WO2021223278A1 - Sim卡配置分发方法及系统 - Google Patents

Sim卡配置分发方法及系统 Download PDF

Info

Publication number
WO2021223278A1
WO2021223278A1 PCT/CN2020/093991 CN2020093991W WO2021223278A1 WO 2021223278 A1 WO2021223278 A1 WO 2021223278A1 CN 2020093991 W CN2020093991 W CN 2020093991W WO 2021223278 A1 WO2021223278 A1 WO 2021223278A1
Authority
WO
WIPO (PCT)
Prior art keywords
card
data
sim
card configuration
sim card
Prior art date
Application number
PCT/CN2020/093991
Other languages
English (en)
French (fr)
Inventor
金辉
陈晓波
Original Assignee
深圳杰睿联科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳杰睿联科技有限公司 filed Critical 深圳杰睿联科技有限公司
Publication of WO2021223278A1 publication Critical patent/WO2021223278A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/183—Processing at user equipment or user record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/42—Security arrangements using identity modules using virtual identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data

Definitions

  • the present invention relates to the field of communication technology, in particular to a SIM card configuration distribution method, a SIM card configuration batch distribution method, a SIM card configuration distribution system, a SIM card configuration distribution system, and an integrated type SIM chip, an electronic device, and a computer-readable storage medium.
  • the input file data input_file (including profile information) is transmitted to the card vendor in offline encrypted form.
  • the card vendor prepares the card hardware and operating system in advance according to the specific requirements of the operator and the customer, and writes the profile to each card on the production line. Individuation is finally being packaged in different specifications and sent back to the operator by express delivery, with the output file data output_file attached, indicating the card making data corresponding to each card. Finally, the operator will express the card to the end customer. In some cases, the card company can also directly send express to the customer.
  • third-party service providers act as integrators in the entire chain. Customers only connect with service providers and block operators. Customers also have a certain degree of flexibility. They only need to care about profile, traffic order, etc., and they can also choose different operators.
  • the service provider will get the profile from the operator in advance and put it on its own server, so that when the customer needs the corresponding profile, it can be directly written locally or downloaded to the customer's device remotely.
  • the service provider needs to integrate the vSIM software with the customer's equipment, and does not require a physical physical card to implement the SIM function. This solution can reduce the cost of physical physical cards and customers' SIM distribution and management costs, but the biggest problem is that the security is unreliable.
  • the server, air transmission, and terminal security are all private implementations, and security is the biggest hidden danger.
  • the standard eSIM solution proposed by GSMA is divided into two types, consumer-level and machine-to-machine-level M2M. Consumers need to bring user interface, manual participation, and support dynamic downloading of profiles.
  • the M2M version needs to support SMS and BIP communication, and you can actively push push from the server to download the profile.
  • SMDP+ is owned by the operator and stores the profile securely.
  • the LPA is integrated in the eUICC or device to assist the eUICC card to download and manage the profile. All communication protocols in this solution strictly abide by the RSP protocol, fully consider the security mechanisms of the server, over-the-air transmission, and terminal, and ensure the interoperability between various components, and increase the certificate system.
  • eUICC card costs 1.5 US dollars, and operators also need 100,000 to 1 million US dollars to deploy server-side systems. And most of the situations are not practical in IoT scenarios. One is that the initial network connection is required, the other is that it needs to support SMS and BIP, and the other is that the profile is very large. If the network using the device is LWPA, there will be insufficient bandwidth. Finally, the cost of eUICC cards is very high, and physical physical cards are still needed.
  • nuSIM is a security protocol proposed by DeutscheInstitut, based on the eSIM specification, an efficient, low-cost, and secure profile distribution solution for Low-cost devices, especially NB-IoT scenarios.
  • the newly-added DP server has optimized the profile size, supports batch download, and improves the efficiency of the production line.
  • LA is directly implemented on the PC of the production line and downloads the profile with the help of the network environment of the production line PC.
  • the security requirements of the terminal are reduced, and the security environment on the device, such as the security module SE, TEE, etc., can be used. No physical physical card is required, and the SIM function is directly integrated into the chip device.
  • the purpose of the present invention is to provide a SIM card configuration distribution method and system.
  • an embodiment of the present invention provides a SIM card configuration distribution method, which is characterized in that the SIM card configuration distribution method includes:
  • the card configuration data is acquired and written to the chip module or a terminal device integrating the chip module.
  • the writing the security configuration data corresponding to the SIM card to the card operating system of the chip module includes:
  • the personalized data includes a unique identification code
  • the security data includes a certificate and a corresponding key
  • the corresponding key Including public key and private key.
  • the certificate includes a card vendor certificate and a card vendor eUICC certificate, the card vendor certificate is issued through a mobile operator platform or self-signed, and the unique identification code is consistent with the issuer of the card vendor eUICC certificate.
  • the receiving allocation code data corresponding to the card configuration data of the SIM card includes:
  • the distribution code data is provided through the subscription management data platform.
  • the acquiring and writing the card configuration data to the chip module or the terminal device integrating the chip module through the distribution code data includes:
  • writing the card configuration data to the chip module is executed, and the card configuration data is installed in the card operating system of the chip module.
  • the SIM card configuration distribution method further includes at least one of the following:
  • the embodiment of the present invention provides a method for batch distribution of SIM card configuration, and the method for batch distribution of SIM card configuration includes:
  • the card configuration data is obtained in batches and written in batches to the chip module or a terminal device integrating the chip module.
  • the embodiment of the present invention provides a SIM card configuration distribution system, and the SIM card configuration distribution system includes:
  • Module integration module used to integrate the card operating system of the SIM card in the chip module
  • the communication security module is used to write security configuration data corresponding to the SIM card to the card operating system of the chip module;
  • a local card configuration management module for receiving allocation code data corresponding to the card configuration data of the SIM card
  • the local card configuration management module is also used to obtain and write the card configuration data to the chip module or a terminal device integrating the chip module through the distribution code data.
  • the embodiment of the present invention provides a system for SIM card configuration distribution, which includes:
  • Module integration platform used to integrate the card operating system of the SIM card with the chip module
  • the module integration platform is used to write security configuration data corresponding to the SIM card to the card operating system of the chip module;
  • the mobile operator platform is used to provide download instructions to the subscription management data platform
  • the local card configuration management service platform is used to run on the upper computer and receive the distribution code data issued by the subscription management data platform;
  • the local card configuration management service platform is used to load and parse the issued distribution code data, and write and install the card configuration data corresponding to the issued distribution code data to the card operation of the chip module system.
  • the mobile operator platform is used to provide a card vendor certificate in the security configuration data and issue the card vendor certificate to the module integration platform.
  • the module integration platform is specifically configured to write personalized data and security data corresponding to the SIM card to the chip module, wherein the personalized data includes a unique identification code, and the security
  • the data includes a certificate and a corresponding key, and the corresponding key includes a public key and a private key.
  • the module integration platform is specifically configured to self-sign and issue the unique identification code and the card vendor eUICC certificate.
  • the local card configuration management service platform is also used to report the installation result of the card configuration data to the subscription management data platform.
  • the local card configuration management service platform is also used to retry the download or installation of the card configuration data, and to perform queue management on the task queue of the download or installation.
  • the system also includes:
  • the terminal device is integrated with the chip module, which is used to activate the card configuration data and maintain the communication between the chip module and the modulation module at startup.
  • the embodiment of the present invention provides an integrated SIM chip configured through the aforementioned system, where the integrated SIM chip is configured as a card operating system with a SIM card;
  • the integrated SIM chip includes: a storage medium written with card configuration data encrypted by a secure key library and a key of the card configuration data derived;
  • the card configuration data and the derived key of the card configuration data are obtained from a local card configuration management service platform through a first encrypted connection, wherein:
  • the local card configuration management service platform receives the key of the card configuration data generated and derived by the key server through a second encrypted connection, and the local card configuration management service platform also forwards subscription management through the first encrypted connection A request or response between the data platform and the integrated SIM chip.
  • the embodiment of the present invention provides an integrated SIM chip configured through the aforementioned system, where the integrated SIM chip is configured as a card operating system with a SIM card;
  • the card operating system is configured to run in the trusted execution environment of the integrated SIM chip
  • the integrated SIM chip includes: a storage medium, and the storage medium is in the trusted execution environment;
  • the storage medium is written with card configuration data of the SIM card, and the card configuration data is obtained from a local card configuration management service platform through a third encrypted connection, wherein the local card configuration management service platform also passes through the The third encrypted connection forwards the request or response between the subscription management data platform and the integrated SIM chip.
  • an electronic device including:
  • At least one processor At least one processor
  • a memory connected to the at least one processor
  • the memory stores instructions that can be executed by the at least one processor, the at least one processor executes the instructions stored in the memory, and the at least one processor executes the instructions stored in the memory to implement the foregoing Methods.
  • an embodiment of the present invention provides a computer-readable storage medium that stores computer instructions, and when the computer instructions run on a computer, the computer executes the aforementioned method.
  • Fig. 1 is a schematic diagram of main modules of an exemplary system according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of the main interaction flow of an exemplary system according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of main modules of an exemplary system according to an embodiment of the present invention.
  • Fig. 4 is a schematic diagram of a main interaction process of an exemplary system according to an embodiment of the present invention.
  • SIM Subscriber identity module
  • identity authentication module is a kind of universal integrated circuit card, and its function is to authenticate legitimate users of the operator's network through this module.
