WO2018065660A1

WO2018065660A1 - Iot device connectivity provisioning

Info

Publication number: WO2018065660A1
Application number: PCT/FI2016/050697
Authority: WO
Inventors: Peter Schneider
Original assignee: Nokia Technologies Oy
Priority date: 2016-10-07
Filing date: 2016-10-07
Publication date: 2018-04-12
Also published as: CN110073681A; EP3523989A4; EP3523989A1; EP3523989B1; US20200045549A1; US10820265B2; CN110073681B

Abstract

Internet of Things devices are provisioned with programmable subscriber units by arranging a secure end-to-end connection with an IoT Application Server IoTAS with a temporary connection through a mobile network that has been previously informed of the identities of the IoT devices. Through the secure end-to-end connection, the IoTAS provides an IoT device with provisioning information that enables mutual authentication between the mobile network and the IoT device so that the IoT device can be equipped with a programmable subscription that enables the IoT device to normally attach to the mobile network.

Description

IOT DEVICE CONNECTIVITY PROVISIONING

TECHNICAL FIELD

[0001] The present application generally relates to provisioning connectivity for Internet of Things devices.

BACKGROUND

[0002] This section illustrates useful background information without admission of any technique described herein representative of the state of the art.

[0003] Internet of Things (IoT) should radically increase the number of devices that have Internet connectivity. In order for the IoT devices to be able to communicate, e.g. with an IoT application server, each device must be somehow provided with connectivity. Not only do these devices require suitable hardware for wireless communication, for example, but they further require some authorizing information to gain access to the networks. It is notable that wireless networks cannot verify the authorization to use simply by their access to a given connector but unlike wired phone lines typically some signaling is required for authorization.

[0004] In case of wireless local area networks, the authorization is typically provided by use of some static secret information such as a combination of an access point identifier and access code. In case of mobile networks or cellular networks, the authorization procedure is usually more robust and employs some kind of a challenge- response mechanism i.e. non-static secret information.

[0005] The IoT devices can make use of any Internet access available to them, but most easily wireless networks. In case of cellular networks, the IoT devices need to be provided with a subscription module such as a SIM or USIM. Such an authentication can be implemented as a smart card chip based application, but alternatively also programmatically on some secure platform. With a programmatically implemented subscription module, subscriber devices can be coded to be operable with a given mobile network operator. As with a hardwired subscription module, the operator needs to associate each subscription with a payee, i.e. an account from which the use of the subscription is charged. As the IoT devices are expected to be deployed in huge quantities, it appears that plenty of work will be required to provide each IoT device with a hardwired subscription module or programmatic subscription module. SUMMARY

[0006] Various aspects of examples of the invention are set out in the claims.

[0007] According to a first example aspect of the present invention, there is provided a method in equipment of an Internet of Things Application Operator, as defined in appended claim 1.

[0008] According to a second example aspect of the present invention, there is provided a method in equipment of a first network operator, as defined in appended claim 5.

[0009] According to a third example aspect of the present invention, there is provided a method in a first device that is an Internet of Things Device, as defined in appended claim 13.

[0010] According to a fourth example aspect of the present invention, there is provided equipment of an Internet of Things Application Operator, as defined in appended claim 22.

[0011] According to a fifth example aspect of the present invention, there is provided equipment of a first network operator of a first mobile communication network, as defined in appended claim 26.

[0012] According to a sixth example aspect of the present invention, there is provided an Internet of Things Device, as defined in appended claim 34.

[0013] According to a seventh example aspect of the present invention, there is provided a computer program for controlling equipment of an Internet of Things Application Operator, as defined in appended claim 43.

[0014] According to an eighth example aspect of the present invention, there is provided a computer program for controlling equipment of a first network operator of a first mobile communication network, as defined in appended claim 45.

[0015] According to a ninth example aspect of the present invention, there is provided a computer program for controlling an Internet of Things device, as defined in appended claim 47.

[0016] According to a tenth example aspect of the present invention, there is provided a computer readable memory medium storing the computer program of any example aspect.

