Patent Description:
It has been known that mobile equipments (ME), such as mobile phones, are capable of connecting to mobile phone networks (GSM - <NUM>, UMTS - <NUM>, LTE - <NUM>, etc.) to enable the transmission of data, sounds, voices, and images. In order to perform communication with the users as well as to run application programs, a mobile equipment is equipped with an application processor. For wireless connection, the mobile equipment is basically required to contain two components, which are a baseband processor and a SIM (which serves as an identifier).

In general, a SIM is provided by a network provider to a user, which is installed in the mobile equipment, the SIM serving as a low-performance embedded computer used to register mobile equipment services with the network provider. The network provider combines a single IMEI (International Mobile Equipment Identity) number of the mobile equipment and the SIM to generate an IMSI (International Mobile Subscriber Identity) number and a TMSI (Temporal Mobile Subscriber Identity) number. The TMSI and IMSI numbers are used by the mobile equipment when performing radio communication sessions with the base stations of the network provider. Logical and communicating connections between a SIM and a mobile equipment is standardized by the 3GPP in the TS <NUM><NUM> and TS <NUM><NUM> specifications. At an application level, the SIM communicates with a baseband processor or an application processor of the mobile equipment by an Application Toolkit interface of the SIM. The interface is standardized by the 3GPP organizer in the 3GPP specification TS. <NUM>, ETSI TS <NUM><NUM>. The Application Toolkit interface allows the SIM to send Proactive Commands to the processor of the mobile equipment. The Proactive Commands may allow the programs on the SIM to request the processor of the mobile equipment to run instructions, such as requesting to perform a call, report a location, send a message, or run any application program.

Typically, applications on the SIM are closed, since the SIM manufacturers may not publicize the SIM management system, and it is difficult for the user to access these applications when using the mobile equipment. In order to check the SIM, such as to check the functionality of the SIM. US Patent No. <CIT> provides a solution of using a computer to connect to a mobile equipment with a SIM installed therein to check the Application Toolkit function of the SIM, wherein a computer software is loaded into the SIM and another software is loaded into the computer, these softwares, upon being executed, will send an event to the SIM and request to generate Proactive Commands, e.g., proactive instructions for performing functions to be checked. Based on the performance of the functions to be checked of the mobile equipment and/or the SIM, it is determined whether results of checking functions of the SIM are valid or invalid. It is notable that this manner of checking the SIM is not convenient and may be quite complicated to common users.

There is an important factor which needs to be concerned for the SIM, that is data exchange with the SIM, which may be performed remotely through Over-the-Air (OTA) mechanism. For example, the programs on the SIM may be installed and updated via OTA mechanism through silent SMS instructions. By using such OTA mechanism, there are potential risks with regard to security for the SIM. Through the OTA mechanism, the SIM may get malicious codes and malicious programs installed by control messages. These malicious codes and programs are hidden in the SIM and may use Proactive Commands to control the mobile equipment illegally, e.g., calling, messaging, performing transaction with third parties, opening browsers, obtaining location information without the user permission or wiretapping, tracking, and installing malicious codes without the user's knowledge. Or more broadly speaking, an attacker may take advantage of the SIM vulnerabilities to employ OTA messages to control the SIM and the mobile equipment of the user/victim remotely. This causes losses of information security for the mobile equipment.

Examples of attacks on the SIM are known as WIBAttack or S@TAttack, which have influenced hundred millions of mobile equipments. It is more dangerous that the attacks on the SIM in general are non-preventable from the operating system layer of the application processor since the Proactive Commands may be sent directly to the baseband processor. Further, the vulnerabilities in the SIM are considered difficult for patching after installing the SIM in the mobile equipment for use.

To overcome the vulnerability problems of the SIM, a solution disclosed by SRLab (refer to https://srlabs. de/) provides a toolkit for detecting some known vulnerabilities in a SIM by sending check instructions to the SIM and checking the responses of the SIM. The check instructions and responses are already defined in the dataset with respect to detected vulnerabilities. A software according to a solution of SRLab is installed on a personal computer (PC) and exchanges with the SIM through a standard communication run once before installing the SIM in the mobile equipment, e.g., a mobile phone. It is notable that scanning the vulnerabilities only once does not continuously prevent security risks due to the attack instructions sent remotely to the SIM even when in use after installing the SIM in the mobile equipment. Simultaneously, this solution has been evaluated to be inconvenient and relatively complicated to common users.