  • Profile Card configuration data, a series of data and applications stored in ordinary SIM cards and eUICC cards.
  • IoT Internet of Things
  • NB-IoT Narrowband Internet of Things
  • Narrowband Internet of Things mainly suitable for fixed location, ultra-low power consumption, and application scenarios that are not particularly sensitive to network bandwidth and delay, such as water meters, electricity meters, manhole covers and other equipment.
  • eMTC enhanced machine-type communication, advanced communication between devices, mainly suitable for location movement, low power consumption, certain requirements for network bandwidth and delay, but no high consumer level requirements, suitable for trackers in IoT scenarios, Scenes such as locator, smart city, smart logistics, etc.
  • LPWA Low power wide area, low-power wide area connection scenarios, especially NB-IoT and eMTC.
  • 2G Second generation, the second generation of communication technology.
  • UICC Universal Integrated Circuit Card
  • universal integrated circuit card including communication SIM card, financial bank card, bus card, etc.
  • eUICC embedded UICC, a pluggable or embedded universal integrated circuit card, usually refers to an eSIM card, which supports remote and local management of the Profile in a secure manner.
  • EID eUICC ID, the unique identifier of the eUICC card.
  • LPA Local Profile Assistant, local Profile assistant, functions include auxiliary Profile download, Profile management (Profile enable, Profile close, Profile delete, Profile information query), provide Profile management interface.
  • PC LPA or LA or LPA The local card configuration management service platform, the LPA software running on the PC computer, expands on the basis of the original LPA, adds support for the serial port, USB and other connections and device data transmission functions, and supports simultaneous connections Multiple devices, supporting simultaneous triggering of the profile download function of multiple devices at the same time, is an important component in this application.
  • SMDP+ (or DP, DP+ for short): Subscription Manager Data Preparation+, subscription management data preparation server (or subscription management data platform), the main function is to prepare the profile, securely encrypt, store and allocate the profile to the specified EID. By binding an encrypted profile, it can be safely delivered to eUICC through LPA.
  • TEE Trust Execution Environment is a secure isolation environment designed based on the Arm TrustZone architecture. It is used for the storage and execution environment of secure applications and secure data, and is isolated from the open environment of external systems. Most of the existing consumer devices and IoT devices such as Qualcomm, MTK, and Unisoc chips support this function. Common application scenarios are fingerprint payment, face recognition, etc.
  • CA Client Application, the client application in the TEE scenario, running on the REE side, responsible for the communication and data exchange and forwarding between the REE and the TA in the TEE.
  • TA Trusted Application, a trusted application in the TEE scenario. It runs inside the TEE and is a secure application that performs operations and calculations on secure data. The SIM application in this document will run inside the TEE as a secure application.
  • REE Rich Execution Environment, rich execution environment, generally a relatively open and general operating system, such as Android, iOS, Linux, etc.
  • Modem Chip A modem chip that provides communication capabilities between terminal equipment and base stations. SoC: System on Chip, this is a technical concept shared between consumer devices and some IoT devices. If the chip is not only used as a modem, but also as a developer and user for business application development, it can be called It is an integrated SoC. At present, most Android and iOS devices are like this, and so are most 4G IoT devices. In a single NB scenario, many of them only serve as modem communication chip functions, not as business application chips. The SoC referred to here is integrated, providing both communication chip functions and business application chip functions.
  • the iSIM of the present invention an integrated SIM chip with complete SIM functions implemented on a chip.
  • TEEiSIM (or TEE SIM) of the present invention an integrated SIM chip with complete SIM functions implemented on a chip with a trusted execution environment.
  • SAS-UP Security Accreditation Scheme-UICC Production, strictly defines, regulates, and reviews the unit, process, key and certificate management of UICC cards to ensure that the keys and certificates of UICC cards are personalized, and the profile is written Safety.
  • MNO Mobile Network Operator
  • mobile operators platforms
  • mobile network services including voice, SMS, data, etc.
  • GSMA GSM Association. International Telecommunication Union, the main participants are operators, card vendors, terminal equipment manufacturers, etc., responsible for the overall technical standard specification and unified coordination related to communications, profile, core network and other fields. SMS: Operator's short message service.
  • BIP Independent transmission protocol, closely related to the new generation of STK--------USAT. To put it simply, it is to increase the data transmission rate and support the USIM card to communicate with the remote server through the TCP/IP protocol. It is the data transmission protocol used when downloading what users need directly through the value-added applications in USAT.
  • BP Baseband Processor. Baseband processor. SKB: Secure Key Box. A third-party security environment service.
  • DM Equipment manufacturer. OEM: Equipment manufacturer. ODM: Solution provider.
  • Module Module, module. Chip/Chipset: Chip.
  • Device terminal equipment or equipment.
  • SW short for software, software.
  • HW short for hardware, hardware.
  • NVM Non-Volatile Memory, non-volatile memory (device).
  • RAM RandomAccessMemory, random access memory, also known as main memory, memory.
  • Secure Boot a secure boot mechanism to protect the integrity of the device's power-on verification and the security of permissions.
  • AES Advanced Encryption Standard, advanced encryption standard algorithm.
  • ECKA Elliptic-curve cryptography (ECC) Key Agreement, a key agreement algorithm based on ECC elliptic curve.
  • SCP03t Asymmetric Secure Channel Protocol
  • SCP03t is an extended version of the secure data transmission channel established based on the SCP03 protocol. It is used in the eSIM standard specification for profile encryption and decryption and segmented transmission to verify integrity.
  • AT is Attention, the AT command set is from terminal equipment (Terminal Equipment, TE) or data terminal equipment (Data Terminal Equipment, DTE) to terminal adapter (Terminal Adapter, TA) or data circuit terminal equipment (Data Circuit Terminal Equipment, DCE) AT commands are sent through TA and TE to control the functions of the mobile station (Mobile Station, MS) and interact with GSM network services. Users can use AT commands to make calls, text messages, phonebooks, data services, and faxes. For the control of other aspects, embedded modules often use this AT command as the communication between the external main control chip and the Modem module.
  • UART Universal Asynchronous Receiver/Transmitter, a universal serial communication protocol, used as a common communication protocol for devices and external computers such as PC computers.
  • ES2+/ES8+/ES9+ The data interaction process of the eSIM standard protocol defined by GSMA.
  • COS Card Operating System, card operating system, currently there are ISO, Oracle Java Card, GlobalPlatform, 3GPP and ETSI and other types.
  • CERT or Crt(s) certificate.
  • EUM eUICC Manufacturer, card merchant.
  • CI Certificate Issuer, certificate issuer (or system).
  • RSP Remote SIM provisioning, remote SIM card configuration.
  • AC Activation Code
  • activation code including the profile download address and corresponding identification information, which can be downloaded from LPA to SMDP+.
  • the distribution code data of the present invention can have a profile data package (such as an Excel table format data package) and download address, etc., and the data package is more streamlined than the Profile native data package, such as reducing unnecessary third parties Subscription service applications and reduced applications for rewriting and updating Profile, etc.
  • a profile data package such as an Excel table format data package
  • download address etc.
  • the data package is more streamlined than the Profile native data package, such as reducing unnecessary third parties Subscription service applications and reduced applications for rewriting and updating Profile, etc.
  • the SIM is fully integrated in the device, and the existing security environment, hardware and software characteristics of the device can be fully utilized.
  • the present invention can provide a low-cost, efficient, and moderately secure integrated SIM product that supports the pre-delivery
  • the profile is delivered and safely written to the device. Once the device leaves the factory, the profile that has been delivered can be used by default. It is the final product and technical form to ensure the safety and use of the entire profile's life cycle. It is prominently reflected in the field of low-cost equipment, focusing on LPWA, 2G, etc., covering industrial applications such as water meters, electricity meters, locators, trackers, smart cities, and smart logistics.
  • the embodiment of the present invention provides a system for SIM card configuration distribution, and the system includes:
  • the module integration platform (or chip module platform or Module) is used to integrate the card operating system of the SIM card with the chip module.
  • the chip module is a physical chip that combines software and hardware, and requires the card operating system to adapt to the chip hardware, and It can be executed on the chip, so that the storage medium of the chip can be written into external input data such as card configuration data;
  • the module integration platform is used to write security configuration data corresponding to the SIM card to the card operating system of the chip module;
  • the subscription management data platform (or SMDP+) is used to create the card configuration data of the SIM card and the distribution code data corresponding to the card configuration data of the SIM card;
  • the mobile operator platform (or MNO) is used to provide download instructions to the subscription management data platform;
  • the local card configuration management service platform (or LA) is used to run on the upper computer (or application module installation platform) and receive the distribution code data issued by the subscription management data platform;
  • the local card configuration management service platform is used to load and parse the issued distribution code data, and write and install the card configuration data corresponding to the issued distribution code data to the card operation of the chip module system.
  • the embodiment of the present invention also provides a SIM card configuration distribution method or a SIM card configuration batch distribution method.
  • the distribution method specifically includes the following steps.
  • COS adapts and integrates the chip, chip general agent, and module into the corresponding SW, and then produces the corresponding chip and module;
  • the EUM certificate can be issued by the MNO or self-signed depending on the situation, and then use EUM to issue batches of eUICC certificates, EID and other information, and ensure the uniqueness of the EID (under the same CI system);
  • the MNO imports the corresponding Profile in DP+ according to the existing business process and provides a batch of AC Infos (whether AC and EID are one-to-one binding);
  • the PC LPA program is loaded into AC infos and connected to multiple corresponding terminal devices at the same time to ensure that the network connection can start downloading and writing. Need to support parallel download and parallel write to multiple devices;
  • LPA After the download is complete and the installation is successful, LPA records the result and reports it to DP+;
  • the installed profile can be automatically activated, and the same is true every time the device is restarted.
  • the device does not support rewriting after leaving the factory, and can be returned to the factory for rewriting.
  • the embodiment of the present invention can overcome the problem that the total cost of manufacturing, distribution, and management of SIM cards is high, which is caused by massive base devices, and the increase in requirements for various characteristics of SIM cards will gradually increase the cost of a single SIM card.
  • the embodiment of the present invention has a reduced package, no longer has a card slot, significantly reduces the size of the device space, and achieves high shock resistance and high compression; the embodiment of the present invention has no network dependency and no longer needs RSP capability.