[0017] The memory medium may comprise a digital data storage such as a data disc or diskette, optical storage, magnetic storage, holographic storage, opto-magnetic storage, phase-change memory, resistive random access memory, magnetic random access memory, solid-electrolyte memory, ferroelectric random access memory, organic memory or polymer memory. The memory medium may be formed into a device without other substantial functions than storing memory or it may be formed as part of a device with other functions, including but not limited to a memory of a computer, a chip set, and a sub assembly of an electronic device. The memory medium may be a non-transitory memory medium.

[0018] Different non-binding example aspects and embodiments of the present invention have been illustrated in the foregoing. The embodiments in the foregoing are used merely to explain selected aspects or steps that may be utilized in implementations of the present invention. Some embodiments may be presented only with reference to certain example aspects of the invention. It should be appreciated that corresponding embodiments may apply to other example aspects as well.

BRIEF DESCRIPTION OF THE DRAWINGS

[0019] For a more complete understanding of example embodiments of the present invention, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:

[0020] Fig. 1 shows an architectural drawing of a system of an example embodiment;

[0021] Fig. 2 shows a block diagram of a machine type device of an example embodiment;

[0022] Fig. 3 shows a block diagram of an Internet of things application server of an example embodiment;

[0023] Fig. 4 shows an event chart of an example embodiment; and

[0024] Fig. 5 shows an event chart of an example embodiment.

DETAILED DESCRIPTON OF THE DRAWINGS

[0025] An example embodiment of the present invention and its potential advantages are understood by referring to Figs. 1 through 5 of the drawings. In this document, like reference signs denote like parts or steps.

[0026] Fig. 1 shows an architectural drawing of a system of an example embodiment. Fig. 1 depicts a plurality of machine type devices, MTD, or Internet of Things devices 110 (such as cars, vending machines, sensors, fridges, bicycles, coffee machines, tags, for example). Fig. 1 shows only few such devices while in practice there can be thousands or even millions of such devices in within the range of one or two mobile communication networks 120. Fig. 1 further illustrates the Internet, public land mobile networks 120 or mobile communication networks and an Internet of Things Application Server, IoTAS 140 of an Internet of Things Application Operator, IoTAO (not shown). Strictly speaking, the IoTAO may be an organization, but the IoTAO may also be used as a shortcut to refer to the equipment of the IoTAO.

[0027] In this context, a mobile communication network or a network in short refers to the entire network of an operator, possibly over more than one countries and / or continents. The devices or MTDs 110 can be within the coverage of either, both, or neither of the networks PLMN 1 and PLMN 2. In sake of demonstration, one of the MTDs 110 is connected with a double line to the IoTAS through the PLMN 1 indicative of a connection formed through the network PLMN 1. This connection and the operation of various parts will be described with more detail after first briefly describing an example of the architecture and of possible structures of the MTDs and of the IoTAS.

[0028] Fig. 2 shows a block diagram of a machine type device 110 of an example embodiment. The block diagram is simplified to show some major parts that are useful for understanding connectivity of the MTD 110. The parts of the MTD 110 that relate to its actual function, be it a sensor, actuator or some other device such as a car or coffee machine, can be implemented in any of the known ways.

[0029] The MTD 110 comprises an input/output circuitry 210 configured to communicate with a data network such as the networks 120. As such, the input/output circuitry of Fig. 2 comprises, for example, a user equipment that is compatible with a 3G, 4G or (future) 5G standard such as the W-CDMA or CDMA-2000. Additionally, the MTD 110 of Fig. 2 comprises a processor 220 configured to control operating of the MTD 110 and an optional user interface 230 in case that the MTD 110 needs a man-machine interface. The MTD 110 further comprises a memory 240 comprising computer software 242 such as one or more programs or generally computer executable program code configured to cause the processor 220 to control the MTD 110 as desired. The MTD 110 further comprises a programmable subscriber module PSM 252 that is here stored by a security module 250. The security module 250 is a secured execution environment the access to which by software and/or hardware attacks is hindered. For example, the security module 250 may comprise any of a dedicated processor, a dedicated memory and a dedicated data bus, configured to allow the security module 250 to operate as in an isolated sandpit. In some other embodiments, the programmable subscriber module 252 is stored in a common memory with the computer software and / or some other data. The programmable subscriber module 252 may be, for example, a Universal Subscriber Identity Module (suited for use with 3G or 4G networks) or a Subscriber Identity Module suited for use with the Global System for Mobile communications, GSM. Thanks to the programmability, the MTD 110 can be adapted to subscribe to any network with which the MTD 110 has hardware compatibility. The programmable subscriber module 252 is provisionable over-the-air so that the MTD 110 can be provided with connectivity after taking into use.

