WO2018098713A1

WO2018098713A1 - Method and device for acquiring authorization file

Info

Publication number: WO2018098713A1
Application number: PCT/CN2016/108094
Authority: WO
Inventors: 衣强; 高林毅
Original assignee: 华为技术有限公司
Priority date: 2016-11-30
Filing date: 2016-11-30
Publication date: 2018-06-07
Also published as: CN108235821A; CN108235821B

Abstract

The present invention relates to the technical field of communications, and disclosed in embodiments of the present invention are a method and device for acquiring an authorization file, used to perform a real-time update of an authorization file stored in a user terminal. The method comprises: a user terminal sending to a server an EID of an eUICC in the user terminal; the user terminal receiving an authorization file sent by the server, wherein the authorization file corresponds to the EID of the eUICC in the user terminal, and comprises one or more policy rules and information, corresponding to each of the one or more policy rules, about operators having permission to configure the one or more policy rules; and the user terminal storing the authorization file in the eUICC; alternatively, the user terminal using the authorization file to update an authorization file stored in the eUICC. The embodiments of the present invention are applicable to an authorization file acquisition process of a user terminal.

Description

Method and device for obtaining authorization file

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a method and a device for obtaining an authorization file.

Background technique

As a module for access authentication and identity authentication, a smart card is one of the necessary devices for a user terminal in a mobile communication network. For example, an embedded universal integrated circuit card (eUICC) is a smart card that allows an operator's identity authentication application to be dynamically loaded online. The eUICC can download and store at least one user identity data and interface. Enter information for legitimate users to access the carrier network. The user identity data and the access information are referred to as a contract information set (referred to as a profile). The profile or order data of the eUICC and an operator may be saved in each profile in at least one profile. The at least one profile may be downloaded from the subscription management data preparation server (English: Subscription Manager Data Preparation, SM-DP for short) and then stored in the eUICC. The terminal can access the carrier network corresponding to the profile by activating the profile.

In order to limit the user's operation on the profile, the operator sets a series of policy rules (English: policy rule) for restricting the user's operation on the profile. For example, the policy rule of the profile can be: "The profile is not allowed to be deactivated", "The profile is not allowed to be deleted" or "The profile should be deleted after activation".

At the same time, the user terminal or the eUICC also stores an authorization file for managing the permission of the operator to set the policy rule of the profile. The authorization file can be implemented only when the authorization file allows the operator to set a policy rule. The policy rule of the profile can be activated when the profile is installed.

The problem is that the authorization file in the eUICC in the prior art is in the eUICC. At the factory, the fixed, unchangeable files in the eUICC are configured by the manufacturer. However, the permission of the operator to set the policy rule can be changed according to the requirements of each user. That is, the fixed and unchangeable authorization files preset in the eUICC in the prior art cannot be adapted to the change of the authority of the operator to set the policy rule. .

Summary of the invention

The embodiment of the present invention provides a method and a device for acquiring an authorization file, which are used to solve the problem that the authorization file that is fixed and unchangeable in the eUICC is not adapted to the change of the authority of the operator to set the policy rule.

In a first aspect, the embodiment of the present invention provides a method for obtaining an authorization file, where the method for obtaining an authorization file may include: the user terminal sends an embedded universal integrated circuit card identifier of the eUICC on the user terminal to the server (English: Embedded Universal) Integrated circuit card identification (EID); the user terminal receives an authorization file sent by the server, and the authorization file corresponds to an EID of the eUICC on the user terminal, where the authorization file includes at least one policy rule and each of the at least one policy rule The information corresponding to the policy rule allows the operator to set the policy rule; the user terminal saves the authorization file in the eUICC, or the user terminal uses the authorization file to update the authorization file saved in the eUICC. The above server may be an SM-DS or a push server.

After the user terminal can send the EID of the eUICC on the user terminal to the server, the user terminal can receive the authorization file corresponding to the eUICC sent by the server, and update the user terminal after receiving the authorization file. Authorization file saved in eUICC. In this way, the fixed and unchangeable authorization file preset in the eUICC in the prior art can be solved, and the authorization file in the eUICC cannot be adapted to the problem that the operator changes the permission of the policy rule for the user. The method for obtaining an authorization file provided by the embodiment of the present invention can update the authorization file saved in the eUICC on the user terminal in real time.

In a possible implementation manner, the foregoing server may be an SM-DS. In this implementation manner, the method for “the user terminal sends the EID of the eUICC on the user terminal to the server” may include: the user terminal sends a polling message to the SM-DS, the polling The message carries the EID of the eUICC on the user terminal, and the user terminal receives the response message of the polling message sent by the SM-DS, and the response message of the polling message carries the authorization file.

In a possible implementation manner, the foregoing server may be a push server. In this implementation, the method for the user terminal to send the EID of the eUICC on the user terminal to the server may include: the user terminal sends a registration request to the push server, where the registration request carries the EID of the eUICC on the user terminal.

In a possible implementation, when the server is a push server, the registration request may further carry an LPA identifier of the LPA in the user terminal, where the LPA identifier is used to uniquely identify one LPA in the user terminal. Correspondingly, after the user terminal sends the registration request to the push server, the method of the embodiment of the present invention may further include: the user terminal receives the response message of the registration request sent by the push server, where the response message of the registration request carries the push server as the registration The password assigned by the LPA indicated by the LPA identifier carried in the request; the user terminal receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file.

It is conceivable that, since the user terminal includes at least one LPA, the push server may send the password assigned by the push server to an LPA in the user terminal to the user terminal, so that the user terminal can save the password of the LPA and receive the password. After the authorization file sent by the server and the password corresponding to the EID corresponding to the authorization file are used, the password corresponding to the EID corresponding to the authorization file may be used to compare the password assigned by the push server to the LPA, and the LPA corresponding to the authorization file is determined.

In a possible implementation, the method for the “user terminal storing the authorization file in the eUICC” may include: if the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, the user terminal passes the LPA. Save the authorization file in eUICC.

The user terminal compares the password corresponding to the EID corresponding to the authorization file and the password assigned by the push server to the LPA. When the password corresponding to the EID corresponding to the authorization file is the same as the password assigned by the push server to the LPA, the user terminal passes the LPA on the eUICC. Save the authorization file; the password and push service corresponding to the EID corresponding to the authorization file When the password assigned to the LPA is different, the user terminal does not save the authorization file in the eUICC.

In a possible implementation manner, the method that the “user terminal uses the authorization file to update the authorization file saved in the eUICC” may include: if the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, the user The terminal updates the authorization file saved in the eUICC through the LPA using the authorization file.

In a possible implementation manner, when the server is an SM-DS, the method of the embodiment of the present invention may further include: the user terminal receives the subscription management data preparation server of the first operator (English: Subscription Manager-Date Preparation) The first policy rule sent by the SM-DP, the first policy rule is a policy rule associated with the first subscription information set set by the first operator, and the first operator is the operation to which the first subscription information set belongs. Business.

The SM-DP may be the SM-DP of the first carrier, and the user equipment may establish a connection with the SM-DP and authenticate each other, and request to obtain the first subscription information set of the first operator. After receiving the message requesting the first subscription information set of the first operator, the SM-DP may first send the metadata of the first subscription information set of the first operator to the user terminal, where the metadata includes the first policy. The rule, so that the user terminal can receive the first policy rule in the metadata of the first subscription information set of the first operator sent by the SM-DP.

In a possible implementation manner, when the server is an SM-DS, the method of the embodiment of the present invention may further include: after receiving the first policy rule, the user terminal sends a polling message to the SM-DS, where the polling The message carries the EID of the eUICC on the user terminal, and the foregoing polling message is used to request the SM-DS to send an authorization file corresponding to the EID of the eUICC on the user terminal to the user terminal.

In this implementation manner, after receiving the first policy rule, the user terminal determines that the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule included in the authorization file does not include the first carrier. The user terminal sends a polling message to the SM-DS. The information of the operator that allows the setting of the first policy rule does not include the information of the first carrier may be the permission of at least one policy rule in the authorization file. The operator of the policy setting rule does not include the information of the first operator, and the operator of the at least one policy rule in the authorization file that allows the policy rule to be set may be all operators. After receiving the first policy rule in the metadata of the first subscription information set sent by the SM-DP, the user equipment may first determine whether the first policy rule is included in the authorization file saved on the user terminal, and the user policy is included in the user terminal. When the information of the operator that allows the first policy rule to be set in the saved authorization file does not include the information of the first carrier, the authorization file is obtained from the SM-DS by sending a polling message to the SM-DS. In order to avoid the user terminal repeatedly obtaining the authorization file from the SM-DS.

In a possible implementation manner, when the server is a push server, the method of the embodiment of the present invention may further include: after receiving the first policy rule, the user terminal starts a timer, and is within a timer time. Waiting to receive the authorization file sent by the push server, the first operator is the operator to which the first subscription information set belongs.

The SM-DP may be the SM-DP of the first carrier, and the user equipment may establish a connection with the SM-DP and authenticate each other, and request to obtain the first subscription information set of the first operator. After receiving the message requesting the first subscription information set of the first operator, the SM-DP may first send the metadata of the first subscription information set of the first operator to the user terminal, where the metadata includes the first policy. The rule, so that the user terminal can receive the first policy rule in the metadata of the first subscription information set of the first operator sent by the SM-DP. It is conceivable that if the user terminal can receive the authorization file sent by the push server within the time limit of the timer, the received authorization file can be saved or the received authorization can be saved after receiving the authorization file sent by the push server. The file is updated with the authorization file saved in the eUICC on the user terminal; if the user terminal does not receive the authorization file sent by the push server within the time limit of the timer, it indicates that the push server may not receive the authorization file sent by the authorized file server. .

In a possible implementation, the method that the user terminal starts the timer after receiving the first policy rule and waits to receive the authorization file sent by the push server within the time limit of the timer may include: the user terminal. After receiving the first policy rule, if the information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first carrier, the user terminal starts a timer and is at the timing of the timer. Waiting to receive the authorization file sent by the push server.

In this implementation manner, after receiving the first policy rule, the user terminal determines that the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule included in the authorization file does not include the first carrier. The user terminal starts a timer and waits to receive the authorization file sent by the push server within the timer time. The information of the operator that allows the setting of the policy rule does not include the information of the first carrier. The operator that can set the policy rule for the at least one policy rule in the authorization file does not include the information of the first carrier. The operator of at least one policy rule in the authorization file that allows the policy rule to be set can be for all operators. After receiving the first policy rule in the metadata of the first subscription information set sent by the SM-DP, the user equipment may first determine whether the first policy rule is included in the authorization file saved on the user terminal, and the user policy is included in the user terminal. When the information of the operator that allows the policy rule to be set in the saved authorization file does not include the information of the first carrier, the timer is started, and the authorization file sent by the push server is waited for within the time limit of the timer. In this way, when the authorization file is saved in the user terminal, it is also necessary to wait for the authorization file sent by the push server to be received within the timer time.

In a possible implementation, the at least one policy rule includes at least one of: the subscription information set is not allowed to be deleted, the subscription information set is not allowed to be deactivated, and at least one of the subscription information set is deactivated, wherein at least one policy is deleted. The rules include the first policy rule. The effective time that the operator sets the policy rule may be used to prompt the user that the operator can only have the right to set the policy rule within the valid time period when the policy rule or profile is activated.