  • the embodiment of the present invention can Before leaving the factory, directly distribute the profile safely to the device, and distribute one or more.
  • the embodiment of the present invention After leaving the factory, it can be directly and flexibly managed and activated without the network; the embodiment of the present invention directly uses the existing eSIM DP+, which does not require additional investment and saves costs. , Without changing the existing process, the operator can seamlessly and zero-cost docking, and is compatible with nuSIM DP; the embodiment of the present invention supports transformation on the production line to support batch download, which improves production efficiency.
  • this SS1 can be the second encrypted connection
  • this SS1 is the data interaction process based on the HTTPS protocol, mainly the cross-certification and security key library of the security key library and the local card configuration management service platform
  • the server where the server is located exports the key of the card configuration data to the authenticated local card configuration management service platform;
  • SS2 can be the first encrypted connection, and
  • SS2 is the data exchange process based on the UART or AT interface, mainly loading EUM certificate, eUICC certificate, and loading
  • EUM certificate EUM certificate
  • eUICC certificate e.g., EUM certificate, eUICC certificate
  • the eSIM COS is adapted and integrated into the corresponding SW on the chip, chip general agent, and module. COS is implemented inside the 2625 chip and communicates with the Modem side through the SIM Driver. Then the corresponding chips and modules are produced;
  • COS Before DM, OEM, ODM plant equipment starts to download Profile, COS must be personalized, EID, EUM CERT, eUICC CERT, eUICC SK (SK is the security key), CI PK (PK is the security key) ) And other data are individually written into each different chip or module;
  • the EUM certificate can be issued by the MNO or self-signed depending on the situation, and then use EUM to issue batches of eUICC certificates, EID and other information, and ensure the uniqueness of the EID (under the same CI system);
  • the MNO imports the corresponding Profile in DP+ according to the existing business process and provides a batch of AC Infos (whether AC and EID are one-to-one binding);
  • the PC LPA program is loaded into AC infos and connected to multiple corresponding terminal devices at the same time to ensure that the network connection can start downloading and writing. Need to support parallel download and parallel write to multiple devices;
  • LPA After the download is complete and the installation is successful, LPA records the result and reports it to DP+;
  • the installed profile can be automatically activated, and the same is true every time the device is restarted.
  • the device does not support rewriting after leaving the factory, and must be returned to the factory for processing.
  • the security encryption mechanism is completed by the external isolation of the Modem Chip of the 2625 chip itself and the encryption protection of the SKB.
  • the 2625 chip itself is isolated from the NVM, RAM and external communication, and will turn off the illegal AT, UART interface and JTAG port. It is an isolated and safe environment.
  • NVM Flash provides Secure Boot and AES OTF encryption functions to further ensure internal data security.
  • SKB performs secondary encryption protection for the key data in the profile to ensure the security of the profile during storage and operation.
  • the download process of the overall profile conforms to the eSIM standard protocol, and there are two-way certificate verification, ECKA and SCP03t encryption mechanisms to ensure the security of the profile download. The overall combination ensures the safety of the lifecycle of the profile. After the configuration and distribution are completed, products with integrated SIM chips can be obtained.
  • the embodiment of the present invention also provides an integrated SIM chip configured through the aforementioned system, the integrated SIM chip is configured as a card operating system with a SIM card; the integrated SIM chip includes: a storage medium, the storage medium It is written with the card configuration data encrypted by the secure key library and the key of the derived card configuration data; the key of the card configuration data and the derived card configuration data is managed from the local card configuration through SS2 Obtained from the service platform, wherein the local card configuration management service platform receives the key of the card configuration data generated and derived by the key server through SS1, and the local card configuration management service platform also forwards subscription management data through SS2 A request or response between the platform and the integrated SIM chip.
  • this SS1 can be the third encrypted connection, this SS1 is a data exchange process based on UART or AT interface, mainly forwarding ES8+/ES9+ requests and responses) and Figure 4, an embodiment of the present invention Provides a method for SIM card configuration and distribution based on the Qualcomm 9205 chip BG77 mobile module. The method specifically includes the following steps.
  • eSIM COS is adapted and integrated into the corresponding SW on the chip, chip general agent, and module.
  • COS is implemented in the TEE security environment provided by the Qualcomm 9205 chip, communicates through external CA and REE, and communicates with the QMI interface through the QMI interface. Modem side communication. Then the corresponding chips and modules are produced;
  • the EUM certificate can be issued by the MNO or self-signed depending on the situation, and then use EUM to issue batches of eUICC certificates, EID and other information, and ensure the uniqueness of the EID (under the same CI system);
  • the MNO imports the corresponding Profile in DP+ according to the existing business process and provides a batch of AC Infos (whether AC and EID are one-to-one binding);
  • the PC LPA program is loaded into AC infos and connected to multiple corresponding terminal devices at the same time to ensure that the network connection can start downloading and writing. Need to support parallel download and parallel write to multiple devices;
  • LPA After the download is complete and the installation is successful, LPA records the result and reports it to DP+;
  • the installed profile can be automatically activated, and the same is true every time the device is restarted.
  • the device does not support rewriting after leaving the factory, and must be returned to the factory for processing.
  • the security encryption mechanism is guaranteed by the TEE trusted execution environment inside the 9205 chip.
  • the eSIM COS executes and stores profile data in the NVM and RAM inside the TEE. External communication is isolated to ensure the secure storage and operation of the profile inside the device. .
  • the download process of the overall profile conforms to the eSIM standard protocol, and there are two-way certificate verification, ECKA and SCP03t encryption mechanisms to ensure the security of the profile download.
  • the overall combination ensures the safety of the lifecycle of the profile. After the configuration and distribution are completed, products with integrated SIM chips can be obtained.
  • the embodiment of the present invention also provides an integrated SIM chip configured through the aforementioned system.
  • the integrated SIM chip is configured as a card operating system with a SIM card; the card operating system is configured to run on the integrated SIM.
  • the trusted execution environment of the chip; the integrated SIM chip includes: a storage medium in the trusted execution environment; the storage medium is written with the card configuration data of the SIM card, and the card configuration Data is obtained from the local card configuration management service platform through SS1, where the local card configuration management service platform also forwards requests or responses between the subscription management data platform and the integrated SIM chip through SS1.
  • the device side does not necessarily use the equivalent eSIM protocol or a specific security environment. It can be directly based on the software environment, integrated into the device or chip to implement the SIM function, and support the profile with external production lines or local interfaces or local tools. Download or write directly;
  • PC LPA does not use web server and browser architecture, and is implemented using Windows or Linux or Mac native software
  • PC LPA and eSIM COS are implemented in different operating system platforms, different chips, different devices, and different security environments.
  • eSIM COS forms an integrated SIM chip (iSIM, Integrated SIM) system, which integrates the complete functions of SIM in Chipset, Module, Device (equipment), such as REE, TEE, SoC, Modem BP, and completely removes the entity UICC It supports the downloading and writing of Profile from the server before the device leaves the factory, and supports the re-downloading and writing of the device after returning to the factory;
  • eSIM COS After eSIM COS receives the profile downloaded by SMDP+, due to the large profile, in LPWA equipment, for example, the space is small and there are many ineffective profile components. eSIM COS will be streamlined according to the equipment application scenarios to meet the equipment space Requirements for saving and normal use;
  • the production line tool supports the downloading and writing process of personalized certificate and production line combination
  • the production line supports batch download to speed up the production line efficiency.
  • nuSIM DP supports batch download or PC LPA simultaneous and parallel download.
  • PC LPA Because eSIM DP+ does not support batch downloading of profiles in advance, it is necessary to add a function to support simultaneous downloading of multiple profiles in parallel and multiple devices need to be connected at the same time, while ensuring the PC's network connection, or multiple PCs at the same time.
  • the number of simultaneous downloads depends on the number of PCs*MIN (LPA supports the maximum number of parallel downloads, and a single PC supports the maximum number of devices connected at the same time). And the concurrent processing requirements for DP+ are very high.
  • PC LPA or LA are placed on the production line, generally in DM, OEM, ODM factories, and Windows PC (Linux, Ubuntu, Mac also available) is the standard. Need to be equipped with a network, support to connect to the device and use USB, AT, UART communication to transmit data.
  • PC LPA uses the Java version
  • the bottom layer uses the general LPAJar package to the Java back-end server (local deployment on the production line PC), and then uses the JS front-end interface to display, which can fully achieve cross-platform effects
  • the database uses PostgreSQL;
  • PC LPA supports custom parameter configuration, such as the number of simultaneous connections, timeout period, number of retries, etc.
  • PC LPA supports concurrent download, connects multiple devices at the same time, automatically detects the serial device connection, and continuously downloads in batches
  • PC LPA adapts to different terminal device interfaces to transmit data, such as USB, UART, AT, etc., abstract the unified Adapter interface and use different implementations;
  • the certificate system can be public or private, with flexibility.
  • the embodiment of the present invention provides a SIM card configuration distribution system, which can be used to build an upper computer or an automated data processing platform.
  • the system can include: a module integration module for integrating a SIM card operating system In the chip module; the communication security module, used to write the security configuration data corresponding to the SIM card to the card operating system of the chip module; the local card configuration management module, used to receive the card with the SIM card Distribution code data corresponding to the configuration data; the local card configuration management module is also used to obtain and write the card configuration data to the chip module or the terminal device integrating the chip module through the distribution code data .
  • the invention saves costs, specifically saves the cost of physical entity cards, saves tedious manual physical entity card distribution and management costs, saves operators' investment in new funds and manpower to build new systems, and can directly use existing SMDP+ That is, the present invention realizes the improvement of production efficiency through PC LPA; PC LPA can realize cross-platform applications; the system of the present invention is flexible and easy to deploy; the present invention reduces the network dependency on the device side, makes full use of the security of the device side, and satisfies Reasonable standard agreement requirements.
  • the program is stored in a storage medium and includes several instructions to enable the single-chip microcomputer, chip or processor (processor) Execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Telephone Function (AREA)
  • Stored Programmes (AREA)