[0030] The processor 220 comprises, for example, any one or more of: a master control unit (MCU); a microprocessor; a digital signal processor (DSP); an application specific integrated circuit (ASIC); a field programmable gate array; and a microcontroller.

[0031] Fig. 3 shows a block diagram of an Internet of things application server, IoTAS 140, of Fig. 1. The IoTAS 140 comprises, similarly with the MTD 110, an input/output circuitry 310, a processor 320, a user interface 330, a memory 340, software 342 and a database 350. In comparison to the MTD 110, the IoTAS is yet more powerful in order to be capable to perform numerous simultaneous server operations.

[0032] It is worth noting at this stage that unless otherwise stated, each element or step disclosed herein can be implemented in one or more parts i.e. using distribution, replication or parallel processing. Likewise, more than one elements or steps can also be combined to one element or step, depending on the implementation.

[0033] The database 350 comprises, for example, a list of all MTDs operated by the IoTAO and identifications of assigned network operators in the networks of whose the MTDs are designed to operate.

[0034] The IoTAS 140 and the networks 120 are configured to be able to establish a secure communication channel for controlling provisioning of the MTDs of the IoTAS 140.

[0035] Fig. 4 shows an event chart of an example embodiment. Fig. 4 presents some major events and signals that may occur.

[0036] Let us assume that a batch of 100 000 MTDs 150 are manufactured and a particular IoT application operator IoTAO is assigned (at some stage, e.g. on import to a given country) as their operator. The identities of these MTDs 150 are delivered 405 to the IoTAS of the IoTAO in question. Notice that we now consider the part of one given IoTAO. There may well be other IoTAOs with their own IoTAS or even in some cases more than one IoTAO may employ same IoTAS, but after step 405, the IoTAS 150 has the MTD identities for the batch that was now assumed to be of 100 000 MTDs. The IoTAS may conveniently store these MTD IDs in its database 350, for example so that they are easily searchable at later stages.

[0037] In one example embodiment, the MTD IDs are International Mobile Equipment Identities i.e. IMEI-codes or IMEI-SV (software version) codes.

[0038] The IoTAS next selects 410 one or more networks for each MTD. In an example embodiment, the IoTAS attempts to select for each MTD networks for the entire geographical area in which the MTDs should be usable. For example, the MTDs may be intended for marketing for global use in which case networks should be selected suitably for global coverage. In another example, the MTDs are intended for only regional or national use so that it suffices to select one or few networks to cover the desired area.

[0039] The IoTAS then delivers 415 the selected MTD identities (MTD IDs) to the selected networks. To this end, the IoTAS employs secure connections with these networks. These secure connections are formed in an example embodiment using dedicated physical channels to which unauthorized parties have no access. Alternatively or additionally, cryptographic measures can be used to secure the communication between the IoTAS and the networks, such as public key encryption that may also conveniently provide proof of authenticity, integrity and confidentiality of communication.

[0040] The network 120 receives a plurality of MTD IDs sent to it by the IoTAS and stores 420 the received MTD IDs as associated with the IoTAS 150. If the network 120 only co-operates with one IoTAS 150, then the association is inherent, otherwise the network 120 can be arranged to store an identifier of the IoTAS in question.

[0041] These steps 405 to 420 prepare the network 120. At some stage, one of the MTDs, a first device or MTD 110 in brief, is taken into use by someone somewhere. The MTD 110 starts up 425 and begins to search for networks. For example, the MTD 110 may start listening to common pilot channels used by base stations of mobile networks in order to find out which networks could provide service to the MTD 110. At this stage, the MTD is not yet provisioned with a subscriber module so that it is unable to perform a normal network registration that mobile phones perform before they can make calls other than emergency calls.