To overcome security risks in use and for more convenience, a solution is provided according to US Patent Application Publication No. <CIT>, with the title "METHODS AND APPARATUS FOR A SIM-BASED FIREWALL," in order to build a software run on a SIM to filter and prevent malicious events originating from the network, from the mobile equipment, or from the SIM to interfaces with the external. However, in this solution there exist some problems as described below.

Thus, there is a demand for a solution that may overcome security risks of the SIM even when in use, which is more convenient and simpler to common users, increases real-time characteristic, and in the same time, may detect existing vulnerabilities in a SIM in a frequent and online manner even when the SIM has been installed in the mobile equipment.

<CIT>discloses a wireless device having a SIM firewall.

The object of the present invention is to provide a method, a mobile equipment, and a system for vulnerability detection and prevention in a SIM that overcome at least one or some of the aforementioned problems.

Another object of the present invention is to provide a method, a mobile equipment, and a system for vulnerability detection and prevention in a SIM that is more convenient and simple to common users.

Still another object of the present invention is to provide a method, a mobile equipment, and a system for vulnerability detection and prevention in a SIM that increase real-time, and may simultaneously detect existing vulnerabilities in a SIM frequently and online even when the SIM is installed in the mobile equipment.

Still another object of the present invention is to provide a method, a mobile equipment, and a system for vulnerability detection and prevention in a SIM using artificial intelligence (AI) to enhance the capabilities of vulnerability detection and prevention in a SIM.

To achieve at least the aforementioned objects, in an aspect, the present invention provides a method for vulnerability detection and prevention in a SIM, the method comprises:
generating a vulnerability detection and prevention unit for detecting and preventing vulnerabilities for the SIM, wherein the vulnerability detection and prevention unit is executed by a plurality of instructions stored on a mobile equipment where the SIM is installed, and is located in at least one secure processing region that is independent of an application processor and a baseband processor of the mobile equipment; receiving, by the vulnerability detection and prevention unit, at least one of the events, data, and instructions, wherein the events, data, and instructions are sent from the SIM to the baseband processor or the application processor, or sent from the baseband processor or the application processor to the SIM; analyzing, by the vulnerability detection and prevention unit, at least one of the received events, data, and instructions to determine whether the events, data, or instructions are associated with predetermined SIM vulnerabilities; stop, by the vulnerability detection and prevention unit, the sending of the events, data, or instructions from the SIM or to the SIM in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities; and sending, by the vulnerability detection and prevention unit, a warning message to the user interface of the vulnerability detection and prevention unit in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities.

According to an embodiment, the above method further comprises: generating a user interface of the vulnerability detection and prevention unit corresponding to the vulnerability detection and prevention unit; generating, by the vulnerability detection and prevention unit, a set comprising at least one vulnerability check proactive instruction; sending, by the user interface of the vulnerability detection and prevention unit, a request for checking the SIM to the vulnerability detection and prevention unit; sending, by the vulnerability detection and prevention unit, a set comprising at least one vulnerability check proactive instruction to the SIM in response to receiving the request for checking the SIM from the user interface; executing, by the SIM, the set comprising at least one vulnerability check proactive instruction, and sending a set comprising at least one vulnerability check result corresponding to the set comprising at least one vulnerability check proactive instruction to the vulnerability detection and prevention unit; analyzing, by the vulnerability detection and prevention unit, the set comprising at least one vulnerability check result to determine whether there are predetermined SIM vulnerabilities; and sending, by the user interface of the vulnerability detection and prevention unit, a warning message to the user about the SIM vulnerabilities in response to determining that there are predetermined SIM vulnerabilities.

According to an embodiment, the above method, before the analyzing, further comprises determining, by a mobile equipment, whether there is an event of SIM installment in the mobile equipment; and sending, by the vulnerability detection and prevention unit, the set comprising at least one vulnerability check proactive instruction to the SIM in response to determining that there is an event of SIM installment in the mobile equipment.

According to an embodiment, the vulnerability detection and prevention unit performs analyzing at least one of the received events, data, and instructions to determine whether the events, data, or instructions are associated with predetermined SIM vulnerabilities by using an artificial intelligence (AI) model using one of the events, data, and instructions as input data.

According to an embodiment, the vulnerability detection and prevention unit performs analyzing the set comprising at least one vulnerability check result to determine whether there are predetermined SIM vulnerabilities by using an artificial intelligence (AI) model using the set comprising at least one vulnerability check result as input data.

