Patent ID: 12219659

DETAILED DESCRIPTION

FIGS.1through3D, discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged electronic device.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In describing the present disclosure below, related well-known functions or configurations incorporated herein are not described in detail in the case where it is determined that they obscure the subject matter of the present disclosure in unnecessary detail. Further, terms to be described later are terms defined in consideration of their functions in the present disclosure, but may differ depending on intentions of a user and an operator or customs. Accordingly, they should be defined on the basis of the contents of the whole description of the present disclosure.

The aspects and features of the present disclosure and methods for achieving the aspects and features will be apparent by referring to the embodiments to be described in detail with reference to the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed hereinafter, but can be implemented in diverse forms. The matters defined in the description, such as the detailed construction and elements, are nothing but specific details provided to assist those of ordinary skill in the art in a comprehensive understanding of the disclosure, and the present disclosure is only defined within the scope of the appended claims. In the entire description of the present disclosure, the same drawing reference numerals are used for the same elements across various figures.

First Embodiment

FIG.1Ais a diagram illustrating the structure of a network in which a terminal that is mounted with an eSIM performs SIM profile provisioning.

Referring toFIG.1A, a terminal (or User Equipment (UE)) is mounted with an embedded Universal Integrated Circulated Card (eUICC) in order to use an eSIM. After the terminal secures connectivity through connection to a packet core network, the eUICC receives provisioning of a SIM profile that corresponds to a Mobile Network Operator (MNO) that will use a data service from an eSIM server (e.g., SM-DP+ server). If the terminal or the eUICC does not have an address of an SM-DP+ server, the terminal receives provisioning of the SIM profile through connection to the SM-DP+ server after acquiring the address of a suitable SM-DP+ server through connection to an SM-DS server that is one other eSIM server.

The packet core network to which the terminal connects to secure the connectivity may be, for example, a cellular network that provides data communication, and may be, for example, an Evolved Packet System (EPS) that provides an LTE network service or a 5G network. There may be an MM functional entity that takes charge of mobility management of the terminal and an SM functional entity that takes charge of session management, and through the functional entities, signaling messages may be processed. In the case of an EPS, an MME serves as the MM functional entity and the SM functional entity. Further, an Equipment Identity Register (EIR) is an entity that determines whether the terminal is a permitted terminal through an IMEI of the terminal in a network, and in the present disclosure, the EIR is defined as an entity that can determine whether the eUICC is a permitted eUICC with respect to an eUICC ID. As an authentication server for encrypted communication with the terminal or the eUICC, for example, there is an AAA server, and if encryption is not performed in the process of connecting to the packet core network, the AAA server is not used. Although not illustrated inFIG.1A, the system may include a base station, and through the base station, the terminal and the MM or the terminal and the MME may transmit and receive signals, information, data, and messages.

FIGS.1B-1and1B-2are diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to perform initial provisioning according to an embodiment of the present disclosure. Hereinafter,FIGS.1B-1and1B-2are commonly calledFIG.1B.

Referring toFIG.1B, in an embodiment of the present disclosure, a process is illustrated, in which connectivity is acquired through connection to a cellular network, provisioning of a SIM profile is received through an eSIM server, and connection to the network is performed using the downloaded SIM profile.

In a turn-on state, a terminal1b-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes the necessity of initial provisioning and transfers a list of available Public Land Mobile Networks (PLMNs) to an application of the terminal or an entity that takes charge of the initial provisioning on the basis of a list of PLMNs that are sensed through a cell search (1b-001).

The terminal1b-100may select a PLMN to be connected to for the initial provisioning on the basis of the transferred PLMN list (1b-002). The selection of the PLMNs may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal. For example, in the case of a smart phone that facilitates the user's input, an initial provisioning app presents a list of PLMNs that can be selected through a UI, and a user may select a PLMN through which the user desires to receive the provisioning. As another method, if it is difficult to make the user's input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT-oriented terminal, and thus there is no information on the communication network service provider in the terminal, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal itself, such as selection of a PLMN having the highest signal strength among available PLMNs.

The terminal1b-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to an MME1b-200. In this case, through an attach request message, it can be known that an attach type is for the initial provisioning (1b-003). For example, “attach type=initial provisioning” may be used. In this case, the attach request message may include an identity of the terminal1b-100, for example, both or one of an International Mobile Station Equipment Identity (IMEI) or an eUICC identity (e.g., eUICC ID or eID). Further, the attach request message may include both or one of an address of an SM-DS server and an address of an SM-DP+ server to be connected to the terminal.

The MME1b-200transmits a request message to an EIR1b-300in order to determine whether the terminal that has sent the attach request is a terminal that is permitted in the corresponding PLMN, or whether the eUICC that is used by the terminal is a permitted eUICC. The request message may include at least one of an IMEI and an eUICC ID, and may request checking of whether the ID is permitted with respect to each identifier or both identifiers (1b-004).

The EIR1b-300checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC on the basis of information that is received from the MME1b-200(1b-005). The EIR1b-300may determine whether to permit the IMEI or eUICC ID in a manner that network connection is rejected if a transmitted ID is in a blacklist of IMEIs or eUICC IDs that are managed to prevent inferiority or robbery that is managed in the corresponding service provider network or to prevent online opening. As another method, network connection is permitted only in the case where a transmitted ID is included in a white list of IMEIs or EUICC IDs of terminals, of which the online opening can be specially permitted by the corresponding service provider. In the case where a terminal manufacturer that has manufactured IoT terminals provides information on IMEI or eUICC ID to an IoT service provider without providing network opening to the IoT service provider, and IoT service providers make a contract to use a network of a communication network service provider later, information on the IMEI or eUICC ID that is received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store the white list in the EIR1b-300on the basis of the transferred information, and may permit an attach only with respect to the terminal of the IMEI or eUICC ID to be subscribed through checking whether the IMEI, eUICC ID, or both of them are permitted IDs through the EIR with respect to all the terminals that have sent an attach request for the initial provisioning.

The EIR1b-300may transmit to the MME1b-200information that indicates whether connection of the terminal1b-100or eUICC is permitted (1b-006).

If the information that is received from the EIR1b-300indicates that the connection is not permitted, the MME1b-200may send an attach reject message to the terminal1b-100to reject the network connection (1b-007). In this case, the rejection cause that is included in the reject message may include eUICC ID mismatch in the PLMN, IMEI mismatch in the PLMN, eUICC ID is not available in the PLMN, and IMEI is not available in the PLMN.

In the case of receiving the attach reject message, the terminal1b-100may store the ID of the corresponding PLMN in a forbidden PLMN list for initial provisioning, and may re-select the PLMN among available PLMNs (1b-008). In this case, the PLMN that is included in the forbidden PLMN list for initial provisioning is excluded from the available PLMN list. The selection of the PLMN is performed in the same method as1b-002, and the terminal1b-100performs again an attach request process for the initial provisioning.

On the other hand, if the EIR1b-300notifies the MME1b-200that the connection of the terminal1b-100has been permitted (1b-006), the MME1b-200omits an authentication/authorization process for security, and selects a GW for the initial provisioning. That is, in an embodiment of the present disclosure, since the attach process is an attach process for provisioning, it is newly proposed for the MME1b-200to omit the authentication/authorization process. At operation1b-003, the terminal1b-100may piggyback a PDN connectivity request on an attach request message, and even if the PDN connectivity request is not transferred together in the case where the access type of the attach request message is for the initial provisioning, the MME1b-200selects the GW1b-400for performing the initial provisioning, and transfers a create session request to the GW1b-400to request the GW to make the PDN connection (1b-010). In this case, if the GW for the initial provisioning is not designated to be used as a separate entity in the network, the create session request includes an indication capable of notifying of the initial provisioning. Further, the create session request may include an address of an SM-DS server that is received from the terminal1b-100or an address of an SM-DP+ server.

On the other hand, if it is recognized that the create session request is for the initial provisioning, the GW1b-400that has received the create session request may allocate an IP address, and may operate to generate a default EPS bearer context. In this case, the GW generates a Traffic Flow Template (TFT) in the default EPS bearer so that the terminal1b-100can use the same only for the purpose of traffic for the initial provisioning, and it configures an uplink/downlink packet filter so that the communication becomes possible only in the case where the address of the eSIM server (e.g., SM-DP+ server or SM-DS server) is included as a destination/source IP address (1b-011). In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal1b-100, or the address that is serviced by the terminal1b-100may be used for authorization.

The GW1b-400may transmit a create session response message to the MME1b-200. The create session response message may include the TFT that includes the uplink/downlink packet filter for the default EPS bearer (1b-012).

The MME1b-200may include the received TFT in an activate default EPS bearer context request message (1b-013). The MME1b-200may transfer the activate default EPS bearer context request message to the terminal1b-100together with an attach accept message (1b-014).

The terminal1b-100may transfer an attach complete message to the MME1b-200, and at this time, it may transfer an active default EPS bearer context accept message together (1b-015). Thereafter, the terminal1b-100may establish a PDN connection to the GW1b-400(1b-016).

Thereafter, the terminal1b-100may attach to an eSIM server1b-500using the acquired connectivity to receive provisioning of a SIM profile (1b-017). If an SM-DS address exists in a packet filter that is configured in the TFT, but an SM-DP+ address is omitted to cause the SIM profile provisioning to be unsuccessfully performed in the process of attaching to the eSIM server, the terminal adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (1b-018). If the provisioning of the SIM profile is successfully performed, the terminal1b-100performs a normal attach process using the downloaded SIM profile to use a data service (1b-019).

FIGS.1C-1and1C-2are diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to perform initial provisioning according to an embodiment of the present disclosure. Hereinafter,FIGS.1C-1and1C-2are commonly calledFIG.1C.

Referring toFIG.1C, in an embodiment of the present disclosure, a process is illustrated, in which connectivity is acquired through connection to a cellular network, provisioning of a SIM profile is received through an eSIM server, and connection to the network is performed using the downloaded SIM profile. The technology illustrated inFIG.1Cis similar to the technology illustrated inFIG.2Bexcept for the procedure in which a GW installs a packet filter in a default EPS bearer.

In a turn-on state, a terminal1c-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes the necessity of initial provisioning and transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the initial provisioning on the basis of a list of PLMNs that are sensed through a cell search (1c-001).

