Managing embedded universal integrated circuit card (eUICC) provisioning with multiple certificate issuers (CIs)
Embodiments provided herein identify a certificate issuer (CI) to be relied on as a trusted third party by an electronic subscriber identity module (eSIM) server in remote SIM provisioning (RSP) transactions with an embedded universal integrated circuit card (eUICC). In an RSP ecosystem, multiple CIs may exist. Parties rely on public key infrastructure (PKI) techniques for establishment of trust. Trust may be established based on a trusted third party such as a CI. Parties need to agree on the CI in order for some PKI techniques to be useful. Embodiments provided herein describe approaches for an eUICC and an eSIM server to arrive at an agreed-on CI. Candidate or negotiated CIs may be indicated on a public key identifier (PKID) list. A PKID list is distributed, in some embodiments, by means of a discovery server, via an activation code (AC) and/or during the establishment of a profile provisioning session.
1. A method comprising:
by an electronic subscriber identity module (eSIM) server during a remote subscriber identity module provisioning (RSP) session:
receiving, from an embedded universal integrated circuit card (eUICC), an eUICC challenge and an eUICC information data structure;
receiving, from the eUICC, a public key identifier (PKID) list obtained by the eUICC from an activation code (AC) message;
selecting a certificate issuer (CI) to be used by the eSIM server as a trusted third party, wherein the selecting is based on the PKID list and produces a selected CI;
signing the eUICC challenge using a private key during a profile installation flow to create a signature, wherein a public key corresponding to the private key is included in a certificate of the eSIM server signed by the selected CI; and
sending, to the eUICC, the certificate signed by the selected CI, the signature, and an indication of a second CI to be used by the eUICC for signing operations.
2. The method of claim 1 , wherein the second CI to be used by the eUICC for signing operations is the selected CI.
3. The method of claim 1 , wherein the second CI to be used by the eUICC for signing operation is different from the selected CI.
4. The method of claim 1 , wherein:
the certificate is a certificate of the eSIM server used for authentication; and
the public key included in the certificate is an elliptic curve cryptography digital signature algorithm (ECDSA) key.
5. The method of claim 1 , further comprising:
by the eSIM server:
signing metadata using the private key, to create a second signature; and
sending, to the eUICC, the metadata, the second signature, and a second certificate of the eSIM server signed by the selected CI.
6. The method of claim 5 , wherein:
the second certificate is a certificate of the eSIM server used for profile package binding.
7. The method of claim 1 , further comprising:
by the eSIM server:
receiving from the eUICC an eUICC certificate that includes an eUICC public key and is signed using the second CI indicated by the eSIM server to be used by the eUICC in signing operations.
8. The method of claim 7 , further comprising:
by the eSIM server:
providing to the eUICC a bound profile package (BPP) for installation of a profile using one or more keys associated with the selected CI.
9. The method of claim 1 , wherein information in the eUICC information data structure is not reduced or sorted based on the PKID list obtained from the AC message.
10. A method comprising:
at an embedded universal integrated circuit card (eUICC) housed in a device:
sending to an electronic subscriber identity module (eSIM) server an eUICC challenge and an eUICC information data structure;
receiving an activation code (AC) message that includes a public key identifier (PKID) list;
providing the PKID list to the eSIM server during a remote subscriber identity module provisioning (RSP) session; and
receiving from the eSIM server:
a certificate signed by a first certificate issuer (CI) selected by the eSIM server based on the PKID list, and
an indication of a second CI to be used by the eUICC for signing operations.
11. The method of claim 10 , wherein the AC message is received via a web portal.
12. The method of claim 10 , wherein the second CI to be used by the eUICC in signing operations is the first CI selected by the eSIM server based on the PKID list.
13. The method of claim 10 , wherein the second CI to be used by the eUICC for signing operation is different from the first CI selected by the eSIM server based on the PKID list.
14. The method of claim 10 , wherein:
the certificate is a certificate of the eSIM server used for authentication.
15. The method of claim 10 , further comprising:
by the eUICC:
sending to the eSIM server an eUICC certificate that includes an eUICC public key and is signed using the second CI;
receiving from the eSIM server a bound profile package (BPP) for installation of a profile using one or more keys associated with the first CI; and
installing the profile on the eUICC.
16. An embedded universal integrated circuit card (eUICC) configurable for operation in a device, the eUICC comprising:
a processor, and
a memory communicatively coupled to the processor and storing instructions that, when executed by the processor, cause the eUICC to perform actions including:
sending to an electronic subscriber identity module (eSIM) server an eUICC challenge and an eUICC information data structure;
receiving, via a web portal, an activation code (AC) message that includes a public key identifier (PKID) list;
providing the PKID list to the eSIM server during a remote subscriber identity module provisioning (RSP) session; and
receiving from the eSIM server:
a certificate signed by a first certificate issuer (CI) selected by the eSIM server based on the PKID list, and
an indication of a second CI to be used by the eUICC for signing operations.
17. The eUICC of claim 16 , wherein the second CI to be used by the eUICC in signing operations is the first CI selected by the eSIM server based on the PKID list.
18. The eUICC of claim 16 , wherein the second CI to be used by the eUICC for signing operation is different from the first CI selected by the eSIM server based on the PKID list.
19. The eUICC of claim 16 , wherein:
the certificate is a certificate of the eSIM server used for authentication.
20. The eUICC of claim 16 , wherein the actions performed by the eUICC further include:
sending to the eSIM server an eUICC certificate that includes an eUICC public key and is signed using the second CI;
receiving from the eSIM server a bound profile package (BPP) for installation of a profile using one or more keys associated with the first CI; and
installing the profile on the eUICC.