Optionally, the aforementioned AI model may be a Linear Regression model, a (Gradient) Boosting Tree model, a Pattern Matching model, a Support Vector Machine (SVM) model, and a Deep Learning model.

According to an embodiment, the above method further comprises a step of training an AI model, including collecting, by the vulnerability detection and prevention unit, a dataset comprising at least one of the events, data, instructions, vulnerability check proactive instructions, and vulnerability check results; sending, by the vulnerability detection and prevention unit, the dataset to the application processor or the baseband processor for sending to a server; and training, by the server, the AI model based on the dataset.

According to an embodiment, the above method further comprises sending, by the server, the trained AI model to the application processor or the baseband processor; sending, by the user interface of the vulnerability detection and prevention unit, a request for confirmation of whether to enable the update of the AI model sent to the vulnerability detection and prevention unit to the user; and updating, by the vulnerability detection and prevention unit, the AI model into the vulnerability detection and prevention unit in response to the user confirming to enable the update of the AI model sent to the vulnerability detection and prevention unit.

According to an embodiment, the updating, by the vulnerability detection and prevention unit, of the AI model into the vulnerability detection and prevention unit is performed automatically.

According to an embodiment, the updating of the AI model may be performed through OTA (Over-The-Air) mechanism or the Internet.

In another aspect, the present invention provides a computer-readable storage medium containing computer instructions that when executed will cause the computer to perform the above method.

In still another aspect, the present invention provides a mobile equipment including an application processor, a baseband processor, a SIM, and a vulnerability detection and prevention unit for detecting and preventing vulnerabilities for the SIM, characterized in that the vulnerability detection and prevention unit is located in at least one secure processing region that is independent of the application processor and the baseband processor; and that the vulnerability detection and prevention unit is configured to perform receiving at least one of the events, data, and instructions, the events, data, and instructions sent from the SIM to the baseband processor or the application processor, or sent from the baseband processor or the application processor to the SIM; analyze at least one of the received events, data, and instructions to determine whether the events, data, or instructions are associated with predetermined SIM vulnerabilities; and stop the sending of the events, data, or instructions from the SIM or to the SIM in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities.

According to an embodiment, the vulnerability detection and prevention unit is configured to be located in the trustzone of an ARM processor.

According to an embodiment, the vulnerability detection and prevention unit is configured to send a warning message to the user interface of the vulnerability detection and prevention unit in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities.

According to an embodiment, the user interface of the vulnerability detection and prevention unit is configured to send a request for checking the SIM to the vulnerability detection and prevention unit; the vulnerability detection and prevention unit is configured to send a set comprising at least one vulnerability check proactive instruction to the SIM in response to receiving the request for checking the SIM from the user interface; the SIM is configured to execute the set comprising at least one vulnerability check proactive instruction, and send a set comprising at least one vulnerability check result corresponding to the set comprising at least one vulnerability check proactive instruction to the vulnerability detection and prevention unit ; the vulnerability detection and prevention unit is configured to analyze the set comprising at least one vulnerability check result to determine whether there are predetermined SIM vulnerabilities; and the user interface of the vulnerability detection and prevention unit is configured to send a warning message to the user about the SIM vulnerabilities in response to determining that there are predetermined SIM vulnerabilities.

According to an embodiment, the above equipment is further configured to, before the vulnerability detection and prevention unit performs analyzing, determine whether there is an event of SIM installment in the mobile equipment; and sending, by the vulnerability detection and prevention unit, the set comprising at least one vulnerability check proactive instruction to the SIM in response to determining that there is an event of SIM installment in the mobile equipment.

In still another aspect, the present invention provides a system for vulnerability detection and prevention in a SIM, the system including the aforementioned mobile equipment and a server, wherein the vulnerability detection and prevention unit is configured to collect a dataset comprising at least one of the events, data, instructions, vulnerability check proactive instructions, and vulnerability check results, and send the dataset to the application processor or the baseband processor for sending to the server; and the server is configured to train an AI model based on the dataset.

According to an embodiment, the server is configured to send the trained AI model to the application processor or the baseband processor; the user interface of the vulnerability detection and prevention unit is configured to send a request for confirmation of whether to enable the update of the AI model sent to the vulnerability detection and prevention unit to the user; and the vulnerability detection and prevention unit is configured to update the AI model into the vulnerability detection and prevention unit in response to the user confirming to enable the update of the AI model sent to the vulnerability detection and prevention unit.