The terminal1c-100may select a PLMN to be connected to for the initial provisioning on the basis of the transferred PLMN list (1c-002). The selection of the PLMNs may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal. For example, in the case of a smart phone that facilitates the user's input, an initial provisioning app presents a list of PLMNs that can be selected through a UI, and a user may select a PLMN through which the user desires to receive the provisioning. As another method, if it is difficult to make the user's input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT-oriented terminal, and thus there is no information on the communication network service provider in the terminal, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal itself, such as selection of a PLMN having the highest signal strength among available PLMNs.

The terminal1c-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to an MME1c-200. In this case, through an attach request message, it can be known that an attach type is for the initial provisioning (1c-003). For example, “attach type=initial provisioning” may be used. In this case, the attach request message may include an identity of the terminal, for example, both or one of an International Mobile Station Equipment Identity (IMEI) or an eUICC identity (e.g., eUICC IDs). Further, the attach request message may include both or one of an address of an SM-DS server and an address of an SM-DP+ server to be connected to the terminal.

The MME1c-200transmits a request message to an EIR1c-300in order to determine whether the terminal1c-100that has sent the attach request is a terminal that is permitted in the corresponding PLMN, or whether the eUICC that is used by the terminal1c-100is a permitted eUICC. The request message may include at least one of an IMEI and an eUICC ID, and may request checking of whether the ID is permitted with respect to each identifier or both identifiers (1c-004).

The EIR1c-300checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC on the basis of information that is received from the MME1c-200(1c-005).

The EIR1c-300may determine whether to permit the IMEI or eUICC ID in a manner that network connection is rejected if a transmitted ID is in a blacklist of IMEIs or eUICC IDs that are managed to prevent inferiority or robbery that is managed in the corresponding service provider network or to prevent online opening. As another method, network connection is permitted only in the case where a transmitted ID is included in a white list of IMEIs or eUICC IDs of terminals, of which the online opening can be specially permitted by the corresponding service provider. In the case where a terminal manufacturer that has manufactured IoT terminals provides information on IMEI or eUICC ID to an IoT service provider without providing network opening to the IoT service provider, and IoT service providers make a contract to use a network of a communication network service provider later, information on the IMEI or eUICC ID that is received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store the white list in the EIR1c-300on the basis of the transferred information, and may permit an attach only with respect to the terminal of the IMEI or eUICC ID to be subscribed through checking whether the IMEI, eUICC ID, or both of them are permitted IDs through the EIR with respect to all the terminals that have sent an attach request for the initial provisioning.

The EIR1c-300may transmit to the MME1c-200information that indicates whether connection of the terminal1c-100or eUICC is permitted (1c-006).

If the information that is received from the EIR1c-300indicates that the connection is not permitted, the MME1c-200may send an attach reject message to the terminal1c-100to reject the network connection (1c-007). In this case, the rejection cause that is included in the reject message may include eUICC ID mismatch in the PLMN, IMEI mismatch in the PLMN, eUICC ID is not available in the PLMN, and IMEI is not available in the PLMN.

In the case of receiving the attach reject message, the terminal1c-100may store the ID of the corresponding PLMN in a forbidden PLMN list for initial provisioning, and may re-select the PLMN among available PLMNs (1c-008). In this case, the PLMN that is included in the forbidden PLMN list for initial provisioning is excluded from the available PLMN list. The selection of the PLMN is performed in the same method as1c-002, and the terminal1c-100performs again an attach request process for the initial provisioning.

On the other hand, if the EIR1c-300notifies the MME1c-200that the connection of the terminal1c-100has been permitted (1c-006), the MME1c-200omits an authentication/authorization process for security, and selects a GW for the initial provisioning. That is, in an embodiment of the present disclosure, since the attach process is an attach process for provisioning, it is newly proposed for the MME1c-200to omit the authentication/authorization process. At operation1c-003, the terminal1c-100may piggyback a PDN connectivity request on an attach request message, and even if the PDN connectivity request is not transferred together in the case where the access type of the attach request message is for the initial provisioning, the MME1c-200selects the GW1c-400for performing the initial provisioning, and transfers a create session request to the GW1c-400to request the GW to make the PDN connection (1c-010). In this case, if the GW for the initial provisioning is not designated to be used as a separate entity in the network, the create session request includes an indication capable of notifying of the initial provisioning. Further, the create session request may include an address of an SM-DS server that is received from the terminal1c-100or an address of an SM-DP+ server.

On the other hand, if it is recognized that the create session request is for the initial provisioning, the GW1c-400that has received the create session request may allocate an IP address, operate to generate a default EPS bearer context, and send a create session response to the MME1c-200(1c-011). If the create session response is received, the MME1c-200may send an attach accept message to the terminal1c-100, and at this time, the MME1c-200may also transmit an activate default EPS bearer context request together. Detailed contents thereof have been described with reference toFIG.2B.

The GW1c-400, after or just after the create session response is transmitted, generates a TFT in the default EPS bearer so that the terminal1c-100can use the same only for the purpose of traffic for the initial provisioning, and it configures an uplink/downlink packet filter so that the communication becomes possible only in the case where the address of the eSIM server (e.g., SM-DP+ server or SM-DS server) is included as a destination/source IP address (1c-013).

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal1c-100, or the address that is serviced by the terminal1c-100may be used for authorization.

The GW1c-400may include the TFT in an update bearer request to be sent to the MME so as to apply the TFT that includes the uplink/downlink packet filter for the default EPS bearer as described above (1c-014).

On the other hand, the MME1c-200that has received the create session response message may transmit an activate default EPS bearer context request to the terminal1c-100together with the attach accept message. The terminal1c-100may transfer an attach complete message to the MME1c-200, and at this time, it may transfer an active default EPS bearer context accept message together (1c-015). Thereafter, the terminal1c-100may establish a PDN connection to the GW1c-400(1c-016).

Further, at operation1c-014, the MME1c-200that has received the update bearer request applies to the default EPS bearer the TFT that includes the packet filter that limits the use of traffic only for the initial provisioning through EPS bearer modification, and notifies the GW1c-400of the result through the update bearer response message. That is, the MME1c-200transmits a modify EPS bearer context request message to the terminal1c-100(1c-017). The terminal1c-100transmits a modify EPS bearer context accept message to the MME1c-200. Thereafter, the MME1c-200transmits an update bearer response message to the GW1c-400.

Thereafter, the terminal may attach to an eSIM server1c-500using the acquired connectivity to receive provisioning of a SIM profile (1c-020). If an SM-DS address exists in a packet filter that is configured in the TFT, but an SM-DP+ address is omitted to cause the SIM profile provisioning to be unsuccessfully performed in the process of attaching to the eSIM server1c-500, the terminal1c-100adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (1c-021). If the provisioning of the SIM profile is successfully performed, the terminal1c-100may perform a normal attach process using the downloaded SIM profile to use a data service (1c-022).

FIGS.1D-1and1D-2are diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to perform initial provisioning in consideration of an ID security according to an embodiment of the present disclosure. Hereinafter,FIGS.1D-1and1D-2are commonly calledFIG.1D.

Referring toFIG.1D, in an embodiment of the present disclosure, a process is illustrated, in which connectivity is acquired through connection to a cellular network, provisioning of a SIM profile is received through an eSIM server, and connection to the network is performed using the downloaded SIM profile. In particular, this embodiment includes a method for encrypting information, such as IMEI or eUICC ID.

In a turn-on state, a terminal1d-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes the necessity of initial provisioning and transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the initial provisioning on the basis of a list of PLMNs that are sensed through a cell search (1d-001).

The terminal1d-100may select a PLMN to be connected to for the initial provisioning on the basis of the transferred PLMN list (1d-002). The selection of the PLMNs may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal. For example, in the case of a smart phone that facilitates the user's input, an initial provisioning app presents a list of PLMNs that can be selected through a UI, and a user may select a PLMN through which the user desires to receive the provisioning. As another method, if it is difficult to make the user's input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT-oriented terminal, and thus there is no information on the communication network service provider in the terminal, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal itself, such as selection of a PLMN having the highest signal strength among available PLMNs.

The terminal1d-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to an MM functional entity1d-200. In this case, through an attach request message, it can be known that an attach type is for the initial provisioning (1d-003). For example, “attach type=initial provisioning” may be used.

The MM functional entity1d-200that has received the attach request triggers an Extensible Authentication Protocol (EAP) process, and the terminal1d-100authenticates an AAA server1d-600on the basis of an AAA server certificate through EAP-TLS or EAP-TTLS between the terminal1d-100and the AAA server1d-600of a network, and generates a secure tunnel on the basis of an encryption key that is created in the authentication process (1d-004).

If the secure tunnel is generated, the terminal1d-100transmits an IMEI, an eUICC ID, or both of them to the MM functional entity1d-200(1d-005). Again, the MM functional entity1d-200determines whether the transmitted ID is a permitted ID through sending the IMEI, eUICC ID, or both of them to an EIR1d-300.

Further, the terminal1d-100may send to the MM functional entity1d-200including both or one of an address of an SM-DS server and an address of an SM-DP+ server to be connected to the terminal1d-100.

As another embodiment, processes of the above-described operations1d-005,1d-006,1d-007, and1d-008may be replaced by a method in which the terminal transfers the IMEI, eUICC ID, or both IDs to the AAA server through an EAP message at operation1d-004, and the AAA server determines whether the transferred ID is a permitted ID through sending of the IMEI, eUICC ID, or both IDs to the EIR.

The EIR1d-300checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC on the basis of information that is received from the MM functional entity1d-200(1d-007).

The EIR may determine whether to permit the IMEI or eUICC ID in a manner that network connection is rejected if the transmitted ID is in a blacklist of IMEIs or eUICC IDs that are managed to prevent inferiority or robbery that is managed in the corresponding service provider network or to prevent online opening. As another method, network connection is permitted only in the case where a transmitted ID is included in a white list of IMEIs or eUICC IDs of terminals, of which the online opening can be specially permitted by the corresponding service provider. In the case where a terminal manufacturer that has manufactured IoT terminals provides information on IMEI or eUICC ID to an IoT service provider without providing network opening to the IoT service provider, and IoT service providers make a contract to use a network of a communication network service provider later, information on the IMEI or eUICC ID that is received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store the white list in the EIR1d-300on the basis of the transferred information, and may permit an attach only with respect to the terminal of the IMEI or eUICC ID to be subscribed through checking whether the IMEI, eUICC ID, or both of them are permitted IDs through the EIR with respect to all the terminals that have sent an attach request for the initial provisioning.

The EIR1d-300may transmit to the MM functional entity1d-200information that indicates whether connection of the terminal1d-100or eUICC is permitted (1d-008).