In a possible implementation, the method of the embodiment of the present invention may further include: receiving, by the user terminal, a valid time of the first policy rule, where the effective time of the first policy rule is used to limit the effective time of the first policy rule.

In a possible implementation manner, the method of the embodiment of the present invention may further include: after the user terminal successfully installs the first subscription information set or the user terminal activates the first subscription information set, prompting the user with the first policy rule and the first The effective time of a policy rule. It is conceivable that the user terminal prompts the user with the first policy rule and the first policy. During the effective time of the rule, at least one of the subscription information set is not allowed to be deleted, the subscription information set is not allowed to be deactivated, and the subscription information set is deactivated, and the operator is allowed to set the policy rule of the operator.

In a possible implementation manner, the authorization file further includes an effective time for allowing the operator to set at least one policy rule, and the operator is allowed to set an effective time of any one of the at least one policy rule to limit the carrier to have the setting. The time of a policy rule's permissions. The method of the embodiment of the present invention may further include: when the user terminal activates the first policy rule, the user terminal determines whether the current time is within a valid time period allowed in the authorization file to allow the first operator to set the first policy rule; The user terminal prohibits activation of the first policy rule when the effective time for allowing the first operator to set the first policy rule is exceeded. In this implementation manner, not only the authorization file may be used to restrict the permission of the operator to set the policy rule, but also whether the current time is within the validity time of the first policy rule that the first carrier is allowed to be included in the authorization file. It is determined whether the operator has the right to set the first policy rule at the current time, that is, the effective time for allowing the operator to set the policy rule of the operator may be specified.

In a possible implementation, after the user terminal receives the authorization file sent by the server, the method of the embodiment of the present invention may further include: the user terminal receiving the policy rule release request message sent by the function entity of the first operator, the policy The rule release request message carries the information of the first operator and/or the policy rule to be released; if the policy rule to be released included in the authorization file contains the information of the operator that is allowed to set the policy rule to be released, The information of the first carrier, the user terminal deletes the information of the first operator in the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released included in the authorization file. The first operator may be any operator in the current network. The user terminal may cancel the request message according to the policy rule sent by the function entity of the first operator, and delete part of the content in the authorization file.

In a possible implementation, after the user terminal receives the authorization file sent by the server, the method of the embodiment of the present invention may further include: after the user terminal successfully installs the first subscription information set, deleting the first content included in the authorization file. Policy rules correspond to Setting the information of the first operator in the information of the operator of the first policy rule; or, after successfully installing the first subscription information set, the user terminal deletes the authorization file containing the information of the first operator saved in the user terminal. .

In a possible implementation manner, before the user terminal activates the second subscription information set installed in the user terminal, if it is determined that the second policy rule is that the subscription information set is not allowed to be deactivated, the user terminal checks the authorization file, and the second subscription The information set belongs to the second operator, and the second policy rule is a policy rule that is associated with the second subscription information set set by the second operator; if the second policy rule included in the authorization file is allowed, the second policy rule is allowed to be set. The information of the operator includes the information of the third carrier, the user terminal sends the prompt information, and the third operator includes any operator other than the second operator. The foregoing prompt information at least includes: if the second subscription information set is activated, the subscription information set of the third operator cannot be downloaded, or the second subscription information set is activated, and the subscription information set of the third operator and the information of the third carrier cannot be downloaded. .

In this implementation manner, the user terminal may prompt the user to activate the second subscription information set by issuing a prompt message to the user, which may cause problems, such as activation of the second subscription information set may result in failure to activate the first The contract information set of the three operators enables the user to select whether to continue to activate the second subscription information set according to the prompt information.

In a second aspect, the embodiment of the present invention provides a method for obtaining an authorization file, where the method for obtaining an authorization file may include: obtaining, by the server, an authorization file, where the authorization file corresponds to an EID of an eUICC on the user terminal, where the authorization file includes An EID of the eUICC, at least one policy rule, and information corresponding to each of the at least one policy rule that allows the operator to set the policy rule; the server sends the authorization file to the user terminal. The server may be a subscription management-service discovery server (English: Subscription Manager-Discovery Service, SM-DS for short) or a push (English: Push) server.

The server may send the authorization file to the user terminal after obtaining the authorization file, so that the user terminal can update the authorization file saved in the eUICC on the user terminal in real time. In this way, the fixed and unchangeable authorization files preset in the eUICC in the prior art can be solved, and the authorization file in the eUICC cannot be adapted. The problem of changes in the authority of the operator to set the policy rule for the user. The method for obtaining an authorization file provided by the embodiment of the present invention can update the authorization file saved in the eUICC on the user terminal in real time.

In a possible implementation manner, the foregoing server may be an SM-DS. Correspondingly, the method for the server to send the authorization file to the user terminal may include: the SM-DS receives the polling message sent by the user terminal (English: Polling), where the polling message carries the EID of the eUICC on the user terminal; The DS sends a response message to the user terminal, and the response message of the polling message carries an authorization file corresponding to the EID carried in the polling message.

After receiving the polling message sent by the user terminal, the SM-DS may send a response message to the user terminal that includes the authorization file corresponding to the EID carried in the polling message, that is, the SM-DS may send and send to the user terminal. The authorization file corresponding to the eUICC on the user terminal. In this way, after receiving the authorization file sent by the SM-DS, the user terminal can save the authorization file or update the authorization file saved in the user terminal by using the received authorization file.

In a possible implementation manner, the foregoing server may be a push server. After the server obtains the authorization file, the method of the embodiment of the present invention may further include: the push server generates, according to the EID and the push server saved in the push server, a local file assistant (English: Local Profile Assistant, LPA) in the user terminal. The password corresponds to the password corresponding to the EID corresponding to the authorization file, and the user terminal includes at least one LPA. Correspondingly, the method for the server to send the authorization file to the user terminal may include: the push server sends the authorization file and the password corresponding to the EID corresponding to the authorization file to the user terminal.

The authorization file may correspond to one eUICC, and each eUICC has its EID; therefore, the authorization file may also correspond to the EID of an eUICC, and the push server may be the user ID in the user terminal according to the EID and the push server saved in the push server. The correspondence between the passwords generated by the LPA determines the password corresponding to the EID corresponding to the authorization file.

In a possible implementation manner, the server sends an authorization file to the user terminal. The method of the embodiment of the present invention may further include: the sending server receiving the registration request sent by the user terminal, where the registration request carries the LPA identifier and the EID of the eUICC on the user terminal; the push server is the LPA identifier carried in the registration request. The indicated LPA assigns a password, and stores a correspondence between the password assigned by the push server for the LPA indicated by the LPA identifier and the EID carried in the registration request. That is, in the above implementation manner, the “correspondence between the EID stored in the push server and the password generated by the push server for the LPA in the user terminal” may be generated by the push server after receiving the registration request sent by the user terminal, and stored in the push server. of.

In a possible implementation, after the push server allocates a password for the LPA indicated by the LPA identifier carried in the registration request, the method of the embodiment of the present invention may further include: the push server sends a response message of the registration request to the user terminal, The response message of the registration request carries a password assigned by the push server to the LPA indicated by the LPA identifier.

It is conceivable that, since the user terminal includes at least one LPA, the push server may send the password assigned by the push server to one of the user terminals to the user terminal, so that the user terminal can save the password of the LPA and receive the password. After the "authorization file and the password corresponding to the EID corresponding to the authorization file" sent by the server are forwarded, the LPA corresponding to the authorization file may be determined by comparing the password corresponding to the EID corresponding to the authorization file with the password of the LPA in the user terminal.

In a third aspect, an embodiment of the present invention provides a user terminal, where the user terminal may include: a sending unit, a receiving unit, and a control unit. And a sending unit, configured to send, to the server, an EID of the eUICC on the user terminal. a receiving unit, configured to receive an authorization file sent by the server, where the authorization file corresponds to an EID of the eUICC on the user terminal, where the authorization file includes at least one policy rule and a permission setting corresponding to each policy rule in the at least one policy rule. The information of the operator of the policy rule. The control unit is configured to save the authorization file received by the receiving unit in the eUICC, or update the authorization file saved in the eUICC by using the authorization file received by the receiving unit.

In a possible implementation manner, the server is an SM-DS, and the sending unit is specifically configured to: send a polling message to the SM-DS, where the polling message carries the user terminal. The EID of the eUICC; the receiving unit is specifically configured to: receive a response message of the polling message sent by the SM-DS, where the response message of the polling message carries an authorization file.

In a possible implementation manner, the server is a push server, and the sending unit is configured to send a registration request to the push server, where the registration request carries the EID of the eUICC on the user terminal.

In a possible implementation manner, the server is a push server, and the registration request sent by the sending unit further carries the LPA identifier of the LPA in the user terminal. The receiving unit is further configured to: after the sending unit sends the registration request to the push server, receive a response message of the registration request sent by the push server, where the response message of the registration request carries the indication that the push server is the LPA identifier carried in the registration request. The password assigned by the LPA; the receiving unit is specifically configured to: receive the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file.

In a possible implementation, after the receiving unit receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file, the user terminal may further include: a comparison unit. The comparing unit is configured to compare the password assigned by the push server to the LPA by using a password corresponding to the EID corresponding to the authorization file.

In a possible implementation manner, the control unit may be specifically configured to: when the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, save the authorization file in the eUICC through the LPA.

In a possible implementation, the control unit may be specifically configured to: if the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, update the authorization file saved in the eUICC by using the authorization file by the LPA. .

In one possible implementation, the server may be an SM-DS. The receiving unit is further configured to receive a first policy rule that is sent by the SM-DP of the first operator, where the first policy rule is a policy rule that is set by the first operator and is associated with the first subscription information set, where the first carrier is The operator to which the first contract information set belongs.

In one possible implementation, the server may be an SM-DS. The sending unit is further configured to: after receiving the first policy rule, the sending unit sends a polling message to the SM-DS, where the polling message carries the EID of the eUICC on the user terminal, where the polling is performed. The information is used to request the SM-DS to send an authorization file corresponding to the EID of the eUICC on the user terminal to the user terminal.

In a possible implementation manner, the sending unit may be specifically configured to: after the receiving, by the receiving unit, the first policy rule, if the information of the operator that allows the setting of the policy rule in the authorization file does not include the first carrier The information is sent to the SM-DS for polling messages.

In a possible implementation, the server is a push server. The user terminal may further include: a boot unit. The startup unit is configured to start a timer after the receiving unit receives the first policy rule. The receiving unit is further configured to wait for receiving the authorization file sent by the push server within a timing time of the timer started by the startup unit.

In a possible implementation, the initiating unit is specifically configured to: after receiving the first policy rule, if the information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first operator, Then start the timer. The receiving unit is further configured to wait for receiving the authorization file sent by the push server within a timing time of the timer started by the startup unit.

In a possible implementation manner, the at least one policy rule includes at least one of: the subscription information set is not allowed to be deleted, the subscription information set is not allowed to be deactivated, and at least one of the subscription information set is deactivated. The at least one policy rule includes a first policy rule.

In a possible implementation, the receiving unit is further configured to receive a valid time of the first policy rule, where the effective time of the first policy rule may be used to define an effective time of the first policy rule.