According to an embodiment, the vulnerability detection and prevention unit performs automatically updating the AI model into the vulnerability detection and prevention unit.

Below, the advantages, effects, and nature of the present invention may may be explained through the detailed description of preferred embodiments with reference to the appended figures. However, it should be understood that these embodiments are only described by way of example to clarify the advantages of the present invention, without limiting the scope of the present invention according to the described embodiments.

First, a method for vulnerability detection and prevention in a SIM in a preferred embodiment of the present invention will be described in details. The method is implemented based on a mobile equipment <NUM> with a SIM <NUM> installed therein and communicates with a network <NUM> through OTA (Over-The-Air) mechanism based on mobile phone networks (GSM - <NUM>, UMTS - <NUM>, LTE - <NUM>, etc.), or the like.

As shown in <FIG>, the mobile equipment <NUM> includes a SIM <NUM>, a vulnerability detection and prevention unit <NUM>, a baseband processor <NUM>, an application processor <NUM>, and a user interface <NUM> of the vulnerability detection and prevention unit.

Also shown in the figure, the vulnerability detection and prevention unit <NUM> is located in the upper layer of the SIM <NUM>, or may be understood as located to externally surround the SIM <NUM> to ensure that the events, data, and instructions transferred to and from the SIM <NUM> all through the vulnerability detection and prevention unit <NUM>, thereby analyzing, detecting, and filtering out insecure events, data, and instructions, such as the events, data, and instructions associated with predetermined SIM vulnerabilities, e.g., messages consisting of malicious codes.

Herein, the events, data, and instructions may be generally understood as transceived information packages occurring during the performance of the mobile equipment <NUM>, e.g., information packages transceived between the mobile equipment <NUM> and the network <NUM>, between the SIM <NUM> and the baseband processor <NUM>, between the SIM <NUM> and the application processor <NUM>, or other information packages. It should be noted that the information packages are not particularly limited, such as an information package not only containing a single event, data, or instruction, but may also include any combination of events, data, and instructions. In general, the terms "information package," "events," "data," "instructions" used herein are widely known in the art. For example, the vulnerability detection and prevention unit functions as a communication bridge with the SIM, the baseband processor, and the application processor through electric and logical communication, application communication in compliance with the 3GPP TS <NUM><NUM> and TS <NUM> specifications. The data, events, and instructions between the vulnerability detection and prevention unit and the SIM, the baseband processor, and the application processor in compliance with the TS <NUM><NUM> and TS <NUM> specifications. In addition, the data, events, and instructions may also be data, events, and instructions clearly described and shown in Patent Literature Nos. <CIT> and <CIT>, all of which may be combined with a solution provided according to the present invention by any known means.

The mobile equipment <NUM> may be one selected from equipments such as mobile phones, cellular phones, smart phones, satellite phones, wireless data cards, wireless personal assistant devices, wireless modems or electronic devices capable of wireless communication with a service provider to transmit and receive voices, sounds, images, data from the network provider.

The mobile equipment <NUM> uses the SIM <NUM> to register communication services with the network provider through the network <NUM>. The SIM <NUM> is generally a smart card that may include one or more processors (CPU), encoding processors, read-only memories (ROM), random access memories (RAM), EEPROMs, and input/output circuits. The SIM <NUM> may store information on a unique subscription identifier, a network to which the subscriber may connect, communication services that the subscriber may use, or a contact list. The SIM may contain value added applications such as banking, biometrics, health, security, digital signature, public key infrastructure (PKI), multimedia, and close customer application. The SIM <NUM> may also implement an SAT (SIM Application Toolkit) interface or other smart card application interfaces to communicate with the mobile equipment <NUM> according to the specification.

The SIM <NUM> may be replaced by a UICC (Universal Integrated Circuit Card). The UICC may include one or more identity modules such as GSM SIM, UMTS ISIM (Internet Protocol Multimedia Services Identity Module), CDMA R-UIM (Removable User Identity Module) and value added applications. The UICC implements the USAT (Universal SIM Application Toolkit), CAT (Card Application Toolkit), CCAT (CDMA Card Application Toolkit), and UATK (UIM Application Toolkit) interfaces.