Abstract

本发明提供一种SIM卡配置分发方法及系统，属于通信技术领域。所述系统包括：模组集成平台，用于集成SIM卡的卡操作系统于芯片模组；所述模组集成平台用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；订阅管理数据平台，用于创建所述SIM卡的卡配置数据和与所述SIM卡的卡配置数据对应的分配代码数据；移动运营商平台，用于提供下载指令至所述订阅管理数据平台；本地卡配置管理服务平台，用于运行于上位机和接收所述订阅管理数据平台下发的分配代码数据；所述本地卡配置管理服务平台用于加载和解析所述下发的分配代码数据，将与所述下发的分配代码数据对应的卡配置数据写入并安装至所述芯片模组的卡操作系统。

Description

SIM卡配置分发方法及系统 技术领域
本发明涉及通信技术领域，具体地涉及一种SIM卡配置分发方法、一种SIM卡配置批量分发方法、一种SIM卡配置分发系统、一种用于SIM卡配置分发的系统、一种集成式SIM芯片、一种电子设备和一种计算机可读存储介质。
背景技术
在爆发增长的IoT时代，可以看到各行各业和不同的应用领域对于设备、对于SIM卡的优化方案不断的提出了新的要求。特别是在LPWA领域，例如NB-IoT，产生了多方面的新的严峻的挑战，一方面是海量设备基数带来的的巨大的SIM卡制造、分发、管理成本，另一方面是对于设备的物理特性、环境特性、寿命长(至少等于设备寿命)、低功耗要求越来越严格，包括温度、湿度、抗震、抗压等。
现有的物理实体卡、虚拟卡等技术都不能完整呈现一个安全、高效、低成本的完整技术方案。
对于物理实体卡方案，可分为插拔塑料卡、贴片卡；物理实体卡形式，客户通常只与运营商交互，通过运营商下单，约定使用的Profile数据、套餐订购信息，然后运营商会将输入文件数据input_file(包含profile信息)以线下加密形式传递给卡商，卡商按照运营商和客户具体要求提前备好卡片硬件和操作系统，在产线上对每张卡片写入profile进行个性化，最终在进行不同规格的封装，通过快递形式发回给运营商，并附带输出文件数据output_file，标明每张卡片对应的制卡数据。最后运营商再将卡片快递给最终客户。有些情况下也可以是卡商直接发快递给客户。除一卡一号的普通物理卡外，还可能有一卡多号的实体卡，或者通用私有协议支持动态下发profile的物理卡。这种方式中，使用物理实体卡，安全但是有实体卡芯片、封装、产线等成本，而且随之而来的卡片的各种分发涉及到的快递、人工管理和运营成本巨大，即使到了客户侧，客户侧也需要自己管理SIM卡，每张卡片插入设备或者在设备产线上贴片，整体分发和管理成本很 高。
对于虚拟SIM卡方案，或称为软SIM、SoftSIM、vSIM、Virtual SIM等，第三方服务商充当整个链条里的整合方。客户只对接服务提供商，屏蔽运营商，客户也具有一定灵活性，只需要关心profile、流量订购等，也可以选择不同运营商。服务提供商会提前从运营商拿到profile，放在自己的服务器上，让客户需要对应profile时，直接本地写入或远程下载到客户的设备上。服务商需要和客户设备集成vSIM软件，不需要物理实体卡实现SIM功能。此方案可以降低物理实体卡成本，减少客户的SIM分发和管理成本，但是最大的问题在于安全性不可靠，服务端、空中传输、终端安全都是私有实现，安全性是最大隐患。
对于eSIM卡方案，GSMA主导提出的标准eSIM方案分成两种，消费级Consumer的和机器对机器级M2M的。Consumer的需要带用户界面、人工参与，支持动态下载profile。M2M版本需要支持SMS和BIP通信，可以从服务端主动推送push进行profile下载。SMDP+是运营商所有，安全存放profile，LPA集成在eUICC中或者设备中，辅助eUICC卡片进行profile下载和管理。此方案所有通信协议严格遵守RSP协议，充分考虑了服务端、空中传输、终端的安全机制，且保证各个不同组件之间的互通性，增加了证书体系。非常安全可靠，但是成本较高。一个eUICC卡需要1.5美金，运营商部署服务端系统也需要10-100万美金。且大多数情况在物联网场景里不太实用，一个是需要初始网络连接，另一个是需要支持SMS和BIP，再有就是profile很大如果使用设备的网络是LWPA的会有带宽不足的问题，最后就是eUICC卡片成本很高，还是需要物理实体卡片。
对于nuSIM卡方案，nuSIM是德国电信提出的，基于eSIM规范的安全协议，针对Low-cost设备，特别是NB-IoT场景的一种高效、低成本的、安全的Profile分发方案。主要有两个地方进行了优化，新增的DP服务器和原来eSIM的SMDP+服务器相比，优化了profile大小，支持批量下载，提高产线效率。LA直接实现在产线的PC上面，借助产线PC的网络环境进行profile下载。另外终端实现的安全性降低要求，使用设备上自有的安全环境，例如安全模块SE、TEE等环境即可。不需要物理实体卡，直接将SIM功能集成到芯片设备内部。但是还是有一个缺点，就是绝大多数运营商已经部署了SMDP+，都 不情愿再投入成本新建一套DP服务器。
发明内容
本发明的目的是提供一种SIM卡配置分发方法及系统。
为了实现上述目的，本发明实施例提供一种SIM卡配置分发方法，其特征在于，该SIM卡配置分发方法包括：
集成SIM卡的卡操作系统于芯片模组；
写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
接收与所述SIM卡的卡配置数据对应的分配代码数据；
通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
具体的，所述写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统，包括：
写入与所述SIM卡对应的个性化数据和安全数据至所述芯片模组，其中，所述个性化数据包括唯一识别码，所述安全数据包括证书和相应密钥，所述相应密钥包括公钥和私钥。
具体的，所述写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统，其中，
所述证书包括卡商证书和卡商eUICC证书，所述卡商证书通过移动运营商平台签发或自签发，所述唯一识别码与所述卡商eUICC证书的签发者一致。
具体的，所述接收与所述SIM卡的卡配置数据对应的分配代码数据，包括：
通过移动运营商平台在订阅管理数据平台中导入所述SIM卡的卡配置数据；
通过所述订阅管理数据平台提供分配代码数据。
具体的，所述通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备，包括：
通过运行有本地卡配置管理服务的上位机加载所述分配代码数据；
将所述上位机与集成所述芯片模组的终端设备连接；
根据所述上位机对所述分配代码数据的解析，执行写入所述卡配置数据至所述芯片模组，并安装所述卡配置数据于所述芯片模组的卡操作系统。
具体的，该SIM卡配置分发方法还包括以下至少一项：
上报所述卡配置数据的安装结果至订阅管理数据平台；
在所述终端设备启动时激活所述卡配置数据；
保持所述芯片模组与所述终端设备的调制模组的通信。
本发明实施例提供一种SIM卡配置批量分发方法，该SIM卡配置批量分发方法包括：
批量集成SIM卡的卡操作系统于芯片模组；
写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
批量接收与所述SIM卡的卡配置数据对应的分配代码数据；
通过所述分配代码数据，批量获取并批量写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
本发明实施例提供一种SIM卡配置分发系统，该SIM卡配置分发系统包括：
模组集成模块，用于集成SIM卡的卡操作系统于芯片模组；
通信安全模块，用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
本地卡配置管理模块，用于接收与所述SIM卡的卡配置数据对应的分配代码数据；
所述本地卡配置管理模块还用于通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
本发明实施例提供一种用于SIM卡配置分发的系统，该系统包括：
模组集成平台，用于集成SIM卡的卡操作系统于芯片模组；
所述模组集成平台用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
订阅管理数据平台，用于创建所述SIM卡的卡配置数据和与所述SIM卡的卡配置数据对应的分配代码数据；
移动运营商平台，用于提供下载指令至所述订阅管理数据平台；
本地卡配置管理服务平台，用于运行于上位机和接收所述订阅管理数据平台下发的分配代码数据；
所述本地卡配置管理服务平台用于加载和解析所述下发的分配代码数据， 将与所述下发的分配代码数据对应的卡配置数据写入并安装至所述芯片模组的卡操作系统。
可选的，所述移动运营商平台用于提供与所述安全配置数据中的卡商证书并下发所述卡商证书至所述模组集成平台。
可选的，所述模组集成平台具体用于写入与所述SIM卡对应的个性化数据和安全数据至所述芯片模组，其中，所述个性化数据包括唯一识别码，所述安全数据包括证书和相应密钥，所述相应密钥包括公钥和私钥。
可选的，所述模组集成平台具体用于自签发所述唯一识别码和所述卡商eUICC证书。
可选的，所述本地卡配置管理服务平台还用于上报所述卡配置数据的安装结果至所述订阅管理数据平台。
可选的，所述本地卡配置管理服务平台还用于重试所述卡配置数据的下载或安装，以及对下载或安装的任务队列进行队列管理。
可选的，该系统还包括：
终端设备，集成有所述芯片模组，用于启动时激活所述卡配置数据和保持所述芯片模组与调制模组的通信。
本发明实施例提供一种通过前述的系统配置的集成式SIM芯片，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；
所述集成式SIM芯片包括：存储介质，所述存储介质被写有通过安全密钥库加密的卡配置数据和导出的所述卡配置数据的密钥；
所述卡配置数据和所述导出的所述卡配置数据的密钥通过第一加密连接从本地卡配置管理服务平台中获取，其中，
所述本地卡配置管理服务平台通过第二加密连接接收密钥服务器生成的和导出的所述卡配置数据的密钥，所述本地卡配置管理服务平台还通过所述第一加密连接转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
本发明实施例提供一种通过前述的系统配置的集成式SIM芯片，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；
所述卡操作系统被配置为运行于所述集成式SIM芯片的可信执行环境；
所述集成式SIM芯片包括：存储介质，所述存储介质处于所述可信执行环 境；
所述存储介质被写有所述SIM卡的卡配置数据，所述卡配置数据通过第三加密连接从本地卡配置管理服务平台中获取，其中，所述本地卡配置管理服务平台还通过所述第三加密连接转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
再一方面，本发明实施例提供一种电子设备，包括：
至少一个处理器；
存储器，与所述至少一个处理器连接；
其中，所述存储器存储有能被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，所述至少一个处理器通过执行所述存储器存储的指令实现前述的方法。
又一方面，本发明实施例提供一种计算机可读存储介质，存储有计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行前述的方法。
本发明实施例的其它特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
