EP3248405A1

EP3248405A1 - Method and devices for managing subscription profiles on a mobile terminal

Info

Publication number: EP3248405A1
Application number: EP16701247.5A
Authority: EP
Inventors: Ulrich WIMBÖCK
Original assignee: Giesecke and Devrient Mobile Security GmbH
Current assignee: Giesecke and Devrient Mobile Security GmbH
Priority date: 2015-01-20
Filing date: 2016-01-19
Publication date: 2017-11-29
Also published as: WO2016116270A1; DE102015000688A1

Abstract

The invention relates to a method for managing a plurality of subscriptions on a security element of a mobile terminal for logging into a particular mobile radio network and to such a security element. On the security element, which is designed to hold at least one of the plurality of subscription profiles and to be operated therewith, a root container is implemented. The method comprises the following steps: checking if a subscription profile of the plurality of subscription profiles that is to be or has already been introduced into the security element satisfies global management rules, which are stored in the root container; and introducing the subscription profile to be introduced into the security element or activating the subscription profile already introduced into the security element if the subscription profile that is to be or has already been introduced into the security element satisfies the global management rules, which are stored in the root container.

Description

Methods and apparatus for managing

Subscription profiles on a mobile terminal device of the invention

The invention relates to communication via mobile radio networks in

In general, and more particularly to methods and apparatus for

Manage subscription profiles on a mobile device for logging into a mobile network.

Background of the invention

Communicating by means of a mobile terminal, for example a mobile telephone, via a mobile radio network (also referred to as PLMN [Public Land Mobile Network]) operated by a network operator (also referred to as MNO [Mobile Network Operator]) usually requires that subscription authorization data ("subscription credentials") are stored securely on the mobile terminal, which uniquely identify the user of the mobile terminal with respect to the mobile radio network

identify and authenticate. such

Subscription authorization data, for example an IMSI (International

Mobile Subscriber Identity) and an authentication key Ki, are usually part of a so-called subscription profile that in addition to the

Subscription authorization data, for example, may also comprise a file structure and / or application code in which operator-specific cryptoalgorithms are implemented. For security reasons, such subscription profiles are usually deposited on a security element of the mobile terminal, which is present, for example, in the form of an exchangeable SIM or a permanently installed eUICC. From the prior art security elements are known to be loaded on the subscription profiles of different network operators can. However, there is a requirement that the subscription profiles (in particular the subscription profiles of different network operators) are separated from each other by the operating system of the security element, so that it is not possible to access the data of another subscription profile from one subscription profile.

For technical reasons, in these known security elements with multiple subscription profiles usually only one

Subscription profile active. Among other things, this has the consequence that the network operator associated with an inactive subscription profile can not be communicated. Here may be the problem that a network operator is applying a software update for an inactive

Subscription profile is provided, but this can not be installed on the security element due to the lack of communication link.

Therefore, a need exists for improved methods and apparatus for managing subscription profiles on a mobile terminal. Summary of the invention

The above object is solved according to the present invention by the subject matter of the independent claims.

Preferred embodiments of the invention are defined in the dependent claims.

According to a first aspect of the invention, there is provided methods for managing a plurality of subscription profiles on a security element of a mobile terminal. In this case, only one subscription profile of the multiplicity of subscription profiles is always active in order to have an associated subscription profile Mobile network and the others

Subscription profiles of the multiplicity of subscription profiles are inactive. The method according to the first aspect of the invention comprises the following steps: operating the security element with the active subscription profile; and downloading at least one update for at least one inactive subscription profile to the mobile terminal or security element.

Preferably, the step of downloading the at least one update for the at least one inactive subscription profile comprises the step of downloading an update for the active one

Subscription profile.

According to preferred embodiments of the invention, after the download of the at least one update for the at least one inactive subscription profile and the update for the active one

Subscription profile updates the active subscription profile and the at least one update for the at least one inactive

Subscription profile initially held.

Preferably, the at least one update for the at least one inactive subscription profile is maintained on the mobile terminal or security element until the respective at least one inactive subscription profile is activated (and thus the previously active subscription profile is deactivated) and the corresponding update is installed.

