KR20140032903A - Subscriber certification module using provisioning profile and method of accessing network using the same - Google Patents

Abstract

Disclosed are a provisioning profile structure for storing a subscriber authentication module and a method of accessing a mobile communication network by a terminal based on the provisioning profile structure. A subscriber authentication module includes a storage unit in which a provisioning profile including network access information is stored, and the provisioning profile includes an international mobile subscriber identify (IMSI) file and authentication credential information. Therefore, the subscriber authentication module embedded in the terminal can access an MNO network, which is not specified, by using the IMSI information of the provisioning profile. [Reference numerals] (AA) Provisioning profile

Description

Subscriber authentication module using provisioning profile and network access method using same {SUBSCRIBER CERTIFICATION MODULE USING PROVISIONING PROFILE AND METHOD OF ACCESSING NETWORK USING THE SAME}

The present invention relates to a subscriber identity module, and more particularly, to a structure of a provisioning profile stored in a subscriber identity module and a method of accessing a mobile communication network of a terminal using the same.

A UICC (Universal Integrated Circuit Card) is a smart card inserted in a terminal and used as a module for user authentication and a mobile communication network subscribed by a user.

UICC includes user information (ShMS (Short Message Service), Phonebook, etc.) and network information for the mobile carriers to which the user has subscribed (International Mobile Subscriber Identity (IMSI), Home Public Land Mobile Network (HPLMN, etc.) Can be stored.

In the meantime, UICC is a subscriber identity module (SIM) card for a global system for mobile communications (GSM) scheme, a universal coder multiple access (WCDMA) card, and a universal subscriber identity module (USIM) card for a long term evolution (LTE) scheme. Also called.

When the user mounts the UICC on the user's terminal, user authentication is made with the mobile communication network automatically subscribed using the information stored in the UICC, and the user can conveniently receive the mobile communication service through the terminal.

Also, the user can easily replace the terminal by removing the UICC from the existing terminal and mounting the terminal on the new terminal. When the user wants to change the mobile communication provider, the user can easily change the mobile communication provider by replacing the UICC removed from the existing terminal with the UICC of the operator to change.

However, when it is difficult to detach the UICC from the terminal, for example, when the UICC is mounted inside the machine to machine (M2M) terminal and manufactured in a structure that is difficult to replace from the outside, the UICC of the existing removable plastic structure In order to provide more shock and heat resistance, a built-in UICC structure is proposed to provide the same service as a removable UICC even when a chip-type terminal integrated structure is provided instead of a detachable structure. It became.

Meanwhile, the eUICC needs to update subscriber information of various mobile operators to the eUICC remotely. Accordingly, a subscription manager (SM) for managing subscriber information is being discussed.

Such SMs are mainly discussed as being responsible for information management of eUICC, information management of various telecommunication carriers, and changes of information when mobile carriers are changed, but the exact function or role has not been determined yet. to be.

SUMMARY OF THE INVENTION An object of the present invention for solving the above problems is to provide a structure of a provisioning profile for providing a mobile communication network connection when the eUICC is not opened with a mobile network operator (MNO). have.

Another object of the present invention for solving the above problems is to provide a method for a terminal including an eUICC to access a mobile communication network.

An eUICC according to an embodiment of the present invention for achieving the above object includes a storage unit in which a provisioning profile including network connection information is stored, wherein the provisioning profile includes an international mobile subscriber identifier (IMSI: International Mobile Subscriber). Identity) file and authentication credential information.

Here, the authentication credential information may be an authentication secret key 'K' used in an authentication and key agreement (AKA) method, which is a basic authentication processing method of WCDMA and LTE networks.

Here, the provisioning profile may be configured in the form of an application dedicated file (ADF).

Here, the storage unit stores application identifier (AID) information indicating access information of the provisioning profile,

The application identifier information may be stored in an elementary file directory (EF _DIR ) among standardized file systems stored in the storage unit.

The application identifier information may include an application code, a country code, an application provider code, and an application provider field option indicating that the profile indicated by the application identifier information is a provisioning profile. (application provider field optional) may include at least one information.

Here, the IMSI file may include at least one information of a mobile country code, a mobile network code, and a mobile subscriber identification number. Can be.