附图是用来提供对本发明实施例的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本发明实施例，但并不构成对本发明实施例的限制。在附图中：
图1为本发明实施例的示例性一种系统主要模块示意图；
图2为本发明实施例的示例性一种系统主要交互流程示意图；
图3为本发明实施例的示例性一种系统主要模块示意图；
图4为本发明实施例的示例性一种系统主要交互流程示意图。
英文缩写对照说明
SIM：Subscriber identity module，身份认证模块，是通用集成电路卡的一种，作用是通过此模块来认证运营商网络的合法用户。Profile：卡配置数据，存储在普通SIM卡、eUICC卡里面的一系列数据和应用。
IoT：Internet of Things，物联网。NB-IoT：narrowband Internet of Things，窄带物联网，主要适合位置固定、超低功耗、对网络带宽和延时都不是特别敏感的应用场景，例如水表、电表、井盖等设备。
eMTC：enhanced machine-type communication，高级设备间通讯，主要适合于位置移动、低功耗、对网络带宽和延时有一定要求但也没有消费者级别要求高，适合于物联网场景的跟踪器、定位器、智慧城市、智慧物流等场景。
LPWA：Low power wide area，低功耗广区域连接场景，特别以NB-IoT和eMTC为主。2G：Second generation,第二代通信技术。
UICC：Universal Integrated Circuit Card，通用集成电路卡，包括通信SIM卡、金融银行卡、公交卡等。
eUICC：embedded UICC，可插拔的或者嵌入式的通用集成电路卡，通常指eSIM卡，支持以一种安全的方式对Profile进行远程和本地的管理。EID：eUICC ID，eUICC卡的唯一标识。
LPA：Local Profile Assistant，本地Profile助手，功能包括辅助Profile下载、Profile管理(Profile启用、Profile关闭、Profile删除、Profile信息查询)、提供Profile管理界面。PC LPA或LA或LPA：本地卡配置管理服务平台，运行在PC电脑上的LPA软件，在原有LPA的基础上进行扩展，新增支持通过串口、USB等连接和设备传输数据功能、支持同时连接多个设备、支持同时触发多个设备的Profile并行下载功能，是本申请中一个重要的组件。
SMDP+(或简称为DP、DP+)：Subscription Manager Data Preparation+，订阅管理数据准备服务器(或订阅管理数据平台)，主要功能有准备Profile，安全的加密、存储和分配Profile到指定的EID。通过绑定一个加密的Profile安全的通过LPA下发到eUICC上。
TEE：Trust Execution Environment，是基于Arm TrustZone架构设计的一个安全隔离环境，用于安全应用和安全数据的存储和执行环境，和外部系统的开放环境进行隔离。现有的Qualcomm、MTK、Unisoc芯片等消费者设备和物联网设备大多支持此功能。常见的应用场景是指纹支付、人脸识别等。CA：Client Application，TEE场景下的客户端应用，运行在REE侧，负责REE和TEE内TA的通信和数据交互转发。TA：Trusted Application，TEE场景下的可信应用， 运行在TEE内部，是安全应用，执行安全数据的操作和运算。本文档中SIM应用将作为安全应用运行在TEE内部。
REE：Rich Execution Environment，富执行环境，一般是比较开放、通用的操作系统，例如Android、iOS、Linux等。Modem Chip：调制解调器芯片，提供终端设备与基站的通信能力。SoC：System on Chip，这是一个在消费者设备和部分物联网设备共用的一个技术概念，如果芯片不只是单纯的用作Modem的用途，而且也作为开发者和用户进行业务应用开发，可以称是一个集成式的SoC。目前绝大部分Android和iOS设备都是如此，大部分4G物联网设备也是，在单独的NB场景中很多只单纯作为Modem通信芯片功能，不作为业务应用芯片。这里指的SoC是集成式的，既提供通信芯片功能，也提供业务应用芯片功能。
本发明iSIM：芯片上实现的具备完整SIM功能的集成式SIM芯片。本发明TEEiSIM(或称TEE SIM)：在具备可信执行环境的芯片上实现的具备完整SIM功能的集成式SIM芯片。
SAS-UP：Security Accreditation Scheme-UICC Production，针对生产UICC卡片的单位、流程、密钥和证书管理进行严格的定义、规范、审查，以保证UICC卡片的密钥和证书个性化、Profile写入的安全。
MNO：Mobile Network Operator，移动运营商(平台)，例如中国移动、中国联通和海外各个国家的运营商，给用户提供移动网络服务，包括语音、短信、数据等。
GSMA:GSM Association.国际电信联盟，主要参与者有运营商、卡商、终端设备厂商等，负责整体涉及到通信、Profile、核心网等领域的整体技术标准规范和统一协调。SMS:运营商短信业务。
BIP:独立传输协议，与新一代STK--------USAT关系密切，说得简单一些，就是为了提高数据传输速率，支持USIM卡通过TCP/IP协议与远端服务器进行通讯。就是直接通过USAT中的增值应用下载用户所需的东西时，所采用的数据传输协议。
BP:Baseband Processor.基带处理器。SKB:Secure Key Box.一个第三方安全环境服务。DM:设备厂商。OEM:设备制造商。ODM:方案商。Module:模 组，模块。Chip/Chipset：芯片。Device：终端设备或设备。SW：software的缩写，软件。HW：hardware的缩写，硬件。NVM：Non-Volatile Memory，不易失存储(器)。RAM：RandomAccessMemory，随机存取存储器,也称主存、内存。Secure Boot：安全启动机制，保护设备开机校验完整性和权限安全。AES：Advanced Encryption Standard，高级加密标准算法。
ECKA：Elliptic-curve cryptography(ECC)Key Agreement，基于ECC椭圆曲线的密钥协商算法。SCP03t：Asymmetric Secure Channel Protocol，SCP03t是基于SCP03协议建立安全数据传输通道的延伸版本，在eSIM标准规范中用作profile加解密和分段传输校验完整性。
JTAG：通过Joint Test Action Group团队名命名，用作一种设备调试常见的工具接口。AT：AT即Attention，AT指令集是从终端设备(Terminal Equipment，TE)或数据终端设备(Data Terminal Equipment，DTE)向终端适配器(Terminal Adapter，TA)或数据电路终端设备(Data Circuit Terminal Equipment，DCE)AT发送的，通过TA，TE发送AT指令来控制移动台(Mobile Station，MS)的功能，与GSM网络业务进行交互，用户可以通过AT指令进行呼叫、短信、电话本、数据业务、传真等方面的控制，嵌入式模组常用此AT指令用作外部主控芯片和Modem模组的通信。
UART：Universal Asynchronous Receiver/Transmitter，通用的串口通信协议，用作设备和外部例如PC电脑常用的通信协议。ES2+/ES8+/ES9+：GSMA所定义的eSIM标准协议的数据交互过程。COS：Card Operating System，卡操作系统，目前有ISO,Oracle Java Card,GlobalPlatform,3GPP and ETSI等类型。CERT或Crt(s)：证书。EUM：eUICC Manufacturer，卡商。CI：Certificate Issuer，证书发行商(或体系)。RSP：Remote SIM provisioning，远程SIM卡配置。
AC:Activation Code，激活码，包含Profile下载地址和相应标识信息，可以供LPA到SMDP+进行下载。
ACinfos：本发明(批量)的分配代码数据，可以具有Profile的数据包(如Excel表格格式的数据包)和下载地址等，并且该数据包相对Profile原生数据包更精简，例如减少不必要第三方订阅服务应用以及减少了用于重写更新Profile的应用等。
具体实施方式
以下结合附图对本发明实施例的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本发明实施例，并不用于限制本发明实施例。
将SIM完全集成在设备中，能够最大限度的充分利用了设备已有的安全环境、硬件和软件特性，本发明能提供一个低成本的、高效、适度安全性的集成式SIM产品，支持出厂前将Profile下发并安全写入到设备中，设备一旦出厂后即可默认使用已经下发的Profile，保证整个Profile的生命周期安全和使用是最终的产品和技术形态。突出体现在低成本设备领域，重点针对LPWA、2G等，覆盖水表、电表、定位器、追踪器、智慧城市、智能物流等行业应用。
实施例1
本发明实施例提供了用于SIM卡配置分发的系统，该系统包括：
模组集成平台(或芯片模组平台或Module)，用于集成SIM卡的卡操作系统于芯片模组，芯片模组是软件硬件结合的实体芯片，需要卡操作系统与芯片硬件适配，并且在芯片上能进行执行，从而可以让芯片的存储介质被写入卡配置数据等外部输入数据；
所述模组集成平台用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
订阅管理数据平台(或SMDP+)，用于创建所述SIM卡的卡配置数据和与所述SIM卡的卡配置数据对应的分配代码数据；
移动运营商平台(或MNO)，用于提供下载指令至所述订阅管理数据平台；
本地卡配置管理服务平台(或LA)，用于运行于上位机(或应用模块安装平台)和接收所述订阅管理数据平台下发的分配代码数据；
所述本地卡配置管理服务平台用于加载和解析所述下发的分配代码数据，将与所述下发的分配代码数据对应的卡配置数据写入并安装至所述芯片模组的卡操作系统。
本发明实施例还提供了SIM卡配置分发方法或SIM卡配置批量分发方法，该分发方法具体为如下步骤。
1.COS在芯片、芯片总代理、模组上适配完成集成到相应SW中，然后 相应芯片、模组进行生产；
2.在DM、OEM、ODM工厂设备开始下载Profile之前，可以先进行COS个性化，需要将EID、EUM CERT、eUICC CERT、eUICC SK、CI PK等数据个性化写入到每一个不同的芯片或者模组中；
3.EUM证书看情况可以由MNO签发或者自签发，然后用EUM签发批量的eUICC证书、EID等信息，并保证EID的唯一性(同一套CI体系下)；
4.MNO按照已有业务流程在DP+导入对应Profile并提供批量的AC Infos(是否AC与EID一对一绑定均可)；
5.PC LPA程序载入AC infos，同时连接到多个对应的终端设备，保证网络连接即可开始下载和写入。需要支持并行下载、并行写入多个设备；
6.下载完成安装成功后LPA记录结果并上报DP+；
7.所有AC对应的Profile下载任务需要增加队列管理和重试机制，并记录最终结果；
8.下载和安装成功的设备断开和PC连接后即可自动启用安装后的Profile，每次设备重启亦然。设备出厂后不支持重新写入，可以返厂进行重写。