According to alternative preferred embodiments of the invention, the at least one update for the at least one inactive Subscription profile as long as on the mobile device or the

Security element is kept until the mobile device is restarted and the corresponding update is installed. Preferably, in this preferred embodiment, the method comprises the further step of checking, after a restart of the mobile terminal, for which of those present on the security element

Subscription profiles an update is available on the mobile terminal or the security element. An advantage of this embodiment is that the installation of the updates, the individual subscription profiles do not have to book in a mobile network.

Preferably, in the step of downloading the at least one update for the at least one inactive subscription profile to the mobile terminal or the security element, the at least one

Updated provided by a background system over an IP communication channel. It is conceivable, for example, for the mobile terminal to be triggered by the user or to be automatically implemented at predefined time intervals by means of the active subscription profile in a system implemented in a background system

Update Service requests if there are updates to the subscription profiles present on the mobile device or security element. This is advantageous since the corresponding

Subscription profile on the mobile device does not have to be active. As the person skilled in the art realizes, in the case of an inactive subscription profile, updating of this subscription profile can generally not take place via the mobile radio network belonging to this subscription profile. The invention thus provides that updates can be made for each subscription profile on the security element, regardless of which of the subscription profiles is currently active. According to a second aspect of the invention there is provided a security element for a mobile terminal for communicating via a mobile radio network, the security element being arranged to manage at least two subscription profiles according to a method according to the first aspect of the invention.

In a security element according to the invention is

for example, a designed in hardware disk. The security element is arranged, for example, as a firmly integrated component in a terminal, wherein it can not be removed either in the form of the terminal, for example as

Subscriber Identification Module, M2M Module, Co-Processor, Trusted Base, Trusted Platform Module.

Alternatively, the security element is connected as a removable module to the mobile terminal, for example as a smart card, in particular as subscriber identification module, smart card, mass storage card, USB token, multimedia card, Secure MicroSD card, mobile network token, e.g. a UMTS surf stick and / or as an electronic identity document, for example as an electronic identity card or

Passport with machine-readable identification data of a person stored in a storage area.

According to another alternative, the security element may be implemented as a combination of hardware and software components in one

trained trusted part of an operating system of the terminal which is also known to the person skilled in the art as a trusted execution environment (TEE). The security element can then be designed, for example, within such a secure runtime environment in the form of programs running therein.

The security element can basically be a computer reduced in size and in terms of resources, which has a processor and at least one interface for communication with an external device. He often has no or only a rudimentary own user data output. In particular, the security element has a data memory for storing data, information, files and / or applications with associated variables, wherein areas of the data memory may be volatile or non-volatile. Of the

Nonvolatile data memory can in particular be permanent, for example as a read-only memory, short ROM or semi-permanent, for example as an Electrically Erasable programmable read only memory, short EEPROM, flash memory, Ferroelectric Random Access Memory, short FRAM or FeRAM memory or magnetoresistive random access memory, in short MRAM memory.

According to a third aspect of the invention, there is provided a mobile terminal for communicating via a mobile radio network having a security element according to the second aspect of the invention. The good order, it should be mentioned, that it is available

Data connection via another channel, such as. WLAN and / or Bluetooth, the operation of the security element with an active

Subscription profile is not mandatory. Instead, the other channel can be used to update for the least an inactive subscription profile on the mobile device or the

Download security element.

As those skilled in the art will recognize, the preferred embodiments described above may be advantageously implemented within the various aspects of the present invention.

Other features, advantages and objects of the invention will be apparent from the following detailed description of several embodiments and alternative embodiments. Reference is made to the drawings, in which:

1 is a schematic representation of a communication system with a security element in the form of an eUICC as part of a

Mobile phones that have different aspects of the present

Invention illustrated, and

Fig. 2 is a schematic representation of a preferred sequence during

Managing Subscription Profiles on the Security Element of FIG. 1.

Figure 1 shows a schematic representation of the components of a

Communication system 10 and some of

Communication links between these components illustrating different aspects of the present invention. Although in the following detailed description reference will be made to a "mobile" terminal, those skilled in the art will appreciate that the present invention may be advantageously implemented in connection with any type of terminal configured to be remotely controlled via a mobile or mobile terminal Cellular communication network to communicate, including with devices whose location is virtually unchanged. In other words, the term "mobile" as used herein refers to the ability of the terminal to communicate over a mobile or cellular communication network, including IP-based communication networks.