Here, the country code and the terminal network code included in the International Mobile Subscriber Identifier (IMSI) file are different from the country code and the terminal network code of the network where the device with the eUICC will register a location, and the authentication of the device. It may be the same as the country code and the terminal network code of the network for generating data for each.

Here, the eUICC may include an operational profile of at least one mobile network operator (MNO), but the operational profile may be configured in the form of an ADF.

Here, the storage unit stores application identifier (AID) information indicating the access information of the operation profile of the at least one mobile network operator, the application identifier information EF _DIR of the standardized file system stored in the storage unit Can be stored in.

In accordance with another aspect of the present invention, there is provided a method for accessing a network having an eUICC device, the method comprising: reading provisioning profile information stored in an eUICC in a network access method performed at a device having an eUICC; And transmitting a location registration request message to the network using the provisioning profile information, receiving an authentication request message in response to the location registration request message from the network, and performing authentication with the network.

The reading of the provisioning profile information may include reading international mobile subscriber identifier (IMSI) information included in provisioning profile information stored in an eUICC, and the international mobile subscriber identifier information may include a mobile country code, At least one of a mobile network code and a mobile subscriber identification number may be included.

The performing of the authentication with the network may include reading authentication credential information included in a provisioning profile, performing a process for authentication based on the read authentication credential information, and authentication processing. And sending a result to the network.

Here, the step of performing authentication with the network may receive a location registration response from the network.

The eUICC according to an embodiment of the present invention described above may provide a function of roaming access to a network of an MNO which is not specified by using IMSI information of a provisioning profile.

In addition, when the eUICC is not opened with the MNO, the terminal may access the roaming mobile communication network to support the opening of the MNO of the eUICC.

1 is a conceptual diagram illustrating the structure of a provisioning profile stored in an eUICC.
2 is a conceptual diagram illustrating information of an AID.
3 is a conceptual diagram illustrating a structure of an MNO operation profile loaded in an eUICC.
4 is a conceptual diagram illustrating IMSI information.
FIG. 5 is a flowchart illustrating a process of requesting and transferring IMSI information and authentication credentials for a provisioning profile between an eUICC manufacturer and an eUICC user authentication provider (or device).
6 is a flowchart illustrating a process of connecting a terminal to a mobile communication network using a provisioning profile.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "having" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the understanding of the present invention, the same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

1 is a conceptual diagram illustrating the structure of a provisioning profile stored in an eUICC. Subscriber authentication module according to an embodiment of the present invention is characterized in that the eUICC, hereinafter will be described based on the eUICC.

Referring to FIG. 1, a file may be stored in an eUICC file including a master file (MF), a dedicated file (DF), an application dedicated file (ADF), an elementary file (EF), and a credential. To be defined).

The credential may have an authentication credential, and the authentication credential may perform an authentication processing function for mobile communication network user authentication, and may be an authentication secret key. For example, the authentication credential information may be an authentication secret key 'K' used in the Authentication and Key Agreement (AKA) method, which is a basic authentication processing method of WCDMA and LTE networks.

The terminal may access the mobile communication network and perform user authentication using the profile of the eUICC, and the profile may be used as a storage space for user information (SMS (Short Message Service), MMS (Multimedia Message Service, phone book)). have.

The profile may be composed of a provisioning profile, an MNO operational profile, a user profile, and the like. The user profile may exist independently or may be included in the MNO operational profile.

In the present invention, when the eUICC is not opened with the MNO, the provisioning profile refers to a file that provides network access information for accessing a mobile communication network to support MNO opening. At this time, the accessing mobile communication network may be a network of an MNO which is not specified.

The MNO operation profile refers to a file that provides MNO network access information for accessing an opened MNO network and providing services after the eUICC is opened with the MNO, and may exist in one or more eUICCs.

The user profile may mean a file provided as a storage space for user information such as SMS, MMS, and phone book.

On the other hand, when the terminal equipped with the eUICC is not opened with the MNO, the provisioning profile for providing a mobile communication network to load the MNO operation profile has been discussed, but the exact function or method has not been determined yet. .

If the function of the provisioning profile is not provided, the user may have to visit the dealer directly at the opening of the MNO to load the MNO operation profile by wire.

For example, a vehicle equipped with an eUICC may need to visit a dealership with a vehicle to open the eUICC. In addition, when the eUICC is mounted on a non-movable M2M device, the opening process may be more difficult.