[0042] The MTD detects one or more available networks and then begins an initial attach procedure IAP to attempt obtaining connectivity through a detected network by sending to that network an IAP request that contains the MTD ID. The order in which different networks are selected for attempt can be freely chosen, but in an example embodiment, networks with strongest signal levels are prioritized to reduce communication error risk.

[0043] The network 120 checks 435 whether the MTD ID is assigned to that network for example by searching the MTD ID from its database. If no, then the network 120 would respond by a NACK message at step 450, otherwise the network 120 would next help the MTD 110 to establish initial connectivity with the IoTAS 150. To this end, the network 120 may either build a temporary channel to the IoTAS 150 or simply determine 440 a network address of the IoTAS 150 and supply that address with an ACK message in step 450 to the MTD 110 plus provide initial access for the MTD 110 solely to that address. A secure end-to-end connection can then be requested 455 by the MTD 110 from the IoTAS 150 using its address and subsequently established 460 by the IoTAS 150. This secure end-to-end connection may be established temporarily only for the duration needed to complete the IAP process. During this period, the MTD 110 may lack all other connectivity through the network 120.

[0044] A secure end-to-end connection is established between the IoTAS 150 and the MTD 110 using, for example, application layer security (e.g. shared secret, public key encryption, the procedure used for eNB enrolment (e.g. 3GPP TS 33.310, Clause 9), and a provisioning key Pk is provided from the IoTAS 150 to the MTD 110. The IoTAS 150 obtains the provisioning key Pk e.g. by using a random number generator or by selecting a previously generated provisioning key, or in an example embodiment the IoTAS 150 receives 445 the Pk from the network 120. For example, the network 120 can be configured to generate a provisioning key Pk for each MTD ID received from the IoTAS and responsively send back the generated provisioning keys Pk. In this case, the IoTAS would not need to subsequently inform the network of the provisioning key Pk in step 465 (described in the following).

[0045] Providing connectivity need not mean to support a specific protocol run between the MTD 110 and the IoTAS 150. Between the network 120 and the IoTAS 150, any suitable transport protocol can be used, e.g. Generic Routing Encapsulation, GRE. Protocol data units of the protocol used between MTD 110 and IoTAS 150 can be transported using a network specific protocol (e.g. PDCP in LTE) over the radio interface and then be tunneled to the IoTAS 150 using e.g. GRE.

[0046] After the secure end-to-end connection is established between the MTD 110 and the IoTAS 150, the IoTAS passes the provisioning key Pk to the network over its secure connection with the network 120, 465 (unless the network 120 already is aware of the provisioning key Pk). Then, the network 120 and the MTD 110 both possess the provisioning key Pk and the network 120 can send to the MTD 110 programmable subscriber module data secured with the provisioning key Pk, 470. For example, the programmable subscriber module or some (confidential part) thereof can be encrypted using the provisioning key Pk as an encryption key, as a portion of the encryption key (the MTD ID, for example, or some replay attack protection code initially set by the MTD 110, could be used to form some part of the encryption key). As the provisioning key Pk is sent to from the IoTAS 150 to the MTD 110 and to the network 110 over respective secure connections, third parties should not be able to capture that key from either of such communications (460,465). The MTD 110 can thus ensure that the network is trusted the IoTAS 150 by using the fact that the network 120 knows Pk as a proof that the network 120 was trusted by the IoTAS 150 after the IAP request was sent, assuming that the provisioning key Pk is not static but varied e.g. by randomizing for each IAP. Moreover, the network 120 can use the fact that the MTD knows Pk as a proof that the MTD 110 is trusted by the IoTAS as a valid MTD associated to the IoTAS. If both MTD 110 and network 120 were in possession of the provisioning key, the provisioning of the subscriber module is completed by the MTD 110 updating its security module by storing the received programmable subscriber module, 470. The MTD 110 can then attach 480 to the network 120 using the normal network attach procedure of the network 120 using the updated subscriber module so that normal security features such as encryption of the network connection are used.

