Remote SIM provisioning

Origin

The GSM Association (GSMA), which brings together about 800 operators and 250 mobile ecosystem companies, became the first to come up with the Consumer Remote SIM Provisioning initiative. The technology was announced in the summer of 2014. The complete version of the specification was released in February 2016. Initially, the specification was supposed to be used just by M2M devices, but since December 2015, it has started to spread over various custom wearable devices, and into enterprise applications like authentication and identity management.

"This new specification gives consumers the freedom to remotely connect devices, such as wearables, to a mobile network of their choice and continues to evolve the process of connecting new and innovative devices," said Alex Sinclair, Chief Technology Officer, GSMA.

Besides, the right of independent service providers to transmit commands for loading profiles to SIM cards in the device has been amended, and the possibility to store arrays of profiles in independent certified data centers (Subscriptions manager) has appeared.

Functions and benefits

The specification that covers the carrier selection aspects aims to allow consumers to choose a mobile network operator from a wide range to activate the SIM embedded in a device via a subscription. It aims to simplify users' lives by connecting their multiple devices through the same subscription. It should also motivate mobile device manufacturers to develop the next generation of mobile-connected devices that will better suit wearable technology applications. The specification that covers carrier selection for M2M devices is simpler since typically there is no subscriber involved (e.g., changing the operator in an electricity meter).

The language that is used to describe this specification can be confusing since eSIM is not a physical format (or "form factor" - the phrase used to describe the various SIM sizes). The eSIM describes the functionality in the SIM, not the physical size of the SIM - and there are eSIMs in many formats (2FF, 3FF, 4FF, MFF).

GSMA has also developed a compliance framework for eSIM devices, eUICCs, and subscription management products — to help with interoperability and security for products supporting eSIM. This is published by the GSMA as SGP.24. The eSIM compliance process describes common compliance requirements for:

• Functional interoperability
• eUICC security
• eUICC production site security
• Subscription Management site security

Operation

For consumer devices, remote provisioning on the host device is initiated by the Local Profile Assistant (LPA), a software package that follows the consumer eSIM RSP specifications SGP.21/22.

When the LPA wants to retrieve a carrier profile, it contacts a subscription manager (SM) service on the internet via HTTPS. The address of the SM can be defined:

• in a QR code scanned by the user
• by manually entering the SM's host name/activation code on screen
• hard-coded by the host device manufacturer in firmware.
• via a universal discovery service operated by the GSMA.

The LPA is responsible for validating that the X.509 certificate of the SM is valid and issued by the GSMA certificate authority. Once validation is complete, the LPA will coordinate a secure channel between the eUICC and the SM using challenge-response authentication to enter programming mode. The LPA will request carrier profiles available for download, either by submitting the activation code provided by the user or the eSIM ID (EID) of the eUICC. The SM will provide the requested profile encrypted in a way that only the eUICC can decrypt/install to ensure the network authentication key remains secure.

RSP works slightly differently for IoT devices, following GSMA's technical specifications as outlined in SGP.31/32. The eSIM IoT specification replaces the LPA with IPA (IoT Profile Assistant) that lives either in the eUICC (IPAe) or the device (IPAd). Remote SIM Provisioning in IoT is managed in a new technical component, the eIM (eSIM IoT Manager) – the software that sends the user commands to the IPA .