Accordingly, the present invention proposes a detailed structure of a provisioning profile stored in an eUICC, and proposes a procedure for accessing a mobile communication network before opening a MNO of a terminal including an eUICC.

In more detail, the provisioning profile stored in the eUICC may be configured in the form of an application dedicated file (ADF). The Application Identification (AID) of the ADF-type provisioning profile may be stored in an EF _DIR (Elementary File Directory) to indicate an address where the ADF of the provisioning profile may be selected.

The provisioning profile according to a preferred embodiment of the present invention comprises an IMSI file (EFIMSI). The 'IMSI (International Mobile Subscriber Identity) file' may be referred to as an 'international terminal subscription identification file', a 'terminal subscriber identification information file', a 'subscriber identification information file', or a 'subscriber identification file'. Although a file including IMSI information described in a file format has been described as an example, it means all files of various formats including information for identifying a subscriber of a terminal.

The IMSI information included in the IMSI file EFIMSI will be described later with reference to FIG. 4.

Accordingly, the eUICC according to an embodiment of the present invention may include a storage unit in which a provisioning profile including network connection information is stored. Here, the provisioning profile may include an International Mobile Subscriber Identity (IMSI) file and authentication credential information, and may be configured in the form of an Application Dedicated File (ADF).

2 is a conceptual diagram illustrating information of an AID.

Referring to FIG. 2, the AID includes a Registered Application Provider Identifier (RID) and a Proprietary Application Identifier eXtension (PIX), and may include a maximum of 16 bytes (22 Digits).

Here, RID may have a value of 'A000000009' if it is defined in ETSI as hexadecimal, and 'A000000087' if it is defined in 3GPP, and PIX is an application code (Application code (Digits 1 to 4)) and a country code (Country). code (Digits 5 to 8)), application provider code (Application provider code (Digits 9 to 14)), and application provider field Optional (Application provider field Optional (Digits 15 up to 22)).

The AID indicating an address at which the ADF of the provisioning profile can be selected may include information for identifying that the profile indicated by the AID is a provisioning profile. That is, a preferred example of the information that can be seen that the provisioning profile may be included in the application code of the PIX of the AID information configuration of FIG.

For example, the storage section of the eUICC has application identifier indicative of the access information in the provisioning profile (AID: Application Identification) information is stored, application identifier information is EF (Elementary File Directory) _DIR of the saved standardized file system to the storage unit Can be stored in.

3 is a conceptual diagram illustrating a structure of an MNO operation profile loaded in an eUICC.

The MNO operation profile loaded in the eUICC may also be configured in the form of an application dedicated file (ADF). Here, AID (Application Identification) of the MNO operation profile in the form of an ADF may be stored in the EF _DIR to indicate an address for selecting an ADF of the MNO operation profile.

The AID indicating an address for selecting an MNO operation profile may include information for identifying that the profile indicated by the AID is an MNO operation profile. A preferred example of the information that can be seen as the operation profile may be included in the application code (Application code) of the PIX of the AID information configuration of FIG.

Meanwhile, the information of the specific MNO may include a country code of the PIX and an application provider code. In addition, you can use the Application provider field Optional.

There may be more than one MNO operational profile in the eUICC.

4 is a conceptual diagram illustrating IMSI information.

Referring to FIG. 4, the configuration of IMSI information included in an IMSI file (EFIMSI) is shown. The provisioning profile may include an IMSI file.

The IMSI is a Mobile Country Code (MCC) indicating the country to which the user has subscribed, a Mobile Network Code (MNC) indicating the MNO to which the user has subscribed, and the MNO to which the user has subscribed. MSIN (Mobile Subscriber Identification Number) indicating the number of the subscriber to manage may be configured.

In addition, the country code and the terminal network code included in the International Mobile Subscriber Identifier (IMSI) file are different from the country code and the terminal network code of the network to which the device with the eUICC registers its location, and the data for authentication of the device is stored. The country code and the terminal network code of the network to be generated may be the same.

When the terminal having the eUICC is not opened with the MNO, the provisioning profile is a profile capable of providing a mobile communication network to load the MNO operation profile, wherein the mobile communication network to which the terminal is connected is not specified ( That is, it may be a network of any) MNO, or may be a network of a predetermined MNO.

