the entities or nodes of the system <NUM>'' schematically represented in <FIG>. In a first transaction T1 the user <NUM> performs operation <NUM>, i.e. taps the subscribed contactless device <NUM>. Then in transaction T2 a mutual authentication between the subscribed contactless device <NUM> and the eSIM card <NUM> is performed, in particular through the local equipment <NUM> and interface <NUM>, performing operation <NUM>. The subscribed contactless device <NUM> then sends T3 a message to eSIM card <NUM> asking to check subscriber identifier SID, which is performed as operation <NUM> in <FIG>. In a first transaction T1 the user <NUM> performs operation <NUM>, i.e. taps the subscribed contactless device <NUM>. Then in transaction T2 a mutual authentication between the subscribed contactless device <NUM> and the eSIM card <NUM> is performed, in particular through the local equipment <NUM> and interface <NUM>, performing operation <NUM>. The the subscribed contactless device <NUM> then sends T3 a message to eSIM card <NUM> asking to check subscriber identifier SID, which is performed as operation <NUM> in <FIG>.

Since the subscriber identifier SID matches an identification in the eSIM <NUM> has onboard, i.e. a profile P with the subscriber identifier SID is already present and it is is disabled, the eSIM <NUM> issues a reply T24 comprising a corresponding information to the local equipment <NUM>. Then, the card is asked by the local equipment in a transaction T27, similar to transaction T17, to enable the profile P. Upon such asking T27, the eSIM card <NUM> then performs the enabling of the profile P. Once the profile is enabled, registration operations on the network (e.g. on the SM-SR server) may follow.

The local equipment <NUM> communicates in transaction T27 that the profile P is enabled to the eSIM <NUM>, i.e. the local equipment <NUM> with the eSIM <NUM> can operate, e.g. exchange phone calls and data, with the mobile network <NUM> according to the subscription defined in profile P.

The method described can be applied also to a software module which is a Secondary Secure Platform bundle, which has to be downloaded to a Secure Platform in a card and then enabled, or viceversa disabled if already present.

The operation <NUM>, performing a contactless interaction between the subscriber contactless device <NUM>, and the local equipment <NUM> associated to integrated circuit card <NUM>, is performed by placing the contactless subscriber device <NUM> within the communication range determined by a corresponding contactless interface, e.g. NFC interface <NUM>, associated to the local equipment <NUM>, but it can be performed also using UWB for automotive, for instance when the NFC tap is not suitable. Since the presence of the subscriber identifier SID in the radio coverage area is not enough to guarantee the user intention, it requires a further step, such as a user interaction with a graphic interface menu, or other input means of the local equipment, in particular in the vehicle this example, equipped with a UWB interface and an integrated circuit card which stores a profile P or in which a profile P has to be downloaded.

Thus, the method proposed by using a contactless interface allows:.

Claim 1:
A method for remote provisioning of software modules (P), which are configured to be stored in a memory of an integrated circuit card and enabled for operation, in particular a subscription profile (P) or a bundle to be enabled in a secure platform, hosted in a local equipment (<NUM>) configured to communicate with a remote provisioning server (<NUM>, <NUM>), in particular a data preparation server or SM-DP+ server, to download, enable or disable said software module (P), comprising
using a subscriber contactless communicating device (<NUM>), in particular a smartcard, to initiate the download (<NUM>) or enabling (<NUM>) or disabling (<NUM>) of a software module (P) in an integrated circuit card (<NUM>) by means of a contactless transaction, comprising the following operations:
performing (<NUM>) a contactless interaction between the contactless device (<NUM>) and the local equipment (<NUM>) hosting the integrated circuit card (<NUM>), in particular by placing the contactless subscriber device (<NUM>) within the communication range determined by a corresponding contactless interface (<NUM>) in the local equipment (<NUM>),
starting (<NUM>) a mutual authentication between the contactless device and the IC card in the host device as a consequence of said contactless interaction (<NUM>),
sending (<NUM>) an identifier (SID), identifying the software module, stored in the subscriber contactless communicating device (<NUM>) to the integrated circuit card (<NUM>),
checking (<NUM>) at the integrated circuit card (<NUM>) if the software module identifier (SID) matches a software module identifier stored in said integrated circuit card (<NUM>),
selecting performing one operation among downloading (<NUM>) from said remote provisioning server (<NUM>, <NUM>) said software module (P) to the integrated circuit card (<NUM>), enabling (<NUM>) the software module (P) and disabling (<NUM>) the software module, in function of the result of said checking (<NUM>) operation, said downloading (<NUM>) comprising that said local equipment (<NUM>), receiving a card identifier (EID) from said integrated circuit card (<NUM>) sends a downloading request providing said remote provisioning server (<NUM>) with said software module identifier (SID).