本发明实施例能够克服海量基数设备随之带来的SIM卡制造、分发、管理总成本价格居高不下，而对于SIM卡各种特性的要求提升也会使单个SIM卡成本价格逐渐增加的问题；本发明实施例具有减小的封装，不再具有卡槽，显著减少设备空间大小，实现高抗震、高抗压；本发明实施例无网络依赖，不再需要RSP能力，本发明实施例能够在出厂前直接将Profile安全下发到设备中，下发一个或多个，出厂后无需网络可以直接灵活进行管理和启用；本发明实施例直接使用已有eSIM DP+，不需要额外投资、节约成本、不改变已有流程，运营商可以无缝、零成本对接，且兼容nuSIM DP；本发明实施例支持在产线上进行改造支持进行批量下载，提高了生产效率。
实施例2
基于实施例1，如图1(此SS1可为第二加密连接，此SS1为基于HTTPS协议的数据交互过程，主要是安全密钥库和本地卡配置管理服务平台的交叉认证和安全密钥库所在服务器向认证后的本地卡配置管理服务平台导出卡配置数据的密钥；SS2可为第一加密连接，SS2为基于UART或AT接口的数据交互过程， 主要是加载EUM证书、eUICC证书、加载导出的卡配置数据的密钥以及转发ES8+/ES9+的请求和响应)和图2，本发明实施例提供基于MTK2625 NB型号的调制芯片集成电路Modem Chip IC进行SIM卡配置分发方法，该方法具体为如下步骤。
1.eSIM COS在芯片、芯片总代理、模组上适配完成集成到相应SW中，COS实现在2625芯片内部，通过SIM Driver(驱动)与Modem侧通信。然后相应芯片、模组进行生产；
2.在DM、OEM、ODM工厂设备开始下载Profile之前，必须先进行COS个性化，需要将EID、EUM CERT、eUICC CERT、eUICC SK(SK为安全密钥)、CI PK(PK为安全密钥)等数据个性化写入到每一个不同的芯片或者模组中；
3.EUM证书看情况可以由MNO签发或者自签发，然后用EUM签发批量的eUICC证书、EID等信息，并保证EID的唯一性(同一套CI体系下)；
4.MNO按照已有业务流程在DP+导入对应Profile并提供批量的AC Infos(是否AC与EID一对一绑定均可)；
5.PC LPA程序载入AC infos，同时连接到多个对应的终端设备，保证网络连接即可开始下载和写入。需要支持并行下载、并行写入多个设备；
6.下载完成安装成功后LPA记录结果并上报DP+；
7.所有AC对应的Profile下载任务需要增加队列管理和重试机制，并记录最终结果；
8.下载和安装成功的设备断开和PC连接后即可自动启用安装后的Profile，每次设备重启亦然。设备出厂后不支持重新写入，必须返厂进行。
9.安全加密机制由2625芯片本身Modem Chip的对外隔离和SKB的加密保护共同完成，2625芯片本身在NVM和RAM以及对外通信上是隔离的，会关掉非法的AT、UART接口和JTAG口，是一个隔离的安全环境。NVM Flash提供Secure Boot和AES OTF加密功能进一步保证内部数据安全。SKB针对profile里的关键数据进行二次加密保护，保证profile在存储、运行时安全。整体profile的下载download流程都符合eSIM标准协议，有证书双向校验、ECKA和SCP03t加密机制保证profile的下载安全。整体结合起来保证profile的生命周期lifecycle安全，配置分发完成后可得集成式SIM芯片的产品。
本发明实施例还提供了通过前述的系统配置的集成式SIM芯片，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；所述集成式SIM芯片包括：存储介质，所述存储介质被写有通过安全密钥库加密的卡配置数据和导出的所述卡配置数据的密钥；所述卡配置数据和所述导出的所述卡配置数据的密钥通过SS2从本地卡配置管理服务平台中获取，其中，所述本地卡配置管理服务平台通过SS1接收密钥服务器生成的和导出的所述卡配置数据的密钥，所述本地卡配置管理服务平台还通过SS2转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
实施例3
基于实施例1，如图3(此SS1可为第三加密连接，此SS1为基于UART或AT接口的数据交互过程，主要是转发ES8+/ES9+的请求和响应)和图4，本发明实施例提供基于Qualcomm 9205型号的芯片BG77移远模组进行SIM卡配置分发方法，该方法具体为如下步骤。
1.eSIM COS在芯片、芯片总代理、模组上适配完成集成到相应SW中，COS实现在Qualcomm 9205芯片内部提供的TEE安全环境内部，通过外部的CA和REE通信，并通过QMI接口与Modem侧通信。然后相应芯片、模组进行生产；
2.在DM、OEM、ODM工厂设备开始下载Profile之前，必须先进行COS个性化，需要将EID、EUM CERT、eUICC CERT、eUICC SK、CI PK等数据个性化写入到每一个不同的芯片或者模组中；
3.EUM证书看情况可以由MNO签发或者自签发，然后用EUM签发批量的eUICC证书、EID等信息，并保证EID的唯一性(同一套CI体系下)；
4.MNO按照已有业务流程在DP+导入对应Profile并提供批量的AC Infos(是否AC与EID一对一绑定均可)；
5.PC LPA程序载入AC infos，同时连接到多个对应的终端设备，保证网络连接即可开始下载和写入。需要支持并行下载、并行写入多个设备；
6.下载完成安装成功后LPA记录结果并上报DP+；
7.所有AC对应的Profile下载任务需要增加队列管理和重试机制，并记录最终结果；
8.下载和安装成功的设备断开和PC连接后即可自动启用安装后的Profile，每次设备重启亦然。设备出厂后不支持重新写入，必须返厂进行。
9.安全加密机制由9205芯片内部TEE可信执行环境保证，eSIM COS执行和存储profile数据都在TEE内部的NVM和RAM中，对外通信上是隔离的，保证profile在设备内部的安全存储和运算。整体profile的下载download流程都符合eSIM标准协议，有证书双向校验、ECKA和SCP03t加密机制保证profile的下载安全。整体结合起来保证profile的生命周期lifecycle安全，配置分发完成后可得集成式SIM芯片的产品。
本发明实施例还提供了通过前述的系统配置的集成式SIM芯片，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；所述卡操作系统被配置为运行于所述集成式SIM芯片的可信执行环境；所述集成式SIM芯片包括：存储介质，所述存储介质处于所述可信执行环境；所述存储介质被写有所述SIM卡的卡配置数据，所述卡配置数据通过SS1从本地卡配置管理服务平台中获取，其中，所述本地卡配置管理服务平台还通过SS1转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
对于本发明实施例2或实施例3，进一步地可优选以下步骤。
1.不使用eSIM协议，利用私有协议模拟SMDP+和PC LPA的类似功能和技术方案然后在产线上进行profile下载和写入；
2.使用自动化生产机器或者设备实现产线工具的批量下载功能；
3.设备侧不一定使用相当的eSIM协议或者特定的安全环境，可以直接是基于软件环境、集成到设备或者芯片中进行SIM功能的实现，支持和外部产线或者本地接口、本地工具进行profile的下载或者直接写入；
4.PC LPA的界面不使用web server和浏览器架构，使用Windows或Linux或Mac原生软件实现；
5.PC LPA、eSIM COS实现在不同操作系统平台、不同芯片、不同设备、不同安全环境中。
对于本发明实施例2或实施例3，具体有以下优点。
1.eSIM COS:形成集成式SIM芯片(iSIM，Integrated SIM)的系统，将SIM的完整功能集成在Chipset、Module、Device(设备)中，比如REE、TEE、SoC、 Modem BP，完全去实体UICC化，支持设备出厂前从服务端下载Profile并写入，支持设备出厂后返厂重新下载并写入；
2.eSIM COS接收到SMDP+下载的profile后，由于profile很大，在例如LPWA设备中空间较小且有很多无实际作用的profile组成部分，eSIM COS会根据设备应用场景情况进行精简以满足设备空间节省和正常使用的要求；
3.产线工具支持个性化证书、产线结合进行下载和写入过程；
4.产线支持批量下载加快产线效率。nuSIM DP支持批量下载或PC LPA同时并行下载。PC LPA因为eSIM DP+不支持批量提前下载Profile，所以必须增加功能可以支持同时并行下载多个Profile且需要同时连接多个设备，同时保证PC的网络连接，或者多PC同时进行。对于网络依赖、产线实时连接要求较高，可以同时下载的数量取决于PC数量*MIN(LPA最大支持并行下载数，单PC最大支持同时连接设备数)。而且对DP+的并发处理要求很高。PC LPA或LA都放置在产线上，一般是DM、OEM、ODM的工厂里，以Windows PC(Linux、Ubuntu、Mac也可以)为标准。需要配备网络，支持连接到设备上用USB、AT、UART通信传输数据。
5.PC LPA使用Java版本，底层使用通用的LPAJar包给Java后端Server(在产线PC本机部署)，然后使用JS前端界面展示，可以充分达到跨平台效果，数据库使用PostgreSQL；
6.PC LPA支持自定义参数配置，如同时连接数、超时时间、重试次数等；
7.PC LPA支持并发下载，同时连接多设备，自动检测串口设备连接，连续批量下载；
8.PC LPA适配不同终端设备接口传输数据，如USB、UART、AT等，抽象统一Adapter接口，使用不同实现即可；
9.低成本，高效，安全。保证整个体系的互联互通性、达到运营商认可的安全程度。证书体系可以是公有的也可以是私有的，具备灵活性。
10.可以兼容nuSIM DP和已有的SMDP+，如果使用已有的SMDP+无需新增投入成本，无需改变运营商已有流程，可以无缝对接。
实施例4
基于实施例1至3，本发明实施例提供了SIM卡配置分发系统，可以用于 构建上位机或自动化数据处理平台，该系统可以包括：模组集成模块，用于集成SIM卡的卡操作系统于芯片模组；通信安全模块，用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；本地卡配置管理模块，用于接收与所述SIM卡的卡配置数据对应的分配代码数据；所述本地卡配置管理模块还用于通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
本发明节约了成本，具体节约了物理实体卡片成本，节约了繁琐的人工物理实体卡片分发和管理成本，节约了运营商投入新的资金、人力搭建新系统的成本，能够直接使用已有的SMDP+即可；本发明通过PC LPA实现了生产效率的提高；PC LPA能够实现跨平台应用；本发明系统灵活、易部署；本发明减少了设备侧的网络依赖，充分利用设备侧的安全性，满足合理标准协议要求。
以上结合附图详细描述了本发明实施例的可选实施方式，但是，本发明实施例并不限于上述实施方式中的具体细节，在本发明实施例的技术构思范围内，可以对本发明实施例的技术方案进行多种简单变型，这些简单变型均属于本发明实施例的保护范围。
另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合。为了避免不必要的重复，本发明实施例对各种可能的组合方式不再另行说明。
本领域技术人员可以理解实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得单片机、芯片或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，本发明实施例的各种不同的实施方式之间也可以进行任意组合，只要其不违背本发明实施例的思想，其同样应当视为本发明实施例所公开的内容。