The subject of allocating information of the IMSI file, which may be included in the provisioning profile, may be an operator managing eUICC user authentication rather than a specific MNO. An operator managing eUICC user authentication (hereinafter referred to as an 'eUICC user authentication provider') is an authentication center (hereinafter referred to as 'AuC') regardless of whether a mobile communication network (base station, exchange, etc.) is provided (managed). ') Or Home Location Register (hereinafter referred to as' HLR') which provides (manages) and refers to a service provider that provides processing of eUICC user authentication related tasks.

Here, the operator may have an authentication credential for authenticating the eUICC user, the authentication credential performs an authentication processing function for mobile communication network user authentication, and may be an authentication secret key.

A preferred example of the eUICC user authentication provider may be an M2M service provider using the eUICC. In addition, the service provider may manage a server that loads the MNO operation profile into the eUICC.

The server may be a subscription management device (SM) or an eUICC user authentication management device. For example, the subscriber management device (SM) for loading the authentication center or home location register and the MNO operation profile into the eUICC. May be physically separate or composed of one device.

Therefore, in one embodiment of the present invention, the IMSI file to be included in the provisioning profile includes an MCC representing the country of the eUICC user authentication provider, an MNC representing the eUICC user authentication provider, and an MSIN representing the number of subscribers managed by the eUICC user authentication provider. It may be configured to include.

FIG. 5 is a flowchart illustrating a process of requesting and transferring IMSI information and authentication credentials for a provisioning profile between an eUICC manufacturer and an eUICC user authentication provider (or device).

Referring to FIG. 5, a procedure for requesting and transferring IMSI information and authentication credentials for a provisioning profile between an eUICC manufacturer and an eUICC user authentication provider (or an authentication device of the eUICC user authentication provider) is shown.

The authentication credential performs an authentication processing function for authenticating a mobile communication network user, and may be an authentication secret key.

The eUICC manufacturer may request an allocation of IMSI and authentication credentials to be included in a provisioning profile from an eUICC user authentication provider or a device managed by the operator (S510). The device managed by the eUICC user authentication operator or the operator may allocate and transfer an IMSI and an authentication credential value (S520).

In addition, the eUICC manufacturer may generate a provisioning profile using the received value and store it in the eUICC (S530).

A process of connecting the terminal to the mobile communication network will be described later with reference to FIG. 6.

6 is a flowchart illustrating a process of connecting a terminal to a mobile communication network using a provisioning profile.

Referring to FIG. 6, when a terminal having an eUICC does not have any MNO operation profile in the eUICC or an MNO operation profile required in the eUICC, an MNO not specified (or predetermined) using a provisioning profile may be present. To a mobile communication network.

The eUICC user authentication provider that manages the authentication credentials of the provisioning profile may not provide a mobile communication network. Therefore, a mobile communication network connected through cell selection and PLMN selection process is a roaming network. Can be

In a network access method performed in an apparatus with an eUICC according to an embodiment of the present invention, the provisioning profile information stored in the eUICC may be read and a location registration request message may be transmitted to the network using the provisioning profile information.

Here, the International Mobile Subscriber Identifier (IMSI) information included in the provisioning profile information stored in the eUICC may be read.

In addition, an authentication request message may be received from the network in response to the location registration request message, and authentication may be performed with the network. Here, the authentication process may read authentication credential information included in the provisioning profile, perform a process for authentication based on the read authentication credential information, and transmit the authentication processing result to the network. The authentication process may further comprise receiving a location registration response from the network.

Referring to Figure 6 will be described in detail the mobile communication network access procedure of an unopened terminal according to an embodiment of the present invention.

The terminal performs a location registration process using the IMSI of the provisioning profile. That is, the terminal may request the location registration to the exchange (S610). Here, IMSI is a value assigned by an eUICC user authentication provider (or device) that manages authentication credential information, and may be different from MCC and MNC values of a connected network.

Accordingly, the exchange of the connected network may request authentication data from the device managing the IMSI (S620). Upon receiving the request, the eUICC user authentication device generates authentication data using the authentication credentials mapped with the IMSI information, and sends an authentication data response to the requesting exchange (S630).

