Method and apparatus for downloading profile on embedded universal integrated circuit card of terminal

1. A method for acquiring a profile from a server by a user equipment (UE) comprising an embedded universal integrated circuit card (eUICC) and a local profile assistant (LPA), the method comprising:

generating, by the eUICC, a one-time key pair, the one-time key pair comprising:

a one-time public key of the eUICC, and

a one-time private key of the eUICC;

transmitting, by the eUICC, a one-time public key of the eUICC to the LPA;

transmitting, by the LPA, a profile package request message including the one-time public key of the eUICC to the server;

receiving, by the LPA, from the server, a profile package comprising:

encrypted profile information of the profile, and

a one-time public key of the server;

transmitting, by the LPA, the one-time public key of the server to the eUICC;

generating, by the eUICC, a session key using the one-time public key of the server and the one-time private of the eUICC;

transmitting, by the LPA, an instruction to store the encrypted profile information to the eUICC;

decrypting, by the eUICC, the encrypted profile information using the session key; and

storing, by the eUICC, the decrypted information,

wherein the encrypted profile information comprises encrypted information related to deleting the profile.

2. The method of claim 1 ,

wherein the information related to deleting the profile comprising at least one of:

a character string required to delete the profile, or

a memory size required to delete the profile.

3. The method of claim 1 ,

wherein the encrypted profile information comprises:

a first profile information encrypted by the session key, and

a second profile information encrypted by the profile protection key, and

wherein the profile package comprises encrypted information of the profile protection key.

4. The method of claim 3 ,

wherein the eUICC decrypts the first profile information and the encrypted information of the profile protection key using the session key, and

wherein the eUICC decrypts the second profile information using decrypted profile protection key.

5. The method of claim 3 ,

wherein the first profile information comprises the encrypted information related to deleting the profile.

6. A method of claim 1 , further comprising:

receiving, by the LPA, unencrypted profile information of the profile from the server; and

checking, by the LPA, whether a user input authorizing additional download of profile information identified by the unencrypted profile information is detected,

wherein if the user input is not detected, the eUICC does not generate the one-time key pair.

7. A method for providing by a server a profile to user equipment (UE), the method comprising:

receiving, from the UE, a profile package request message including a one-time public key of an embedded universal integrated circuit card (eUICC) of the UE;

generating a one-time key pair of the server, the one-time key pair comprising:

a one-time public key of the server, and

a one-time private key of the server;

generating a session key using the one-time secret key of the server and the one-time public key of the eUICC;

generating a profile package including encrypted profile information of the profile and a one-time public key of the server, by using the session key; and

transmitting the profile package to the UE,

wherein the encrypted profile information comprises encrypted information related to deleting the profile.

8. The method of claim 7 ,

wherein the information related to deleting a profile comprises at least one of:

a character string required to delete the profile, or

a memory size required to delete the profile.

9. The method of claim 7 ,

wherein the encrypted profile information comprises:

a first profile information encrypted by the session key, and

a second profile information encrypted by the profile protection key, and

wherein the profile package comprises encrypted information of the profile protection key.

10. The method of claim 9 ,

wherein the generating a profile package comprises:

encrypting the first profile information with the session key,

encrypting the second profile information with the profile protection key, and

encrypting the profile protection key with the session key.

11. The method of claim 9 ,

wherein the first profile information comprises the encrypted information related to deleting the profile.

12. A user equipment (UE), the UE comprising:

an embedded universal integrated circuit card (eUICC); and

a local profile assistant (LPA),

wherein the eUICC is configured to:

generate a one-time key pair, the one-time key pair comprising:

a one-time public key of the eUICC, and

a one-time private key of the eUICC, and

transmit a one-time public key of the eUICC to the LPA, wherein the LPA is configured to:

transmit a profile package request message including the one-time public key of the eUICC to a server,

receive, from the server, a profile package comprising encrypted profile information of the profile and a one-time public key of the server, and

transmit the one-time public key of the server to the eUICC,

wherein the eUICC is further configured to generate a session key using the one-time public key of the server and the one-time private of the eUICC,

wherein the LPA is further configured to transmit an instruction to store the encrypted profile information to the eUICC,

wherein the eUICC is further configured to:

decrypt, the encrypted profile information using the session key, and

store the decrypted information, and

wherein the encrypted profile information comprises encrypted information related to deleting the profile.

13. The UE of claim 12 , wherein the information related to deleting the profile comprising at least one of:

a character string required to delete the profile, or

a memory size required to delete the profile.

14. The UE of claim 12 ,

wherein the encrypted profile information comprises:

a first profile information encrypted by the session key, and

a second profile information encrypted by the profile protection key, and

wherein the profile package comprises encrypted information of the profile protection key.

15. The UE of claim 14 ,

wherein the eUICC is configured to:

decrypt the first profile information and the encrypted information of the profile protection key using the session key, and

decrypt the second profile information using decrypted profile protection key, and

wherein the first profile information comprises the encrypted information related to deleting the profile.

16. The UE of claim 12 ,

wherein the LPA is configured to:

receive unencrypted profile information of the profile from the server, and

check whether a user input authorizing additional download of profile information identified by the unencrypted profile information is detected, and

wherein, if the user input is not detected, the eUICC does not generate the one-time key pair.

17. A server providing a profile to a user equipment (UE), the server comprising:

a transceiver; and

a processor configured to:

receive, through the transceiver, from the UE, a profile package request message including a one-time public key of an embedded universal integrated circuit card (eUICC) of the UE,

generate a one-time key pair of the server, the one-time key pair comprising:

a one-time public key of the server, and

a one-time private key of the server,

generate a session key using the one-time secret key of the server and the one-time public key of the eUICC,

generate a profile package including encrypted profile information of the profile and a one-time public key of the server, by using the session key, and

transmit, through the transceiver, the profile package to the UE,

wherein the encrypted profile information comprises information that information related to deleting a profile is encrypted.

18. The server of claim 17 ,

wherein the information related to deleting a profile comprises at least one of:

a character string required to delete the profile, or

a memory size required to delete the profile.

19. The server of claim 17 ,

wherein the encrypted profile information comprises:

a first profile information encrypted by the session key, and

a second profile information encrypted by the profile protection key, and

wherein the profile package comprises encrypted information of the profile protection key.

20. The server of claim 19 ,

wherein the processor is configured to:

encrypt the first profile information with the session key,

encrypt the second profile information with the profile protection key, and

encrypt the profile protection key with the session key, and

wherein the first profile information comprises the encrypted information related to deleting the profile.