According to the preferred embodiment, the vulnerability detection and prevention unit <NUM> contains executable instructions stored on a mobile equipment and located in at least one secure processing region that is independent of an application processor and a baseband processor of the mobile equipment, or the vulnerability detection and prevention unit <NUM> may be located on a secure processing region of an already equipped baseband processor (e.g., a trustzone of an ARM processor). The secure processing region is not limited to an already equipped secure processing region, rather it may be reset or redefined depending on the technologies and supporting capabilities of different microprocessor types.

<FIG> shows a method for vulnerability detection and prevention in a SIM according to this preferred embodiment.

As shown in the figure, the method for vulnerability detection and prevention in a SIM comprises the steps described below.

Step <NUM>: generating a vulnerability detection and prevention unit <NUM> to detect and prevent vulnerabilities for a SIM <NUM>.

In this step, the vulnerability detection and prevention unit <NUM> is executed by a plurality of instructions stored on the mobile equipment <NUM> with the SIM <NUM> installed therein, and located in at least one secure processing region that is independent of the application processor <NUM> and the baseband processor <NUM> of the mobile equipment <NUM>.

Step <NUM>: receiving, by the vulnerability detection and prevention unit <NUM>, at least one of the events, data, and instructions, wherein the events, data, and instructions are sent from the SIM <NUM> to the baseband processor <NUM> or the application processor <NUM>, or sent from the baseband processor <NUM> or the application processor <NUM> to the SIM <NUM>.

Step <NUM>: analyzing, by the vulnerability detection and prevention unit <NUM>, at least one of the received events, data, and instructions to determine whether the events, data, or instructions are associated with predetermined vulnerabilities in the SIM <NUM>.

Step <NUM>: stopping, by the vulnerability detection and prevention unit, the sending of the events, data, or instructions from the SIM <NUM> or to the SIM <NUM> in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities.

According to an embodiment of the invention, method for vulnerability detection and prevention in a SIM may further comprise sending a warning message to the user interface of the vulnerability detection and prevention unit in response to determining that the events, data, or instructions are associated with predetermined SIM vulnerabilities.

It is notable that the vulnerability detection and prevention unit <NUM> may be implemented by a software/application installed in the mobile equipment <NUM>, making it significantly convenient to use and overcoming the problems of restricted hardware resources that cause slow speed and reduction of real-time characteristic. Beside, all of the information packages sent from the SIM <NUM> or transmitted to the SIM <NUM> are processed/filtered through this software, the capabilities of detecting and processing vulnerabilities during the performance of the SIM <NUM> are well guaranteed.

To make it simpler while using, even to common users, the user interface <NUM> of the vulnerability detection and prevention unit that is installed and displayed on the mobile equipment <NUM> may be generated. Accordingly, the method for vulnerability detection and prevention in a SIM may further comprise:.

In a preferred embodiment, the vulnerability detection and prevention unit <NUM> performs the analysis to determine whether there are aforementioned vulnerabilities, which may be performed via comparing the analyzed events, data, and instructions with the events, data, and instructions having known vulnerabilities and storing in a database of vulnerabilities. If they are found identical or similar, the vulnerability detection and prevention unit <NUM> may provide results as specific events, data, or instructions analyzed to be associated with predetermined SIM vulnerabilities.

However, in practice, the predetermination of the vulnerabilities is not easy. Further, regarding known vulnerabilities, attackers (e.g., hackers or crackers) always change the methods or contents of the information packages associated with presumingly known vulnerabilities. For example, regarding junk messages, or messages containing malicious codes, the same message contents or malicious codes may be modified to add further information or replace some small details to no longer be the same as already known contents or malicious codes. This has led to effectiveness reduction in the comparison based on a database of vulnerabilities.

To overcome this problem, a preferred embodiment of the present invention applies artificial intelligence to perform analyzing to determine whether there are vulnerabilities. In particular, the vulnerability detection and prevention unit <NUM> performs the analysis to determine whether there are vulnerabilities in the SIM <NUM> by using an artificial intelligence (AI) model using the aforementioned events, data, instructions, vulnerability check proactive instructions, and vulnerability check results as input data.

It is known that an AI model is capable of better solving tasks of analysing and identifying different input data to provide a result with high accuracy. For example, use an AI model used in known classification tasks to classify messages into groups having malicious codes or not having malicious codes based on datasets that are events, data, instructions, vulnerability check proactive instructions and vulnerability check results labeled as training data for the AI model. It is obvious that the present invention is not limited to specific AI models, but optionally the aforementioned AI model may be an AI model that applies one of algorithms, including but not limited to, linear regression, (gradient) boosting tree, pattern matching, support vector machine (SVM), deep learning, or the like.