In a possible implementation manner, the user terminal may further include: an installation unit, a first activation unit unit, and a first prompt unit. The installation unit is configured to install the first subscription information set on the user terminal. The first activation unit is configured to activate the first subscription information set. The first prompting unit is configured to prompt the user of the first policy rule and the valid time of the first policy rule after the installation unit successfully installs the first subscription information set or the first activation unit activates the first subscription information set.

In a possible implementation, the authorization file also includes allowing the operator to set The effective time of at least one policy rule allows the operator to set the effective time of any one of the at least one policy rule to limit the time when the operator has the right to set any policy rule. The user terminal may further include: a second activation unit, a determination unit, and a prohibition unit. a second activation unit, configured to activate the first policy rule. The determining unit is configured to determine, when the second activation unit activates the first policy rule, whether the current time is within a valid time period allowed in the authorization file to allow the first operator to set the first policy rule. The forbidden unit is configured to prohibit activation of the first policy rule if the determining unit determines that the current time exceeds a valid time for allowing the first operator to set the first policy rule.

In a possible implementation manner, the receiving unit is further configured to: after receiving the authorization file sent by the server, receive a policy rule release request message sent by the function entity of the first operator, where the policy rule release request message carries the An operator's information and policy rules to be released. The user terminal may further include: a deleting unit. Deleting a unit, if the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released included in the authorization file includes the information of the first operator, deleting the information to be released included in the authorization file The information of the first operator in the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule.

In a possible implementation, after the receiving unit receives the authorization file sent by the server, the deleting unit is further configured to delete the first policy rule included in the authorization file after the installation unit successfully installs the first subscription information set. The information of the first operator in the information of the operator that is allowed to set the first policy rule; or, after the installation unit successfully installs the first subscription information set, delete the information containing the first operator saved in the user terminal. Authorization file.

In a possible implementation, the installation unit is further configured to install a second subscription information set in the user terminal, and the first activation unit is further configured to activate the second subscription information set installed by the installation unit. The user terminal may further include: an inspection unit and a second prompt unit. The checking unit is configured to: before the first activation unit activates the second subscription information set, if it is determined that the second policy rule is that the subscription information set is not allowed to be deactivated, the authorization file is checked, and the second subscription information set belongs to the second operator, The second policy rule is a policy rule that is set by the second operator and associated with the second subscription information set. Second prompt unit, if the authorization text If the information of the operator that is allowed to set the second policy rule corresponding to the second policy rule included in the device includes the information of the third operator, the prompt information is sent, and the third operator includes any other than the second operator. An operator. The prompt information includes at least: the activation of the second subscription information set may fail to download the subscription information set of the third operator or activate the second subscription information set to download the subscription information set of the third operator and the information of the third carrier.

It should be noted that each of the functional units of the third aspect and various possible implementation manners of the embodiments of the present invention is to obtain the authorization file according to the foregoing first aspect and various optional manners of the first aspect. The method, while logically dividing the user terminal. For a detailed description of the various functional units of the third aspect and its various possible implementations, and the beneficial effects analysis, reference may be made to the corresponding descriptions and technical effects in the foregoing first aspect and various possible implementation manners, and details are not described herein again.

In a fourth aspect, a user terminal is provided, the user terminal comprising: one or more processors, a memory, a bus, and a transceiver. The memory is used to store computer execution instructions, the processor and the memory are connected by a bus, and when the user terminal is running, the processor executes the computer stored instructions of the memory storage to enable the user terminal to perform various optional aspects as in the first aspect and the first aspect. The method used to obtain the authorization file in the mode.

In a fifth aspect, a non-volatile storage medium is provided. One or more program codes are stored in a non-volatile storage medium. When the processor of the user terminal in the fourth aspect executes the program code, the user terminal executes A method for obtaining an authorization file as in the first aspect and the various alternatives of the first aspect.

The processor in the fourth aspect may be the control unit, the comparison unit, the activation unit, the installation unit, the first activation unit, the first prompt unit, and the second activation unit in the third aspect and various possible implementation manners thereof. Integration of functional units such as a judging unit, a disabling unit, a deleting unit, an inspecting unit, and a second prompting unit, and the transceiver in the fourth aspect may be the transmitting unit and receiving in the above third aspect and various possible implementation manners thereof Unit integration for information interaction between user terminals and other communication devices such as servers.

The user terminal in the fourth aspect and the user terminal perform the meter described in the fifth aspect For a specific technical effect of the program stored in the computer readable storage medium and the related analysis process, reference may be made to the related technical effects in the first aspect or the implementation manner of the first aspect of the present invention, and details are not described herein again. .

In a sixth aspect, an embodiment of the present invention provides a server, where the server may include: an obtaining unit and a sending unit. An obtaining unit, configured to obtain an authorization file, where the authorization file corresponds to an EID of an eUICC on the user terminal, where the authorization file includes an EID of the eUICC, at least one policy rule, and an allowable corresponding to each policy rule in the at least one policy rule. Set the carrier's information for this policy rule. And a sending unit, configured to send, to the user terminal, an authorization file obtained by the acquiring unit.

In a possible implementation manner, the server is an SM-DS; the server may further include: a receiving unit. The receiving unit is configured to receive a polling message sent by the user terminal, where the polling message carries an EID of the eUICC on the user terminal. The sending unit is specifically configured to: send a response message of the polling message to the user terminal, where the response message of the polling message carries an authorization file corresponding to the EID carried in the polling message.

In a possible implementation, the server is a push server; the server may further include: a determining unit. a determining unit, configured to determine, according to the correspondence between the EID saved in the push server and the password generated by the push server for the LPA in the user terminal, after the obtaining unit obtains the authorization file, the password corresponding to the EID corresponding to the authorization file, in the user terminal Contains at least one LPA. The sending unit is specifically configured to: send, to the user terminal, an authorization file obtained by the obtaining unit and a password corresponding to the EID corresponding to the authorization file determined by the determining unit.

In a possible implementation manner, the receiving unit is further configured to: before the sending unit sends the authorization file obtained by the acquiring unit to the user terminal, receive a registration request sent by the user terminal, where the registration request carries the LPA identifier and the user terminal. EID of eUICC. The server may further include: an allocating unit and a saving unit. And an allocating unit, configured to allocate a password for the LPA indicated by the LPA identifier carried in the registration request received by the receiving unit. And a saving unit, configured to save a correspondence between the password allocated by the allocation unit for the LPA indicated by the LPA identifier and the EID carried in the registration request received by the receiving unit.

In a possible implementation manner, the sending unit is further configured to be connected in the allocating unit After receiving the LPA assignment password indicated by the LPA identifier carried in the registration request received by the receiving unit, the response message of the registration request is sent to the user terminal, where the response message of the registration request carries the LPA allocated by the push server for the LPA indication. Password.

It should be noted that each functional unit of the sixth aspect of the embodiments of the present invention and various possible implementation manners thereof is a method for obtaining an authorization file in order to perform the foregoing second aspect and various alternative manners of the second aspect. And the logical division of the server. For a detailed description of the various functional units of the sixth aspect and its various possible implementations, and the beneficial effects analysis, reference may be made to the corresponding descriptions and technical effects in the foregoing second aspect and various possible implementation manners, and details are not described herein again.

In a seventh aspect, a server is provided, the server comprising: one or more processors, a memory, a bus, and a transceiver. The memory is used to store computer execution instructions, the processor is coupled to the memory via a bus, and when the server is running, the processor executes the memory stored computer execution instructions to cause the server to perform the various alternatives as in the second aspect and the second aspect. The method used to obtain the authorization file.

According to an eighth aspect, a nonvolatile storage medium is provided. The nonvolatile storage medium stores one or more program codes. When the processor of the server in the seventh aspect executes the program code, the server executes the first A method for obtaining an authorization file in two aspects and various alternatives of the second aspect.

The processor in the seventh aspect may be the integration of the acquiring unit, the determining unit, the allocating unit, and the saving unit in the sixth aspect and various possible implementation manners thereof, where the transceiver in the seventh aspect may be The integration of the sending unit and the receiving unit in the sixth aspect and various possible implementation manners thereof is used to implement information interaction between the server and other communication devices (such as user terminals). The server of the seventh aspect, and the specific technical effect of the program stored in the computer-readable storage medium described in the eighth aspect, and the related analysis process, may refer to any of the second aspect or the second aspect of the embodiment of the present invention. Description of related technical effects in the implementation manner, and details are not described herein again.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set forth in the claims

1 is a schematic diagram of a network architecture of a communication network to which the method according to an embodiment of the present invention is applied;

2 is a schematic diagram of another network architecture of a communication network to which the method according to an embodiment of the present invention is applied;

3 is a schematic diagram of another network architecture of a communication network to which the method according to an embodiment of the present invention is applied;

FIG. 4 is a flowchart of a method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 5 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 6 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 7 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 8 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 9 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 10 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 11 is a flowchart of another method for obtaining an authorization file according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a server according to an embodiment of the present disclosure;

FIG. 13 is a schematic structural diagram of another server according to an embodiment of the present disclosure;

FIG. 14 is a schematic structural diagram of another server according to an embodiment of the present disclosure;

FIG. 15 is a schematic structural diagram of a user terminal according to an embodiment of the present disclosure;

FIG. 16 is a schematic structural diagram of another user terminal according to an embodiment of the present disclosure;

FIG. 17 is a schematic structural diagram of another user terminal according to an embodiment of the present invention.

detailed description

The terms "first" and "second" and the like in the description of the present invention and the drawings are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of the objects. For example, the first carrier, the second carrier, and the third carrier may be different operators.

In the description of the present invention, the meaning of "a plurality" means two or more unless otherwise indicated. For example, a plurality of processors refers to a processor that includes two or more physical cores.

Furthermore, the terms "comprises" and "comprising" and variations of the invention, as used in the description of the invention, are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the listed steps or units, but optionally includes other steps or units not listed, or alternatively Other steps or units inherent to these processes, methods, products or devices are included.

A method for obtaining an authorization file according to an embodiment of the present invention may be applied to a process in which a user terminal saves an authorization file in an eUICC installed in the user terminal or updates an authorization file saved in the eUICC.

Please refer to FIG. 1 , which is a schematic diagram of a network architecture of a communication network to which a method for obtaining an authorization file according to an embodiment of the present invention is applied. As shown in FIG. 1, the communication network may include an authorization file server 11, a server 12, an SM-DP 13, and at least one user terminal 14 including an eUICC. The server 12 may be an SM-DS or a push server.

The authorization file server 11 is configured to generate an authorization file and send the generated authorization file to the server 12. The server 12 is configured to receive the authorization file sent by the authorization file server 11 and send the authorization file to the user terminal 14 where the eUICC corresponding to the EID is located according to the EID corresponding to the authorization file. The user terminal 14 is configured to receive the authorization file sent by the server 12, and save the authorization file in the eUICC on the user terminal 14 or update the saved in the eUICC on the user terminal 14 with the authorization file. Authorization file. The authorization file server in this embodiment may be a logical function entity deployed by the terminal device manufacturer, and the authorization file server may be integrated on the server, or may be integrated on other function servers independently of the above server. The eUICC hardware module can be included in the user terminal. The SM-DP 13 described above is used to generate and store a profile and send a profile to the user terminal 14. The user terminal 14 can install the profile on the eUICC after receiving the profile sent by the SM-DP 13. After the authorization file is saved on the eUICC, the user terminal can also back up the authorization file saved on the eUICC in the user terminal. The authorization file in the embodiment of the present invention may be a rule authorization table (English: Rules Authorization Table, RAT for short).

