Methods and devices for OTA management of subscriber identity modules

1. A method for providing subscription data from a data providing unit to a secure identification element of a mobile station for communication via a mobile communications system, wherein the mobile communications system implements a challenge-response authentication procedure to authenticate mobile stations therewith, and wherein the method comprises the following steps performed by the data providing unit:

receiving a request from the mobile station to start the challenge-response authentication procedure implemented in the mobile communications system, wherein the request contains a mode indicator data element signifying that a modified challenge-response authentication procedure be used to provide subscription data to the mobile station instead of authenticating the mobile station, wherein the mode indicator data element causes the mobile communications system to forward the request to the data providing unit and informs the data providing unit that the mobile station is requesting subscription data, and wherein the mode indicator data element comprises a preliminary IMSI (PIMSI) number that defines the address of the data providing unit and has the same format as an IMSI number;

creating a challenge containing subscription data, wherein the format of the challenge conforms to the format of the challenge portion of the challenge-response authentication procedure implemented in the mobile communications system, wherein the challenge comprises a modified random number RAND* that carries the subscription data, and wherein the subscription data carried by the challenge comprises an IMSI number and an authentication key Ki; and

transmitting the challenge containing the subscription data to the mobile station, wherein the subscription data is extracted from the challenge and is usable by the mobile station to authenticate itself with the mobile communications system in a subsequent standard challenge-response authentication procedure of the mobile communications system.

2. The method of claim 1 , wherein the data providing unit comprises a dedicated subscription data providing server or part of a home location register of the mobile communications system, wherein the secure identification element comprises a subscriber identity module of the mobile station, and wherein the PIMSI number was stored on the subscriber identity module during a previous manufacturing or personalization process.

3. The method of claim 1 , wherein the steps of the method are performed over-the-air before the mobile station has attached to the mobile communications system.

4. The method of claim 1 , wherein the subscription data carried by the challenge is in plaintext or is encrypted, and wherein the secure identification element of the mobile station stores an encryption key for extracting the subscription data from RAND* if encrypted.

5. The method of claim 1 , wherein the steps of the method are repeated as often as necessary, in case the size of the subscription data is larger than the size of the challenge.

6. The method of claim 1 , wherein the selection of the subscription data carried by the challenge depends upon the location of the mobile station and/or the type of the mobile equipment of the mobile station.

7. The method of claim 1 , wherein the mobile communications system is implemented according to the GSM standard, and wherein the challenge is created as part of an authentication triplet that further comprises a signed response SRES and a ciphering key Kc according to the GSM challenge-response authentication procedure.

8. A method for obtaining subscription data from a data providing unit by a secure identification element of a mobile station for communication via a mobile communications system, wherein the mobile communications system implements a challenge-response authentication procedure to authenticate mobile stations therewith, and wherein the method comprises the following steps performed by the secure identification element:

providing a mode indicator data element to a mobile equipment of the mobile station, wherein the mobile equipment issues the mode indicator data element as part of a request to start the challenge-response authentication procedure implemented in the mobile communications system, wherein the mode indicator data element signifies that a modified challenge-response authentication procedure be used to provide subscription data to the mobile station instead of authenticating the mobile station, wherein the mode indicator data element causes the mobile communications system to forward the request to the data providing unit and informs the data providing unit that the mobile station is requesting subscription data, and wherein the mode indicator data element comprises a preliminary IMSI (PIMSI) number that defines the address of the data providing unit and has the same format as an IMSI number;

receiving a challenge containing subscription data issued by the data providing unit, wherein the format of the challenge conforms to the format of the challenge portion of the challenge-response authentication procedure implemented in the mobile communications system, wherein the challenge comprises a modified random number RAND* that carries the subscription data, and wherein the subscription data carried by the challenge comprises an IMSI number and an authentication key Ki; and

storing the subscription data received in the challenge, wherein the subscription data is extracted from the challenge and is usable by the mobile station to authenticate itself with the mobile communications system in a subsequent standard challenge-response authentication procedure of the mobile communications system.

