Updating a subscriber identity module

1. A method performed by an agent on a device, the method comprising:

receiving a value from a server over a network;

transmitting the value to a subscriber identity module, SIM, on the device;

receiving a first message from the SIM wherein the first message is generated using the value and comprises a signed response and a cipher key;

deriving a pre-shared key using the first message and at least one of the signed response and the cipher key;

receiving a second message over the network from the server, wherein the second message is encrypted using the pre-shared key;

decrypting the second message using the derived pre-shared key; and

transmitting data included in the decrypted second message to the SIM.

2. The method of claim 1 , further comprising:

obtaining a SIM identifier of the SIM;

transmitting an agent identifier and the SIM identifier over the network to the server; and

receiving a random value as the value from the server over the network.

3. The method of claim 2 , further comprising

deriving the agent identifier from the SIM identifier.

4. The method of claim 2 , wherein obtaining the SIM identifier comprises:

requesting the SIM identifier from the SIM; and

receiving the SIM identifier from the SIM.

5. The method of claim 1 , further comprising:

supplying the value to the SIM to initiate a SIM authentication procedure; and

receiving an authentication response as the first message from the SIM.

6. The method of claim 1 , further comprising:

transmitting an update request message over the network to the server, wherein the update request message comprises an agent identifier and is encrypted prior to transmission using the pre-shared key; and

receiving an update response message as the second message over the network from the server, wherein the update response message comprises update data and is encrypted using the pre-shared key,

wherein transmitting the data included in the decrypted second message comprises transmitting the update data to the SIM for execution to update the SIM.

7. The method of claim 1 , wherein the server includes a server configured to provide data to be used for updating the SIM.

8. The method of claim 1 , wherein deriving the pre-shared key comprises further using the value to derive the pre-shared key.

9. The method of claim 8 , wherein deriving the pre-shared key comprises concatenating the cipher key with itself to generate a concatenated result and applying a bitwise XOR operation on the concatenated result and the value to derive the pre-shared key.

10. The method of claim 1 , wherein the update data is encrypted with a symmetric cryptographic key stored by the SIM.

11. The method of claim 1 , further comprising, in response to transmitting the data:

receiving an execution result from the SIM; and

transmitting a further update request message over the network to the server, the further update request message conveying the execution result, wherein the further update request message is encrypted prior to transmission using the pre-shared key.

12. The method of claim 1 , wherein an Attention, AT, Command or an application programming interface provided by a communication module of the device is used for communication between the communication module and the agent.

13. The method of claim 6 , wherein the update request message is encrypted prior to transmission with a first session key derived from the pre-shared key, and the update response message is decrypted with a second session key derived from the pre-shared key.

14. The method of claim 1 , wherein the agent on the device is configured to communication with the SIM via an access device.

15. The method of claim 14 , wherein the access device includes a communication module of the hest-device.

16. A device with a processor configured to communicate with a subscriber identity module, SIM, associated with the device, the processor configured to:

receive a value from a server over a network;

transmit the value to the SIM;

receive a first message from the SIM wherein the first message is generated using the value and comprises a signed response and a cipher key;

derive a pre-shared key using the first message and at least one of the signed response and the cipher key;

receive a second message over the network from the server, wherein the second message is encrypted using the pre-shared key;

decrypt the second message using the derived pre-shared key; and

transmit data included in the decrypted second message to the SIM.

17. A nontransitory computer readable medium storing a computer program, the computer program comprising code configured so as when executed on a processor of a device to perform the method of claim 1 .