As shown in FIG. 1, an LPA can be installed in the user terminal 14. The LPA is an application that can be installed in the user terminal. The user terminal 14 can perform operations such as downloading and local management of the profile through the LPA in the user terminal 14. The LPA can also provide a user interface for the user terminal 14 to interact with the user. The user terminal 14 can detect an operation instruction triggered by the user for activation, deactivation, deletion, and the like of the profile through the user interface, and implement management of the profile downloaded in the user terminal 14.

As shown in FIG. 1 , the LPA in the user terminal 14 may include: a local file download (English: Local Profile Download, LPD) module, a local user interface (English: Local User Interface, LUI) module, and a local device. Discovery Service (English: Local Discovery Service, LDS) module. The LPD module is used to implement downloading of the profile, the LUI module is used to provide a user interface, and the LDS module is used to implement interaction with the server 12 (such as an SM-DS or a push server).

In the first application scenario of the embodiment of the present invention, as shown in FIG. 2, the server 12 in FIG. 1 is an SM-DS. The SM-DS can be divided into a root SM-DS and an optional SM-DS. The SM-DS in the embodiment of the present invention can be a root SM-DS, and the root SM-DS can pass through the user terminal. The LPA in 14 (specifically the LDS module in the LPA) is an SM-DS that communicates directly with the user terminal.

The user terminal 14 can preset the address of the root SM-DS, and communicate with the root SM-DS according to the LDS module in the address LPA of the root SM-DS. The SM-DP address is obtained from the root SM-DS, and after obtaining the SM-DP address, the profile can be downloaded from the SM-DP. In the embodiment of the present invention, in the process of the user terminal communicating with the SM-DS through the LDS module, in addition to obtaining the SM-DP address, an authorization file may be obtained, so that the obtained authorization file is saved on the eUICC or the user terminal.

In the second application scenario of the embodiment of the present invention, as shown in FIG. 3, the server 12 in FIG. 1 is a push server. As shown in FIG. 3, a push client may be installed in the user terminal 14 in FIG. 1. The user terminal 14 may register the LPA to the push server through the push client, and the push server may exist on the eUICC to be sent to the user terminal. When the file is authorized, the authorization file can be pushed to the user terminal by pushing the client, and the user terminal receives the authorization file pushed by the push server through the LPA registered to the push server. For a specific method for the user terminal 14 to register to the push server by the push client and receive the authorization file pushed by the push server, reference may be made to the subsequent related description of the embodiment of the present invention.

The method for obtaining an authorization file provided by the embodiment of the present invention, after obtaining the authorization file, the server may send the authorization file to the user terminal, so that the user terminal can update the authorization file saved in the eUICC on the user terminal in real time. In this way, the problem that the authorization file in the eUICC cannot adapt to the change of the authority of the operator to set the policy rule cannot be solved due to the fixed and unchangeable authorization file preset in the eUICC in the prior art. The method for obtaining an authorization file provided by the embodiment of the present invention can update the authorization file saved in the eUICC on the user terminal in real time.

The method and device for obtaining an authorization file according to an embodiment of the present invention are described in detail below with reference to the accompanying drawings.

An embodiment of the present invention provides a method for obtaining an authorization file. The method may be applied to a communication network as shown in any of FIG. 1 to FIG. 3. As shown in FIG. 4, the method for obtaining an authorization file includes:

S401. The authorization file server generates an authorization file, where the authorization file corresponds to an EID of the eUICC on the user terminal, where the authorization file includes an EID of the eUICC, at least one policy rule, and an allow setting corresponding to each policy rule in the at least one policy rule. The information of the operator of the policy rule.

Exemplarily, the authorization file server may receive the EID, the carrier information, and the at least one policy rule carried in the message according to the authorization file request message after receiving the authorization file request message sent by the operator's functional entity (such as the operator server). Such information generates the above authorization file. The at least one policy rule indicates a policy rule set by the operator for the profile corresponding to the EID. Specifically, the policy rule in the authorization file may be an identifier of the policy rule. If the authorization file server allows the operator to set the policy rule, the information in the authorization file corresponding to the policy rule that allows the operator to set the policy rule is written in the authorization file. Carrier information. It should be noted that the authorization file in the embodiment of the present invention may include the EID of the eUICC or the EID of the eUICC. For the method for authorizing the file server to generate the authorization file, reference may be made to the related method for generating the authorization file in the prior art, which is not described herein again.

The at least one policy rule in the embodiment of the present invention includes at least: the subscription information set is not allowed to be deleted (that is, the profile is not allowed to be deleted), the subscription information set is not allowed to be deactivated (that is, the profile is not allowed to be deactivated), and the subscription information set is deactivated. At least one of the following should be deleted (ie, the profile should be deleted after deactivation).

In the embodiment of the present invention, the information of the operator that allows the setting of the policy rule may be the mobile network code (English: Mobile Network Code, MNC for short). For each of the at least one policy rule, the authorization file includes information of at least one operator that can set the policy rule (eg, at least one operator's MNC). The MNC of the operator consists of two to three decimal numbers, which can uniquely identify each carrier. For example, China Mobile's MNCs can be 00, 02, 04, and 07, China Unicom's MNCs can be 01, 06, and China Telecom's MNCs can be 03, 05.

For example, suppose that China Mobile's MNC is 00, China Unicom's MNC is 01, and China Telecom's MNC is 03; the EID contained in the authorization file in the embodiment of the present invention is EID-x; at least one policy rule may be “ The profile does not allow deactivation" and "this profile does not allow deletion"; the information of the operator with the permission to set "this profile is not allowed to deactivate" is 00 and 03, with the permission to set "this profile does not allow deletion" The operator's information is 00 and 01. In this case, it means operation 商-China Mobile has the right to set the policy rule "This profile is not allowed to deactivate" and "The profile is not allowed to delete"; Carrier-China Unicom has the permission to set the policy rule "This profile does not allow deletion", but does not have settings The policy rule "This profile does not allow deactivation" permission; Carrier-China Telecom has the permission to set the policy rule "This profile does not allow deactivation", but does not have the permission to set the policy rule "This profile does not allow deletion".

It should be noted that, in the embodiment of the present invention, the manner of restricting the authority of the operator to set the policy rule by using the “information of the operator that allows the policy rule to be set” includes, but is not limited to, the method in the foregoing example. For example, when the information of the operator corresponding to the policy rule in the authorization file is a special symbol, such as *, it means that any operator is allowed to set the policy rule; when the authorization file does not contain a policy of a certain policy rule When the information is displayed, it means that no operator is allowed to set the policy rule. When the configuration file does not contain the information of the operator corresponding to the policy rule, it means that any operator is allowed to set the policy rule.

Optionally, the authorization file in the embodiment of the present invention may further include an integrated circuit card identifier (English: Integrated Circuit Card Identification, ICCID), where the ICCID is used to uniquely identify a subscription information set (ie, a profile).

S402. The authorization file server sends an authorization file to the server.

The server in the embodiment of the present invention may be an SM-DS or a push server.

It is conceivable that, in the embodiment of the present invention, the authorization file server may send an authorization file corresponding to the eUICC to the server, that is, the authorization file server may send at least one authorization file to the server, and each authorization file in the at least one authorization file corresponds to On an eUICC. The server determines that an authorization file corresponds to an eUICC, and specifically that the authorization file corresponds to the eUICC indicated by the EID included in the authorization file, and the authorization file server may also send the authorization file to the server and the EID of the eUICC corresponding to the authorization file. Therefore, the authorization file can determine the eUICC corresponding thereto by the eUICC indicated by the EID transmitted together with the authorization file.

S403. The server receives an authorization file sent by an authorization file server.

The authorization file corresponds to the EID of the eUICC on the user terminal, and the authorization file includes an EID of the eUICC, at least one policy rule, and an operator corresponding to each policy rule in the at least one policy rule that allows the policy rule to be set. information. Each of the at least one policy rule may be an identifier of the policy rule, and the information of the operator in the information of the operator that is allowed to set the policy rule may be the identifier information of the operator, such as the operation. Business mobile network number.

S404. The user terminal sends the EID of the eUICC on the user terminal to the server.

S405. The server receives the EID sent by the user terminal.

It should be noted that, in the embodiment of the present invention, S401-S403 may be performed first, and then S404-S405 may be executed; S404-S405 may be executed first, then S401-S403 may be executed; and S401-S403 and S404-S405 may be simultaneously executed. The embodiment of the present invention does not limit the order of execution of S401-S403 and S404-S405.

S406. The server determines, according to the EID sent by the user terminal, an authorization file corresponding to the EID of the eUICC on the user terminal, and sends the determined authorization file to the user terminal, where the authorization file includes the EID of the eUICC, at least one policy rule, and Information of an operator corresponding to each policy rule in at least one policy rule that allows the policy rule to be set.

The server may receive the at least one authorization file sent by the authorization file server, so after receiving the EID sent by the user terminal, the server may compare the EID sent by the user terminal with the corresponding EID in the at least one authorization file, if the user terminal The EID sent is the same as the EID contained in an authorization file, and the server can determine that the authorization file corresponds to the eUICC on the user terminal.

S407. The user terminal receives an authorization file sent by the server.

After receiving the authorization file sent by the server, the user terminal may save the authorization file or use the received authorization file to update the authorization file saved in the user terminal. Specifically, the method in the embodiment of the present invention may further include S408a or S408b. .

S408a. The user terminal saves the authorization file in the eUICC.

S408b. The user terminal updates the user terminal by using the received authorization file. Authorization file saved in eUICC.

The method for obtaining an authorization file provided by the embodiment of the present invention, the server may send the authorization file to the user terminal after obtaining the authorization file, so that the user terminal can update the authorization file saved in the eUICC on the user terminal in real time, and the operator can Set the permissions of the policy rule based on the real-time updated configuration file. In this way, the problem that the authorization file in the eUICC cannot adapt to the change of the authority of the operator to set the policy rule cannot be solved due to the fixed and unchangeable authorization file preset in the eUICC in the prior art.

The method for obtaining an authorization file provided by the embodiment of the present invention can update the authorization file saved in the eUICC on the user terminal in real time.

Optionally, in the first application scenario of the embodiment of the present invention, as shown in FIG. 5, the server in FIG. 4 may be an SM-DS. The first application scenario of the embodiment of the present invention may be a scenario corresponding to the network architecture shown in FIG. 2 .

In the first application scenario, the user terminal may send the EID of the eUICC on the user terminal to the SM-DS by sending a polling message to the SM-DS. Specifically, as shown in FIG. 5, S404 in FIG. 4 may be replaced by S404a, S405 may be replaced by S405a, S406 may be replaced by S406a, and S407 may be replaced by S407a:

S404a: The user terminal sends a polling message to the SM-DS, where the polling message carries the EID of the eUICC on the user terminal.

S405a and SM-DS receive the polling message sent by the user terminal.

The S406a and the SM-DS send a response message to the user terminal, and the response message of the polling message carries an authorization file corresponding to the EID carried in the polling message.

S407a: The user terminal receives a response message of the polling message sent by the SM-DS, where the response message of the polling message carries an authorization file.