[0047] After successful registration to a network 120, the MTD has its connectivity through that network 120 as long as the network continues to service the MTD 110. However, the network 120 might cease to service the MTD 110 for various reasons such as that the IoTAO would have chosen to switch the network 120 used for the MTD 110. Such a network switching could be useful for various reasons such as connectivity or pricing related reasons. In order to maintain control on the MTD 110, the MTD 110 is configured in an embodiment to repeatedly (e.g. periodically and/or in response to some events such as not receiving expected responses from other parties) check its connection with the IoTAS, 485. For example, the MTD 110 can be configured to send a message via the secure end-to-end connection and to verify that it receives an expected response. After a predetermined time without connectivity to the IoTAS, the

MTD 110 performs network switching 490. In an example embodiment, the MTD 110 then re-executes the IAP in an embodiment, i.e. the procedure may resume to step 425. This time, the MTD 110 may prefer other networks than the one it previously used.

[0048] In an example embodiment, the MTD 110 is requested by the IoTAS 150 to perform an inter-network switch. Such a request could be received in response to the repeated connection check of the MTD 110. In this case, the IoTAS 150 need not acquire and maintain network addresses of all the MTDs operated by the IoTAO (or of those MTDs that have acquired network connectivity). Alternatively, the IoTAS can be configured to acquire and maintain the network addresses of the MTDs with network connectivity. Responsive to the inter-network switching request, the MTD 110 could record that it should no longer user the network 120 and restart the IAP process by resuming to step 425 this time intentionally avoiding the network 120. In an example embodiment, the inter-network switching request specifies a new network to use or blacklists one or more networks not to use.

[0049] In an example embodiment, the inter-network switching is accelerated by containing in the inter-network switching facilitating information. The facilitating information may comprise any of a desired new network identification; a provisioning key readily informed to the new network by the IoTAS 150; or new subscriber module data in case that the IoTAS has readily acquired these data from the new network in which case the MTD 110 could update its subscriber module and then register to that network without need to repeat the IAP. In an example embodiment, roaming of the MTDs 110 is facilitated by maintaining by different partnered mobile network operators a joined database of the MTD IDs that contains the MTD IDs together with an indication of their home networks. In this context, roaming may refer to performing the IAP in a visited network that is not the intended home network.

[0050] In this case, the MTD ID appearing in the IAP request could be detected to belong to a roaming partner and the procedure could be continued such that the network 120 could obtain the subscriber module and perform the provisioning on behalf of a home network assigned to the MTD 110. Alternatively, the network 120 could be configured so that in case of an MTD 110 assigned to a roaming partner network, the network 120 would enable connectivity with that network and direct the MTD 110 to request and receive the provisioning 470 from the home network. The secure end-to-end connection with the

IoTAS 455 could then be routed via the home network or formed directly between the

MTD 110 and the IoTAS 455.

[0051] Fig. 5 shows an event chart of an example embodiment. Fig. 5 corresponds to Fig. 4 except that in Fig. 5, the network 120 provides 510 the PSM to the IoTAS 150 and the provisioning key is not exchanged at all between the secure connections (MTD- network, network-IoTAS). That the IoTAS 150 provides the PSM over the secure end-to- end connection indicates to the MTD that the IoTAS 150 trusts the network that acts as the carrier of the secure end-to-end connection. In step 475', the PSM received from the IoTAS 150 is taken into use by the MTD 110.

[0052] In an example embodiment, Internet of Things devices are provisioned with programmable subscriber units by arranging a secure end-to-end connection with an IoT Application Server IoTAS with a temporary connection through a mobile network that has been previously informed of the identities of the IoT devices. Through the secure end-to-end connection, the IoTAS provides an IoT device with provisioning information that enables mutual authentication between the mobile network and the IoT device so that the IoT device can be equipped with a programmable subscription that enables the IoT device to normally attach to the mobile network.

[0053] Without in any way limiting the scope, interpretation, or application of the claims appearing below, a technical effect of one or more of the example embodiments disclosed herein is that IoT devices can be manufactured and deployed without need for physical access for subscription module insertion or adaptation. Another technical effect of one or more of the example embodiments disclosed herein is that delivered IoT devices can be centrally transferred from one network to another. Yet another technical effect of one or more of the example embodiments disclosed herein is that delivered IoT devices can be automatically transferred from one network to another in case of a network failure.

