The invention concerns telecommunications and in particular subscriptions loaded on secure elements cooperating with terminals.

More precisely, the invention concerns the recovering of subscriptions profiles loaded in secure elements that are not retrievable from telecommunication terminals, like eUICCs (embedded UICCs, UICC meaning“Universal Integrated Circuit Card”) or iUICCs (integrated UICCs).

A eUICC is a secure element that contains one or more subscription profiles. Each profile enables the eUICC to function in the same way as a removable SIM card issued by the operator that created it. A eUICC may be built using any form factor from the traditional removable card to embedded formats soldered into devices.

A profile comprises of the operator data related to a subscription, including the operator’s credentials and potentially operator or third-party SIM based applications. Profiles are remotely downloaded over-the-air into a eUICC. Although the eUICC is an integral part of the device, the profile remains the property of the operator as it contains items“owned” by the operator (IMSI, ICCID, security algorithms, etc.) and is supplied under license. The content and structure for interoperable Profiles stored on eUICCs are similar to those installed on traditional SIMs. The inter-operable description of these Profiles is defined by the SIMAIIiance.

The GSMA Remote SIM Provisioning Consumer solution (GSMA SGP.22 ) follows a client driven (pull model) and enables control over remote provisioning and local management of operator profiles by the end user of the device. The solution is organized around 4 elements: the SM-DP+ (Subscription Manager - Data Preparation +), the SM-DS (Subscription Manager - Discovery Server), the LPA (Local Profile Assistant) and the eUICC.

When a Sim card is broken or lost, his owner (the end user) can go to a shop of his operator and ask for a new Sim card. This is however not possible for eUICCs or iUICCs when the terminal does not work anymore (a broken phone for example) or if the terminal is lost.

The invention proposes a way to recover the subscription profile of a user that has lost or broken his terminal (a mobile phone, a smartphone, a PDA, ...) and to reduce the risk to clone the subscription after having broken or lost his device in a solution that implements the specification GSMA SGP.22.

If a user has lost his terminal, he can buy another one and download a new profile each time he breaks or loses his terminal, but this implies that the operator will lose an IMSI/Ki and he will have to provision his HLR (Home Location Register) with the new profile. Moreover, the user might change from his previous MNO (Mobile Network Operator) to a new one. This represents a cost for the previous MNO.

In this respect, the invention proposes a method for recovering a profile of a MNO downloaded in a first secure element integrated in a first terminal at the level of a second secure element integrated in a second terminal, the method comprising:

Transmitting from the first terminal to a SM-DP+ a first secured message containing a personal code known by the user of the first terminal along with a unique identifier of the profile;

- After having checked that the first secure element is not operational anymore, sending from the MNO to the SM-DP+ a recover code known by the user and the unique identifier of the profile;

Sending from the second terminal to the SM-DP+ a second secured message containing the recover code, the personal code and a unique identifier of the second secure element; Comparing at the SM-DP+ the first and second messages and if they correspond, installing in the second secure element the profile and upon installation success, notifying the MNO that the profile has been installed in the second secure element.

The first and second messages are preferably secured through hash or AES encryption.

Other features and advantages of the invention will appear by reading the following description of a preferred embodiment of the invention in regard of the unique figure that represents a flowchart explaining the method of the invention.

In this figure, five elements are represented:

- An OTA server 10;

- A MNO server 1 1 (a point of sales, a back-end or a portal of the MNO for example);

- A SM-DP+ 12;

- A first device 13 comprising a LPA and a eUICC (or a iUICC);

- A second device 14 also comprising a LPA and a eUICC (or a iUICC).

The LPA (Local Profile Assistant) is a set of functions in the device responsible for providing the capability to download encrypted Profiles to the eUICC. It also presents the local management end user interface to the end user so they can manage the status of profiles on the eUICC. The principal functions of the LPA may also be in built into the eUICC.

The SM-DP+ 12 is responsible for the creation, download, remote management (enable, disable, update, delete) and the protection of operator credentials (the profile). It is given the + designation as it encapsulates the functions of both the SM-DP (Subscription Manager - Data Preparation) and the SM-SR (Subscription Manager - Secure Routing) of the M2M (Machine to Machine) solution.

This invention proposes the following steps:

Steps 100 to 103 are already existing in the GSMA specification:

At step 100, the MNO server 1 1 using GSMA specification books the subscription for the end user. An OrderDownload message is sent to the SM-DP+ 12. The latter waits for a request to download this subscription (profile) in a secure element.

