CN111479259A

CN111479259A - SIM card configuration distribution method and system

Info

Publication number: CN111479259A
Application number: CN202010378164.3A
Authority: CN
Inventors: 金辉; 陈晓波
Original assignee: Shenzhen Jieruilian Technology Co ltd
Current assignee: Shenzhen Jieruilian Technology Co ltd
Priority date: 2020-05-07
Filing date: 2020-05-07
Publication date: 2020-07-31
Anticipated expiration: 2040-05-07
Also published as: CN111479259B; WO2021223278A1

Abstract

The invention provides a method and a system for distributing SIM card configuration, belonging to the technical field of communication. The system comprises: the module integration platform is used for integrating a card operating system of the SIM card into the chip module; the module integration platform is used for writing the security configuration data corresponding to the SIM card into a card operating system of the chip module; a subscription management data platform for creating card configuration data of the SIM card and assignment code data corresponding to the card configuration data of the SIM card; the mobile operator platform is used for providing a downloading instruction to the subscription management data platform; the local card configuration management service platform is used for operating an upper computer and receiving distribution code data sent by the subscription management data platform; the local card configuration management service platform is used for loading and analyzing the issued distribution code data, and writing and installing card configuration data corresponding to the issued distribution code data into the card operating system of the chip module.

Description

SIM card configuration distribution method and system

Technical Field

The present invention relates to the field of communications technologies, and in particular, to a method for distributing SIM card configurations, a method for distributing SIM card configurations in batches, a system for distributing SIM card configurations, an integrated SIM chip, an electronic device, and a computer-readable storage medium.

Background

Particularly in the L PWA field, such as NB-IoT, various industries and different application fields generate new and serious challenges, namely huge SIM card manufacturing, distribution and management costs caused by a massive device base, and increasingly strict requirements on physical characteristics, environmental characteristics, long service life (at least equal to the service life of the device) and low power consumption, including temperature, humidity, shock resistance, pressure resistance and the like of the device.

The existing physical card and virtual card technologies cannot completely present a complete technical scheme with safety, high efficiency and low cost.

For the physical entity card scheme, the physical entity card scheme can be divided into a plug-in plastic card and a patch card; in the physical entity card form, a client usually interacts with an operator only, the operator places an order to appoint used Profile data and package ordering information, then the operator transmits input _ file (containing Profile information) to the card merchant in an offline encryption form, the card merchant prepares card hardware and an operating system in advance according to specific requirements of the operator and the client, writes the Profile into each card on a production line for personalization, finally packages different specifications, sends the card to the operator in an express form, and attaches output _ file to mark card making data corresponding to each card. And finally, the operator express the card to the final customer. In some cases, the card merchant can directly send the card to the customer. Besides the ordinary physical card with one card and one number, the physical card with one card and multiple numbers or the physical card with the profile dynamically issued by the support of the general proprietary protocol is possible. In this way, a physical card is used, but the physical card is safe, but has the cost of a physical card chip, packaging, a production line and the like, and the express delivery, manual management and operation cost involved in various card distribution are huge, even if the client side needs to manage the SIM card by itself, each card is inserted into the equipment or pasted on the equipment production line, and the overall distribution and management cost is high.

For the Virtual SIM card solution, otherwise known as soft SIM, SoftSIM, vSIM, Virtual SIM, etc., the third party facilitator acts as an integrator throughout the chain. The customer only connects with the service provider, shields the operator, and has certain flexibility, only needs to care about profile, flow order and the like, and can select different operators. The service provider can take the profile from the operator in advance and place the profile on a server of the service provider, so that the client can directly write in the profile locally or download the profile to the equipment of the client remotely when needing to correspond to the profile. The service provider needs to integrate vSIM software with the client device without the need for a physical card to implement SIM functionality. The scheme can reduce the cost of a physical entity card and the SIM distribution and management cost of a client, but has the biggest problems of unreliable safety, private realization of a server, over-the-air transmission and terminal security and the biggest hidden danger of safety.