[0054] Embodiments of the present invention may be implemented in software, hardware, application logic or a combination of software, hardware and application logic.

[0055] If desired, the different functions discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the before-described functions may be optional or may be combined.

[0056] Although various aspects of the invention are set out in the independent claims, other aspects of the invention comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims.

[0057] It is also noted herein that while the foregoing describes example embodiments of the invention, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications which may be made without departing from the scope of the present invention as defined in the appended claims.

Claims

1. A method in equipment of an Internet of Things Application Operator, comprising: storing a device identity for each of a plurality of Internet of Things devices including a first device;

establishing a cryptographically secured end-to-end communication connection with the first device through a mobile communication network of a first operator;

obtaining provisioning information associated with the first device, which provisioning information enables equipping the first device with a programmatic subscription module of the mobile communication network; and

providing the provisioning information to the first device over the cryptographically secured end-to-end communication connection.

2. The method of claim 1, further comprising providing the first operator with a list of device identities associated with the application operator.

3. The method of claim 1 or 2, wherein:

the provisioning information comprises a provisioning key for the first device; and the method further comprises:

sending the provisioning key to the first device over the cryptographically secured end-to-end communication connection; and

providing the provisioning key to the first operator to enable the first operator to prove right to provision the first device with a programmatic subscription module and to ensure that the Internet of Things Application Operator is responsible for the first device.

4. The method of claim 1 or 2, wherein:

the provisioning information comprises the programmatic subscription module; and

the obtaining of the provisioning information comprises obtaining the programmatic subscription module from the mobile communication network.

5. A method in equipment of a first network operator of a first mobile communication network, comprising:

receiving an initial attach procedure request from a first device that is an Internet of Things Device provided with a device identifier;

obtaining the device identifier or a derivative thereof from the request;

determining, an Internet of Things Application Operator associated with the first device;

establishing a communication channel between the first device and equipment of the Internet of Things Application Operator associated with the first device; and

transporting over the communication channel from the equipment of the Internet of Things Application Operator to the first device provisioning information associated with the first device, which provisioning information enables equipping the first device with a programmatic subscription module of the mobile communication network.

6. The method of claim 5, wherein:

the provisioning information comprises a provisioning key.

7. The method of claim 6, further comprising:

receiving the provisioning key from the equipment of the Internet of Things Application Operator associated with the first device; and

provisioning the first device with a programmatic subscription module using the provisioning key as a provisioning authenticator configured to show trusted relationship between the network operator and the Internet of Things Application Operator associated with the first device and to ensure that the Internet of Things Application Operator is responsible for the first device.

8. The method of claim 7, wherein the ensuring comprises decrypting the programmatic subscription module using the provisioning key

9. The method of claim 5, wherein the provisioning information comprises the programmatic subscription module.

10. The method of claim 6 or 9, further comprising providing the provisioning information to the equipment of the Internet of Things Application Operator associated with the first device before the establishing of the communication channel between the first device and equipment of the Internet of Things Application Operator associated with the first device.

11. The method of any one of claims 5 to 10, further comprising:

restricting communication, resulting from the initial attach procedure request between the first device and the equipment of the Internet of Things Application Operator to an extent required for mutual authentication and transmission of the provisioning information.

12. The method of claim 11, comprising:

performing the restricting of the communication by allowing transport of data for predetermined time interval or amount of data.

13. A method in a first device that is an Internet of Things Device, comprising:

maintaining a device identifier associated with the first device;

identifying an available mobile communication network, the available mobile communication network being referred to as a first network and being operated by a first network operator;

forming an initial attach procedure request comprising the device identifier or a derivative thereof;

sending the initial attach procedure request to the first network;

checking whether the first network establishes a communication channel between the first device and equipment of an Internet of Things Application Operator associated with the first device within a predetermined duration, and if yes:

establishing, through the first network, a cryptographically secured end- to-end communication connection with equipment of the Internet of Things Application Operator associated with the first device;

receiving a provisioning information over the cryptographically secured end-to-end communication connection from the equipment of the Internet of Things Application Operator associated with the first device; and

obtaining a programmatic subscription module of the mobile communication network using the provisioning information.

