# US 10,771,943 B1 · Privacy-enhanced method for linking an eSIM profile > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,943 B1 - Document ID: US10771943B1 - Status: Granted - Kind: B1 - Application number: 16/378,441 - Filed: 2019-04-08 - Published: 2020-08-20 - Granted: 2020-09-08 - Earliest claimed: 2019-02-19 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: John David Bruner - Web page: https://patentgrep.com/patent/US10771943B1 ## CPC - H04W 4/50: Service provisioning or reconfiguring - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3247: {involving digital signatures} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04W 8/24: Transfer of terminal data - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/06: Authentication - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - H04W 12/40: Security arrangements using identity modules - H04W 12/48: using secure binding, e.g. securely binding identity modules to devices, services or applications - H04W 76/11: Allocation or use of connection identifiers - H04L 63/166: {at the transport layer} - H04L 2209/42: Anonymization, e.g. involving pseudonyms - H04W 8/205: {Transfer to or from user equipment or user record carrier} - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/71: Hardware identity - H04W 12/75: Temporary identity - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A temporary EID (TEID) is generated based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm. The hash is generated based on the indicator, nonce, and EID of a mobile device. The TEID is sent to the mobile network operator to identify the mobile device in lieu of using the device's EID. The TEID is stored in a data store and an eSIM profile for the mobile device is associated the TEID. The mobile device sends to an eSIM server the device's EID over a secure communications channel. The eSIM server generates a hash using the indicator and nonce contained in the stored TEID and the EID of the mobile device. The eSIM server verifies that the generated hash matches the hash contained in the TEID stored in the data store. If the hash matches, the eSIM server sends, to the mobile device, subscription credentials for accessing the mobile network in accordance with the data plan. ## Claims ### Claim 1 A method of provisioning a mobile device configured to communicate on a mobile communications network operated by a mobile network operator, the method comprising: determining, by the mobile device in communication with the mobile network operator, a data plan for accessing the mobile communications network operated by the mobile network operator; generating, by the mobile device, a temporary EID (TEID) based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm, wherein the hash is generated based on the indicator, nonce, and EID of the mobile device; sending, by the mobile device to the mobile network operator, the TEID to identify the mobile device in lieu of using the device's EID, wherein the TEID is stored in a data store and an eSIM profile for the mobile device is associated the TEID; receiving, by the mobile device from the mobile network operator, an activation code associated with the data plan; sending, by the mobile device to an eSIM server indicated by the activation code, the device's EID over a secure communications channel; and receiving, by the mobile device via the secure communications channel, subscription credentials for accessing the mobile communications network operated by the mobile network operator in accordance with the data plan, the subscription credentials provided based in part on a verification of the hash contained in the TEID stored in the data store to a hash generated using the indicator and nonce contained in the stored TEID and the device's EID received over the secure communications channel. ### Claim 2 (depends on 1) The method of claim 1, wherein the eSIM server is an SM-DP+ server, the location of which is included in the activation code. ### Claim 3 (depends on 1) The method of claim 1, wherein the activation code identifies a SIM profile to be obtained from the mobile network operator. ### Claim 4 (depends on 1) The method of claim 1, wherein the TEID is a concatenation of the hash algorithm indicator, nonce, and the generated hash. ### Claim 5 (depends on 1) The method of claim 1, wherein the verification comprises generating a hash using the hash algorithm using the indicator, nonce, and the received EID. ### Claim 6 (depends on 1) The method of claim 1, wherein the hash algorithm is one of SHA-256, SHA-512, or SM3. ### Claim 7 A computing device comprising: a memory storing thereon instructions that when executed by a processor of the computing device, cause the computing device to perform operations comprising: receiving an EID associated with a mobile device and an activation code associated with an eSIM profile for the mobile device that is associated with a temporary EID (TEID), wherein the eSIM profile is associated with a data plan for the mobile device for accessing a mobile network operated by a mobile network operator; accessing, from a data store, the TEID, wherein the TEID is generated based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm, and wherein the hash is generated based on the indicator, nonce, and an EID of the mobile device; generating a hash using the indicator and nonce contained in the stored TEID and the received EID of the mobile device; verifying that the generated hash matches the hash contained in the TEID accessed from the data store; and based on the verifying, sending, to the mobile device, subscription credentials for accessing the mobile network in accordance with the data plan. ### Claim 8 (depends on 7) The computing device of claim 7, wherein the computing device is an SM-DP+ server, the location of which is included in the activation code. ### Claim 9 (depends on 7) The computing device of claim 7, wherein the activation code identifies the subscription credentials to be sent to the mobile device. ### Claim 10 (depends on 7) The computing device of claim 7, wherein the TEID is a concatenation of the hash algorithm indicator, nonce, and the generated hash. ### Claim 11 (depends on 7) The computing device of claim 7, wherein the hash algorithm is one of SHA-256, SHA-512, or SM3. ### Claim 12 A method of provisioning a mobile device configured to communicate on a mobile communications network operated by a mobile network operator, the method comprising: determining, by the mobile device in communication with the mobile network operator, a data plan for accessing the mobile communications network operated by the mobile network operator; generating, by the mobile device, a temporary EID (TEID) based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm, wherein the hash is generated based on the indicator, nonce, and EID of the mobile device; sending, by the mobile device to the mobile network operator, the TEID to identify the mobile device in lieu of using the device's EID, wherein the TEID is stored in a data store and an eSIM profile for the mobile device is associated the TEID; sending, by the mobile device to an eSIM server, the device's EID over a secure communications channel; and receiving, by the mobile device via the secure communications channel, subscription credentials for accessing the mobile communications network operated by the mobile network operator in accordance with the data plan, the subscription credentials provided based in part on: a verification of the hash contained in the TEID stored in the data store to a hash generated using the indicator and nonce contained in the stored TEID and the device's EID received over the secure communications channel. ### Claim 13 (depends on 12) The method of claim 12, wherein the subscription credentials are further provided based in part on: based on the TEID, determining that delivery of the subscription credentials for the mobile device is pending. ### Claim 14 (depends on 13) The method of claim 13, wherein determining that delivery of the subscription credentials for the mobile device is pending comprises: matching the TEID with stored TEIDs that are associated with pending subscription credentials. ### Claim 15 (depends on 12) The method of claim 12, wherein the eSIM server is an SM-DP+ server. ### Claim 16 (depends on 12) The method of claim 12, wherein a location of the eSIM server is provided by a discovery server. ### Claim 17 (depends on 12) The method of claim 12, wherein the TEID is a concatenation of the hash algorithm indicator, nonce, and the generated hash. ### Claim 18 (depends on 12) The method of claim 12, wherein the verification comprises generating a hash using the hash algorithm using the indicator, nonce, and the received EID. ### Claim 19 (depends on 12) The method of claim 12, wherein the hash algorithm is one of SHA-256, SHA-512, or SM3. ### Claim 20 (depends on 12) The method of claim 12, wherein the subscription credentials are pre-arranged to be available for the mobile device.