For the eSIM card solution, the standard eSIM solution proposed by GSMA dominantly is divided into two, the Consumer and M2M, the Consumer needs to have a user interface, participate in manual work, support dynamic download of a profile, the M2M version needs to support SMS and BIP communication, can actively push a profile download from a server, SMDP + is operator-owned, securely store the profile, L PA is integrated in the eUICC or in the device, assist the eUICC card to perform the profile download and management, all communication protocols strictly adhere to the RSP protocol, fully consider security mechanisms of the server, over-the-air transmission and the terminal, and ensure interoperability between various components, add a certificate system, very secure and reliable, but with higher cost, one eUICC needs 1.5 dollars, the operator service end system also needs 10-100w dollars, and most cases are not practical in a scene, one needs initial network connection, the other needs to support the eUICC and BIP, and the operator service end system also needs 10-w dollars if SMS is used for a large-cost, and the problem that the WPA physical network entity needs L is a high cost.

For nuSIM card scheme, nuSIM is proposed by German telecommunication, based on the safety protocol of eSIM specification, aiming at L ow-cost equipment, in particular to an efficient, low-cost and safe Profile distribution scheme of NB-IoT scene, optimization is mainly carried out in two places, compared with the SMDP + server of the original eSIM, the size of Profile is optimized, batch downloading is supported, and the efficiency of production line is improved. L A is directly realized on the PC of a production line, and Profile downloading is carried out by means of the network environment of the PC of the production line.

Disclosure of Invention

The invention aims to provide a method and a system for distributing SIM card configuration.

In order to achieve the above object, an embodiment of the present invention provides a method for distributing SIM card configurations, where the method for distributing SIM card configurations includes:

integrating a card operating system of the SIM card in the chip module;

writing security configuration data corresponding to the SIM card into a card operating system of the chip module;

receiving allocation code data corresponding to the card configuration data of the SIM card;

and acquiring and writing the card configuration data into the chip module or the terminal equipment integrating the chip module through the distribution code data.

Specifically, the writing of the security configuration data corresponding to the SIM card to the card operating system of the chip module includes:

writing personalized data and safety data corresponding to the SIM card into the chip module, wherein the personalized data comprises a unique identification code, the safety data comprises a certificate and a corresponding secret key, and the corresponding secret key comprises a public key and a private key.

Specifically, the writing of the security configuration data corresponding to the SIM card to the card operating system of the chip module,

the certificate comprises a card merchant certificate and a card merchant eUICC certificate, the card merchant certificate is issued or self-issued through a mobile operator platform, and the unique identification code is consistent with an issuer of the card merchant eUICC certificate.

Specifically, the receiving of the allocation code data corresponding to the card configuration data of the SIM card includes:

importing card configuration data of the SIM card in a subscription management data platform through a mobile operator platform;

providing assignment code data through the subscription management data platform.

Specifically, the acquiring and writing the card configuration data into the chip module or the terminal device integrating the chip module by the allocation code data includes:

loading the distribution code data through an upper computer running a local card configuration management service;

connecting the upper computer with a terminal device integrating the chip module;

and according to the analysis of the upper computer on the distribution code data, writing the card configuration data into the chip module, and installing the card configuration data in a card operating system of the chip module.

Specifically, the SIM card configuration distribution method further includes at least one of the following:

reporting the installation result of the card configuration data to a subscription management data platform;

activating the card configuration data when the terminal device is started;

and maintaining the communication between the chip module and the modulation module of the terminal equipment.

The embodiment of the invention provides a method for distributing SIM card configuration in batches, which comprises the following steps:

integrating a card operating system of the SIM cards in a chip module in batch;

receiving distribution code data corresponding to the card configuration data of the SIM cards in batch;

and acquiring and writing the card configuration data into the chip module or the terminal equipment integrating the chip module in batches through the distribution code data.

The embodiment of the invention provides a SIM card configuration and distribution system, which comprises:

the module integration module is used for integrating a card operating system of the SIM card into the chip module;

the communication security module is used for writing security configuration data corresponding to the SIM card into a card operating system of the chip module;

a local card configuration management module for receiving allocation code data corresponding to the card configuration data of the SIM card;

the local card configuration management module is further configured to acquire and write the card configuration data into the chip module or a terminal device integrating the chip module, according to the allocation code data.