14. The method of claim 13, wherein the provisioning information comprises the programmatic subscription module.

15. The method of claim 14, wherein the obtaining of the programmatic subscription module comprises:

obtaining a provisioning key from the provisioning information;

receiving from the first network the programmatic subscription module;

ensuring with the provisioning key that both the first network operator and the first device are trusted by the Internet of Things Application Operator and responsive to an affirmative result of the ensuring, configuring the first device to take in use the programmatic subscription module.

16. The method of claim 15, wherein the ensuring comprises decrypting the programmatic subscription module using the provisioning key.

17. The method of any one of claims 13 to 16, further comprising performing the method of claim 13 as often as necessary until a mobile communication network is found that establishes the communication channel between the first device and the equipment of an Internet of Things Application Operator associated with the first device and from which a validly authenticated provisioning request is subsequently received.

18. The method of any one of claims 13 to 17, further comprising:

attaching to the first network with the programmatic subscriber module and thereafter communicating through the first network; and

after having communicated through the first network, receiving an inter-operator switching request from the Internet of Things Application Operator.

19. The method of claim 18, wherein the inter-operator switching request specifies a new mobile communication network operator to use instead.

20. The method of claim 18, wherein:

the inter-operator switching request further comprises new provisioning information for the new mobile communication network; and

the method further comprises obtaining a programmatic subscription module of the new mobile communication network using the new provisioning information.

21. The method of any one of claims 13 to 17, further comprising:

attaching to the first network with the programmatic subscriber module and thereafter communicating through the first network; detecting failure to proceed communicating through the first network, and responsively performing the method of claim 13 again in order to gain connectivity through another network.

22. Equipment of an Internet of Things Application Operator, comprising:

a data storage configured to store a device identity for each of a plurality of

Internet of Things devices including a first device;

at least one processor configured to cause the equipment to:

establish a cryptographically secured end-to-end communication connection with the first device through a mobile communication network of a first operator;

obtain provisioning information associated with the first device, which provisioning information enables equipping the first device with a programmatic subscription module of the mobile communication network; and

provide the provisioning information to the first device over the cryptographically secured end-to-end communication connection.

23. The equipment of claim 22, the at least one processor being configured to cause the equipment to provide the first operator with a list of device identities associated with the application operator.

24. The equipment of claim 22 or 23,

the provisioning information comprising a provisioning key for the first device; and the at least one processor being configured to:

send the provisioning key to the first device over the cryptographically secured end-to-end communication connection; and

provide the provisioning key to the first operator to enable the first operator to prove right to provision the first device with a programmatic subscription module and to ensure that the Internet of Things Application Operator is responsible for the first device.

25. The equipment of claim 22 or 23, wherein:

the provisioning information comprising the programmatic subscription module; and

26. Equipment of a first network operator of a first mobile communication network, comprising:

a radio interface input configured to receive an initial attach procedure request from a first device that is an Internet of Things Device provided with a device identifier;

at least one processor configured to cause the equipment to:

obtain the device identifier or a derivative thereof from the request; determine an Internet of Things Application Operator associated with the first device;

establish a communication channel between the first device and equipment of the Internet of Things Application Operator associated with the first device; and

transport over the communication channel from the equipment of the

Internet of Things Application Operator to the first device provisioning information associated with the first device, which provisioning information enables equipping the first device with a programmatic subscription module of the mobile communication network.

27. The equipment of claim 26, wherein:

the provisioning information comprises a provisioning key.

28. The equipment of claim 27, the at least one processor being configured to cause the equipment to:

receive the provisioning key from the equipment of the Internet of Things Application Operator associated with the first device; and

provision the first device with a programmatic subscription module using the provisioning key as a provisioning authenticator configured to show trusted relationship between the network operator and the Internet of Things Application Operator associated with the first device and to ensure that the Internet of Things Application Operator is responsible for the first device.

29. The equipment of claim 28, wherein the provisioning information comprises the programmatic subscription module.

30. The equipment of claim 26, wherein the provisioning information comprises the programmatic subscription module.

31. The equipment of claim 27 or 30, the at least one processor being configured to cause the equipment to provide the provisioning information to the equipment of the Internet of Things Application Operator associated with the first device before the establishing of the communication channel between the first device and equipment of the Internet of Things Application Operator associated with the first device.