An exemplary mobile terminal 12 is shown in FIG. 1, which preferably includes a secure element 14 for securely storing and processing data that uniquely identifies, for example, the mobile terminal 12 and / or its user. As indicated in FIG. 1, the mobile terminal 12 is preferably a mobile telephone, a smartphone or a similar device. However, those skilled in the art will recognize that the mobile

Terminal 12 according to the present invention may also be implemented in the form of other devices adapted to communicate over a cellular network, such as a tablet computer, a notebook, a TV system, a set-top box Vending machine, a motor vehicle, a security camera, a sensor device and the like.

According to preferred embodiments of the invention that is

Security element 14 as an eUICC (embedded universal integrated circuit card) with a SIM application implemented thereon

designed, i. as a security element that is an integral part of the mobile terminal 12 and in a mobile network for the

unique and secure identification of the user or subscriber and used for the provision of different functions and value-added services. Alternatively, the security element 14 may be implemented as a Universal Integrated Circuit Card (UICC) or Subscriber Identity (SIM) card Modules), which is known in the art as one of the currently most commonly used forms of a security element. However, those skilled in the art will recognize that other types of

Security elements, referred to as USIM, R-UIM, ISIM, and the like, depending on the generation and type of underlying cellular standard, are also encompassed by the present invention.

According to further preferred embodiments of the invention, the security element 14 as a combination of hardware and

Software components in a trusted part of a

Operating system of a central processing unit of the mobile terminal 12 may be formed, which is known in the art as a trusted execution environment ("TEE"). The security element 14 can then, for example, within such a secured

Runtime environment of the mobile terminal 12 in the form of running therein programs, so-called Trustlets® be formed.

The mobile terminal 12 is configured to communicate via the air interface with a mobile radio network (also referred to as "mobile radio network" or "Public Land Mobile Network" [PLMN] for short) of a mobile radio system 20. As is known to those skilled in the art, the mobile terminal 12 may for this purpose comprise a GSM module (not shown in FIG. 1) with an antenna for receiving and transmitting radio waves.

In Figure 1, the mobile networks 30 and 40 are shown by way of example. It is conceivable that the mobile network 30 from a first

Mobile network operator (also referred to as "Mobile Network Operator" or MNO) and the second mobile network 40 from a second Mobile network operator is operated. According to preferred

Embodiments of the invention, the mobile network 30 and / or the mobile network 40 according to the GSM standard ("Global Standard for Mobile Communications") operated.

Hereinafter, preferred embodiments of the invention will be described in connection with mobile radio networks 30, 40 as part of the

Mobile radio system 20 described in accordance with the GSM standard, which is specified in a variety of ETSI specifications. However, those skilled in the art will recognize that the present invention may also be used to advantage in connection with other mobile networks. Such networks include third generation (3GPP) cellular networks, such as UMTS (Universal Mobile Telecommunications System), fourth generation (4G) cellular networks, such as LTE (Long Term Evolution), and others

Mobile networks, such as CDMA and the like.

As is known to the person skilled in the art, a mobile radio network or PLMN constructed according to the GSM standard generally comprises a BSS (Base Station Subsystem), which consists of a multiplicity of BTSs ("Base Transceiver Station"), the respective radio cells of the PLMN and are connected to a BSC ("Base Station Controller"). Typically, the BSC is one of a plurality of BSCs that communicate with a common MSC ("Mobile Switching Center"). Often, a local database called the Visitor Location Register (VLR) is part of the MSC to hold information about the mobile subscribers currently located in the radio cells served by an MSC (ie, the one covered by an MSC Area). The MSC provides essentially the same functionality as a public-switched telephone network (PSTN) and is available in the US Pat Communication with a HLR ("Home Location Register"), which is the primary database of the PLMN, in which information for the registration or authentication of mobile subscribers are stored. For this purpose, the HLR usually has access to an AUC

("Authentication Center"). As is known to those skilled in the art, the communication links between the components of a PLMN described above may be based on proprietary and / or open standards. The protocols used may be, for example, SS7 or IP based. Like the network components as a separate or

summarized units are formed and how the interfaces between these components are formed, is a matter for the MNO, so that the above description is to be understood as exemplary only.