Claims (19)

  1. 一种SIM卡配置分发方法，其特征在于，该SIM卡配置分发方法包括：
    集成SIM卡的卡操作系统于芯片模组；
    写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
    接收与所述SIM卡的卡配置数据对应的分配代码数据；
    通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
  2. 根据权利要求1所述的SIM卡配置分发方法，其特征在于，所述写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统，包括：
    写入与所述SIM卡对应的个性化数据和安全数据至所述芯片模组，其中，所述个性化数据包括唯一识别码，所述安全数据包括证书和相应密钥，所述相应密钥包括公钥和私钥。
  3. 根据权利要求2所述的SIM卡配置分发方法，其特征在于，所述写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统，其中，
    所述证书包括卡商证书和卡商eUICC证书，所述卡商证书通过移动运营商平台签发或自签发，所述唯一识别码与所述卡商eUICC证书的签发者一致。
  4. 根据权利要求1所述的SIM卡配置分发方法，其特征在于，所述接收与所述SIM卡的卡配置数据对应的分配代码数据，包括：
    通过移动运营商平台在订阅管理数据平台中导入所述SIM卡的卡配置数据；
    通过所述订阅管理数据平台提供分配代码数据。
  5. 根据权利要求1所述的SIM卡配置分发方法，其特征在于，所述通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备，包括：
    通过运行有本地卡配置管理服务的上位机加载所述分配代码数据；
    将所述上位机与集成所述芯片模组的终端设备连接；
    根据所述上位机对所述分配代码数据的解析，执行写入所述卡配置数据至所述芯片模组，并安装所述卡配置数据于所述芯片模组的卡操作系统。
  6. 根据权利要求5所述的SIM卡配置分发方法，其特征在于，该SIM卡配置分发方法还包括以下至少一项：
    上报所述卡配置数据的安装结果至订阅管理数据平台；
    在所述终端设备启动时激活所述卡配置数据；
    保持所述芯片模组与所述终端设备的调制模组的通信。
  7. 一种SIM卡配置批量分发方法，其特征在于，该SIM卡配置批量分发方法包括：
    批量集成SIM卡的卡操作系统于芯片模组；
    写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
    批量接收与所述SIM卡的卡配置数据对应的分配代码数据；
    通过所述分配代码数据，批量获取并批量写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
  8. 一种SIM卡配置分发系统，其特征在于，该SIM卡配置分发系统包括：
    模组集成模块，用于集成SIM卡的卡操作系统于芯片模组；
    通信安全模块，用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
    本地卡配置管理模块，用于接收与所述SIM卡的卡配置数据对应的分配代码数据；
    所述本地卡配置管理模块还用于通过所述分配代码数据，获取并写入所述卡配置数据至所述芯片模组或集成所述芯片模组的终端设备。
  9. 一种用于SIM卡配置分发的系统，其特征在于，该系统包括：
    模组集成平台，用于集成SIM卡的卡操作系统于芯片模组；
    所述模组集成平台用于写入与所述SIM卡对应的安全配置数据至所述芯片模组的卡操作系统；
    订阅管理数据平台，用于创建所述SIM卡的卡配置数据和与所述SIM卡的卡配置数据对应的分配代码数据；
    移动运营商平台，用于提供下载指令至所述订阅管理数据平台；
    本地卡配置管理服务平台，用于运行于上位机和接收所述订阅管理数据平台下发的分配代码数据；
    所述本地卡配置管理服务平台用于加载和解析所述下发的分配代码数据，将与所述下发的分配代码数据对应的卡配置数据写入并安装至所述芯片模组的 卡操作系统。
  10. 根据权利要求9所述的用于SIM卡配置分发的系统，其特征在于，
    所述移动运营商平台用于提供与所述安全配置数据中的卡商证书并下发所述卡商证书至所述模组集成平台。
  11. 根据权利要求9所述的用于SIM卡配置分发的系统，其特征在于，所述模组集成平台具体用于写入与所述SIM卡对应的个性化数据和安全数据至所述芯片模组，其中，所述个性化数据包括唯一识别码，所述安全数据包括证书和相应密钥，所述相应密钥包括公钥和私钥。
  12. 根据权利要求11所述的用于SIM卡配置分发的系统，其特征在于，
    所述模组集成平台具体用于自签发所述唯一识别码和所述卡商eUICC证书。
  13. 根据权利要求9所述的用于SIM卡配置分发的系统，其特征在于，
    所述本地卡配置管理服务平台还用于上报所述卡配置数据的安装结果至所述订阅管理数据平台。
  14. 根据权利要求9所述的用于SIM卡配置分发的系统，其特征在于，
    所述本地卡配置管理服务平台还用于重试所述卡配置数据的下载或安装，以及对下载或安装的任务队列进行队列管理。
  15. 根据权利要求9所述的用于SIM卡配置分发的系统，其特征在于，该系统还包括：
    终端设备，集成有所述芯片模组，用于启动时激活所述卡配置数据和保持所述芯片模组与调制模组的通信。
  16. 一种通过权利要求9至15中任意一项所述的系统配置的集成式SIM芯片，其特征在于，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；
    所述集成式SIM芯片包括：存储介质，所述存储介质被写有通过安全密钥库加密的卡配置数据和导出的所述卡配置数据的密钥；
    所述卡配置数据和所述导出的所述卡配置数据的密钥通过第一加密连接从本地卡配置管理服务平台中获取，其中，
    所述本地卡配置管理服务平台通过第二加密连接接收密钥服务器生成的和导出的所述卡配置数据的密钥，所述本地卡配置管理服务平台还通过所述第一加密连接转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
  17. 一种通过权利要求9至15中任意一项所述的系统配置的集成式SIM芯片，其特征在于，所述集成式SIM芯片被配置成具有SIM卡的卡操作系统；
    所述卡操作系统被配置为运行于所述集成式SIM芯片的可信执行环境；
    所述集成式SIM芯片包括：存储介质，所述存储介质处于所述可信执行环境；
    所述存储介质被写有所述SIM卡的卡配置数据，所述卡配置数据通过第三加密连接从本地卡配置管理服务平台中获取，其中，所述本地卡配置管理服务平台还通过所述第三加密连接转发订阅管理数据平台与所述集成式SIM芯片间的请求或响应。
  18. 一种电子设备，其特征在于，包括：
    至少一个处理器；
    存储器，与所述至少一个处理器连接；
    其中，所述存储器存储有能被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令实现权利要求1至7中任意一项权利要求所述的方法。
  19. 一种计算机可读存储介质，存储有计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行权利要求1至7中任意一项权利要求所述的方法。
PCT/CN2020/093991 2020-05-07 2020-06-02 Sim卡配置分发方法及系统 WO2021223278A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010378164.3A CN111479259B (zh) 2020-05-07 2020-05-07 Sim卡配置分发方法及系统
CN202010378164.3 2020-05-07