If the information that is received from the EIR1d-300indicates that the connection is not permitted, the MM functional entity1d-200may send an attach reject message to the terminal1d-100to reject the network connection (1d-009). In this case, the rejection cause that is included in the reject message may include eUICC ID mismatch in the PLMN, IMEI mismatch in the PLMN, eUICC ID is not available in the PLMN, and IMEI is not available in the PLMN.

In the case of receiving the attach reject message, the terminal1d-100may store the ID of the corresponding PLMN in a forbidden PLMN list for initial provisioning, and may select the PLMN among available PLMNs (1d-010). In this case, the PLMN that is included in the forbidden PLMN list for initial provisioning is excluded from the available PLMN list. The selection of the PLMN is performed in the same method as1d-002, and the terminal1d-100performs again an attach request process for the initial provisioning.

On the other hand, if the EIR1d-300notifies the MM functional entity1d-200of the connection permission (1d-008), the MM functional entity1d-200omits an authentication/authorization process for security (1d-011), and requests an SM functional entity1d-201to generate a PDU session for initial provisioning (1d-012). That is, in an embodiment of the present disclosure, since the attach process is an attach process for provisioning, it is newly proposed for the MM functional entity1d-200to omit the authentication/authorization process. At operation1d-003, the terminal1d-100may piggyback a PDN connectivity request on an attach request message, and even if the PDN connectivity request is not transferred together in the case where the access type of the attach request message is for the initial provisioning, the MM functional entity1d-200may request the SM functional entity1d-201to generate the PDU session for performing the initial provisioning. In this case, a PDU generation request message may include an address of an SM-DS server that is received from the terminal1d-100or an address of an SM-DP+ server.

The SM functional entity1d-201that has received the PDU generation request selects the GW1d-400for the initial provisioning, and transfers a create session request to the GW1d-400to request the GW to make the PDU connection (1d-014). In this case, if the GW for the initial provisioning is not designated to be used as a separate entity in the network, the create session request includes an indication capable of notifying of the initial provisioning.

Further, the create session request may include an address of an SM-DS server that is received from the terminal1d-100or an address of an SM-DP+ server.

On the other hand, if it is recognized that the create session request is for the initial provisioning, the GW1d-400that has received the create session request may allocate an IP address, and may operate to generate a default bearer context. In this case, the GW generates a TFT in the default bearer so that the terminal1d-100can use the same only for the purpose of traffic for the initial provisioning, and it configures an uplink/downlink packet filter so that the communication becomes possible only in the case where the address of the eSIM server (e.g., SM-DP+ server or SM-DS server) is included as a destination/source IP address (1d-015).

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal1d-100, or the address that is serviced by the terminal1d-100may be used for authorization.

If the GW1d-400has sent the TFT that includes the uplink/downlink packet filter for the default bearer to the SM functional entity1d-201as described above (1d-016), the SM functional entity1d-201may configure the PDU connection through messaging for bearer setup between the MM functional entity1d-200and the terminal1d-100, and in the process, the TFT information is transferred to the terminal (1d-017).

Further, as another embodiment, the GW1d-400does not transfer the TFT that is generated at operation1d-015to the terminal1d-100through operations1d-016and1d-017, but may transfer to the terminal1d-100the TFT that limits the use of traffic only for the initial provisioning through a process of updating the default bearer through the bearer update request (1d-018,1d-019, and1d-020).

Thereafter, the terminal may attach to an eSIM server1d-500using the acquired connectivity to receive provisioning of a SIM profile (1d-021). If an SM-DS address exists in a packet filter that is configured in the TFT, but an SM-DP+ address is omitted to cause the SIM profile provisioning to be unsuccessfully performed in the process of attaching to the eSIM server1d-500, the terminal1d-100adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (1d-022). If the provisioning of the SIM profile is successfully performed, the terminal1d-100may perform a normal attach process using the downloaded SIM profile to use a data service (1d-023).

Second Embodiment

FIG.2Ais a diagram illustrating the structure of a network in which a terminal that is mounted with an eSIM performs SIM profile provisioning. A terminal (or User Equipment (UE)) is mounted with an embedded Universal Integrated Circulated Card (eUICC) in order to use an eSIM. After the terminal secures connectivity through connection to a packet core network, the eUICC receives provisioning of a SIM profile that corresponds to a Mobile Network Operator (MNO) that will use a data service from an eSIM server (e.g., SM-DP+ server) that stores the SIM profile therein. If the terminal or the eUICC does not have an address of the SM-DP+ server, the terminal receives provisioning of the SIM profile through attaching to the SM-DP+ server after acquiring the address of a suitable SM-DP+ server through attaching to an SM-DS server that is an eSIM server for searching for the address of the SM-DP+ server that stores therein a SIM profile of a specific terminal.

The packet core network to which the terminal is attaching to secure the connectivity may be, for example, a cellular network that provides data communication, and may be, for example, an Evolved Packet System (EPS) that provides an LTE network service or a 5G network. There may be a Control Plane (CP) function that takes charge of a control related function, such as mobility management or session management and a User Plane (UP) function that takes charge of a UP related function, such as a packet data gateway, for forwarding of user data. The CP function may perform an authenticator for triggering an Extensible Authentication Protocol (EAP) process in an EAP authentication process, and after such authentication, it may also perform management of a security context for encrypting a signaling message.

Further, a user data repository may store therein user's subscription information, for example, an ID (i.e., ED) of an eUICC of a subscribed user terminal and address information of a SM-DP+ that stores a SIM profile for the corresponding EID. Further, the user data repository may store therein an ED white list that is a list of information of permitted eUICC, or may store therein an ED black list that is a list of information of unpermitted eUICC. Further, the user data repository is an entity which provides the address information of the SM-DP+ that stores therein a SIM profile related to whether the eUICC is an eUICC of a subscribed terminal on the basis of the stored information, or determines whether the eUICC is a permitted eUICC. A subscription portal is a subscription portal server to which a user can attach to select a desired subscription plan. Further, there is an AAA server for authenticating the eUICC. The AAA server has a certificate of a root Certificate Authority (CA), and the eUICC also has its own certificate, a private key, and a certificate of a root Certificate Authority (CA), and if encryption is not performed in the process of connecting to the packet core network, the AAA server is not used. Although not illustrated inFIG.1B, the system may include a base station, and through the base station, the terminal and the MM or the terminal and the MME may transmit and receive signals, information, data, and messages.

FIGS.2BA to2BEare diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to perform remote provisioning through determination of subscription/non-subscription in an EAP process. Hereinafter,FIGS.2BA to2BEare commonly calledFIG.2B.

Referring toFIG.2B, in an embodiment of the present disclosure, a process is illustrated, in which a user or a terminal has already subscribed to a specific communication company, and the terminal having no SIM profile acquires connectivity through attaching to a cellular network and receives provisioning of the SIM profile through an eSIM server.

Accordingly, at operation2b-001, a user data repository2b-500stores therein ID (i.e., EID) information of an eUICC that is provided in a terminal2b-100subscribed by the user or a terminal2b-100subscribed by an IoT service provider, and also stores therein address information of an eSIM server2b-600that provides provisioning of subscription data that corresponds to the EID and the SIM profile that corresponds to the EID. For example, the eSIM server2b-600that provides SIM profile provisioning may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning.

On the other hand, the specific SM-DP+2b-600is a provisioning server that stores therein a SIM profile that corresponds to the EID of the subscribed terminal2b-100, and the address information of the SM-DP+ is mapped on the EID information to be stored in the user data repository.

In a turn-on state, the terminal2b-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2b-100to receive the PDU connection through a cellular network, the terminal2b-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2b-002).

The terminal2b-100may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2b-003). The selection of the PLMNs by the terminal2b-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2b-100. For example, if a user has already known the subscribed PLMN information, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2b-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT-oriented terminal, and thus there is no information on the communication network service provider in the terminal2b-100, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal2b-100itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal2b-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2b-200(2b-004). In this case, since the terminal that has already subscribed to a communication company should receive provisioning of the SIM profile, it may separately indicate an attach type in an attach request message in order to indicate the attach process. For example, the terminal sets “attach type=remote provisioning”. In this case, the attach request message may include an identity of the terminal2b-100, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2b-200or authenticator2b-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2b-200or authenticator2b-200triggers an EAP process2b-005, and the eUICC of the terminal authenticates an AAA2b-400on the basis of an AAA certificate through an EAP-TTLS between the eUICC and the network, or performs mutual authentication between the eUICC of the terminal2b-100and the AAA on the basis of an eUICC certificate, and creates a secure tunnel between the terminal2b-100and the AAA2b-400on the basis of an encryption key that is created during the authentication process. The terminal2b-100sends the eUICC information to the AAA2b-400through the created secure tunnel (2b-005a). The eUICC information may include an eUICC ID (i.e., EID), and may further include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2b-100or the eUICC or a server (e.g., SM-DS) for searching for an address of the provisioning server.

The AAA that has received the eUICC information transmits an eUICC ID check request message that includes the eUICC information to the user data repository2b-500in order to determine whether the eUICC is an eUICC of a subscribed user (2b-005b).

The user data repository2b-500determines whether the received eUICC ID has been subscribed (2b-005c). If there is no information on the corresponding eUICC ID in the user data repository, it is checked whether the received eUICC ID that has not been subscribed to the corresponding PLMN corresponds to a terminal that has been subscribed to another PLMN. That is, the user data repository may attach to a server (e.g., SM-DS) that can search for the address of the provisioning server, and may find out what PLMN the terminal has been subscribed to with respect to the corresponding eUICC ID, or of what SIM profile a server (e.g., SM-DP+), in which the SIM profile of the eUICC ID has been stored, provides provisioning.

The user data repository2b-500transfers information of a related server to the AAA2b-400together with subscription/non-subscription of the eUICC ID (2b-005d).

For example, in the case of the eUICC that has been subscribed to the PLMN to which the terminal is attaching, the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. Further, ID information of the PLMN for notifying of the information of the subscribed PLMN may also be included therein. However, if the eUICC is determined as an eUICC that is not subscribed to the PLMN to which the terminal is attaching, it may be notified that the eUICC is an unsubscribed eUICC, while if the eUICC is determined as an eUICC that has been subscribed to another PLMN at operation2b-005c, ID information of the PLMN for notifying of the information of the subscribed PLMN may also be included therein. Further, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may also be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein.