The embodiment of the invention provides a system for SIM card configuration distribution, which comprises:

the module integration platform is used for integrating a card operating system of the SIM card into the chip module;

the module integration platform is used for writing the security configuration data corresponding to the SIM card into a card operating system of the chip module;

a subscription management data platform for creating card configuration data of the SIM card and assignment code data corresponding to the card configuration data of the SIM card;

the mobile operator platform is used for providing a downloading instruction to the subscription management data platform;

the local card configuration management service platform is used for operating an upper computer and receiving distribution code data sent by the subscription management data platform;

the local card configuration management service platform is used for loading and analyzing the issued distribution code data, and writing and installing card configuration data corresponding to the issued distribution code data into the card operating system of the chip module.

Optionally, the mobile operator platform is configured to provide a card merchant certificate in the security configuration data and issue the card merchant certificate to the module integration platform.

Optionally, the module integration platform is specifically configured to write personalized data and secure data corresponding to the SIM card into the chip module, where the personalized data includes a unique identification code, the secure data includes a certificate and a corresponding key, and the corresponding key includes a public key and a private key.

Optionally, the module integration platform is specifically configured to self-issue the unique identifier and the card merchant eUICC certificate.

Optionally, the local card configuration management service platform is further configured to report an installation result of the card configuration data to the subscription management data platform.

Optionally, the local card configuration management service platform is further configured to retry downloading or installation of the card configuration data, and perform queue management on a task queue for downloading or installation.

Optionally, the system further comprises:

and the terminal equipment is integrated with the chip module and used for activating the card configuration data and maintaining the communication between the chip module and the modulation module when the terminal equipment is started.

An embodiment of the present invention provides an integrated SIM chip configured by the foregoing system, where the integrated SIM chip is configured as a card operating system having an SIM card;

the integrated SIM chip comprises: a storage medium written with card configuration data encrypted by a secure key repository and a key of the derived card configuration data;

the card configuration data and the derived key for the card configuration data are obtained from a local card configuration management service platform via a first encrypted connection, wherein,

the local card configuration management service platform receives a key of the card configuration data generated and derived by a key server through a second encryption connection, and forwards a request or a response between a subscription management data platform and the integrated SIM chip through the first encryption connection.

the card operating system is configured to run in a trusted execution environment of the integrated SIM chip;

the integrated SIM chip comprises: a storage medium in the trusted execution environment;

the storage medium is written with card configuration data of the SIM card, and the card configuration data is acquired from a local card configuration management service platform through a third encrypted connection, wherein the local card configuration management service platform further forwards a request or a response between a subscription management data platform and the integrated SIM chip through the third encrypted connection.

In another aspect, an embodiment of the present invention provides an electronic device, including:

at least one processor;

a memory coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, the at least one processor implements the aforementioned method by executing the instructions stored by the memory.

In yet another aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer instructions, which, when executed on a computer, cause the computer to perform the foregoing method.

Additional features and advantages of embodiments of the invention will be set forth in the detailed description which follows.

Drawings

The accompanying drawings, which are included to provide a further understanding of the embodiments of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the embodiments of the invention without limiting the embodiments of the invention. In the drawings:

FIG. 1 is a schematic diagram of the main modules of an exemplary system according to the present invention;

FIG. 2 is a schematic diagram illustrating a main interaction flow of an exemplary system according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of the main modules of an exemplary system according to the present invention;

fig. 4 is a schematic diagram illustrating a main interaction flow of an exemplary system according to an embodiment of the present invention.

Reference to English abbreviations

SIM: the Subscriber identity module is one of universal integrated circuit cards and is used for authenticating legal users of an operator network.

Profile: card configuration data, a series of data and applications stored in the ordinary SIM card and the eUICC card.

IoT: the Internet of things.

NB-IoT: the narrowband Internet of Things is mainly suitable for application scenes with fixed positions, ultra-low power consumption and no particular sensitivity to network bandwidth and time delay, such as water meters, electric meters, well covers and other equipment.

eMTC: enhanced machine-type communication is mainly suitable for position movement, low power consumption, certain requirements on network bandwidth and delay but no high requirements on consumer level, and is suitable for scenes such as trackers, positioners, smart cities and smart logistics in scenes of the Internet of things.

L PWA L ow power wide area, low power wide area connectivity scenario, especially NB-IoT and eMTC.

2G: second generation communication technology.

UICC: universal Integrated Circuit Card, including communication SIM Card, financial bank Card, public transport Card, etc.

The eUICC: an embedded UICC, a pluggable or embedded universal integrated circuit card, commonly referred to as an eSIM card, supports remote and local management of profiles in a secure manner.