9. A data providing unit that provides a secure identification element of a mobile station with subscription data for communication via a mobile communications system, wherein the mobile communications system implements a challenge-response authentication procedure to authenticate mobile stations therewith, and wherein the data providing unit is configured to:

receive a request from the mobile station to start the challenge-response authentication procedure implemented in the mobile communications system, wherein the request contains a mode indicator data element signifying that a modified challenge-response authentication procedure be used to provide subscription data to the mobile station instead of authenticating the mobile station, wherein the mode indicator data element causes the mobile communications system to forward the request to the data providing unit and informs the data providing unit that the mobile station is requesting subscription data, and wherein the mode indicator data element comprises a preliminary IMSI (PIMSI) number that defines the address of the data providing unit and has the same format as an IMSI number;

create a challenge containing subscription data, wherein the format of the challenge conforms to the format of the challenge portion of the challenge-response authentication procedure implemented in the mobile communications system, wherein the challenge comprises a modified random number RAND* that carries the subscription data, and wherein the subscription data carried by the challenge comprises an IMSI number and an authentication key Ki; and

transmit the challenge containing the subscription data to the mobile station, wherein the subscription data is extracted from the challenge and is usable by the mobile station to authenticate itself with the mobile communications system in a subsequent standard challenge-response authentication procedure of the mobile communications system.

10. The data providing unit of claim 9 , wherein the data providing unit comprises a dedicated subscription data providing server or part of a home location register of the mobile communications system, wherein the secure identification element comprises a subscriber identity module of the mobile station, and wherein the PIMSI number was stored on the subscriber identity module during a previous manufacturing or personalization process.

11. A secure identification element of a mobile station that obtains from a data providing unit subscription data for communication via a mobile communications system, wherein the mobile communications system implements a challenge-response authentication procedure to authenticate mobile stations therewith, and wherein the secure identification element is configured to:

provide a mode indicator data element to a mobile equipment of the mobile station, wherein the mobile equipment issues the mode indicator data element as part of a request to start the challenge-response authentication procedure implemented in the mobile communications system, wherein the mode indicator data element signifies that a modified challenge-response authentication procedure be used to provide subscription data to the mobile station instead of authenticating the mobile station, wherein the mode indicator data element causes the mobile communications system to forward the request to the data providing unit and informs the data providing unit that the mobile station is requesting subscription data, and wherein the mode indicator data element comprises a preliminary IMSI (PIMSI) number that defines the address of the data providing unit and has the same format as an IMSI number;

receive a challenge containing subscription data issued by a data providing unit, wherein the format of the challenge conforms to the format of the challenge portion of the challenge-response authentication procedure implemented in the mobile communications system, and wherein the challenge comprises a modified random number RAND* that carries the subscription data, and wherein the subscription data carried by the challenge comprises an IMSI number and an authentication key Ki; and

store the subscription data received in the challenge, wherein the subscription data is extracted from the challenge and is usable by the mobile station to authenticate itself with the mobile communications system in a subsequent standard challenge-response authentication procedure of the mobile communications system.

12. The secure identification element of claim 11 , wherein the data providing unit comprises a dedicated subscription data providing server or part of a home location register of the mobile communications system, wherein the secure identification element comprises a subscriber identity module of the mobile station, and wherein the PIMSI number was stored on the subscriber identity module during a previous manufacturing or personalization process.

13. A mobile communications system comprising a data providing unit that provides subscription data according to claim 9 .

14. The mobile communications system of claim 13 , further comprising a mobile station with a secure identification element comprising a subscriber identity module that obtains subscription data according to claim 11 .

15. The mobile communications system of claim 14 , wherein the data providing unit comprises a dedicated subscription data providing server or part of a home location register of the mobile communications system, wherein the secure identification element comprises a subscriber identity module of the mobile station, and wherein the PIMSI number was stored on the subscriber identity module during a previous manufacturing or personalization process.