On the other hand, the AAA2b-400that has received information on whether the eUICC has been subscribed may transfer the information to the CP function2b-200or the authenticator2b-200together with the authentication result in the process of completing the authentication process (2b-005e). For example, if the EAP authentication has been successfully completed, the AAA may transfer the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored together with a Master Session Key (MSK) that is created during the authentication process. Of course, the address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. Further, what PLMN the eUICC has been subscribed to may be included in the ID of the PLMN. IF the ID of the PLMN is omitted, it can be known that the eUICC has been subscribed to the PLMN being attached. However, if the EAP authentication has failed or if the eUICC is an unsubscribed eUICC, the EAP failure may be sent to the CP function2b-200or the authenticator2b-200. Even in this case, if the PLMN to which the corresponding terminal2b-100has been subscribed is grasped, the ID of the subscribed PLMN may also be included in the EAP failure message.

After completion of the authentication process, if the eUICC has not been subscribed to the corresponding PLMN and thus an attach to the network is not permitted, or if the EAP has failed and thus an attach is not permitted (2b-007), the CP function2b-200or the authenticator2b-200performs an attach reject. In this case, when an attach reject message is sent to the terminal2b-100, the terminal is notified that the eUICC has not been subscribed to the corresponding PLMN as a reject cause. For example, “cause=invalid eUICC” or “eUICC has not been subscribed to this PLMN” may be set. Further, if the CP function or the authenticator2b-200knows that the eUICC has been subscribed to another PLMN, ID information of the subscribed PLMN may be included therein (2b-007).

In the case of receiving the attach reject message, the terminal2b-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. If the attach reject message includes the ID of the PLMN to which the eUICC has been subscribed, the received PLMN may be selected to perform the next attach (2b-008). When the terminal2b-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2b-003, and the terminal2b-100performs again an attach request process for the remote provisioning.

On the other hand, the terminal2b-100and the CP function2b-200, or the authenticator2b-200share a security context on the basis of the MSK that is acquired at operation2b-005e, and perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2b-009). Operation2b-009may be performed before the attach reject is sent.

If the setup of the security key is completed, the CP function or the authenticator2b-200may send an attach accept message to the terminal2b-100to notify of successful attach to the network (2b-010). The attach accept message may include the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile for the eUICC ID is stored.

The terminal2b-100requests the CP function2b-200to create a PDU connection for SIM provisioning (2b-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to perform the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2b-004, the terminal2b-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the remote provisioning, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2b-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable network slice and select a suitable UP function of the selected network slice.

The CP function2b-200transmits a create session request message to a suitable UP function2b-300(2b-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2b-005e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2b-100. The create session request message may include an indication capable of notifying of the request for SIM provisioning.

Then, the UP function2b-300selects a GW for SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal2b-100can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal2b-100can use the same only for the purpose of traffic for the SIM provisioning (2b-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2b-100or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2b-005eand2b-012, or the address that is serviced by the terminal2b-100may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function2b-300so as to redirect the attach to the subscription portal.

The UP function2b-300may transfer a response to the CP function2b-200(2b-014), and the CP function2b-200may transfer a PDU connection response message up to the terminal2b-100(2b-015). In this case, the address of the SM-DP+ server for provisioning may be transferred up to the terminal2b-100together with the PDU connection response message.

Thereafter, the terminal2b-100attaches to the SM-DP+2b-600using the acquired PDU connectivity to receive a SIM profile (2b-017). However, if the terminal2b-100attempts an attach to an address other than the address that is permitted so that the terminal2b-100can use the address only for the purpose of traffic for the SIM provisioning, the attach is redirected to the subscription portal (2b-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (2b-018).

If the provisioning of the SIM profile is successfully performed, the terminal2b-100may perform a detach process for the attach using the downloaded SIM profile (2b-019). After selecting the downloaded SIM profile, the terminal2b-100may perform an attach process to use a data service (2b-020).

Instead of performing operations2b-019and2b-020, the terminal2b-100may not perform the detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIGS.2CA to2CDare diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to perform initial provisioning through an EAP process and a separate subscription/non-subscription determination procedure. Hereinafter,FIGS.2CA to2CDare commonly calledFIG.2C.

Referring toFIG.2C, in an embodiment of the present disclosure, a process is illustrated, in which a user or a terminal has already subscribed to a specific communication company, and the terminal having no SIM profile acquires connectivity through attaching to a cellular network and receives provisioning of the SIM profile through an eSIM server.

Accordingly, at operation2c-001, a user data repository2c-500stores therein ID (i.e., EID) information of an eUICC that is provided in a terminal2c-100subscribed by the user or a terminal2c-100subscribed by an IoT service provider, and also stores therein address information of an eSIM server2c-600that provides provisioning of subscription data that corresponds to the EID and the SIM profile that corresponds to the EID. For example, the eSIM server2c-600that provides SIM profile provisioning may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning.

On the other hand, the specific SM-DP+2c-600 is a provisioning server that stores therein a SIM profile that corresponds to the EID of the subscribed terminal2c-100, and the address information of the SM-DP+ is mapped on the EID information to be stored in the user data repository.

In a turn-on state, the terminal2c-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2c-100to receive the PDU connection through a cellular network, the terminal2c-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2c-002).

The terminal2c-100may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2c-003). The selection of the PLMNs by the terminal2c-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2c-100. For example, if a user has already known the subscribed PLMN information, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2c-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT-oriented terminal, and thus there is no information on the communication network service provider in the terminal2c-100, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal2c-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2c-200(2b-004). In this case, since the terminal that has already subscribed to a communication company should receive provisioning of the SIM profile, it may separately indicate an attach type in an attach request message in order to indicate the attach process. For example, the terminal sets “attach type=remote provisioning”. In this case, the attach request message may include an identity of the terminal2c-100, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal2c-100may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2c-200or authenticator2c-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2c-200or authenticator2c-200triggers an EAP process2c-005, and mutual authentication is performed between the eUICC of the terminal2c-100and an AAA2c-400on the basis of an AAA certificate and an eUICC certificate through an EAP-TLS or EAP-TTLS. In the process of completing the authentication process, the AAA2c-400may transfer the result of the authentication to the CP function2c-200or the authenticator2c-200(2c-005a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) that is created in the authentication process may be transferred while an EAP success is transmitted to the CP function2c-200or the authenticator2c-200. However, if the EAP authentication has failed, an EAP failure may be transmitted to the CP function2c-200or the authenticator2c-200. In this case, the CP function2c-200or the authenticator2c-200may perform an attach reject (2c-005b). On the other hand, the terminal2c-100and the CP function2c-200or the authenticator2c-200may share a security context on the basis of the MSK that is acquired at operation2c-005a, and may perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2c-006).

If the security is set up as described above, a process of checking whether an eUICC has been subscribed may be performed. For this, the CP function2c-200may request eUICC information from the terminal2c-100(2c-007a). If the eUICC information request message is received (2c-007a) or the setup of the security keys is completed (2c-006), the terminal2c-100may encrypt and transmit an eUICC ID of the terminal2c-100to the CP function2c-200(2c-007a).

The eUICC information may include an eUICC ID (i.e., EID), and may include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2c-100or the eUICC or an address of a server (e.g., SM-DS) for searching for an address of the provisioning server.

The CP function2c-200that has received the eUICC information transmits an eUICC ID check request message that includes the eUICC information to the user data repository2c-500in order to determine whether the eUICC is an eUICC of the subscribed user (2c-007c).

The user data repository2c-500determines whether the received eUICC ID has been subscribed (2c-007d). If there is no information on the corresponding eUICC ID in the user data repository2c-500, it is checked whether the received eUICC ID that has not been subscribed to the corresponding PLMN corresponds to a terminal that has been subscribed to another PLMN. That is, the user data repository may attach to a server (e.g., SM-DS) that can search for the address of the provisioning server, and may find out what PLMN the terminal has been subscribed to with respect to the corresponding eUICC ID, or of what SIM profile a server (e.g., SM-DP+), in which the SIM profile of the eUICC ID has been stored, provides provisioning.

The user data repository2c-500transfers information of a related server to the CP function2c-200together with subscription/non-subscription of the eUICC ID (2c-007e).

For example, in the case of the eUICC that has been subscribed to the PLMN to which the terminal is attaching, the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. Further, ID information of the PLMN for notifying of the information of the subscribed PLMN may also be included therein. However, if the eUICC is determined as an eUICC that is not subscribed to the PLMN to which the terminal is attaching, it may be notified that the eUICC is an unsubscribed eUICC, while if the eUICC is determined as an eUICC that has been subscribed to another PLMN at operation2c-007d, ID information of the PLMN for notifying of the information of the subscribed PLMN may also be included therein. Further, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may also be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. Further, the ID of the PLMN for notifying what PLMN the eUICC has been subscribed to may be included therein. If the ID of the PLMN is omitted, it can be known that the eUICC has been subscribed to the PLMN to which the terminal2c-100is attaching. However, if the eUICC has not been subscribed to the corresponding PLMN and thus an attach to the network is not permitted (2c-007f), an attach reject is performed. In this case, the CP function2c-200sends an attach reject message to the terminal2c-100, and notifies the terminal2c-100that the eUICC has not been subscribed to the corresponding PLMN as a reject cause. For example, “cause=invalid eUICC” or “eUICC has not been subscribed to this PLMN” may be set. Further, if the CP function2c-200knows that the eUICC has been subscribed to another PLMN, ID information of the subscribed PLMN may be included therein (2c-008).

In the case of receiving the attach reject message, the terminal2c-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. If the attach reject message includes the ID of the PLMN to which the eUICC has been subscribed, the received PLMN may be selected to perform the next attach (2c-008). When the terminal2c-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2c-003, and the terminal2c-100performs again an attach request process for the remote provisioning.

If the setup of the security keys is completed, the CP function2c-200or the authenticator2c-200may send an attach accept message to the terminal2c-100to notify of successful attach to the network (2c-010). The attach accept message may include the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile for the eUICC ID is stored.

The terminal2c-100requests the CP function2c-200to create a PDU connection for SIM provisioning (2c-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to perform the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2c-004, the terminal2c-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the remote provisioning, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2c-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable network slice and select a suitable UP function of the selected network slice.

The CP function2c-200transmits a create session request message to a suitable UP function2c-300(2c-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2c-005e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2c-100. The create session request message may also include an indication capable of notifying of the request for SIM provisioning. Then, the UP function2c-300selects a GW for SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal2c-100can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal2c-100can use the same only for the purpose of traffic for the SIM provisioning (2c-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2c-100, or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2c-005eand2c-012, or an address that is serviced by the terminal may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function2c-300so as to redirect the attach to the subscription portal.