Optionally, in an implementation manner of the first application scenario, the user terminal may obtain metadata of the first subscription information set of the first carrier from the SM-DP, and determine the first subscription information set. When the first policy rule is included in the metadata, whether the first policy rule is included in the authorization file saved in the user terminal, the user terminal can pass the The manner in which the SM-DS sends a polling message to obtain an authorization file from the SM-DS.

Specifically, as shown in FIG. 6, after the user terminal obtains the SM-DP address and requests the SM-DP to download the profile, the method in the embodiment of the present invention may further include S409 and S404a' and subsequent processes:

S409. The user terminal receives the first policy rule sent by the SM-DP of the first operator.

The first policy rule is a policy rule that is set by the first operator and is associated with the first subscription information set, and the first operator is the operator to which the first subscription information set belongs.

It is conceivable that the user equipment can establish a connection with the first operator's SM-DP and authenticate each other, and request to obtain the first subscription information set, and the SM-DP can receive the user equipment for requesting to acquire the first subscription information set. After the message, the metadata of the first subscription information set of the first carrier is sent to the user terminal, where the metadata includes the first policy rule, so that the user terminal can receive the first carrier of the first carrier sent by the SM-DP. The first policy rule in the metadata of the contracted information set.

S404a', after receiving the first policy rule, the user terminal sends a polling message to the SM-DS, where the polling message carries the EID of the eUICC on the user terminal, and the polling message is used to request the SM-DS to the user terminal. Send an authorization file corresponding to the EID of the eUICC on the user terminal.

When receiving the first policy rule in the metadata sent by the SM-DP, the user terminal sends a polling message to the SM-DS, where the polling message carries the EID of the eUICC on the user terminal.

It is conceivable that after the user terminal sends a polling message to the SM-DS, the SM-DS and the user terminal can continue to execute S405a, S406a, S407a, and S408a or S408b.

Preferably, in the second implementation manner of the first application scenario, in order to prevent the user terminal from repeatedly obtaining the authorization file from the SM-DS, the user terminal may only include the first operation in determining the authorization file saved in the user terminal. When the information of the policy rule is set, the authorization file is obtained from the SM-DS by sending a polling message to the SM-DS. With Body, as shown in FIG. 7, S404a' in FIG. 6 can be replaced with S404a〞:

After receiving the first policy rule, the user terminal sends a polling message to the SM-DS if the information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first operator.

Specifically, after receiving the first policy rule, the user terminal may determine that the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule included in the authorization file does not include the information of the first operator. The user terminal sends a polling message to the SM-DS. The user terminal receives the first policy rule included in the metadata sent by the SM-DP, where the polling message carries the EID of the eUICC on the user terminal. The above-mentioned "authorization file saved on the user terminal" may be an authorization file stored in a storage space (such as a memory or a disk) of the user terminal, or may be an authorization file stored in the eUICC on the user terminal. The information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first carrier. The carrier that can set the policy rule for the at least one policy rule in the authorization file does not include the information of the first carrier. , wherein the operator of the at least one policy rule in the authorization file that allows the policy rule to be set can be for all operators.

In the embodiment of the present invention, after the user equipment downloads the metadata of the first subscription information set from the SM-DP, that is, the user equipment receives the first policy rule in the metadata of the first operator sent by the SM-DP, the user equipment first determines the Whether the first policy rule is included in the authorization file saved on the user terminal, and only when the information of the operator that allows the policy rule to be set in the authorization file saved on the user terminal does not include the information of the first carrier, When the SM-DS sends a polling message, the authorization file is obtained from the SM-DS, and the user terminal can be prevented from repeatedly obtaining the authorization file from the SM-DS.

In the second application scenario of the embodiment of the present invention, as shown in FIG. 8, the server in FIG. 4 may be a push server. The second application scenario of the embodiment of the present invention may be a scenario corresponding to the network architecture shown in FIG. 3 .

In the second application scenario, after the user terminal registers with the push server, the push server pushes the authorization file to the user terminal. As shown in FIG. 8, S404 in FIG. 4 may be replaced by S404b, S405 may be replaced by S405b, and S406 may be replaced by S406b:

S404b: The user terminal sends a registration request to the push server, where the registration request carries the EID of the eUICC on the user terminal.

After the user terminal starts the LPA in the user terminal, the LPA can use the LPA to send a registration request to the push server through the push client in the user terminal as shown in FIG. 3 to register the LPA application of the terminal in the push server, and the above registration. The request carries the EID of the eUICC on the user terminal.

S405b. The push server receives the registration request sent by the user terminal.

The registration request may also carry the identifier of the LPA that logs in to the push client. After receiving the registration request sent by the user terminal through the push client, the push server may assign a password to the LPA indicated by the LPA identifier. Specifically, as shown in FIG. 8, after S405b, the method in the embodiment of the present invention may further include S410:

S410: The push server allocates a password for the LPA indicated by the LPA identifier carried in the registration request, and saves the correspondence between the password allocated by the push server for the LPA indicated by the LPA identifier and the EID carried in the registration request.

Exemplarily, the push server can save the correspondence between the password and the EID in a list manner. As shown in Table 1, an example of the correspondence between the password and the EID provided by the embodiment of the present invention is as follows:

Table 1

As shown in Table 1, password 1 has a correspondence with EID-a, password 2 has a correspondence with EID-b, and password n has a correspondence with EID-x.

It is conceivable that after receiving the authorization file sent by the authorization file server, the push server may determine the EID corresponding to the authorization file according to the corresponding relationship. The corresponding password.

Specifically, as shown in FIG. 8, after the S403 is shown in FIG. 5 (that is, the push server receives the authorization file sent by the authorization file server), the method in the embodiment of the present invention may further include S411:

S411. The push server determines a password corresponding to the EID corresponding to the authorization file according to the correspondence between the EID stored in the push server and the password generated by the push server for the LPA in the user terminal.

Exemplarily, taking the above Table 1 as an example, assuming that the EID corresponding to the authorization file is EID-b, the push server may determine the password corresponding to the EID-b according to the correspondence between the password and the EID shown in Table 1. For password 2.

Correspondingly, since the user terminal is the LPA registered to the push server through the push client in the user terminal, the push server carries the determined password (such as the password 2 above) when sending the authorization file to the user terminal through the push client. The push client determines, based on the password 2, that the push message should be pushed to the LPA application. Specifically, as shown in FIG. 8, S406 in FIG. 4 may be replaced by S406b, and correspondingly, S407 may be replaced by S407b:

S406b: The push server sends the authorization file and the password corresponding to the EID corresponding to the authorization file to the user terminal.

S407b: The user terminal receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file.

The user terminal may receive, by the push client, an authorization file sent by the push server and a password corresponding to the EID corresponding to the authorization file.

Optionally, as shown in FIG. 9, after the S410 shown in FIG. 8, the method of the embodiment of the present invention may further include S412-S413:

S412. The push server sends a response message of the registration request to the user terminal, where the response message of the registration request carries a password allocated by the push server for the LPA indicated by the LPA identifier.

S413. The user terminal receives a response message of the registration request sent by the push server.

The user terminal can receive the note sent by the push server by pushing the client. The response message of the request.

It is conceivable that after the user terminal receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file, the user terminal may use the password corresponding to the EID corresponding to the authorization file to compare the password allocated by the push server to the LPA. If the password corresponding to the EID corresponding to the authorization file is the same as the password assigned by the push server to the LPA, the user terminal saves the authorization file in the eUICC through the LPA; or, if the password corresponding to the EID corresponding to the authorization file and the push server are The password assigned by the LPA is the same, and the user terminal updates the authorization file saved in the eUICC through the LPA using the authorization file.

It is conceivable that after receiving the response message of the registration request sent by the push server by the push client, the user terminal may determine that the password carried in the response message of the registration request is the push server is the LPA identifier carried in the registration request. The indicated LPA assigned password (referred to as the configuration password), that is, the password that the push server assigns to the LPA registered to the push server. In this way, after the user terminal receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file (ie, S407a), the push client compares the configuration password with the authorization file sent by the push server. The password corresponding to the EID may be pushed to the corresponding LPA by the push client if the configuration password is the same as the password corresponding to the EID corresponding to the authorization file sent by the push server.

Further, in an implementation manner of the second application scenario, the user terminal may obtain the first policy rule from the SM-DP, whether the authorization file saved in the user terminal includes the policy rule of the first operator, The user terminal can wait for a predetermined time to obtain an authorization file from the push server. Specifically, as shown in FIG. 10, after the user terminal obtains the SM-DP address and requests the SM-DP to download the profile, the method in the embodiment of the present invention may further include S414 and S407b' and subsequent processes:

S414. The user terminal receives the first policy rule sent by the SM-DP.

The SM-DP may be the SM-DP of the first carrier, and the first policy rule is a policy rule that is set by the first operator and is associated with the first subscription information set, where the first carrier is the first subscription. The operator to which the information set belongs.

S407b', after receiving the first policy rule, the user terminal starts a timer, and waits to receive the authorization file sent by the push server within the time limit of the timer.

The metadata of the first subscription information set includes a first policy rule, and the first operator is an operator to which the first subscription information set belongs.

It is conceivable that if the user terminal can receive the authorization file sent by the push server within the time limit of the timer, the user terminal may continue to execute S408a or S408b after receiving the authorization file sent by the push server; if the user terminal is in the timer If the authorization file sent by the push server is not received within the time limit, it indicates that the push server may not receive the authorization file sent by the authorized file server.

Preferably, in the second implementation manner of the second application scenario, in order to prevent the user terminal from repeatedly obtaining the authorization file from the SM-DS, the user terminal may only allow the setting of the policy rule in the authorization file saved on the user terminal. When the information of the first carrier is not included in the information of the operator, the timer is started, and the authorization file sent by the push server is waiting to be received within the time limit of the timer. Specifically, as shown in FIG. 11, S407b' in FIG. 10 can be replaced with S407b〞:

After receiving the first policy rule, if the information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first carrier, the timer is started, and the timer is started. Waiting to receive the authorization file sent by the push server.

Specifically, after receiving the first policy rule, the user terminal may determine that the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule included in the authorization file does not include the information of the first operator. The user terminal starts a timer and waits to receive the authorization file sent by the push server within the timer time.

The first policy rule is included in the metadata of the first subscription information set. The "authorization file saved on the user terminal" in the embodiment of the present invention may be an authorization file stored in a storage space (such as a memory or a disk) of the user terminal, or may be an authorization stored in the eUICC on the user terminal. file. The information of the operator that allows the setting of the policy rule does not include the information of the first carrier. The operator that can set the policy rule for the at least one policy rule in the authorization file does not include the information of the first carrier. The operator of at least one policy rule in the authorization file that allows the policy rule to be set can be for all operators.

In the embodiment of the present invention, after the user equipment downloads the metadata of the first subscription information set from the SM-DP, that is, after the user equipment receives the first policy rule sent by the SM-DP, it determines whether the authorization file saved on the user terminal is The first policy rule is included, and the timer is started only when the information of the operator that allows the policy rule to be set in the authorization file saved on the user terminal does not include the information of the first carrier, and is in the timer time. Waiting to receive the authorization file sent by the push server, the user terminal can be prevented from repeatedly obtaining the authorization file from the push server.