EID: eUICC ID, unique identification of eUICC card.

L PA L cal Profile Assistant, local Profile Assistant, functions including assisting Profile download, Profile management (Profile enable, Profile close, Profile delete, Profile information query), and providing a Profile management interface.

The PC L PA or L A or L PA is a local card configuration management service platform, L PA software running on a PC computer is expanded on the basis of the original L PA, and a function of supporting data transmission and equipment connection through a serial port, a USB and the like, a function of supporting simultaneous connection of a plurality of equipment and a function of supporting simultaneous trigger of Profile parallel downloading of the plurality of equipment are newly added, so that the software is an important component in the application.

SMDP + (or DP, DP + for short) Subscription Manager Data Preparation +, Subscription management Data Preparation server (or Subscription management Data platform), the main functions are to prepare Profile, encrypt, store and distribute Profile to specified EID safely, and issue it to eUICC through L PA by binding an encrypted Profile.

TEE: the Trust Execution Environment is a safe isolation Environment designed based on an Arm Trust zone architecture, and is used for isolating a storage and Execution Environment of safe application and safe data from an open Environment of an external system. The existing consumer devices such as Qualcomm, MTK and Unisoc chips and the Internet of things devices support the function. Common application scenarios are fingerprint payment, face recognition, and the like.

CA: the Client Application in the Client Application and TEE scene runs on the REE side and is responsible for communication and data interaction forwarding of TA in the REE and the TEE.

TA: trusted Application in a TEE scene runs inside the TEE, is safe Application, and executes operation and operation of safe data. In this document the SIM application will run inside the TEE as a secure application.

Rich Execution Environment, a Rich Execution Environment, is typically an open, general-purpose operating system, such as Android, iOS, L inux, etc.

Modem Chip: and the modem chip provides the communication capability of the terminal equipment and the base station.

SoC: the System on Chip is a technical concept shared by consumer equipment and part of internet of things equipment, and if the Chip is not only used as a Modem, but also used as a developer and a user to perform service application development, the Chip can be called an integrated SoC. At present, most Android and iOS devices are the same, and most 4G Internet of things devices are also the devices which are only used as Modem communication chips in single NB scenes and are not used as business application chips. The SoC referred to herein is integrated and provides both communication chip functionality and business application chip functionality.

The invention iSIM: an integrated SIM chip with complete SIM function is realized on the chip.

The invention TEEiSIM (or TEE SIM): the integrated SIM chip with the complete SIM function is realized on a chip with a trusted execution environment.

SAS-UP: the Security authorization Scheme-UICC Production strictly defines, standardizes and examines the unit, process, key and certificate management of UICC card Production so as to ensure the individuation of the key and certificate of the UICC card and the safety of Profile writing.

MNO: mobile Network Operator, a Mobile Operator (platform), such as operators in china Mobile, china unicom and overseas countries, provides Mobile Network services including voice, short messages, data, etc. to users.

The GSMA is GSM Association, International telecommunication Union, and the main participants comprise operators, card merchants, terminal equipment manufacturers and the like and are responsible for the overall technical standard specification and unified coordination in the fields of communication, Profile, core network and the like.

SMS is short message service of operator.

The BIP is an independent transmission protocol, has close relation with a new generation STK-USAT, is simpler, and aims to improve the data transmission rate and support the USIM card to communicate with a remote server through a TCP/IP protocol. Namely, the data transmission protocol is adopted when the user needs the things by directly downloading the things through the value-added application in the USAT.

BP base and processor.

SKB Secure Key Box, a third party Secure environment service.

DM, device manufacturer.

OEM equipment manufacturer.

ODM scheme quotient.

Module, Module.

Chip/Chip: and (3) a chip.

Device: a terminal device or a device.

SW: software, acronym for software.

HW: hardware, acronym, hardware.

NVM: Non-Volatile Memory, Non-Volatile Memory.

RAM: random access memory, also known as main memory, internal memory.

Secure Boot: and the safety starting mechanism protects the starting verification integrity and the authority safety of the equipment.

AES: advanced Encryption Standard, Advanced Encryption Standard Algorithm.

ECKA (electron transfer KA): an ECC Elliptic curve-based Key Agreement algorithm.