Publications (1)

Publication Number Publication Date
WO2021223278A1 true WO2021223278A1 (zh) 2021-11-11

Family

ID=71757469

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/093991 WO2021223278A1 (zh) 2020-05-07 2020-06-02 Sim卡配置分发方法及系统

Country Status (2)

Country Link
CN (1) CN111479259B (zh)
WO (1) WO2021223278A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114501535A (zh) * 2021-11-29 2022-05-13 北京握奇智能科技有限公司 一种高质量网络连接终端的流量管理方法及系统
CN114786168A (zh) * 2021-12-10 2022-07-22 国网电力科学研究院有限公司 一种适用于电力业务的加密esim模块以及5g模组
CN115499820A (zh) * 2022-07-25 2022-12-20 北京中电飞华通信有限公司 一种eSIM空中写号系统及方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112202931B (zh) * 2020-12-04 2021-09-07 深圳杰睿联科技有限公司 一种在窄带物联网设备中植入sim信息的方法和设备
CN114258012A (zh) * 2021-12-16 2022-03-29 武汉天喻信息产业股份有限公司 Esim号码的预制方法及esim虚拟系统、设备及存储介质
CN114363880A (zh) * 2021-12-28 2022-04-15 武汉天喻信息产业股份有限公司 eSIM卡多号码管理方法、装置、设备及可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150281964A1 (en) * 2012-11-19 2015-10-01 Kt Corporation Method for configuring profile of subscriber authenticating module embedded and installed in terminal device, and apparatus using same
CN108702386A (zh) * 2017-06-14 2018-10-23 华为技术有限公司 一种嵌入式通用集成电路卡配置文件的管理方法及装置
CN109819434A (zh) * 2019-01-11 2019-05-28 深圳市斯凯荣科技有限公司 一种基于eSIM的卡池系统及控制方法
US20190174466A1 (en) * 2018-01-22 2019-06-06 Intel Corporation Control signaling for uplink multiple input multiple output, channel state information reference signal configuration and sounding reference signal configuration
EP3629610A1 (en) * 2017-06-14 2020-04-01 Huawei Technologies Co., Ltd. Method and apparatus for managing embedded universal integrated circuit card configuration file

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101674303B (zh) * 2009-07-31 2012-08-22 厦门敏讯信息技术股份有限公司 嵌入式网络产品烧写设备及方法
KR102160597B1 (ko) * 2014-07-17 2020-09-28 삼성전자 주식회사 eUICC의 프로파일 설치 방법 및 장치
CN105678179B (zh) * 2014-11-20 2018-11-13 广东华大互联网股份有限公司 一种ic卡互联网终端发行方法及管理系统
US20180167805A1 (en) * 2015-06-03 2018-06-14 Deutsche Telekom Ag Transmitting parameter data between a telecommunications network and a telecommunications terminal and for activating and/or changing and/or deactivating a communication profile on the telecommunications terminal, which communication profile is defined or denoted by the parameter data
CN105530107B (zh) * 2015-12-03 2018-10-16 中国联合网络通信集团有限公司 基于eUICC的批量开户方法和平台
CN110324808A (zh) * 2018-03-30 2019-10-11 中兴通讯股份有限公司 配置文件的切换方法、装置与移动终端
CN109089256A (zh) * 2018-08-27 2018-12-25 深圳杰睿联科技有限公司 电子sim卡终端的连接管理系统、用户终端及应用程序
CN109151805B (zh) * 2018-09-21 2021-07-20 中国联合网络通信集团有限公司 基于物联网的eSIM卡配置方法及系统
CN109754033A (zh) * 2018-12-26 2019-05-14 航天信息股份有限公司 智能卡发行系统和方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150281964A1 (en) * 2012-11-19 2015-10-01 Kt Corporation Method for configuring profile of subscriber authenticating module embedded and installed in terminal device, and apparatus using same
CN108702386A (zh) * 2017-06-14 2018-10-23 华为技术有限公司 一种嵌入式通用集成电路卡配置文件的管理方法及装置
EP3629610A1 (en) * 2017-06-14 2020-04-01 Huawei Technologies Co., Ltd. Method and apparatus for managing embedded universal integrated circuit card configuration file
US20190174466A1 (en) * 2018-01-22 2019-06-06 Intel Corporation Control signaling for uplink multiple input multiple output, channel state information reference signal configuration and sounding reference signal configuration
CN109819434A (zh) * 2019-01-11 2019-05-28 深圳市斯凯荣科技有限公司 一种基于eSIM的卡池系统及控制方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114501535A (zh) * 2021-11-29 2022-05-13 北京握奇智能科技有限公司 一种高质量网络连接终端的流量管理方法及系统
CN114786168A (zh) * 2021-12-10 2022-07-22 国网电力科学研究院有限公司 一种适用于电力业务的加密esim模块以及5g模组
CN114786168B (zh) * 2021-12-10 2023-10-20 国网电力科学研究院有限公司 一种适用于电力业务的加密esim模块以及5g模组
CN115499820A (zh) * 2022-07-25 2022-12-20 北京中电飞华通信有限公司 一种eSIM空中写号系统及方法

Also Published As

Publication number Publication date
CN111479259A (zh) 2020-07-31
CN111479259B (zh) 2021-08-17

Similar Documents

Publication Publication Date Title
WO2021223278A1 (zh) Sim卡配置分发方法及系统
EP2731381B1 (en) Method for changing the mobile network operator in an embedded sim on basis of special privilege
US20230021634A1 (en) OTA System Software Upgrade Control Method and Terminal Device
EP2741548B1 (en) Method for changing mno in embedded sim on basis of dynamic key generation and embedded sim and recording medium therefor
US10911939B2 (en) Embedded universal integrated circuit card profile management method and apparatus
US9572025B2 (en) Method, server, computer program and computer program product for communicating with secure element
EP3337219B1 (en) Carrier configuration processing method, device and system, and computer storage medium
CN111935704B (zh) Profile下载方法、装置及设备
US9439076B2 (en) Method for incorporating subscriber identity data into a subscriber identity module
KR101979162B1 (ko) 내장 ｓｉｍ에서의 키 관리방법, 및 그를 위한 내장 ｓｉｍ과 기록매체
CN103455349A (zh) 应用程序访问智能卡的方法和装置
CN111372249A (zh) 物联网eSIM终端码号下载流程一致性测试系统及方法
US11907931B2 (en) Method and system for managing virtual electronic card, secure chip, terminal and storage medium
CN105376059A (zh) 基于电子钥匙进行应用签名的方法和系统
US9246910B2 (en) Determination of apparatus configuration and programming data
JP2021511737A (ja) トラステッドサービスマネージメントのための方法および装置
CN102547661B (zh) 一种Android系统与电信智能卡通信的方法及装置
CN110636491A (zh) 面向服务的可信执行模块及通信方法
CN109618327B (zh) 一种软体适配的方法和装置、电子设备、可读存储介质
US20240129743A1 (en) Method for personalizing a secure element
US20240137336A1 (en) Esim-based card pool system and control method thereof
CN114556887A (zh) 用于在设备之间传送捆绑包的方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20934290

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 12/04/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20934290

Country of ref document: EP

Kind code of ref document: A1