Optionally, in the above embodiment, the user terminal may receive the first policy rule, and may also receive the validity time of the first policy rule, where the effective time of the first policy rule is used to define the first policy rule. Effective time.

After the user terminal successfully installs the first subscription information set or the user terminal activates the first subscription information set, the user is prompted with the first policy rule and the valid time of the first policy rule.

It is conceivable that, when the user terminal prompts the user for the first policy rule and the validity time of the first policy rule, the subscription information set may not be deleted, the subscription information set is not allowed to be deactivated, and the subscription information set is deactivated. At least one of the deletions restricts the user's management operation on the first subscription information set.

The authorization file in the embodiment of the present invention may include at least one policy rule and information corresponding to each of the at least one policy rule that allows the operator to set the policy rule, and may also include allowing the operator to set at least The effective time of a policy rule, allowing the operator to set any of the at least one policy rule. The time is used to limit the time that the operator has permission to set any of the policy rules. When the operator sets the effective time of the operator's policy rule, the carrier can activate the policy rule. Only when the carrier can set the policy rule within the valid time. Correspondingly, the method of the embodiment of the present invention may further include: when the user terminal activates the first policy rule, the user terminal determines whether the current time is within a valid time period allowed in the authorization file to allow the first operator to set the first policy rule; If the current time exceeds the valid time allowed for the first operator to set the first policy rule, the user terminal prohibits activation of the first policy rule. Through this scheme, not only the authorization file can be used to restrict the operator's permission to set policy rules, but also the effective time for allowing the operator to set policy rules.

Further, the user terminal may also cancel the request according to the policy rule sent by the function entity (such as the operator server) of the operator, and delete part of the content of the authorization file saved in the user terminal. The carrier server in the embodiment of the present invention may be an over-the-air (English: Over The Air, OTA for short) server. Specifically, after the user terminal receives the authorization file sent by the server (SM-DS or the push server), the method of the embodiment of the present invention may further include S501:

S501: The user terminal receives the policy rule release request sent by the function entity of the first operator, where the policy rule release request carries the information of the first operator and the policy rule to be released.

The first operator may be any operator in the current communication network, and the information of the first operator may be identification information of the first operator, such as an MNC.

S502. If the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released included in the authorization file saved on the user terminal, the information of the first carrier is included, and the user terminal deletes the authorization file. The information of the first operator in the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released.

Exemplarily, if the information of the operator that is allowed to set the policy rule to be released includes the information of the first operator and the information of the second operator, the user terminal may delete the operator that allows the policy rule to be released to be set. Information of the first carrier in the information.

It is conceivable that if the authorization file saved on the user terminal includes multiple policy rules, when there is only information of the first operator in any of the policy rules, the user terminal deletes any one of the policy rules; There is only one policy rule in the authorization file saved on the user terminal. Only the information of the first operator is included in the policy rule, and the user terminal deletes the authorization file saved on the user terminal.

With this solution, not only the authorization file saved in the user terminal can be updated in real time, but also the request message can be released according to the policy rule sent by the operator's device, and part of the content of the authorization file saved in the user terminal is deleted.

Optionally, after the user terminal successfully downloads and installs the first subscription information set, the user terminal deletes part of the content of the authorization file saved in the user terminal. Specifically, the method of the embodiment of the present invention may further include S601-S602:

S601. The user terminal installs the first subscription information set.

S602. The user terminal deletes the information of the first operator in the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule included in the authorization file saved in the user terminal, or deletes the information saved in the user terminal. An authorization file for an operator's information.

It is conceivable that if the authorization file saved on the user terminal includes multiple policy rules, when only the information of the first operator is included in any of the policy rules, the user terminal deletes the authorization file, that is, deletes the user terminal. An authorization file for saving the information of the first carrier.

Further, after successfully downloading and installing the second subscription information set, the user terminal activates the second subscription information set. The operator to which the second subscription information set belongs is the second operator, and the second subscription information set and the first subscription information set may be the same or different. After the user terminal successfully installs the second subscription information set, the user terminal may detect an activation instruction of the second subscription information set triggered by the user through the UI of the LPA, and activate the second subscription information set after detecting the activation instruction. Specifically, the method of the embodiment of the present invention may further include S603-S604:

S603. Before the user terminal activates the second subscription information set installed by the user terminal, if the second policy rule is determined that the subscription information set is not allowed to be deactivated, the user terminal checks Authorization file.

The second subscription information set belongs to the second operator, and the second policy rule is a policy rule that is set by the second operator and is associated with the second subscription information set.

S604. If the information of the operator that is allowed to set the second policy rule corresponding to the second policy rule included in the authorization file saved in the user terminal includes the information of the third carrier, the user terminal sends the prompt message.

The third operator includes any operator other than the second operator. The foregoing prompt information may at least include: “Activating the second subscription information set will not be able to download the third operator's subscription information set” or “Activating the second subscription information set will not be able to download the third operator's subscription information set and the third. Carrier's information."

The method for obtaining an authorization file provided by the embodiment of the present invention can not only update the authorization file saved in the user terminal in real time, but also limit the setting of the policy rule in the authorization file by the operator according to the authorization file, and can restrict the operator to set the policy arbitrarily. At the same time, when the user installs the contract information set of any operator, the user may be prompted according to the information of the authorization file to the user to influence the authorization file of the other operator when installing the contract information set of the operator.

The foregoing embodiment of the present invention mainly introduces the solution provided by the embodiment of the present invention from the perspective of the interaction between the authorization file server and the server and the user terminal. It can be understood that the server and the user terminal include corresponding hardware structures and/or software modules for performing the respective functions in order to implement the above functions. Those skilled in the art will readily appreciate that the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the server and user terminal and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The embodiment of the present invention may perform the division of the function module or the function unit between the server and the user terminal according to the foregoing method example. For example, each function module or function unit may be divided according to each function, or two or more functions may be integrated in the function. One In the processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules or functional units. The division of a module or a unit in the embodiment of the present invention is schematic, and is only a logical function division. In actual implementation, there may be another division manner.

FIG. 12 shows a possible structural diagram of a server involved in the above embodiment. The server 1200 can include an obtaining unit 1201 and a sending unit 1202. The obtaining unit 1201 is configured to obtain an authorization file. For example, the acquisition unit 1201 is for supporting S403 in the above embodiments, and/or other processes for the techniques described herein. The sending unit 1202 is configured to send an authorization file to the user terminal. For example, the transmitting unit 1202 is configured to support S406, S406a, S406b, and S412 in the above embodiments, and/or other processes for the techniques described herein.

Further, as shown in FIG. 13, the server may be an SM-DS or a push server, and the server 1200 may further include: a receiving unit 1203, a determining unit 1204, an allocating unit 1205, and a saving unit 1206.

The receiving unit 1203 is configured to receive an authorization file sent by the authorization file server. For example, receiving unit 1203 is for supporting S403 and S405 in the above embodiments, and/or other processes for the techniques described herein. The determining unit 1204 is configured to determine an authorization file corresponding to the eUICC on the user terminal. For example, determining unit 1204 is for supporting S406 in the above-described embodiments, and/or other processes for the techniques described herein.

The receiving unit 1203 is further configured to receive a polling message sent by the user terminal, when the server is an SM-DS. For example, receiving unit 1203 is also used to support S405a in the above-described embodiments, and/or other processes for the techniques described herein.

When the server is a push server, the receiving unit 1203 is further configured to receive a registration request sent by the user terminal. For example, the receiving unit is also used to support S405b in the above embodiments, and/or other processes for the techniques described herein. The determining unit 1204 is further configured to determine a password corresponding to the EID corresponding to the authorization file. For example, determining unit 1204 is also used to support S406 and S411 in the above-described embodiments, and/or other processes for the techniques described herein. The allocating unit 1205 is configured to carry the request for registration The LPA assigned password indicated by the LPA tag. For example, allocation unit 1205 is used to support S410 in the above-described embodiments, and/or other processes for the techniques described herein. The saving unit 1206 is configured to save a correspondence between a password allocated by the push server for the LPA indicated by the LPA identifier and an EID carried in the registration request. For example, save unit 1206 is used to support S410 in the above-described embodiments, and/or other processes for the techniques described herein.

In the case of adopting an integrated unit, the above-mentioned obtaining unit 1201, determining unit 1204, allocating unit 1205 and saving unit 1206, etc. may be implemented in one processing unit, which may be a processor or a controller, for example, may be a CPU. , general purpose processor, digital signal processor (English: Digital Signal Processor, referred to as: DSP), ASIC (English: Application-Specific Integrated Circuit, referred to as: ASIC), field programmable gate array (English: Field Programmable Gate Array , abbreviated as: FPGA) or other programmable logic device, transistor logic device, hardware component or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processing unit may also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The transmitting unit 1202 and the receiving unit 1203 may be implemented by being integrated in one communication unit, and the communication unit may be a communication interface, a transceiver circuit or a transceiver, or the like. The storage unit can be a memory.

When the processing unit is a processor, the storage unit is a memory, and the communication unit is a transceiver, the server 1200 according to the embodiment of the present invention may be the server 1400 shown in FIG.

Referring to FIG. 14, the server 1400 includes one or more processors 1401, a memory 1402, a transceiver 1403, and a bus 1404. The one or more processors 1401, the memory 1402, and the transceiver 1403 are connected to one another via a bus 1404. The bus 1404 may be a Peripheral Component Interconnect (PCI) bus or an extended industry standard architecture (English: Extended Industry Standard Architecture, referred to as: EISA) bus and so on. The bus 1404 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus.

The embodiment of the present invention further provides a non-volatile storage medium having one or more program codes stored therein. When the processor 1401 of the server 1400 executes the program code, the server 1400 executes the map. 4- related method steps in any of the figures of FIG.

The detailed description of each module or unit in the server 1400 provided by the embodiment of the present invention and the technical effects brought by each module or unit performing the related method steps in any of the figures in FIG. 4 can be referred to. The related description in the method embodiment of the present invention is not described herein again.

FIG. 15 is a schematic diagram showing a possible structure of a user terminal involved in the above embodiment. The user terminal 1500 may include a transmitting unit 1501, a receiving unit 1502, and a control unit 1503. The sending unit 1501 is configured to send, to the server, an EID, a polling message, and a registration request of the eUICC on the user terminal. For example, the transmitting unit 1501 is configured to support S404, S404a, S404a', S404a, and S404b in the above embodiments, and/or other processes for the techniques described herein. The receiving unit 1502 is configured to receive the sending by the server. The receiving unit 1502 is further configured to receive a response message of the polling message sent by the SM-DS, and the receiving unit 1502 is further configured to receive a response message of the registration request sent by the push server, and the receiving unit 1502 is further configured to receive the first The first policy rule sent by the SM-DP of the operator; the receiving unit 1502 is further configured to wait for receiving the authorization file sent by the push server during the timing of the timer; the receiving unit 1502 is further configured to receive the first policy rule. The receiving unit 1502 is further configured to receive the policy rule release request message sent by the function entity of the first operator. For example, the receiving unit 1502 is configured to support S407, S407a, S409, S407b, and S413 in the foregoing embodiment. S414, S407b', S407b and S501, and/or other processes for the techniques described herein. The control unit 1503 is configured to save the authorization file in the eUICC, or update the authorization file saved in the eUICC by using the authorization file. For example, the control unit 1503 is configured to support the above embodiments. S408a, S408b, and/or other processes for the techniques described herein.