SCP03 t: the Asymmetric Secure Channel Protocol, SCP03t, is an extended version of the Secure data transmission Channel established based on the SCP03 Protocol, and is used as profile encryption/decryption and segment transmission check integrity in the eSIM standard specification.

JTAG: named through the name of the Joint Test Action Group team, the method is used as a common tool interface for debugging equipment.

AT: the AT is Attention, and the AT instruction set is sent from a Terminal Equipment (TE) or a Data Terminal Equipment (DTE) to a Terminal Adapter (TA) or a Data Circuit Terminal Equipment (DCE) AT, and sends an AT instruction through the TA or the TE to control a function of a Mobile Station (MS), interact with GSM network services, and a user can control a call, a short message, a phone book, Data services, a fax, and the like through the AT instruction, and the AT instruction is commonly used for communication between an external main control chip and a Modem module.

UART: universal Asynchronous Receiver/Transmitter, a common serial communication protocol, is used as a communication protocol commonly used by devices and external devices such as PC computers.

ES2+/ES8+/ES9 +: a data interaction procedure of an eSIM standard protocol defined by GSMA.

COS: the Card Operating System is currently of the type ISO, Oracle Java Card, GlobalPlatform,3GPP and ETSI.

CERT or Crt(s): a certificate.

And EUM: eUICC manager, card vendor.

CI: certificate issue, Certificate Issuer (or authority).

RSP: remote SIM provisioning.

The AC is an Activation Code which comprises a Profile download address and corresponding identification information and can be downloaded from L PA to SMDP +.

ACInfos: the (batch) distributed code data of the invention can have a Profile data packet (such as a data packet in an Excel table format), a download address and the like, and the data packet is more simplified compared with a Profile native data packet, for example, unnecessary third party subscription service application is reduced, and application for rewriting and updating the Profile is reduced.

Detailed Description

The following detailed description of embodiments of the invention refers to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating embodiments of the invention, are given by way of illustration and explanation only, not limitation.

The invention can provide a low-cost, high-efficiency and moderate-security integrated SIM product, supports the issue of the Profile before factory shipment and the safe write-in of the Profile into the equipment, ensures the life cycle safety of the whole Profile and the final product and technical form of the use once the equipment leaves the factory, and particularly relates to the field of low-cost equipment, wherein the emphasis is on L PWA, 2G and the like, and the application of industries such as water meters, electric meters, locators, trackers, smart cities, smart logistics and the like is covered.

Example 1

the Module integration platform (or chip Module platform or Module) is used for integrating a card operating system of the SIM card into the chip Module, the chip Module is a physical chip combined by software and hardware, the card operating system is required to be matched with the chip hardware, and the chip can be executed on the chip, so that a storage medium of the chip can be written into external input data such as card configuration data and the like;

a subscription management data platform (or SMDP +) for creating card configuration data of the SIM card and assignment code data corresponding to the card configuration data of the SIM card;

a mobile operator platform (or MNO) for providing download instructions to the subscription management data platform;

the local card configuration management service platform (or L A) is used for running on an upper computer (or an application module installation platform) and receiving distribution code data sent by the subscription management data platform;

The embodiment of the invention also provides a method for distributing the SIM card configuration or a method for distributing the SIM card configuration in batches.

COS is matched and integrated into corresponding SW on a chip, a chip general agent and a module, and then the corresponding chip and the corresponding module are produced;

2. before the DM, OEM and ODM factory devices start downloading the Profile, COS personalization may be performed first, and data such as EID, EUM CERT, eUICC SK and CI PK needs to be personalized and written into each different chip or module;

the EUM certificate can be issued by an MNO or self-issued according to the situation, then batch information such as eUICC certificates and EIDs is issued by the EUM, and the uniqueness of the EIDs (under the same CI system) is ensured;

4, the MNO imports a corresponding Profile in the DP + according to the existing service flow and provides batch AC info (whether AC and EID are bound one to one or not);

the PC L PA program is loaded into the AC info and is simultaneously connected to a plurality of corresponding terminal devices, so that the downloading and writing can be started by ensuring network connection;

6. l PA records the result and reports DP + after the successful installation;

7. all Profile downloading tasks corresponding to the AC need to add a queue management and retry mechanism, and record a final result;

8. after the equipment which is downloaded and installed successfully is disconnected and the PC is connected, the installed Profile can be started automatically, and the equipment is restarted each time. The equipment does not support rewriting after leaving factory and can be returned to factory for rewriting.