The UP function2c-300may transfer a response to the CP function2c-200(2c-014), and the CP function2c-200may transfer a PDU connection response message up to the terminal2c-100(2c-015). In this case, the address of the SM-DP+ server for provisioning may be transferred up to the terminal2c-100together with the PDU connection response message.

Thereafter, the terminal2c-100attaches to the SM-DP+2c-600 using the acquired PDU connectivity to receive a SIM profile (2c-017). However, if the terminal2c-100attempts an attach to an address other than the address that is permitted so that the terminal2c-100can use the address only for the purpose of traffic for the SIM provisioning, the attach is redirected to the subscription portal (2c-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal2c-100adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (2c-018). If the provisioning of the SIM profile is successfully performed, the terminal2c-100may perform a detach process for the attach using the downloaded SIM profile (2c-019). After selecting the downloaded SIM profile, the terminal may perform an attach process to use a data service (2c-020).

Instead of performing operations2c-019and2c-020, the terminal2c-100may not perform the detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIGS.2DA to2DDare diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to make a subscription and to perform provisioning through determination of whether to permit eUICC in an EAP process. Hereinafter,FIGS.2DA to2DDare commonly calledFIG.2D.

Referring toFIG.2D, in an embodiment of the present disclosure, a process is illustrated, in which a terminal that has not yet subscribed to any communication company acquires connectivity through attaching to a cellular network, subscribes online to the network, and receives provisioning of a SIM profile through an eSIM server.

Accordingly, at operation2d-001, a user data repository2d-500stores therein white list information for an ID (i.e., EID) of a valid or permitted eUICC that is possessed by each service provider or blacklist information for an ID of an invalid eUICC that is reported to have a problem. For example, if an accident, such as an illegal use or theft, occurs for the corresponding EID in a specific communication company, the corresponding EID may be classified into a blacklist as unpermitted EID, and blacklist information may be shared with other communication companies in accordance with relationship between the communication companies. Further, in the case of terminals that are made for a specific communication company, EID information of the respective terminals are managed in the white list, and may be used to determine whether to permit their attaching for provisioning.

On the other hand, a terminal that has not yet been subscribed may select a subscription plan that is provided by a corresponding service provider through attaching to a subscription portal2d-600. In this case, selected information interlocks with a Business Sales System (BSS), and an eSIM server that provides provisioning of a SIM profile that corresponds to an EID of the terminal prepares a SIM profile for the corresponding selected subscription plan.

For example, the eSIM server that provides provisioning of the SIM profile may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning. In the description of the present disclosure, detailed interlocking schemes between a subscription portal, a BSS, and the SM-DP+ are not described.

In a turn-on state, the terminal2d-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2d-100to receive the PDU connection through a cellular network, the terminal2d-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2d-002). The terminal may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2d-003).

The selection of the PLMNs by the terminal2d-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2d-100. For example, if a user desires to subscribe to a PLMN, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2d-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if the user does not have a separate preference to the PLMN to which the user desires to subscribe, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal2d-100itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal2d-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2d-200(2d-004). In this case, in order to indicate that the terminal2d-100subscribes to a communication company and attaches thereto to receive provisioning of a SIM profile, the terminal separately indicates an attach type. For example, “attach type=subscription” is set. In this case, the attach request message may include an identity of the terminal2d-100, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal2d-100may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2d-200or authenticator2d-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2d-200or authenticator2d-200triggers an EAP process2d-005, and the eUICC of the terminal authenticates an AAA2d-400on the basis of an AAA certificate through an EAP-TTLS between the eUICC and the AAA2d-400of the network, or performs mutual authentication between the eUICC of the terminal2d-100and the AAA2d-400on the basis of an AAA certificate and an eUICC certificate, and creates a secure tunnel between the terminal2d-100and the AAA2d-400on the basis of an encryption key that is created during the authentication process. The terminal2d-100sends the eUICC information to the AAA2d-400through the created secure tunnel (2d-005a). The eUICC information may include an eUICC ID (i.e., EID), and may further include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2d-100or the eUICC or a server (e.g., SM-DS) for searching for an address of the provisioning server.

The AAA2d-400that has received the eUICC information may send an eUICC ID report message that includes the eUICC information to the user data repository2d-500in order to determine whether the eUICC is a permitted eUICC (2d-005b). The user data repository2d-500determines whether the received eUICC ID is a permitted eUICC (2d-005c). The user data repository2d-500transfers information of a server for related provisioning to the AAA2d-400together with permission/non-permission of the eUICC ID (2d-005d).

For example, in the case of the permitted eUICC, the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored in a PLMN to which the terminal2d-100is attaching may be included therein. Of course, the address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein.

On the other hand, the AAA2d-400that has received information on whether to permit the eUICC may transfer the information to the CP function2d-200or the authenticator2d-200together with the authentication result in the process of completing the authentication process (2d-005e). For example, if the EAP authentication has been successfully completed, the AAA may transfer the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored together with a Master Session Key (MSK) that is created during the authentication process. Of course, the address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the EAP authentication has failed or if the eUICC is an unpermitted eUICC, the EAP failure may be sent to the CP function or the authenticator2d-200.

After completion of the authentication process, if the eUICC is not permitted and thus an attach to the network is not permitted, or if the EAP has failed and thus an attach is not permitted (2d-007), the CP function2d-200or the authenticator2d-200performs an attach reject. In this case, when an attach reject message is sent to the terminal2d-100, the terminal is notified that the eUICC is not permitted as a reject cause. For example, “cause=invalid eUICC” or “eUICC is not available in this PLMN” may be set (2d-007).

In the case of receiving the attach reject message, the terminal2d-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. When the terminal2d-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2d-003, and the terminal2d-100performs again an attach request process for the subscription.

On the other hand, the terminal2d-100and the CP function2d-200, or the authenticator2d-200share a security context on the basis of the MSK that is acquired at operation2d-005e, and perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2d-009). Operation2d-009may be performed before the attach reject is sent.

If the setup of the security keys is completed, the CP function2d-200or the authenticator2d-200may send an attach accept message to the terminal2d-100to notify of successful attach to the network (2d-010). The attach accept message may include address information of the subscription portal to which the terminal2d-100should attach in order to subscribe to the subscription.

The terminal2d-100requests the CP function2d-200to create a PDU connection for SIM provisioning (2d-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to perform the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2d-004, the terminal2d-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the subscription, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2d-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable UP function of a suitable network slice that is selected.

The CP function2d-200transmits a create session request message to a suitable UP function2d-300(2d-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2d-005e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2d-100. The create session request message may include an indication capable of notifying of the request for SIM provisioning. Then, the UP function selects a GW for SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal2d-100can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal2d-100can use the same only for the purpose of traffic for the SIM provisioning (2d-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2d-100or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2d-005eand2d-012, or the address that is serviced by the terminal2d-100may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function so as to redirect the attach to the subscription portal.

The UP function2d-300may transfer a response to the CP function2d-200, and may transfer a PDU connection response message up to the terminal2d-100. In this case, the address information of the subscription portal to which the terminal2d-100should attach for the subscription may be transferred up to the terminal.

Thereafter, like operation2d-017, the terminal2d-100attaches to the subscription portal using the acquired PDU connectivity, and selects and subscribes to a desired subscription plan. In this case, the terminal2d-100may transfer the EID information to the subscription portal, or may transfer the EID information through encrypted transmission for safe transfer.

Further, if the provisioning has been prepared, the SM-DP+ may notify the terminal2d-100that the provisioning has been prepared.

Further, the terminal may receive the provisioning of the SIM profile through attaching to the corresponding SM-DP+ (2d-018).

However, if the terminal2d-100attempts an attach to an address other than the address that is permitted so that the terminal can use the address only for the purpose of traffic for the SIM provisioning, the attach may be redirected to the subscription portal (2d-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal2d-100adds an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then performs detach and attach request processes in order (2d-019). If the provisioning of the SIM profile is successfully performed, the terminal2d-100may select the downloaded SIM profile, and then may perform an attach process to use a data service (2d-021). Instead of performing operations2d-020and2d-021, the terminal2d-100may not perform a detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIGS.2EA to2EDare diagrams illustrating detailed network connection schemes for a terminal that is mounted with an eSIM to make a subscription and to perform provisioning through determination of whether to permit eUICC in an EAP process. Hereinafter,FIGS.2EA to2EDare commonly calledFIG.2E.

Referring toFIG.2E, in an embodiment of the present disclosure, a process is illustrated, in which a terminal that has not yet subscribed to any communication company acquires connectivity through attaching to a cellular network, subscribes online to the network, and receives provisioning of a SIM profile through an eSIM server.

Accordingly, at operation2e-001, a user data repository2e-500stores therein white list information for an ID (i.e., EID) of a valid or permitted eUICC that is possessed by each service provider or blacklist information for an ID of an invalid eUICC that is reported to have a problem. For example, if an accident, such as an illegal use or theft, occurs for the corresponding EID in a specific communication company, the corresponding EID may be classified into a blacklist as unpermitted EID, and blacklist information may be shared with other communication companies in accordance with relationship between the communication companies. Further, in the case of terminals that are made for a specific communication company, EID information of the respective terminals are managed in the white list, and may be used to determine whether to permit their attaching for provisioning.

On the other hand, a terminal that has not yet been subscribed may select a subscription plan that is provided by a corresponding service provider through attaching to a subscription portal2e-600. In this case, selected information interlocks with a Business Sales System (BSS), and accordingly, an eSIM server2e-600that provides provisioning of a SIM profile that corresponds to an EID of the terminal prepares a SIM profile for the corresponding selected subscription plan.

For example, the eSIM server that provides provisioning of the SIM profile may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning.

In a turn-on state, the terminal2e-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2e-100to receive the PDU connection through a cellular network, the terminal2e-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2e-002). The terminal may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2e-003).

The selection of the PLMNs by the terminal2e-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2e-100. For example, if a user desires to subscribe to a PLMN, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2e-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if the user does not have a separate preference to the PLMN to which the user desires to subscribe, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal2e-100itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2e-200(2e-004). In this case, in order to indicate that the terminal2e-100subscribes to a communication company and attaches thereto to receive provisioning of a SIM profile, the terminal separately indicates an attach type. For example, “attach type=subscription” is set. In this case, the attach request message may include an identity of the terminal2e-100, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal2e-100may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2e-200or authenticator2e-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2e-200or authenticator2e-200triggers an EAP process2e-005, and the eUICC of the terminal authenticates an AAA2e-400on the basis of an AAA certificate through an EAP-TTLS between the eUICC and the AAA2e-400of the network, or performs mutual authentication between the eUICC of the terminal2e-100and the AAA2e-400on the basis of an AAA certificate and an eUICC certificate, and creates a secure tunnel between the terminal2e-100and the AAA2e-400on the basis of an encryption key that is created during the authentication process. The terminal2e-100sends the eUICC information to the AAA2e-400through the created secure tunnel (2e-005a). The eUICC information may include an eUICC ID (i.e., EID), and may further include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2e-100or the eUICC or a server (e.g., SM-DS) for searching for an address of the provisioning server.