At step 101 , the end user downloads the profile (using a QR code for example that is photographed by the user thanks to his device 13). A message“DownloadProfile” is sent to the SM-DP+ 12.

The profile is then downloaded in the secure element (called first secure element) comprised in the first device 13 and at step 102, the subscription is correctly installed on the first device 13 and this information is sent to the server (Install Success).

At step 103, the SM-DP+ 12 forwards the notification to the MNO server 1 1.

The communications between the MNO server 11 and the SM-DP+ 12 are done on the ES2+ channel and those between the device 13 and the SM-DP+ 12 are done on the ES9+ channel as defined by the GSMA.

The invention proposes the following steps for being able to retrieve later on the profile downloaded in the first secure element for installing it in a second secure element:

At step 104, automatically after an installation success, the LPA of the first device 13 proposes to the end user to create a backup of his profile in case of issue. If the end user accepts, a personal code is requested. This is the UserCode. The UserCode is securely provided to the SM-DP+ 12 like for example as a hashed UserCode = SHA256 (SHA256 (UserCode) | ICCID), signed by eUlCC’s credential and where '|' means concatenation of data. The aim is to trust backup order from end user.

SHA 256 is only an example, other hash functions can be used.

At step 105, after a while, the end user breaks or loses his first device 13. He communicates with the MNO Center 11 (mail, phone, tchat, shop, etc...) at step 106.

At step 107, the MNO 11 checks the end user with his usual process (personal question, password, etc, ...). MNO 1 1 gets information like name or MSISDN. With the notification received at step 103, the MNO is able to find the correct profile for this user (he associates the ICCID with the profile).

At step 108, the MNO 11 will test the MSISDN of this user. He can for example try to localize it, to make one audit, to send a SMS, etc... At step 109, no response comes from the first device 13.

At step 110, when the MNO 11 is sure of himself (the first secure element is not operational anymore), all verification and procedure done, the MNO 11 requests from the user his UserCode and the EID (identifier of his new device 14). The MNO 1 1 sends to the SM-DP+ 12 the following parameters: UserCode, RecoverCode, ICCID (of the first device 13), new EID (eUICC-ID of the second device 14). At reception of these parameters, the SM-DP+ 12 will check the UserCode (linked to the ICCID). If OK, the SM-DP+ 12 will prepare the subscription profile to be ready for a download on the new secure element.

At step 11 1 , the MNO 11 gives to the end user the“RecoverCode”. This can be done by e-mail, chat or by phone for example.

At step 112, the end user clicks on the button RESTORE on his LPA. The UserCode and the RecoverCode are requested and the RecoverCode is provided to the SM-DP+ 12 like:

Hashed RecoverCode = SHA256 (SHA256 (Recover Code) | SHA256 (SHA256 (UserCode) | ICCID)).

The aim is to trust recover order from the end user. The SM-DP+ 12 is able to compute the Hashed RecoverCode since he knows the UserCode and the RecoverCode.

After comparison of the two hashes, if they are equal, the download of the profile is done.

At step 113, the second device informs the SM-DP+ 12 that the installation was successful (same as step 102) in https.

At step 114, an installation success notification is sent to the MNO 1 1 (same as step 103) and at step 1 15, the MNO 1 1 could request to the OTA server 10 to send all updates needed for this profile.

The UserCode is preferably, for the sake of simplicity, the last PIN code chosen by the user of the first terminal. So, even if the user loses his first terminal, he will remember his last PIN code. This can be done automatically: When the user changes his PIN code, it is considered as being the UserCode and sent to the SM-DP+ 12.

Instead of using hash functions, it is also possible to use AES with SCP03t: At step 101 , it is known to establish ephemeral session keys for securing the download of the profile. The SM-DP+ 12 encrypts the profile and the eUICC 13 decrypts it. This mechanism can be used inversely at step 104: Other ephemeral session keys are generated and the eUICC 12 encrypts the UserCode that is then decrypted by the SM-DP+ 12. At step 1 12, the second message is encrypted using AES. This procedure is described in SGP 22v.2.2.

The advantages brought by the invention are that if the profile is really lost, there is the possibility to download again the same profile. This: represents a gain of IMSI/KI for the MNO (re-use without IMSI/KI cloning); avoids any rework / provisioning on HLR for the MNO (better go to market); gives a way to retain the end user of the initial MNO;

permits to the end user to recover a quick connectivity.