The embodiment of the invention can overcome the problems that the total cost price of manufacturing, distributing and managing the SIM cards is high and the cost price of a single SIM card is gradually increased due to the improvement of various characteristics of the SIM card caused by mass base number equipment;

the embodiment of the invention has reduced encapsulation, no clamping groove is provided, the space size of the equipment is obviously reduced, and high shock resistance and high pressure resistance are realized;

the embodiment of the invention has no network dependence, does not need RSP capability any more, can directly and safely issue the Profile to the equipment before leaving the factory, issues one or more profiles, and can directly and flexibly manage and start without a network after leaving the factory;

the embodiment of the invention directly uses the existing eSIM DP +, does not need additional investment, saves cost, does not change the existing flow, can be seamlessly and zero-cost butted by an operator, and is compatible with the nuSIM DP;

the embodiment of the invention supports the transformation on a production line and the batch downloading, and improves the production efficiency.

Example 2

Based on embodiment 1, as shown in fig. 1 (where the SS1 may be a second encryption connection, where the SS1 is a data interaction process based on an HTTPS protocol, mainly cross-authentication between a security key library and a local card configuration management service platform, and a server where the security key library is located derives a key of card configuration data from the authenticated local card configuration management service platform), and the SS2 may be a first encryption connection, where the SS2 is a data interaction process based on a UART or AT interface, mainly loads an EUM certificate, an eUICC certificate, a key of the derived card configuration data, and forwards a request and a response of ES8+/ES9 +), the embodiment of the present invention provides a SIM card configuration distribution method based on a modulation Chip integrated circuit Modem Chip IC of a MTK2625NB model, and the method specifically includes the following steps.

The method comprises the following steps that 1, the eSIM COS is matched and integrated into corresponding SW on a chip, a chip general agent and a module, the COS is realized inside a 2625 chip, and communication is carried out with a Modem side through an SIM Driver (Driver). Then, producing corresponding chips and modules;

2. before the DM, OEM and ODM factory devices start downloading the Profile, COS personalization must be performed first, and data such as EID, EUM CERT, eUICC SK (SK is a security key), CI PK (PK is a security key) and the like need to be personalized and written into each different chip or module;

6. l PA records the result and reports DP + after the successful installation;

8. after the equipment which is downloaded and installed successfully is disconnected and the PC is connected, the installed Profile can be started automatically, and the equipment is restarted each time. The equipment does not support rewriting after leaving factory and must be returned to factory.

9. The security encryption mechanism is completed by external isolation of a Modem Chip of the 2625 Chip and encryption protection of SKB, the 2625 Chip is isolated on NVM, RAM and external communication, illegal AT, UART interfaces and JTAG interfaces can be turned off, and the security encryption mechanism is an isolated security environment. The NVM Flash provides Secure Boot and AES OTF encryption functions to further ensure internal data security. And the SKB performs secondary encryption protection on the key data in the profile, so that the safety of the profile in storage and operation is ensured. The download flow of the whole profile conforms to an eSIM standard protocol, and the download safety of the profile is ensured by the aid of certificate bidirectional verification and ECKA and SCP03t encryption mechanisms. The whole combination ensures the life cycle safety of the profile, and the integrated SIM chip product can be obtained after the configuration and distribution are finished.

The embodiment of the invention also provides an integrated SIM chip configured by the system, wherein the integrated SIM chip is configured into a card operating system with an SIM card;

the card configuration data and the derived key for the card configuration data are obtained from a local card configuration management service platform through SS2, wherein,

the local card configuration management service platform receives keys of the card configuration data generated and derived by a key server through the SS1, and forwards a request or a response between a subscription management data platform and the integrated SIM chip through the SS 2.

Example 3

Based on embodiment 1, as shown in fig. 3 (where the SS1 may be a third encryption connection, and the SS1 is a data interaction process based on UART or AT interface, and mainly forwards a request and a response of ES8+/ES9 +), and fig. 4, the embodiment of the present invention provides a SIM card configuration distribution method based on a chip BG77 remote module of Qualcomm9205 model, which specifically includes the following steps.