In general, the AI models is basically already known, the illustration and description of the specific AI models are intended for omission to avoid redundant information, and focus on the features that specify the present invention.

In a preferred embodiment, the aforementioned vulnerability detection and prevention unit <NUM> may load, or update the AI model from the server, and optionally, the loading, or updating of the AI model may be performed through OTA (Over-The-Air) mechanism, Internet connection, or the like. As a result, the vulnerability detection and prevention unit <NUM> may detect, filter, or even prevent the vulnerabilities that have not been known before.

Next, examples of specific active event/status flows of the method for vulnerability detection and prevention in a SIM according to the present invention will be described based on <FIG>, to better specify the above-mentioned method for vulnerability detection and prevention in a SIM.

<FIG> shows the activity flow of message checking and filtering.

As shown in the figure, it is assumed that the network <NUM> sends an OTA SMS containing malicious codes (a message consisting of malicious codes through OTA) to the SIM <NUM>, which when receiving the OTA SMS containing malicious codes, the SIM <NUM> will execute the message contain malicious codes as the sender desires, e.g., the attacker requests to send information on the location or account number of the victim (the user of the mobile equipment <NUM>). According to this activity flow, the message consisting of malicious codes will be sent to the baseband processor <NUM>, and obligated to pass through the vulnerability detection and prevention unit <NUM> for analyzing and checking whether the message is forwarded to the SIM <NUM>. When the vulnerability detection and prevention unit <NUM> analyzes and detects an OTA SMS containing malicious codes is associated with the vulnerabilities, the OTA SMS containing malicious codes will be rejected and not forwarded to the SIM <NUM>, simultaneously the vulnerability detection and prevention unit <NUM> will send a warning message to the user interface <NUM> of the vulnerability detection and prevention unit for the user to be aware. The warning message may be audio, image, vibration messages or the like, or combination thereof.

Also shown in the figure, it is assumed that the network <NUM> sends a safe OTA SMS to the SIM <NUM>, the message will be sent to the baseband processor <NUM>, and obligated to pass through the vulnerability detection and prevention unit <NUM> for analyzing and checking whether the message is forwarded to the SIM <NUM>. When the vulnerability detection and prevention unit <NUM> checks, analyzes, and does not detect any vulnerability, it will forward the message to the SIM <NUM>.

<FIG> shows the activity flow of proactive instruction checking and filtering.

As shown in the figure, it is assumed that the SIM <NUM> sends proactive instructions having malicious codes to the baseband processor <NUM> and/or the application processor <NUM>. This may occur when vulnerabilities existing on the SIM <NUM>. The proactive instructions having malicious codes may be directed to execute unsafe requests for the user of the mobile equipment <NUM> with the SIM <NUM> installed therein, e.g., sending the information on the location, and account number of the victim, or opening an application/a browser, performing a call, or sending a message to a specific subscriber. According to the activity flow, proactive instructions consisting of the codes are obligated to pass through the vulnerability detection and prevention unit <NUM> for analyzing and checking whether the instructions are forwarded to the baseband processor <NUM> and/or the application processor <NUM> for execution. When the vulnerability detection and prevention unit <NUM> analyzes and detects proactive instructions containing malicious codes associated with the vulnerabilities, the proactive instructions containing malicious codes will be rejected and not executed, and simultaneously the vulnerability detection and prevention unit <NUM> will send a warning message to the user interface <NUM> of the vulnerability detection and prevention unit for the user to be aware.

Also shown in the figure, it is assumed that the SIM <NUM> sends safe proactive instructions to the baseband processor <NUM> and/or the application processor <NUM>, the instructions are obligated to pass through the vulnerability detection and prevention unit <NUM> for analyzing and checking whether the message is executable. When the vulnerability detection and prevention unit <NUM> checks, analyzes and does not detect any vulnerability, it will forward the instructions to the baseband processor <NUM> and/or the application processor <NUM> for execution.

<FIG> shows the activity flow of detecting SIM vulnerabilities performed by the user through the user interface <NUM> of the vulnerability detection and prevention unit.