Those skilled in the art will recognize that, although the above-described functional units of a conventional cellular network according to the GSM standard may have different names in other or future cellular standards, the underlying principles in the

Are substantially the same and therefore they are also included by the invention.

For the sake of clarity, those described above

Components of a mobile network only the following shown in the schematic representation of Figure 1: an exemplary BTS 32 and an HLR 34 for the mobile network 30 and an exemplary BTS 42 and an HLR 44 for the mobile network 40. As can be seen in Figure 1, stand the mobile network 30 and the mobile network 40 at least temporarily in communication with a background system 50,

preferably in the form of a suitably configured server, as described in detail below. The mobile network 30 and / or The mobile radio network 40 may have, for example, in each case an SMS-C ("Short Message Service Center") for storing, forwarding, converting and delivering SMS messages, among other further known to those skilled functional units, by means of which, for example, data from

Background system 50 can be transmitted to the security element 14 of the mobile terminal 12.

As can be seen from the enlarged view of the security element 14 in FIG. 1, the security element 14 preferably comprises a central processing unit or central processing unit (CPU) 15. Preferably, the processor 15 is equipped such that applications are provided processor 15, such as a subscription management applet (SM applet), which preferably provides at least some of the subscription profile management features on the security element 14, as described below

In connection with the figure 2 is described in detail. Preferably, the subscription management application 16 is implemented in the form of a Java applet. To provide an appropriate

Execution environment for the SM applet 16 may preferably be a secure operating system (not shown in Figure 1) implemented on the processor 15.

The security element 14 preferably further comprises a storage unit 17, preferably as a non-volatile, rewritable

Storage unit, e.g. in the form of a flash memory. The memory unit 17 is configured to have a plurality of

Subscription profiles include, for example, in FIG

illustrated subscription profiles SPl and SP2. Preferably contain Subscription profile SP1 and the subscription profile Data enabling the security element 14 and the mobile terminal 12 to log into and communicate via the mobile network 30 and the mobile network 40 respectively, ie, data such as subscription credentials, an MNO -specific

Authentication algorithm and the like.

With further reference to FIG. 2, a preferred embodiment of a method for managing the subscription profiles SP1 and SP2 on the mobile terminal 12 or security element 14 is described below.

Step Sl of Figure 2 shows the normal operation of the mobile terminal 12 and the security element 14, in which the mobile terminal 12 communicates via the mobile network 30 by means of the active subscription profile SP1. As is known to the person skilled in the art, this generally requires first of all that the mobile terminal 12 or the security element 14 is authenticated with respect to the mobile radio network 30, in particular with those in the

Subscription authorization data contained in the subscription profile SP1, for example an IMSI and / or an authentication key Ki. It is conceivable that the subscription profile SP1 is already part of the

Production and / or personalization of the mobile terminal 12 and / or the security element 14 in the storage unit 17 of the

Security element 14 has been deposited. According to one

variant according to the invention it is also conceivable that the

Subscription profile SP1 OTA ("over-the-air") is provided on the security element 14 when the mobile terminal device 12 and the

Security element 14 already in the field. In this variant, it is conceivable that in the production or personalization only a preliminary Subscription ("provisional subscription") is deposited on the security element 14, which allows the user of the mobile terminal 12 to install a complete subscription, for example, the subscription profile SP1, on the security element 14.

As soon as the security element 14 with the subscription profile SP1 has logged into the mobile radio network or PLMN 30, it can communicate with the background system 50 via the mobile radio system 30, for example. As shown in step S2 of FIG

Background system 50, which preferably includes a subscription management server (SM-Server), configured to receive updates from

Subscription profiles.