The method comprises the following steps that 1, an eSIM COS is matched and integrated into a corresponding SW on a chip, a chip master agent and a module, the COS is realized in a TEE safety environment provided inside a Qualcomm9205 chip, communication is realized through external CA and REE, and communication is realized with a Modem side through a QMI interface. Then, producing corresponding chips and modules;

2. before the DM, OEM and ODM factory equipment starts to download the Profile, COS personalization must be carried out, and data such as EID, EUM CERT, eUICC SK, CI PK and the like need to be written into each different chip or module in a personalized mode;

6. l PA records the result and reports DP + after the successful installation;

9. The security encryption mechanism is guaranteed by a TEE trusted execution environment inside the 9205 chip, the execution of the eSIM COS and the storage of the profile data are both in an NVM and an RAM inside the TEE, the external communication is isolated, and the security storage and the operation of the profile inside the equipment are guaranteed. The download flow of the whole profile conforms to an eSIM standard protocol, and the download safety of the profile is ensured by the aid of certificate bidirectional verification and ECKA and SCP03t encryption mechanisms. The whole combination ensures the life cycle safety of the profile, and the integrated SIM chip product can be obtained after the configuration and distribution are finished.

the storage medium is written with card configuration data of the SIM card, and the card configuration data is acquired from a local card configuration management service platform through SS1, wherein the local card configuration management service platform further forwards a request or a response between a subscription management data platform and the integrated SIM chip through SS 1.

The following steps may be further preferred for the present invention of example 2 or example 3.

1. Simulating similar functions and technical schemes of SMDP + and PC L PA by using a private protocol without using an eSIM protocol, and then downloading and writing profile on a production line;

2. realizing the batch downloading function of production line tools by using automatic production machines or equipment;

3. the device side does not necessarily use a comparable eSIM protocol or a specific security environment, and can be directly based on a software environment, integrated into a device or a chip to implement the SIM function, support downloading or directly write the profile with an external production line or a local interface, a local tool;

the interface of the PC L PA is realized by using Windows or L inux or Mac native software without using a web server and a browser architecture;

and 5, the PC L PA and the eSIM COS are realized in different operating system platforms, different chips, different devices and different security environments.

The following advantages are specific to embodiment 2 or embodiment 3 of the present invention.

An eSIM COS, namely forming a system of an Integrated SIM chip (iSIM), integrating the complete functions of the SIM into a chip, a Module and a Device (equipment), such as REE, TEE, SoC and Modem BP, completely removing entity UICC, downloading and writing the Profile from a service end before the equipment leaves a factory, and returning the equipment to the factory for re-downloading and writing;

after the eSIM COS receives the profile downloaded by the SMDP +, because the profile is large, the space of the device is small in L PWA equipment and many profile components without practical effects exist, and the eSIM COS can be simplified according to the application scene condition of the device so as to meet the requirements of saving the space of the device and normal use;

3. the production line tool supports the personalized certificate and the production line to combine the downloading and writing processes;

4.PC L PA has higher requirements on network dependence and real-time connection of production lines, the quantity of simultaneous downloads depends on the quantity of PCs MIN (L PA maximum supports the quantity of parallel downloads, and a single PC maximum supports the quantity of simultaneously connected devices), and has higher requirements on concurrent processing of DP +.

5, the PC L PA uses Java version, the bottom layer uses a universal L PA Jar packet to a Java back-end Server (deployed in a production line PC local machine), and then the Java back-end Server uses a JS front-end interface for display, so that the cross-platform effect can be fully achieved, and the database uses PostgreSQL L;

the PC L PA supports self-defined parameter configuration, such as the number of simultaneous connections, timeout time, retry times and the like;

the PC L PA supports concurrent downloading, is connected with multiple devices simultaneously, automatically detects the connection of serial devices and continuously downloads in batches;

the PC L PA is adapted to different terminal equipment interfaces for transmitting data, such as USB, UART, AT and the like, and abstractly unifies the Adapter interface and can be realized by different methods;

9. low cost, high efficiency and high safety. The interconnection and the interoperability of the whole system are ensured, and the safety degree approved by operators is reached. The certificate system can be public or private, and has flexibility.

10. The nuSIM DP and the existing SMDP + can be compatible, if the existing SMDP + is used, no new investment cost is needed, no change of the existing flow of an operator is needed, and seamless docking can be realized.