The AAA2e-400that has received the eUICC information may send an eUICC ID report message that includes the eUICC information to the user data repository2e-500in order to determine whether the eUICC is a permitted eUICC (2e-005b). The user data repository2e-500determines whether the received eUICC ID is a permitted eUICC (2e-005c). The user data repository2e-500transfers information of a server for related provisioning to the AAA2e-400together with permission/non-permission of the eUICC ID (2e-005d).

For example, in the case of the permitted eUICC, the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored in a PLMN to which the terminal2e-100is attaching may be included therein. Of course, the address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein.

On the other hand, the AAA2e-400that has received information on whether to permit the eUICC may transfer the information to the CP function2e-200or the authenticator2e-200together with the authentication result in the process of completing the authentication process (2e-005e). For example, if the EAP authentication has been successfully completed, the AAA may transfer the address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored together with a Master Session Key (MSK) that is created during the authentication process. Of course, the address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the EAP authentication has failed or if the eUICC is an unpermitted eUICC, the EAP failure may be sent to the CP function2e-200or the authenticator2e-200.

After completion of the authentication process, if the eUICC is not permitted and thus an attach to the network is not permitted, or if the EAP has failed and thus an attach is not permitted (2e-007), the CP function2e-200or the authenticator2e-200performs an attach reject. In this case, when an attach reject message is sent to the terminal2e-100, the terminal is notified that the eUICC is not permitted as a reject cause. For example, “cause=invalid eUICC” or “eUICC is not available in this PLMN” may be set (2e-007).

In the case of receiving the attach reject message, the terminal2e-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. When the terminal2e-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2e-003, and the terminal2e-100performs again an attach request process for the subscription.

On the other hand, the terminal2e-100and the CP function2e-200, or the authenticator2e-200share a security context on the basis of the MSK that is acquired at operation2e-005e, and perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2e-009). Operation2e-009may be performed before the attach reject is sent.

If the setup of the security keys is completed, the CP function2e-200or the authenticator2e-200may send an attach accept message to the terminal2e-100to notify of successful attach to the network (2e-010). The attach accept message may include address information of the subscription portal to which the terminal2e-100should attach in order to subscribe to the subscription.

The terminal2e-100requests the CP function2e-200to create a PDU connection for SIM provisioning (2e-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to perform the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2e-004, the terminal2e-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the subscription, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2e-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable UP function of a suitable network slice that is selected.

The CP function2e-200transmits a create session request message to a suitable UP function2e-300(2e-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2e-005e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2e-100. The create session request message may include an indication capable of notifying of the request for SIM provisioning. Then, the UP function selects a GW for SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal2e-100can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal2e-100can use the same only for the purpose of traffic for the SIM provisioning (2e-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2e-100or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2e-005eand2e-012, or the address that is serviced by the terminal2e-100may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function so as to redirect the attach to the subscription portal.

The UP function2e-300may transfer a response to the CP function2e-200, and may transfer a PDU connection response message up to the terminal2e-100. In this case, the address information of the subscription portal to which the terminal2e-100should attach for the subscription may be transferred up to the terminal.

Thereafter, like operation2e-017, the terminal2e-100attaches to the subscription portal using the acquired PDU connectivity, and selects and subscribes to a desired subscription plan. In this case, the terminal2e-100may transfer the EID information to the subscription portal, or may transfer the EID information through encrypted transmission for safe transfer.

On the other hand, a subscription portal2e-700transfers selected subscription plan information to the user data repository2e-500. For example, activated plan information and an identifier (e.g., IMSI or the like) that is allocated to a SIM of the terminal2e-100may be included in the user data repository2e-500. Further, the subscription portal transfers to the SM-DP+2e-600a message for notifying the SM-DP+2e-600having the SIM profile for the EID of the subscription of the corresponding EID that the corresponding EID has been subscribed (2e-019). For example, the message may include ID information of the eUICC of the terminal2e-100, or may include an Integrated Circuit Card Identifier (ICCID) that is information on the corresponding profile.

Further, the SM-DP+ that has received the transferred message transfers to the SM-DS information that it has its own EID and the corresponding profile, so that the terminal2e-100can search for a provisioning server that corresponds to the ID value of the eUICC thereof (2e-020). For example, the SM-DP+ may transfer the EID value to the SM-D S. Further, the SM-DP+ may also transfer the ICCID that is profile information on the EID.

On the other hand, if the subscription portal completes the operations2e-018and2e-019with respect to the user data repository2e-500and the SM-DP+, it may notify the terminal2e-100that the SIM profile provisioning has been prepared (2e-021). A notification message that is sent at this time may include address information of the SM-DP+ to which the terminal2e-100can attach to receive the SIM profile provisioning. Further, the notification message may also include address information of the SM-DS that can notify of the address information of the SM-DP+ having the SIM profile for the eUICC of the terminal2e-100. Further, the terminal2e-100may receive the SIM profile provisioning through attaching to the corresponding SM-DP+ (2e-022).

However, if the terminal2e-100attempts an attach to an address other than the address that is permitted so that the terminal can use the address only for the purpose of traffic for the SIM provisioning, the attach may be redirected to the subscription portal (2e-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal2e-100may add an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then may perform detach and attach request processes in order (2e-023). If the provisioning of the SIM profile is successfully performed, the terminal2e-100may perform a detach process to perform attaching using the downloaded SIM profile (2e-024). The terminal2e-100may select the downloaded SIM profile, and then may perform an attach process to use a data service (2e-025). Instead of performing operations2e-024and2e-025, the terminal2e-100may not perform a detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIGS.2FA to2FDare diagrams illustrating network connection schemes for a terminal that is mounted with an eSIM to make a subscription and to perform provisioning through determination of whether to permit eUICC separately from an EAP process. Hereinafter,FIGS.2FA to2FDare commonly calledFIG.2F.

Referring toFIG.2F, in an embodiment of the present disclosure, a process is illustrated, in which a terminal that has not yet subscribed to any communication company acquires connectivity through attaching to a cellular network, subscribes online to the network, and receives provisioning of a SIM profile through an eSIM server.

Accordingly, at operation2f-001, a user data repository2f-500stores therein white list information for an ID (i.e., EID) of a valid or permitted eUICC that is possessed by each service provider or blacklist information for an ID of an invalid eUICC that is reported to have a problem. For example, if an accident, such as an illegal use or theft, occurs for the corresponding EID in a specific communication company, the corresponding EID may be classified into a blacklist as unpermitted EID, and blacklist information may be shared with other communication companies in accordance with the relationship between the communication companies. Further, in the case of terminals that are made for a specific communication company, EID information of the respective terminals are managed in the white list, and may be used to determine whether to permit their attaching for provisioning.

On the other hand, a terminal that has not yet been subscribed may select a subscription plan that is provided by a corresponding service provider through attaching to a subscription portal2f-600. In this case, selected information interlocks with a Business Sales System (BSS), and an eSIM server that provides provisioning of a SIM profile that corresponds to an EID of the terminal prepares a SIM profile for the corresponding selected subscription plan.

For example, the eSIM server that provides provisioning of the SIM profile may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning. In the description of the present disclosure, detailed interlocking schemes between a subscription portal, a BSS, and the SM-DP+ are not described.

In a turn-on state, the terminal2f-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2f-100to receive the PDU connection through a cellular network, the terminal2f-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2f-002). The terminal may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2f-003).

The selection of the PLMNs by the terminal2f-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2f-100. For example, if a user desires to subscribe to a PLMN, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2f-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if the user does not have a separate preference to the PLMN to which the user desires to subscribe, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal2f-100itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal2f-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2f-200(2f-004). In this case, in order to indicate that the terminal2f-100subscribes to a communication company and attaches thereto to receive provisioning of a SIM profile, the terminal separately indicates an attach type. For example, “attach type=subscription” is set. In this case, the attach request message may include an identity of the terminal2f-100, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal2f-100may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2f-200or authenticator2f-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2f-200or authenticator2f-200triggers an EAP process2f-005to perform mutual authentication between the eUICC of the terminal and an AAA2fon the basis of an AAA certificate and an eUICC certificate through EAP-TLS or EAP-TTLS. In the process of completing the authentication process, the AAA2f-400may transfer the result of the authentication to the CP function2f-200or the authenticator2f-200(2f-005a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) that is created in the authentication process may be transferred while an EAP success is transmitted to the CP function or the authenticator2f-200. However, if the EAP authentication has failed, an EAP failure may be transmitted to the CP function or the authenticator2f-200. In this case, the CP function or the authenticator2f-200may perform an attach reject (2f-005b). On the other hand, the terminal2f-100and the CP function or the authenticator2f-200may share a security context on the basis of the MSK that is acquired at operation2f-005a, and may perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2f-006).

If the security is set up as described above, a process of checking whether to permit an eUICC may be performed. For this, the CP function2f-200may request eUICC information from the terminal2f-100(2f-007a). If the eUICC information request message is received (2f-007a) or the setup of the security keys is completed (2f-006), the terminal2f-100may encrypt and transmit an eUICC ID of the terminal to the CP function2f-200(2f-007b).

The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2f-100or the eUICC or an address of a server (e.g., SM-DS) for searching for the address of the provisioning server.

The CP function2f-200that has received the eUICC information transmits an eUICC ID check request message that includes the eUICC information to the user data repository2f-500in order to determine whether the eUICC is a permitted eUICC (2f-007c). The user data repository2f-500determines whether the received eUICC ID has been permitted (2f-007d). The user data repository2f-500transfers information of a related provisioning server to the CP function together with information whether to permit the eUICC ID (2f-007e).

For example, in the case of the eUICC that has been permitted in the PLMN that is being attached to, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the eUICC is determined as an eUICC that has not been permitted in the PLMN that is being attached to, it may be notified that the eUICC is an eUICC that has not been permitted in the PLMN. Further, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may also be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the eUICC is determined to be inferior in the corresponding PLMN and thus an attach to the network is not permitted (2f-007f), an attach reject is performed. In this case, when an attach reject message is sent to the terminal2f-100, the terminal is notified that the eUICC has not been permitted in the corresponding PLMN as a reject cause. For example, “cause=invalid eUICC” or “eUICC is not available in this PLMN” may be set.

