DIGITAL PRODUCTION OF SUBSCRIBER IDENTITY MODULES
An edge device includes a memory and circuitry. The circuitry is configured to communicate over a communication network, including serving as a Subscriber Identity Module (SIM) of the edge device, to be pre-configured with security credentials assigned to the SIM, to receive, over the communication network or over an alternative communication channel, at least a portion of a SIM-blob, the portion including at least part of a SIM Operating System (SIM-OS) for operating the SIM, to store the SIM-blob in the memory, to provision the SIM-OS using the security credentials, and to carry out SIM tasks for the edge device using the SIM-OS.
1 . An edge device, comprising: a memory; and
circuitry, configured to:
communicate over a communication network, including serving as a Subscriber Identity Module (SIM) of the edge device;
be pre-configured with security credentials assigned to the SIM:
receive, over the communication network or over an alternative communication channel, at least a portion of a SIM-blob, the portion comprising at least part of a SIM Operating System (SIM-OS) for operating the SIM, and store the SIM-blob in the memory;
provision the SIM-OS using the security credentials; and carry out SIM tasks for the edge device using the SIM-OS.
2 . The edge device according to claim 1 , wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, further comprises a profile of a network operator associated with the SIM.
3 . The edge device according to claim 2 , wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, further comprises a certificate for subsequent changing of the profile.
4 . The edge device according to claim 1 , wherein the circuitry is configured to obtain at least the portion of the SIM-blob by:
establishing a connection with the communication network using a dedicated SIM that is designated for SIM-blob provisioning and is running in a non-secure software environment; and
requesting and receiving at least the portion of the SIM-blob over the established connection.
5 . The edge device according to claim 1 , wherein the circuitry is configured to receive at least the portion of the SIM-blob by communicating over a non-cellular wireless network.
6 . The edge device according to claim 1 ,
wherein the SIM-blob is pre-stored in the memory in encrypted form using a unique key,
wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, comprises the unique key, and
wherein the circuitry is configured to provision the SIM-OS by decrypting the pre-stored SIM-blob using the received unique key.
7 . The edge device according to claim 1 ,
wherein the SIM-blob comprises a generic portion and a device-specific portion, wherein the generic portion of the SIM-blob is pre-stored in the memory,
wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, comprises the device-specific portion of the SIM-blob, and
wherein the circuitry is configured to provision the SIM-OS by combining the generic portion and the device-specific portion.
8 . A network device, comprising:
a network interface, for communicating with a network; and one or more processors, configured to:
receive over the network a message from an edge device, the message requesting provisioning of a Subscriber Identity Module (SIM) of the edge device;
identify, based on the request, a server assigned to provision the SIM; and
establish a communication connection between the edge device and the identified server, for provisioning the SIM.
9 . The network device according to claim 8 , wherein the one or more processors are configured as an isolated network enclave dedicated only for provisioning of SIMs.
10 . The network device according to claim 8 , wherein the one or more processors are configured to identify the server from among multiple servers of multiple SIM vendors.
11 . The network device according to claim 8 , wherein the one or more processors are configured to verify an authenticity of the request before establishing the communication connection between the edge device and the server.
12 . A server, comprising:
a network interface, for communicating with a network; and one or more processors, configured to:
receive over the network a message from an edge device, the message requesting provisioning of a Subscriber Identity Module (SIM) of the edge device; and
in response to the request, send to the edge device at least a portion of a SIM-blob, the portion comprising at least part of a SIM Operating System (SIM-OS) for operating the SIM.
13 . The server according to claim 12 , wherein the one or more processors are configured to further include, in the SIM-blob sent to the edge device, a profile of a network operator associated with the SIM.
14 . The server according to claim 13 , wherein the one or more processors are configured to further include, in the SIM-blob sent to the edge device, a certificate for subsequent changing of the profile.
15 . A method in an edge device, the method comprising:
in an edge device that communicates over a communication network and is pre-configured with security credentials assigned to a Subscriber Identity Module (SIM) of the edge device, receiving, over the communication network or over an alternative communication channel, at least a portion of a SIM-blob, the portion comprising at least part of a SIM Operating System (SIM-OS) for operating the SIM;
storing the SIM-blob in a memory;
provisioning the SIM-OS using the security credentials; and carrying out SIM tasks for the edge device using the SIM-OS.
16 . The method according to claim 15 , wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, further comprises a profile of a network operator associated with the SIM.
17 . The method according to claim 16 , wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, further comprises a certificate for subsequent changing of the profile.
18 . The method according to claim 15 , wherein receiving at least the portion of the SIM-blob comprises:
establishing a connection with the communication network using a dedicated SIM that is designated for SIM-blob provisioning and is running in a non-secure software environment; and
requesting and receiving at least the portion of the SIM-blob over the established connection.
19 . The method according to claim 15 , wherein receiving at least the portion of the SIM-blob comprises communicating over a non-cellular wireless network.
20 . The method according to claim 15 ,
wherein the SIM-blob is pre-stored in the memory in encrypted form using a unique key,
wherein the portion of the SIM-blob, received over the communication network or over the alternative channel, comprises the unique key, and
wherein provisioning the SIM-OS comprises decrypting the pre-stored SIM-blob using the received unique key.
21 .- 28 . (canceled)