Example 4

Based on embodiments 1 to 3, an embodiment of the present invention provides a SIM card configuration and distribution system, which may be used to construct an upper computer or an automated data processing platform, and the system may include:

The invention saves cost, particularly saves cost of physical entity cards, saves fussy manual physical entity card distribution and management cost, saves cost for operators to invest new capital and manually build new systems, can directly use the existing SMDP +, improves production efficiency by using the PC L PA, realizes cross-platform application by using the PC L PA, is flexible and easy to deploy, reduces network dependence on equipment side, fully utilizes safety of the equipment side, and meets the requirement of a reasonable standard protocol.

Although the embodiments of the present invention have been described in detail with reference to the accompanying drawings, the embodiments of the present invention are not limited to the details of the above embodiments, and various simple modifications can be made to the technical solutions of the embodiments of the present invention within the technical idea of the embodiments of the present invention, and the simple modifications all belong to the protection scope of the embodiments of the present invention.

It should be noted that the various features described in the above embodiments may be combined in any suitable manner without departing from the scope of the invention. In order to avoid unnecessary repetition, the embodiments of the present invention do not describe every possible combination.

Those skilled in the art will understand that all or part of the steps in the method according to the above embodiments may be implemented by a program, which is stored in a storage medium and includes several instructions to enable a single chip, a chip, or a processor (processor) to execute all or part of the steps in the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

In addition, any combination of various different implementation manners of the embodiments of the present invention is also possible, and the embodiments of the present invention should be considered as disclosed in the embodiments of the present invention as long as the combination does not depart from the spirit of the embodiments of the present invention.

Claims

1. A method for distributing SIM card configuration is characterized in that the method for distributing SIM card configuration comprises the following steps:

integrating a card operating system of the SIM card in the chip module;

2. The method according to claim 1, wherein writing the security configuration data corresponding to the SIM card to a card operating system of the chip module comprises:

3. The method according to claim 2, wherein the writing of the security configuration data corresponding to the SIM card to a card operating system of the chip module,

4. The SIM card configuration distribution method according to claim 1, wherein the receiving of the distribution code data corresponding to the card configuration data of the SIM card comprises:

5. The SIM card configuration distribution method according to claim 1, wherein the obtaining and writing of the card configuration data to the chip module or a terminal device integrating the chip module by the distribution code data comprises:

6. The SIM card configuration distribution method according to claim 5, further comprising at least one of:

activating the card configuration data when the terminal device is started;

7. The method for distributing the SIM card configuration in batches is characterized by comprising the following steps:

integrating a card operating system of the SIM cards in a chip module in batch;

8. A SIM card configuration distribution system, comprising:

9. A system for SIM card configuration distribution, the system comprising:

10. The system for SIM card configuration distribution according to claim 9,

the mobile operator platform is used for providing a card merchant certificate in the security configuration data and issuing the card merchant certificate to the module integration platform.

11. The system for SIM card configuration distribution of claim 9, wherein the module integration platform is specifically configured to write personalization data and security data corresponding to the SIM card to the chip module, wherein the personalization data comprises a unique identification code, the security data comprises a certificate and a corresponding key, and the corresponding key comprises a public key and a private key.

12. The system for SIM card configuration distribution according to claim 11,

the module integration platform is specifically used for self-issuing the unique identification code and the card business eUICC certificate.

13. The system for SIM card configuration distribution according to claim 9,

the local card configuration management service platform is further configured to report an installation result of the card configuration data to the subscription management data platform.

14. The system for SIM card configuration distribution according to claim 9,

the local card configuration management service platform is also used for retrying the downloading or installation of the card configuration data and carrying out queue management on a task queue of the downloading or installation.

15. The system for SIM card configuration distribution of claim 9, further comprising:

16. An integrated SIM chip configured by the system of any one of claims 9 to 15, wherein the integrated SIM chip is configured as a card operating system with a SIM card;

17. An integrated SIM chip configured by the system of any one of claims 9 to 15, wherein the integrated SIM chip is configured as a card operating system with a SIM card;

18. An electronic device, comprising:

at least one processor;

a memory coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing the method of any one of claims 1 to 7 by executing the instructions stored by the memory.

19. A computer readable storage medium storing computer instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 7.