The exchange performs an authentication process with the terminal using the received authentication data (S640). In this case, the terminal may process the authentication process using the authentication credentials included in the provisioning profile (S650). That is, the exchange can make an authentication request to the terminal using the authentication data (S640), and the terminal can make an authentication response corresponding to the authentication request (S650).

When the authentication process is normally completed, the exchange sends a location registration response (S660) and the terminal can receive the mobile communication service in the connected mobile communication network. Thus, the terminal can access the eUICC user authentication device using the provided mobile communication network and load the MNO operation profile in the eUICC.

That is, the terminal may perform a cell selection and PLMN selection process to select a network and register a location of the terminal in the selected network.

In addition, the location registration process may include a user authentication process. When the location registration process is normally completed, the terminal may be provided with a mobile communication service through the corresponding mobile communication network. The cell selection process is a process of finding whether there is a cell that can communicate in a supportable frequency band of the terminal, and the PLMN selection process is a process of finding a suitable cell according to PLMN priority among selected cells.

Accordingly, the terminal loaded with the MNO operation profile may be connected to the mobile communication network of the loaded MNO to receive the mobile communication service of the MNO. That is, the eUICC includes an operational profile of at least one mobile network operator (MNO), but the operational profile may be in the form of an ADF.

In the present specification, the 'function' may be referred to as 'functional part', 'module', and 'operating part', etc., and one 'function' may be referred to as a separate 'function' independent of the other 'function'. Each may be implemented, but may also be implemented in a single 'function' (eg, a control unit provided in the terminal).

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

Claims (13)

Includes a storage in which a provisioning profile containing network connection information is stored,
The provisioning profile is
An embedded Universal Integrated Circuit Card (eUICC) containing an International Mobile Subscriber Identity (IMSI) file and authentication credential information. The method according to claim 1,
The authentication credential information,
EUICC, characterized in that the authentication secret key 'K' used in the Authentication and Key Agreement (AKA) method of the basic authentication processing method of WCDMA and LTE networks. The method according to claim 1,
The provisioning profile is
EUICC, characterized in that configured in the form of ADF (Application Dedicated File). The method according to claim 1,
The storage unit stores application identifier (AID) information indicating access information of the provisioning profile,
The application identifier information is stored in the elementary file directory (EF _DIR ) of the standardized file system stored in the storage unit. The method of claim 4,
The application identifier information,
At least one of an application code, a country code, an application provider code, and an application provider field optional indicating that the profile indicated by the application identifier information is a provisioning profile EUICC, characterized in that it contains information. The method according to claim 1,
The international mobile subscriber identifier (IMSI) file,
EUICC, characterized in that it comprises at least one of a mobile country code (Mobile Country Code), a mobile network code (Mobile Network Code) and a mobile subscriber identification number (Mobile Subscriber Identification Number). The method according to claim 1,
The country code and the terminal network code included in the international mobile subscriber identifier (IMSI) file,
And a device having the eUICC is different from a country code and a terminal network code of a network to register a location, and is identical to a country code and a terminal network code of a network generating data for authentication of the device. The method according to claim 1,
The eUICC,
Including an operational profile of at least one mobile network operator (MNO),
The operation profile is eUICC, characterized in that configured in the form of ADF. The method according to claim 8,
The storage unit stores application identifier (AID) information indicating access information of the operation profile of the at least one mobile network operator,
The application identifier information is eUICC, characterized in that stored in the EF _DIR of the standardized file system stored in the storage. In the network connection method performed in the device having an eUICC,
Reading provisioning profile information stored in the eUICC;
Transmitting a location registration request message to a network using the provisioning profile information;
Receiving an authentication request message in response to a location registration request message from the network; And
A network access method of a device with an eUICC comprising the step of performing authentication with the network. The method of claim 10,
Reading the provisioning profile information,
Read International Mobile Subscriber Identifier (IMSI) information included in provisioning profile information stored in the eUICC,
The international mobile subscriber identifier information includes an eUICC, characterized in that it includes at least one of a mobile country code, a mobile network code, and a mobile subscriber identification number. How to connect a network to one device. The method of claim 10,
Performing authentication with the network,
Reading authentication credential information included in the provisioning profile;
Performing a process for authentication based on the read authentication credential information; And
And a step of transmitting an authentication process result to the network. The method of claim 10,
Performing authentication with the network,
And receiving a location registration response from the network.

Images