Further, as shown in FIG. 16 , the user terminal 1500 may further include: an activation unit 1504, an installation unit 1505, a first activation unit 1506, a first prompt unit 1507, a second activation unit 1508, a determination unit 1509, and a prohibition unit 1510. The deleting unit 1511, the checking unit 1512, the second prompting unit 1513, and the comparing unit 1514.

The startup unit 1504 is configured to start a timer. For example, the activation unit 1504 is configured to support S407b' and S407b〞 in the above embodiments, and/or other processes for the techniques described herein. The installation unit 1505 is configured to install the first subscription information set or the second subscription. An information set, for example, an installation unit 1505 for supporting S601 in the above embodiments, and/or other processes for the techniques described herein. A first activation unit 1506 for activating a first subscription information set or a second The first information unit 1507 is configured to prompt the user of the policy information of the first operator's policy rule and the effective time of the policy information. The second activation unit 1508 is configured to activate the policy rule of the first operator. The determining unit 1509 is configured to determine, when the policy rule of the first operator is activated, whether the current time is within the validity time of the policy rule included in the authorization file that allows the first operator to set the first operator. The prohibiting unit 1510, If it is determined that the current time exceeds the valid time of the first operator to set the first operator's policy rule, the first operator's policy rule is prohibited from being activated. The deleting unit 1511 is configured to delete the information of the first operator in the information of the operator corresponding to the policy rule to be released, and delete the first operation in the information of the operator that allows the setting of the policy rule in the authorization file saved in the user terminal. The information of the quotient, or the authorization file corresponding to the first operator saved in the user terminal. For example, the deleting unit 1511 is used to support S502 and S602 in the above embodiment, and/or other technologies used in the techniques described herein. The checking unit 1512 is configured to check the authorization file saved in the user terminal. For example, the checking unit 1512 is configured to support S603 in the above embodiment, and/or other processes for the techniques described herein. The unit 1513 is configured to issue prompt information. For example, the second prompting unit 1513 is configured to support S604 in the above embodiment, and/or other processes for the techniques described herein. The comparing unit 1514 is configured to adopt and authorize The password corresponding to the EID corresponding to the file is compared with the password assigned by the push server to the LPA.

In the case of employing an integrated unit, the above-described control unit 1503, activation unit 1504, installation unit 1505, first activation unit 1506, first prompt unit 1507, second activation unit 1508, determination unit 1509, inhibition unit 1510, deletion unit 1511, the function unit such as the checking unit 1512 and the second prompting unit 1513 may be integrated and implemented in one processing unit, and the processing unit may be a processor or a controller, such as a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or the like. Programming logic devices, transistor logic devices, hardware components, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processing unit may also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The transmitting unit 1501 and the receiving unit 1502 may be implemented by being integrated in one communication unit, which may be a communication interface, a transceiver circuit or a transceiver, or the like. The storage unit can be a memory.

When the processing unit is a processor, the storage unit is a memory, and the communication unit is a transceiver, the user terminal 1500 according to the embodiment of the present invention may be the user terminal 1700 shown in FIG.

Referring to FIG. 17, the user terminal 1700 includes one or more processors 1701, a memory 1702, a transceiver 1702, and a bus 1704. Among them, one or more processors 1701, a memory 1702, and a transceiver 1703 are connected to each other through a bus 1704. The bus 1704 can be a PCI bus or an EISA bus. The bus 1704 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 17, but it does not mean that there is only one bus or one type of bus.

The embodiment of the present invention further provides a non-volatile storage medium having one or more program codes stored therein. When the processor 1701 of the user terminal 1700 executes the program code, the user terminal 1700 executes Related method steps in any of Figures 4-11.

The detailed description of each module in the user terminal 1700 provided by the embodiment of the present invention and the technical effects of each module performing the related method steps in any of the figures in FIG. 4 can refer to the method embodiment of the present invention. The related descriptions are not repeated here.

Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above functional modules is illustrated. In practical applications, the above functions can be allocated according to needs. It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. For the specific working process of the system, the device and the unit described above, reference may be made to the corresponding process in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. , including several instructions All or part of the steps of the method of the various embodiments of the present invention are performed by a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor. The foregoing storage medium includes: a memory card, a SIM card, a U disk, a removable hard disk, a read only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A method for obtaining an authorization file, comprising:

Transmitting, by the user terminal, an eUICC identifier EID of the embedded universal integrated circuit card eUICC on the user terminal to the server;

Receiving, by the user terminal, an authorization file sent by the server, where the authorization file corresponds to an EID of an eUICC on the user terminal, where the authorization file includes at least one policy rule and each of the at least one policy rule Information corresponding to the operator of the policy rule that allows the policy rule to be set;

The user terminal saves the authorization file in the eUICC, or the user terminal updates the authorization file saved in the eUICC by using the authorization file.
The method according to claim 1, wherein the server is a subscription management-service discovery server SM-DS,

Sending, by the user terminal, the eUICC identifier EID of the eUICC on the user terminal to the server, including:

The user terminal sends a polling message to the SM-DS, where the polling message carries the EID of the eUICC on the user terminal,

Receiving, by the user terminal, the authorization file sent by the server, including:

The user terminal receives the response message of the polling message sent by the SM-DS, and the response message of the polling message carries the authorization file.
The method of claim 1 wherein said server is a push server.

Sending, by the user terminal, the eUICC identifier EID of the eUICC on the user terminal to the server, including:

The user terminal sends a registration request to the push server, where the registration request carries an EID of the eUICC on the user terminal.
The method according to claim 3, wherein the registration request further carries an LPA identifier of a local file assistant LPA in the user terminal;

After the user terminal sends a registration request to the push server, the method further includes:

The user terminal receives the response message of the registration request sent by the push server, and the response message of the registration request carries the password allocated by the push server for the LPA indicated by the LPA identifier carried in the registration request. ;

The user terminal receives the authorization file sent by the server, including:

The user terminal receives the authorization file sent by the push server and a password corresponding to the EID corresponding to the authorization file;

After the user terminal receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file, the method further includes:

The user terminal compares the password corresponding to the EID corresponding to the authorization file with a password allocated by the push server for the LPA;

The user terminal saves the authorization file in the eUICC, including:

If the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, the user terminal saves the authorization file in the eUICC through the LPA.

Alternatively, the user terminal uses the authorization file to update the authorization file saved in the eUICC, including:

If the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, the user terminal updates the authorization saved in the eUICC by using the authorization file by the LPA. file.
The method according to any one of claims 1 to 4, wherein the method further comprises:

The user terminal receives the first policy rule that is sent by the first operator's subscription management-data preparation server SM-DP, and the first policy rule is a policy rule that is set by the first operator and is associated with the first subscription information set. The first operator is an operator to which the first subscription information set belongs.
The method of claim 5, wherein the server is the SM-DS, the method further comprising:

After receiving the first policy rule, the user terminal sends the SM-DS to the SM-DS. Sending the polling message, where the polling message carries the EID of the eUICC on the user terminal, where the polling message is used to request the SM-DS to send to the user terminal and the user terminal The authorization file corresponding to the EID of the eUICC.
The method according to claim 6, wherein the user terminal sends the polling message to the SM-DS after receiving the first policy rule, including:

After receiving the first policy rule, the user terminal does not include the information of the first operator in the information of the operator that is allowed to set the policy rule in the authorization file, and the user terminal goes to the The SM-DS sends the polling message.
The method of claim 5, wherein the server is the push server, the method further comprising:

After receiving the first policy rule, the user terminal starts a timer, and waits to receive an authorization file sent by the push server within a timing time of the timer.
The method according to claim 8, wherein the user terminal starts a timer after receiving the first policy rule, and waits to receive the sending by the push server within a timing time of the timer. Authorization documents, including:

After the user terminal receives the first policy rule, if the information of the operator that allows the policy rule to be set in the authorization file does not include the information of the first operator, the user terminal starts the a timer, and waiting to receive an authorization file sent by the push server within a timing time of the timer.
The method according to any one of claims 5-9, wherein the at least one policy rule comprises at least: the subscription information set is not allowed to be deleted, the subscription information set is not allowed to be deactivated, and the subscription information set is deactivated. At least one of the deletions;

The at least one policy rule includes the first policy rule.
The method of any of claims 5-9, wherein the method further comprises:

The user terminal receives the validity time of the first policy rule, and the effective time of the first policy rule is used to limit the effective time of the first policy rule.
The method of claim 11 further comprising:

After the user terminal successfully installs the first subscription information set or the user terminal activates the first subscription information set, the user prompts the user of the validity time of the first policy rule and the first policy rule.
The method according to any one of claims 5-9, wherein the authorization file further includes an effective time for allowing the operator to set the at least one policy rule, allowing the operator to set the at least one policy rule. The effective time of any one of the policy rules is used to limit the time when the operator has the right to set any of the above policy rules;

The method further includes:

When the user terminal activates the first policy rule, the user terminal determines whether the current time is within a valid time period in the authorization file that allows the first operator to set the first policy rule.

If the current time exceeds a valid time that allows the first operator to set the first policy rule, the user terminal prohibits activation of the first policy rule.
The method according to any one of claims 5-9, wherein after the user terminal receives the authorization file sent by the server, the method further includes:

The user terminal receives the policy release request sent by the function entity of the first operator, where the policy release request carries the information of the first operator and the policy rule to be released;

If the information of the operator that is allowed to set the policy rule to be released corresponding to the to-be-released policy rule included in the authorization file includes the information of the first carrier, the user terminal deletes the The information of the first operator in the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released, which is included in the authorization file.
The method according to any one of claims 5-9, wherein after the user terminal receives the authorization file sent by the server, the method further includes:

After the user terminal successfully installs the first subscription information set, the user terminal deletes the grant Information of the first operator in the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule that is included in the rights file;

or,

After successfully installing the first subscription information set, the user terminal deletes an authorization file that is stored in the user terminal and includes information about the first carrier.
The method of any of claims 1-9, wherein the method further comprises:

Before the user terminal activates the second subscription information set installed in the user terminal, if it is determined that the second policy rule is that the subscription information set is not allowed to be deactivated, the user terminal checks the authorization file, and the second The subscription information set belongs to the second operator, and the second policy rule is a policy rule that is set by the second operator and is associated with the second subscription information set;

If the information of the operator that allows the setting of the second policy rule that is included in the second policy rule that is included in the authorization file includes the information of the third carrier, the user terminal sends a prompt message, The third operator includes any operator other than the second operator;

The prompt information at least includes: the activation of the second subscription information set will not be able to download the subscription information set of the third operator or the activation of the second subscription information set will not be able to download the subscription of the third operator. Information set and information of the third operator.
A method for obtaining an authorization file, comprising:

Obtaining an authorization file, where the authorization file corresponds to an EID of an embedded universal integrated circuit card eUICC on the user terminal, where the authorization file includes an eUICC identifier EID of the eUICC, at least one policy rule, and the at least one policy Information corresponding to each policy rule in the rule that allows the operator to set the policy rule;

The server sends the authorization file to the user terminal.
The method according to claim 17, wherein the server is a subscription management-service discovery server SM-DS;

Sending, by the server, the authorization file to the user terminal, including:

The SM-DS receives a polling message sent by the user terminal, where the polling message carries an EID of an eUICC on the user terminal;

The SM-DS sends a response message of the polling message to the user terminal, where the response message of the polling message carries an authorization file corresponding to the EID carried in the polling message.
The method of claim 17, wherein the server is a push server;

After the server obtains the authorization file, the method further includes:

The push server determines a password corresponding to the EID corresponding to the authorization file according to the correspondence between the EID saved in the push server and the password generated by the push server for the local file assistant LPA in the user terminal. The user terminal includes at least one LPA;

Sending, by the server, the authorization file to the user terminal, including:

The push server sends the authorization file and the password corresponding to the EID corresponding to the authorization file to the user terminal.
The method according to claim 19, wherein before the sending the authorization file to the user terminal, the method further comprises:

The push server receives the registration request sent by the user terminal, where the registration request carries an LPA identifier and an EID of the eUICC on the user terminal;

The push server allocates a password for the LPA indicated by the LPA identifier carried in the registration request, and saves the correspondence between the password allocated by the push server for the LPA indicated by the LPA identifier and the EID carried in the registration request. relationship.
The method according to claim 20, wherein after the push server assigns a password to the LPA indicated by the LPA identifier carried in the registration request, the method further includes:

The push server sends a response message of the registration request to the user terminal, where the response message of the registration request carries a password allocated by the push server for the LPA indicated by the LPA identifier.
A user terminal, comprising:

a sending unit, configured to send, to the server, an eUICC identifier EID of the embedded universal integrated circuit card eUICC on the user terminal;

a receiving unit, configured to receive an authorization file sent by the server, where the authorization file corresponds to an EID of an eUICC on the user terminal, where the authorization file includes at least one policy rule and each of the at least one policy rule Information of the operator corresponding to the policy rule that allows the policy rule to be set;

And a control unit, configured to save the authorization file received by the receiving unit in the eUICC, or update the authorization file saved in the eUICC by using the authorization file received by the receiving unit.
The user terminal according to claim 22, wherein the server is a subscription management-service discovery server SM-DS,

The sending unit is specifically configured to:

Sending a polling message to the SM-DS, where the polling message carries an EID of an eUICC on the user terminal,

The receiving unit is specifically configured to:

Receiving a response message of the polling message sent by the SM-DS, where the response message of the polling message carries the authorization file.
The user terminal according to claim 22, wherein the server is a push server.

The sending unit is specifically configured to:

Sending a registration request to the push server, where the registration request carries an EID of the eUICC on the user terminal.
The user terminal according to claim 24, wherein the server is the push server, and the registration request sent by the sending unit further carries an LPA identifier of a local file assistant LPA in the user terminal. ;

The receiving unit is further configured to: after the sending unit sends a registration request to the push server, receive a response message of the registration request sent by the push server, where the response message of the registration request carries the The password allocated by the push server to the LPA indicated by the LPA identifier carried in the registration request;

The receiving unit is specifically configured to:

Receiving, by the push server, the authorization file and a password corresponding to the EID corresponding to the authorization file;

After the receiving unit receives the authorization file sent by the push server and the password corresponding to the EID corresponding to the authorization file, the user terminal further includes:

a comparison unit, configured to compare, by using the password corresponding to the EID corresponding to the authorization file, a password assigned by the push server to the LPA;

The control unit is specifically configured to:

And if the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, saving the authorization file in the eUICC by using the LPA,

Alternatively, the control unit is specifically configured to:

And if the password corresponding to the EID corresponding to the authorization file is the same as the password allocated by the push server for the LPA, the authorization file saved in the eUICC is updated by using the authorization file by the LPA.
The user terminal according to any one of claims 22-25, wherein the server is the SM-DS;

The receiving unit is further configured to receive a first policy rule sent by the subscription management-data preparation server SM-DP of the first operator, where the first policy rule is the first subscription information set by the first operator The associated policy rule is set; the first operator is an operator to which the first subscription information set belongs.
The user terminal according to claim 26, wherein the server is the SM-DS;

The sending unit is further configured to: after the receiving, by the receiving unit, the first policy rule, send the polling message to the SM-DS, where the polling message carries the user terminal The EID of the eUICC, the polling message is used to request the SM-DS to send an authorization file corresponding to the EID of the eUICC on the user terminal to the user terminal.
The user terminal according to claim 27, wherein said transmitting Unit, specifically for:

After the receiving, by the receiving unit, the first policy rule, if the information of the operator that allows the setting of the policy rule in the authorization file does not include the information of the first carrier, the information is sent to the SM-DS. The polling message.
The user terminal according to claim 26, wherein the server is the push server;

The user terminal further includes:

a starting unit, configured to start a timer after the receiving unit receives the first policy rule;

The receiving unit is further configured to wait to receive an authorization file sent by the push server within a timing time of the timer that is initiated by the startup unit.
The user terminal according to claim 29, wherein the activation unit is specifically configured to:

After the receiving, by the receiving unit, the first policy rule, if the information of the operator that allows the setting of the policy rule in the authorization file does not include the information of the first carrier, the timer is started;

The receiving unit is further configured to wait to receive an authorization file sent by the push server within a timing time of the timer that is initiated by the startup unit.
The user terminal according to any one of claims 26 to 30, wherein the at least one policy rule comprises at least: the subscription information set is not allowed to be deleted, the subscription information set is not allowed to be deactivated, and the subscription information set is deactivated. At least one of them should be deleted;

The at least one policy rule includes the first policy rule.
The user terminal according to any one of claims 26 to 30, wherein the receiving unit is further configured to receive a valid time of the first policy rule, where a valid time of the first policy rule is used The effective time of the first policy rule is defined.
The user terminal according to claim 32, further comprising:

An installation unit, configured to install the first subscription information set on the user terminal;

a first activation unit, configured to activate the first subscription information set installed by the installation unit;

a first prompting unit, configured to: when the installation unit successfully installs the first subscription information set or the first activation unit activates the first subscription information set, prompting the user with the first policy rule and the The effective time of the first policy rule.
The user terminal according to any one of claims 26 to 30, wherein the authorization file further includes an effective time for allowing the operator to set the at least one policy rule, allowing the operator to set the at least one policy. The effective time of any policy rule in the rule is used to limit the time when the operator has the right to set any of the above policy rules;

The user terminal further includes:

a second activation unit, configured to activate the first policy rule;

a determining unit, configured to determine, when the second activation unit activates the first policy rule, whether the current time is in a valid time that is allowed in the authorization file to allow the first operator to set the first policy rule Inside;

The prohibiting unit is configured to prohibit activation of the first policy rule if the determining unit determines that the current time exceeds a valid time for allowing the first operator to set the first policy rule.
The user terminal according to any one of claims 26 to 30, wherein the receiving unit is further configured to: after receiving the authorization file sent by the server, receive the functional entity of the first operator a policy rule release request message that is sent, where the policy rule release request message carries the information of the first operator and the policy rule to be released;

The user terminal further includes:

a deleting unit, configured to delete, if the information of the operator that is to be released from the policy rule that is to be released in the authorization file is The information of the first operator in the information of the operator that is allowed to set the policy rule to be released corresponding to the policy rule to be released, which is included in the authorization file.
The user terminal according to any one of claims 26 to 30, wherein after the receiving unit receives the authorization file sent by the server, the deleting unit is further used to succeed in the installing unit. After the first contract information set is installed, the information of the first operator in the information of the operator that is allowed to set the first policy rule corresponding to the first policy rule that is included in the authorization file is deleted. ;

or,

After the installation unit successfully installs the first subscription information set, the authorization file stored in the user terminal and containing the information of the first operator is deleted.
The user terminal according to any one of claims 22 to 30, wherein the installation unit is further configured to install the second subscription information set in the user terminal;

The first activation unit is further configured to activate the second subscription information set installed by the installation unit;

The user terminal further includes:

a checking unit, configured to check the authorization file, the second subscription information, if it is determined that the second policy rule does not allow deactivation of the subscription information set before the first activation unit activates the second subscription information set The set belongs to the second operator, and the second policy rule is a policy rule that is set by the second operator and is associated with the second subscription information set;

a second prompting unit, configured to send a prompt message if the information of the operator that is required to set the second policy rule corresponding to the second policy rule included in the authorization file includes information of the third carrier The third operator includes any operator other than the second operator;

The prompt information at least includes: the activation of the second subscription information set will not be able to download the subscription information set of the third operator or the activation of the second subscription information set will not be able to download the subscription of the third operator. Information set and information of the third operator.
A server, comprising:

An obtaining unit, configured to obtain an authorization file, and the authorization file and the user terminal Corresponding to the EID of the embedded universal integrated circuit card (eUICC), the authorization file includes an eUICC identifier EID of the eUICC, at least one policy rule, and a policy rule corresponding to each of the at least one policy rule. Carrier information;

And a sending unit, configured to send, to the user terminal, the authorization file obtained by the acquiring unit.
The server according to claim 38, wherein the server is a subscription management-service discovery server SM-DS;

The server further includes:

a receiving unit, configured to receive a polling message sent by the user terminal, where the polling message carries an EID of an eUICC on the user terminal;

The sending unit is specifically configured to:

Sending a response message of the polling message to the user terminal, where the response message of the polling message carries an authorization file corresponding to the EID carried in the polling message.
The server according to claim 38, wherein said server is a push server;

The server further includes:

a determining unit, configured to determine, according to the correspondence between the EID saved in the push server and the password generated by the push server for the local file assistant LPA in the user terminal, after the obtaining unit obtains the authorization file a password corresponding to the EID corresponding to the authorization file, the user terminal includes at least one LPA;

The sending unit is specifically configured to:

Sending, to the user terminal, the authorization file obtained by the obtaining unit and the password corresponding to the EID corresponding to the authorization file determined by the determining unit.
The server according to claim 40, wherein the receiving unit is further configured to: before the sending unit sends the authorization file obtained by the acquiring unit to the user terminal, receive the sending by the user terminal a registration request, the registration request carrying an LPA identifier and an EID of the eUICC on the user terminal;

The server further includes:

An allocating unit, configured to allocate a password for the LPA indicated by the LPA identifier carried in the registration request received by the receiving unit;

And a saving unit, configured to save a correspondence between a password allocated by the allocation unit for the LPA indicated by the LPA identifier and an EID carried in the registration request received by the receiving unit.
The server according to claim 41, wherein the sending unit is further configured to: after the assigning unit allocates a password to the LPA indicated by the LPA identifier carried in the registration request received by the receiving unit Sending, by the user terminal, a response message of the registration request, where the response message of the registration request carries a password allocated by the push server for the LPA indicated by the LPA identifier.
A user terminal, characterized in that the user terminal comprises: one or more processors, a memory, a bus and a transceiver;

The memory is configured to store a computer execution instruction, the processor is connected to the memory through the bus, and when the user terminal is running, the processor executes the computer execution instruction stored in the memory, so that The user terminal performs the method of obtaining an authorization file according to any one of claims 1-16.
A server, comprising: one or more processors, a memory, a bus, and a transceiver;

The memory is configured to store a computer execution instruction, the processor is connected to the memory through the bus, and when the server is running, the processor executes the computer execution instruction stored in the memory to make The server performs the method of obtaining an authorization file according to any one of claims 17-21.