In step S3 of FIG. 2, the mobile terminal 12 preferably makes a request to the background system 50 via the mobile radio network 30 as to whether updates of the subscription profiles SP1 and / or SP2 present on the mobile terminal 12 are present in the background system 50. If at least one update of one of the subscription profiles SP1 or SP2 is present, it is downloaded from the background system in step S4 of FIG. 2 to the mobile terminal 12 or the security element 14. In the exemplary representation of FIG. 2, both an update for the active subscription profile SP1 and an update for the inactive subscription profile SP2 are downloaded in step S4 of FIG. Preferably, the communication between the

Background system 50 and the mobile terminal 12 while on the

Basis of the active subscription profile SP1 over the mobile radio network 30. According to alternative embodiments of the invention, it is conceivable that another communication channel between the mobile terminal 12 and the 2 and / or downloading the updates used in step S4 of FIG. 2, eg a WiFi network. The background system 50 preferably contains information about which subscription profiles are present on the mobile terminal 12. According to an alternative embodiment, the mobile terminal 12 transmits information for the request in step S3 of FIG

Identification of the device 12 stored on the mobile terminal

Subskriptionsprofile. Preferably, this information further contains the version number, i. the update status of a respective subscription profile.

After, in step S4 of FIG. 2, the updating of the

Subscription profile SPl and the update of the subscription profile SP2 on the mobile terminal 12 and the security element 14th

have been downloaded, the update of the active subscription profile SPl on the mobile terminal 12 and the security element 14 is performed in step S5. In order not to disturb the ongoing operation of the active subscription profile SP1, the inactive subscription profile SP2 is not updated at this time, but instead the one downloaded from the background system 50 in step S3

Updating the subscription profile SP2 stored in the mobile terminal device 12 and / or the security element 14 for updating at a later date or held.

According to preferred embodiments of the invention, the

Updating the subscription profile SP2 made only when the subscription profile SP2 is activated (see step S6 of Figure 2). After the subscription profile SP2 has been activated and updated in step S6 of FIG. 2, which according to preferred embodiments of the invention may require a restart of the mobile terminal, the mobile terminal 12 can communicate via the mobile network 40 by means of the updated subscription profile SP2.

Claims

Patent claims

A method for managing a plurality of subscription profiles (SP1, SP2) on a security element (14) of a mobile terminal (12), wherein only one subscription profile of the plurality of

Subscription profiles (SP1, SP2) is active in order to be able to communicate via an associated mobile radio network (30, 40) and the other subscription profiles of the plurality of subscription profiles (SP1, SP2) are inactive, the method comprising the following steps:

operating the security element (14) with the active one

Subscription profile (SPl); and

downloading at least one update for at least one inactive subscription profile (SP2) to the mobile terminal (12) or the security element (14), wherein the step of downloading the

at least one update for the at least one inactive

Subscription profile (SP2) the step of downloading a

Update for the active subscription profile (SPl).

2. The method of claim 1, wherein after downloading the at least one update for the at least one inactive

Subscription profile (SP2) and the update for the active

Subscription profile (SPL), the active subscription profile (SPL) is updated and the at least one update for the at least one inactive subscription profile (SP2) is initially maintained.

3. The method of claim 1 or 2, wherein the at least one

Updating for the at least one inactive subscription profile (SP2) as long as on the mobile terminal (12) or the security element (14) held until the respective at least one inactive - 2 -

Subscription profile (SP2) is activated and the corresponding

Update is installed.

4. The method of claim 1, wherein the at least one update for the at least one inactive

Subscription profile (SP2) as long as on the mobile terminal (12) or the security element (14) is held until the mobile terminal (12) is restarted and the corresponding update is installed.

The method of claim 4, wherein the method further comprises the step of verifying after a reboot of the mobile terminal (12) for which those present on the security element (14)

Subscription Profiles (SP1, SP2) an update is available.

The method of any one of the preceding claims, wherein in the step of downloading the at least one update for the at least one inactive subscription profile (SP2) to the mobile terminal (12) or the security element (14) the at least one update from a background system via an IP -Kommunikationskanal

provided.

7. security element (14) for a mobile terminal (12) for

Communicating over a mobile network (30, 40), the

Security element (14) is designed to at least two

Subscription profiles according to a method according to any one of the preceding claims to manage. - 3 -

8. Security element (14) according to claim 7, wherein the security element (14) is a SIM, eUICC / UICC or M2M module.

9. Mobile terminal (12) for communicating via a

Mobile radio network (30, 40) with a security element (14) according to claims 7 or 8.