32. The equipment of any one of claims 26 to 31, the at least one processor being configured to cause the equipment to restrict communication, resulting from the initial attach procedure request between the first device and the equipment of the Internet of Things Application Operator to an extent required for mutual authentication and transmission of the provisioning information.

33. The equipment of claim 32, the at least one processor being configured to cause the equipment to perform the restricting of the communication by allowing transport of data for predetermined time interval or amount of data.

34. An Internet of Things Device referred to as a first device, comprising:

a memory configured to maintain a device identifier associated with the first device;

at least one processor configured to cause the first device to perform a process comprising:

sending the initial attach procedure request to the first network;

establishing, through the first network, a cryptographically secured end-to-end communication connection with equipment of the Internet of Things Application Operator associated with the first device;

receiving a provisioning information over the cryptographically secured end-to-end communication connection from the equipment of the Internet of Things Application Operator associated with the first device; and obtaining a programmatic subscription module of the mobile communication network using the provisioning information.

35. The Internet of Things Device of claim 34, wherein the provisioning information comprises the programmatic subscription module.

36. The Internet of Things Device of claim 35, wherein the obtaining of the programmatic subscription module comprises:

obtaining a provisioning key from the provisioning information;

receiving from the first network the programmatic subscription module;

ensuring with the provisioning key that both the first operator and the first device are trusted by the Internet of Things Application Operator and responsive to an affirmative result of the ensuring, configuring the first device to take in use the programmatic subscription module.

37. The Internet of Things Device of claim 36, wherein the ensuring comprises decrypting the programmatic subscription module using the provisioning key.

38. The Internet of Things Device of any one of claims 34 to 37, the at least one processor being configured to cause the first device to perform the as often as necessary until a mobile communication network is found that establishes the communication channel between the first device and the equipment of an Internet of Things Application Operator associated with the first device and from which a validly authenticated provisioning request is subsequently received.

39. The Internet of Things Device of any one of claims 34 to 38, the at least one processor being configured to cause the first device to perform: attaching to the first network with the programmatic subscriber module and thereafter communicating through the first network; and

40. The Internet of Things Device of claim 39, wherein the inter-operator switching request specifies a new mobile communication network operator to use instead.

41. The Internet of Things Device of claim 40, wherein:

the at least one processor being configured to cause the first device to obtain a programmatic subscription module of the new mobile communication network using the new provisioning information.

42. The Internet of Things Device of any one of claims 34 to 41, the at least one processor being configured to cause the first device to perform:

attaching to the first network with the programmatic subscriber module and thereafter communicating through the first network;

detecting failure to proceed communicating through the first network, and responsively performing the process again in order to gain connectivity through another network.

43. A computer program comprising program code configured to cause an apparatus, when executing the program code, to perform in equipment of an Internet of Things Application Operator:

storing a device identity for each of a plurality of Internet of Things devices including a first device;

44. The computer program of claim 43, wherein the program code is configured to cause the apparatus, when executing the program code, to perform in equipment of an Internet of Things Application Operator the method of any one of claims 1 to 4.

45. A computer program comprising program code configured to cause an apparatus, when executing the program code, to perform in equipment of a first network operator of a first mobile communication network:

obtaining the device identifier or a derivative thereof from the request;

46. The computer program of claim 45 comprising program code configured to cause an apparatus, when executing the program code, to perform in the equipment of the first network operator of the first mobile communication network the method of any one of claims 6 to 12.

47. A computer program comprising program code configured to cause an apparatus, when executing the program code, to perform in a first device that is an Internet of Things Device:

maintaining a device identifier associated with the first device;

forming an initial attach procedure request comprising the device identifier or a derivative thereof; sending the initial attach procedure request to the first network;

48. The computer program of claim 47 comprising program code configured to cause an apparatus, when executing the program code, to perform in the first device the method of any one of claims 15 to 21.

obtaining a provisioning key from the provisioning information;

receiving from the first network the programmatic subscription module;

49. The computer program of any one of claims 43 to 48, wherein the computer program is stored in a non-transitory memory medium.