In the case of receiving the attach reject message (2f-008), the terminal2f-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. When the terminal2f-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2f-003, and the terminal2f-100performs again an attach request process for the subscription.

If the setup of the security keys is completed, the CP function2f-200or the authenticator2f-200may send an attach accept message to the terminal2f-100to notify of successful attach to the network (2f-010).

The attach accept message may include address information of the provisioning server to which the terminal2f-100should attach in order to subscribe to the subscription.

The terminal2f-100requests the CP function2f-200to create a PDU connection for SIM provisioning (2f-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to notify that the PDU connection is for the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2f-004, the terminal2f-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the subscription, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2f-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable network slice and select a suitable UP function of the selected network slice.

The CP function2f-200transmits a create session request message to a suitable UP function2f-300(2f-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2f-007e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2f-100. The create session request message may also include an indication capable of notifying of the request for the SIM provisioning. Then, the UP function selects a GW for the SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal can use the same only for the purpose of traffic for the SIM provisioning (2f-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2f-100, or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2f-007eand2f-012, or an address that is serviced by the terminal2f-100may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function so as to redirect the attach to the subscription portal.

The UP function2f-300may transfer a response to the CP function2f-200, and may transfer a PDU connection response message up to the terminal2f-100. In this case, address information of the subscription portal to which the terminal2f-100should attach for subscription may be transferred together up to the terminal.

Thereafter, like operation2f-017, the terminal2f-100selects and subscribes to a desired subscription plan through attaching to the subscription portal using the acquired PUD connectivity. In this case, the terminal2f-100may transfer EID information to the subscription portal, or may transfer the EID information through encrypted transmission in order to safely transfer the EID information.

Further, the SM-DP+ may prepare provisioning, and if the provisioning has been prepared, it may notify the terminal2f-100of the prepared provisioning.

Further, the terminal2f-100may receive provisioning of a SIM profile through attaching to the corresponding SM-DP (2f-018).

However, if the terminal2f-100attempts an attach to an address other than the address that is permitted so that the terminal can use the address only for the purpose of traffic for the SIM provisioning, the attach may be redirected to the subscription portal (2f-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal2f-100may add an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then may perform detach and attach request processes in order (2f-019). If the provisioning of the SIM profile has been successfully performed, the terminal2f-100may perform a detach process for the attach using the downloaded SIM profile (2f-020). After selecting the downloaded SIM profile, the terminal2f-100may perform an attach process to use a data service (2f-021). Instead of performing operations2f-020and2f-021, the terminal2f-100may not perform the detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIGS.2GA to2GDare diagrams illustrating detailed network connection schemes for a terminal that is mounted with an eSIM to make a subscription and to perform provisioning through determination of whether to permit eUICC separately from an EAP process. Hereinafter,FIGS.2GA to2GDare commonly calledFIG.2G.

Referring toFIG.2G, in an embodiment of the present disclosure, a process is illustrated, in which a terminal that has not yet subscribed to any communication company acquires connectivity through attaching to a cellular network, subscribes online to the network, and receives provisioning of a SIM profile through an eSIM server.

Accordingly, at operation2g-001, a user data repository2g-500stores therein white list information for an ID (i.e., EID) of a valid or permitted eUICC that is possessed by each service provider or blacklist information for an ID of an invalid eUICC that is reported to have a problem. For example, if an accident, such as an illegal use or theft, occurs for the corresponding EID in a specific communication company, the corresponding EID may be classified into a blacklist as unpermitted EID, and blacklist information may be shared with other communication companies in accordance with the relationship between the communication companies. Further, in the case of terminals that are made for a specific communication company, EID information of the respective terminals are managed in the white list, and may be used to determine whether to permit their attaching for provisioning.

On the other hand, a terminal that has not yet been subscribed may select a subscription plan that is provided by a corresponding service provider through attaching to a subscription portal2g-700. In this case, selected information interlocks with a Business Sales System (BSS), and an eSIM server2g-600that provides provisioning of a SIM profile that corresponds to an EID of the terminal prepares a SIM profile for the corresponding selected subscription plan.

For example, the eSIM server that provides provisioning of the SIM profile may be, for example, a SM-DP+. In the description of the present disclosure, for convenience, the SM-DP+ is used to commonly call a SM-DP+ that is authenticated by GSMA and an eSIM server that provides SIM profile provisioning.

In a turn-on state, the terminal2g-100checks a SIM profile, and if there is not the SIM profile, the terminal recognizes that it is necessary to receive provisioning of the SIM profile, and acquires PDU connection in order to receive the provisioning. If it is determined or set for the terminal2g-100to receive the PDU connection through a cellular network, the terminal2g-100transfers a list of available PLMNs to an application of the terminal or an entity that takes charge of the provisioning on the basis of a list of PLMNs that are sensed through a cell search (2g-002). The terminal may select a PLMN to be connected to for the provisioning on the basis of the transferred list of available PLMNs (2g-003).

The selection of the PLMNs by the terminal2g-100may be performed through a user's selection input or in accordance with the priority order according to a specific priority rule in the terminal2g-100. For example, if a user desires to subscribe to a PLMN, a provisioning app presents a list of PLMNs that can be selected through a UI, and the user may select a subscribed PLMN through which the user desires to receive the provisioning. As another method, if the subscribed PLMN information has already been set in the terminal2g-100, it becomes possible to select the subscribed PLMN through which the user desires to receive the provisioning. As still another method, if the user does not have a separate preference to the PLMN to which the user desires to subscribe, a PLMN that corresponds to the highest priority may be selected in accordance with the priority rule of the terminal2g-100itself, such as selection of a PLMN having the highest signal strength among available PLMNs or random selection of a PLMN among the available PLMNs.

The terminal2g-100requests a network connection through the PLMN that is selected in the above-described process while transmitting an attach request to a CP function2g-200(2g-004). In this case, in order to indicate that the terminal2g-100subscribes to a communication company and attaches thereto to receive provisioning of a SIM profile, the terminal separately indicates an attach type. For example, “attach type=subscription” is set. In this case, the attach request message may include an identity of the terminal, for example, an International Mobile Station Equipment Identity (IMEI). Further, a Non-Access Stratum (NAS) of the terminal may indicate that the access request message is for SIM provisioning when the attach request message is transferred to an Access Stratum (AS). Information that indicates the SIM provisioning may be transferred to a base station, and may be used for the base station to select a suitable CP function.

The CP function2g-200or authenticator2g-200that has received the attach request triggers an authentication process between the eUICC and a network. For example, the CP function2g-200or authenticator2g-200triggers an EAP process2g-005to perform mutual authentication between the eUICC of the terminal2g-100and an AAA2g-400on the basis of an AAA certificate and an eUICC certificate through EAP-TLS or EAP-TTLS. In the process of completing the authentication process, the AAA2g-400may transfer the result of the authentication to the CP function2g-200or the authenticator2g-200(2g-005a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) that is created in the authentication process may be transferred while an EAP success is transmitted to the CP function2g-200or the authenticator2g-200. However, if the EAP authentication has failed, an EAP failure may be transmitted to the CP function2g-200or the authenticator2g-200. In this case, the CP function2g-200or the authenticator2g-200may perform an attach reject (2g-005b). On the other hand, the terminal2-100and the CP function2g-200or the authenticator2g-200may share a security context on the basis of the MSK that is acquired at operation2g-005a, and may perform sync-up of security keys to be used in a Non-Access Stratum (NAS) and an Access Stratum (AS) (2g-006).

If the security is set up as described above, a process of checking whether to permit an eUICC may be performed. For this, the CP function2g-200may request eUICC information from the terminal2g-100(2g-007a). If the eUICC information request message is received (2g-007a) or the setup of the security keys is completed (2g-006), the terminal2g-100may encrypt and transmit an eUICC ID of the terminal to the CP function2g-200(2g-007b).

The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP+) for provisioning of the SIM profile that is preset in the terminal2g-100or the eUICC or an address of a server (e.g., SM-DS) for searching for the address of the provisioning server.

The CP function2g-200that has received the eUICC information transmits an eUICC ID check request message that includes the eUICC information to the user data repository2g-500in order to determine whether the eUICC is a permitted eUICC (2g-007c). The user data repository2g-500determines whether the received eUICC ID has been permitted (2g-007d). The user data repository2g-500transfers information of a related provisioning server to the CP function together with information whether to permit the eUICC ID (2g-007e).

For example, in the case of the eUICC that has been permitted in the PLMN to which the terminal2g-100is attaching, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the eUICC is determined as an eUICC that has not been permitted in the PLMN to which the terminal2g-100is attaching, it may be notified that the eUICC is an eUICC that has not been permitted in the PLMN. Further, address information of the provisioning server (e.g., SM-DP+) in which the SIM profile of the eUICC ID is stored may also be included therein. Of course, address information of the server (e.g., SM-DS) that can search for the provisioning server may also be included therein. However, if the eUICC is determined to be inferior in the corresponding PLMN and thus an attach to the network is not permitted (2g-007f), an attach reject is performed. In this case, when an attach reject message is sent to the terminal2g-100, the terminal2g-100is notified that the eUICC has not been permitted in the corresponding PLMN as a reject cause. For example, “cause=invalid eUICC” or “eUICC is not available in this PLMN” may be set.

In the case of receiving the attach reject message (2g-008), the terminal2g-100may store the ID of the corresponding PLMN in a forbidden PLMN list for SIM provisioning, and may apply a backoff timer for a predetermined time. When the terminal2g-100selects a PLMN among available PLMNs to perform the next attach, the PLMN that is included in the forbidden PLMN list for SIM provisioning is excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as2g-003, and the terminal2g-100performs again an attach request process for the subscription.

If the setup of the security keys is completed, the CP function2g-200or the authenticator2g-200may send an attach accept message to the terminal2g-100to notify of successful attach to the network (2g-010).

The attach accept message may include address information of the provisioning server to which the terminal should attach in order to subscribe to the subscription.

The terminal2g-100requests the CP function2g-200to create a PDU connection for SIM provisioning (2g-011). A PDU connection request message may configure a separate type to notify that the PDU connection is to notify that the PDU connection is for the SIM provisioning. For example, “type=SIM provisioning” may be set. On the other hand, at operation2g-004, the terminal2g-100may piggyback a PDU connection request message on an attach request message, and even if the PDU connection request message is not transferred together in the case where the access type of the attach request message is for the subscription, the terminal may proceed with a session creation process for making the PDU connection for the SIM provisioning.