As shown in the figure, it is assumed that the user wants to check the SIM <NUM>, and sends a request for checking the vulnerabilities through the user interface <NUM> of the vulnerability detection and prevention unit to the vulnerability detection and prevention unit <NUM>. The vulnerability detection and prevention unit <NUM> will generate a set comprising at least one check proactive instruction to be sent to and executed in the SIM <NUM>, a set comprising at least one check response/result after execution in the SIM <NUM> will be returned to the vulnerability detection and prevention unit <NUM> for analyzing and checking, if the set comprising at least one check response/result is determined to be associated with any vulnerability, the user interface <NUM> of the vulnerability detection and prevention unit will send a warning message to the user about the SIM vulnerabilities. Of course when no vulnerability is detected, the user may also be informed through the user interface <NUM> of the vulnerability detection and prevention unit.

<FIG> shows the activity flow of updating the AI model used in analyzing, detecting events, a message, data, proactive commands consisting of malicious codes, and vulnerabilities in the SIM <NUM>.

As shown in the figure, data on the vulnerabilities including at least one of the events, data, instructions, vulnerability check proactive instructions, and vulnerability check results may be collected by the vulnerability detection and prevention unit <NUM>. Of course the data collection is not limited to the vulnerability detection and prevention unit <NUM> of the mobile equipment <NUM> that may in general be collected from multiple different mobile equipment <NUM>, and even multiple different sources to generate a large database, even including simulated data. Advantageously, newly detected or simulated vulnerabilities may help train new or updated AI models, and be updated for multiple different mobile equipment <NUM>.

When the vulnerability detection and prevention unit <NUM> collects data, it will send the data through the baseband processor <NUM>, the application processor <NUM>, or the user interface <NUM> of the vulnerability detection and prevention unit, to a remote server. The data will be used to analyze and train for generation of the new or updated AI model. This AI model will the be updated for the vulnerability detection and prevention unit <NUM>. The updating may be actively performed from the user request, or may be sent from the server and updated when there is user permission. According to an embodiment, the updating, by the vulnerability detection and prevention unit, of the AI model into the vulnerability detection and prevention unit may be performed automatically.

According to an embodiment illustrated on the figure, the server sends a notification to update the AI model for the vulnerability detection and prevention unit <NUM> through the baseband processor <NUM>, the application processor <NUM>, or the user interface <NUM> of the vulnerability detection and prevention unit, and checks the user permission, if permitted, it will perform updating the AI model for the vulnerability detection and prevention unit <NUM>.

In a further aspect, the present invention provides a system for vulnerability detection and prevention in a SIM. In general, the system for vulnerability detection and prevention in a SIM includes a mobile equipment <NUM> with a SIM <NUM> installed therein and a server.

The server may be a centralized or decentralized server or server cluster, or a server with cloud technology application.

The mobile equipment <NUM> with the SIM <NUM> installed therein has similar features and functions to those described above, repetitions thereof are intended for omission to avoid redundancy.

In still another aspect, the present invention provides computer-readable storage medium to store computer programs consisting of instructions that execute multiple steps of the method for vulnerability detection and prevention in a SIM or generate multiple functions for the system for vulnerability detection and prevention in a SIM as described.

Claim 1:
A method for vulnerability detection and prevention in a SIM, Subscriber Identity Module, the method comprising:
generating a vulnerability detection and prevention unit (<NUM>) for detecting and preventing vulnerabilities for the SIM (<NUM>), wherein the vulnerability detection and prevention unit (<NUM>) is executed by a plurality of instructions stored on a mobile equipment (<NUM>) where the SIM (<NUM>) is installed, and is located in at least one secure processing region that is independent of an application processor (<NUM>) of the mobile equipment (<NUM>), wherein a baseband processor of the mobile equipment is an ARM processor and the at least one secure processing region is a trustzone of the ARM processor;
receiving, by the vulnerability detection and prevention unit (<NUM>), at least one of the events, data, and instructions, wherein the events, data, and instructions are sent from the SIM (<NUM>) to the baseband processor (<NUM>) or the application processor (<NUM>), or sent from the baseband processor (<NUM>) or the application processor (<NUM>) to the SIM (<NUM>);
analyzing, by the vulnerability detection and prevention unit (<NUM>), at least one of the received events, data, and instructions to determine whether the events, data, or instructions are associated with predetermined SIM (<NUM>) vulnerabilities; and
stopping, by the vulnerability detection and prevention unit (<NUM>), the sending of the events, data, or instructions from the SIM (<NUM>) or to the SIM (<NUM>) in response to determining that the events, data, or instructions are associated with predetermined SIM (<NUM>) vulnerabilities.