The CP function2g-200that has received a PDU connection creation request selects a suitable UP function in order to send a create session request message. In this case, the CP function may select the UP function in consideration of the SIM provisioning, or may select a suitable network slice and select a suitable UP function2g-300of the selected network slice.

The CP function2g-200transmits a create session request message to a suitable UP function2g-300(2g-012). The create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received at operation2g-007e. Further, the create session request message may include an address of a SM-DS server or an address of a SM-DP+ server that is received from the terminal2g-100. The create session request message may also include an indication capable of notifying of the request for the SIM provisioning. Then, the UP function selects a GW for the SIM provisioning, and allocates an IP address thereto. In this case, the PDU connection may be configured so that the terminal can attach only to an address of a SM-DP+ server for provisioning, an address of a SM-DS server for searching for the SM-DP+, an address of a DNS server, and an address of a subscription portal so that the terminal can use the same only for the purpose of traffic for the SIM provisioning (2g-013). For example, an uplink/downlink packet filter of a packet filter may be configured so that communication becomes possible only in the case where an address for specific provisioning (e.g., an address of the SM-DP+ server for provisioning, an address of the SM-DS server for searching for the SM-DP+, an address of a DNS server, or an address of a subscription portal) is included as a destination/source IP address.

In the process of configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined on the basis of the address of the SM-DS server or the address of the SM-DP+ server that is received from the terminal2g-100, or the address of the SM-DS server or the address of the SM-DP+ server that is transferred through operations2g-007eand2g-012, or an address that is serviced by the terminal2g-100may be used for authorization. Further, in the case of attempting an attach to another address other than the above-described address, a redirection rule may be set in the UP function so as to redirect the attach to the subscription portal. The UP function may transfer a response to the CP function, and may transfer a PDU connection response message up to the terminal2g-100. In this case, address information of the subscription portal to which the terminal2g-100should attach for subscription may be transferred together up to the terminal.

Thereafter, like operation2g-017, the terminal selects and subscribes to a desired subscription plan through attaching to the subscription portal using the acquired PUD connectivity. In this case, the terminal2g-100may transfer EID information to the subscription portal, or may transfer the EID information through encrypted transmission in order to safely transfer the EID information.

On the other hand, a subscription portal2g-700transfers selected subscription plan information to the user data repository2g-500. For example, activated plan information and an identifier (e.g., IMSI or the like) that is allocated to a SIM of the terminal2g-100may be included in the user data repository2g-500. Further, the subscription portal transfers to the SM-DP+2g-600 a message for notifying the SM-DP+2g-600having the SIM profile for the EID of the subscription of the corresponding EID that the corresponding EID has been subscribed (2g-019). For example, the message may include ID information of the eUICC of the terminal2g-100, or may include an Integrated Circuit Card Identifier (ICCID) that is information on the corresponding profile.

Further, the SM-DP+ that has received the transferred message transfers to the SM-DS information that it has its own EID and the corresponding profile, so that the terminal2g-100can search for a provisioning server that corresponds to the ID value of the eUICC thereof (2g-020). For example, the SM-DP+ may transfer the EID value to the SM-DS. Further, the SM-DP+ may also transfer the ICCID that is profile information on the EID.

On the other hand, if the subscription portal completes the operations2g-018and2g-019with respect to the user data repository and the SM-DP+, it may notify the terminal2e-100that the SIM profile provisioning has been prepared (2g-021). A notification message that is sent at this time may include address information of the SM-DP+ to which the terminal2g-100can attach to receive the SIM profile provisioning. Further, the notification message may also include address information of the SM-DS that can notify of the address information of the SM-DP+ having the SIM profile for the eUICC of the terminal2g-100. Further, the terminal2g-100may receive the SIM profile provisioning through attaching to the corresponding SM-DP+(2g-022).

However, if the terminal2g-100attempts an attach to an address other than the address that is permitted so that the terminal can use the address only for the purpose of traffic for the SIM provisioning, the attach may be redirected to the subscription portal (2g-016).

On the other hand, if the SIM provisioning is delayed for a predetermined time or the SIM provisioning has failed, the terminal2g-100may add an ID of the currently attached PLMN to a forbidden PLMN list for initial provisioning, and then may perform detach and attach request processes in order (2g-023). If the provisioning of the SIM profile has been successfully performed, the terminal2g-100may perform a detach process for the attach using the downloaded SIM profile (2g-024). After selecting the downloaded SIM profile, the terminal may perform an attach process to use a data service (2g-025). Instead of performing operations2g-024and2g-025, the terminal may not perform the detach process, but may select the downloaded SIM profile, and then may update the existing attach information to use a normal data service.

FIG.3Ais a diagram illustrating the structure of a terminal according to an embodiment of the present disclosure.

Referring toFIG.3A, a terminal may include a transceiver unit3a-10, a controller3a-20, and a storage unit3a-30. The controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit3a-10may transmit and receive signals with another network entity. The transceiver unit3a-10may transmit and receive signals under the control of the controller3a-20.

The controller3a-20may control the whole operation of the terminal according to an embodiment proposed in the present disclosure. The controller3a-20may control the operation of the terminal according to the first and second embodiments of the present disclosure. For example, the controller3a-20may control the operation of the terminal as described above with reference toFIGS.1A to2G.

According to an embodiment of the present disclosure, the controller3a-20may operate to check whether there is a profile for a Universal Integrated Circulated Card (UICC) of the terminal, to transmit an attach request message that includes identification information of the UICC to a Public Land Mobile Network (PLMN) that is selected by the terminal if there is no profile, and to receive an attach response message. The attach request message may include attach request type information, and the attach request type information may indicate initial provisioning. Further, the attach response message may include an active default bearer context request message if an attach to the selected PLMN is permitted. Further, the active default bearer context request message may include Traffic Flow Template (TFT) information for downloading the profile. Further, the TFT information may include address information of a server for downloading the profile.

The storage unit3a-30may store therein at least one of information that is transmitted and received through the transceiver unit3a-10and information that is generated through the controller3a-20. Further, the storage unit3a-30may store therein information and codes for operating the controller3a-20.

FIG.3Bis a diagram illustrating the structure of an MME according to an embodiment of the present disclosure. The structure of an MME may be applied to the structure of a control function in the case where it is applied to a New Radio (NR) system. In the case of the control function, it may include an SM function entity and an MM function entity, and each function may include a transceiver unit and a controller.

Referring toFIG.3B, the MME may include a transceiver unit3b-10, a controller3b-20, and a storage unit3b-30. The controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit3b-10may transmit and receive signals with another network entity. The transceiver unit3b-10may transmit and receive signals under the control of the controller3b-20.

The controller3b-20may control the whole operation of the MME according to an embodiment proposed in the present disclosure. The controller3b-20may control the operation of the MME or the control function according to the first and second embodiments of the present disclosure. For example, the controller3b-20may control the operation of the MME or the control function as described above with reference toFIGS.1A to2G.

The storage unit3b-30may store therein at least one of information that is transmitted and received through the transceiver unit3b-10and information that is generated through the controller3b-20. Further, the storage unit3b-30may store therein information and codes for operating the controller3b-20.

FIG.3Cis a diagram illustrating the structure of a GW according to an embodiment of the present disclosure.

Referring toFIG.3C, a GW may include a transceiver unit3c-10, a controller3c-20, and a storage unit3c-30. The controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit3c-10may transmit and receive signals with another network entity. The transceiver unit3c-10may transmit and receive signals under the control of the controller3c-20.

The controller3c-20may control the whole operation of the GW according to an embodiment proposed in the present disclosure. The controller3c-20may control the operation of the terminal according to the first and second embodiments of the present disclosure. For example, the controller3c-20may control the operation of the GW as described above with reference toFIGS.1A to2G.

According to an embodiment of the present disclosure, the controller3c-20may operate to receive from a terminal an attach request message that includes identification information of a Universal Integrated Circulated Card (UICC) of the terminal, to transmit to an Equipment Identity Register (EIR) a message for requesting to check whether to permit an attach of the UICC with respect to a Public Land Mobile Network (PLMN) that is selected by the terminal, to receive from the EIR a message that includes information on whether to permit the attach of the UICC, and to transmit an attach response message to the terminal on the basis of the information on whether to permit the attach of the UICC. Further, the storage unit3c-30may store therein at least one of information that is transmitted and received through the transceiver unit3c-10and information that is generated through the controller3c-20. Further, the attach request message may include attach request type information, and the attach request type information may indicate initial provisioning. Further, the controller3c-20may operate to omit an authentication process for the terminal and to select a gateway for downloading a profile if the attach request type information indicates the initial provisioning and information that indicates attach permission of the UICC is received from the EIR. Further, the attach response message may include an active default bearer context request message if the information that indicates the attach permission of the UICC is received. Further, the active default bearer context request message may include Traffic Flow Template (TFT) information for the profile download.

The storage unit3c-30may store therein information and codes for operating the controller3c-20.

FIG.3Dis a diagram illustrating the structure of an UP function according to an embodiment of the present disclosure.

Referring toFIG.3D, the MME may include a transceiver unit3d-10, a controller3d-20, and a storage unit3d-30. The controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit3d-10may transmit and receive signals with another network entity. The transceiver unit3d-10may transmit and receive signals under the control of the controller3d-20.

The controller3d-20may control the whole operation of the UP function according to an embodiment proposed in the present disclosure. The controller3d-20may control the operation of the UP function according to the first and second embodiments of the present disclosure. For example, the controller3d-20may control the operation of the UP function as described above with reference toFIGS.1A to2G.

The storage unit3d-30may store therein at least one of information that is transmitted and received through the transceiver unit3d-10and information that is generated through the controller3d-20. Further, the storage unit3d-30may store therein information and codes for operating the controller3d-20.

In the detailed embodiments of the present disclosure as described above, the constituent elements included in the present disclosure are described as singular expressions or plural expressions in accordance with the presented embodiments. However, the singular or plural expressions are selected to suit the presented situations for convenience in explanation, and thus the present disclosure is not limited to such singular or plural constituent elements. Even the constituent elements that are expressed by plural expressions may correspond to a singular constituent element, while even the constituent element that is expressed by singular expressions may correspond to plural constituent elements.

Although the present disclosure has been described with an exemplary embodiment, various changes and modifications may be suggested to one skilled in the art. It is intended that the present disclosure encompass such changes and modifications as fall within the scope of the appended claims.