Provision of application level identity

A method for provisioning of an application level identity from an ID backend server to a communication device;

• wherein the provisioning of the application level identity is protected using Transport Layer Security (TLS)-, Datagram Transport Layer Security (DTLS)-, or Object Security for Constrained RESTful Environments (OSCORE)-based secure communication;
• wherein the communication device comprises an identity module configured for interaction according to Global System for Mobile Communications Association Remote Subscriber Identity Module (SIM) Provisioning (GSMA RSP) based remote subscription profile download, the method comprising the ID backend server:
• receiving a first message from the communication device to establish secure communication with the communication device, wherein the first message is a ClientHello message of a TLS handshake protocol and comprises an identity module challenge;
• transmitting a second message to the communication device as a part of establishing the secure communication with the communication device, wherein the second message is provided as a combination of a ServerHello message, a CertificateRequest message indicating a request for a first identity module certificate, a Certificate message comprising an ID backend certificate, a Certificate Verify message comprising an ID backend signature for authentication of the ID backend server at the communication device, and a Finished message of the TLS handshake protocol;
• receiving a third message from the communication device as a part of establishing the secure communication with the communication device, wherein the third message comprises a first identity module signature for authentication of the communication device at the ID backend server;
• establishing a secure connection between the communication device and the ID backend server based on the received third message;
• and
• transmitting a fourth message to the communication device, wherein the fourth message comprises an application level identity information and is protected using the established secure communication with the communication device.

A communication device for provisioning of an application level identity from an ID backend server to the communication device, wherein the provisioning of the application level identity is protected using Transport Layer Security (TLS)-, Datagram Transport Layer Security (DTLS)-, or Object Security for Constrained RESTful Environments (OSCORE)-based secure communication;

• wherein the communication device comprises an identity module configured for interaction according to Global System for Mobile Communications Association Remote Subscriber Identity Module (SIM) Provisioning (GSMA RSP) based remote subscription profile download;
• the communication device comprising:
• processing circuitry;
• memory containing instructions executable by the processing circuitry whereby the communication device is operative to:
• transmit a first message to the ID backend server to establish secure communication with the ID backend server, wherein the first message is a ClientHello message of a TLS handshake protocol and comprises an identity module challenge;
• receive a second message from the ID backend server as a part of establishing the secure communication with the ID backend server, wherein the second message is provided as a combination of a ServerHello message, a CertificateRequest message indicating a request for an identity module certificate, a Certificate message comprising an ID backend certificate, a Certificate Verify message comprising an ID backend signature for authentication of the ID backend server at the communication device, and a Finished message of the TLS handshake protocol;
• transmit a third message to the ID backend server as a part of establishing the secure communication with the ID backend server, wherein the third message comprises an identity module signature for authentication of the communication device at the ID backend server, wherein a secure connection is established between the communication device and the ID backend server based on the third message;
• and
• receive a fourth message from the ID backend server, wherein the fourth message comprises an application level identity information and is protected using the established secure communication with the ID backend server.

An ID backend server for provisioning of an application level identity from the ID backend server to a communication device, wherein the provisioning of the application level identity is protected using Transport Layer Security (TLS)-, Datagram Transport Layer Security (DTLS)-, or Object Security for Constrained RESTful Environments (OSCORE)-based secure communication;

• wherein the communication device comprises an identity module configured for interaction according to Global System for Mobile Communications Association Remote Subscriber Identity Module (SIM) Provisioning (GSMA RSP) based remote subscription profile download;
• the ID backend server comprising:
• processing circuitry;
• memory containing instructions executable by the processing circuitry whereby the ID backend server is operative to:
• receive a first message from the communication device to establish secure communication with the communication device, wherein the first message is a ClientHello message of a TLS handshake protocol and comprises an identity module challenge;
• transmit a second message to the communication device as a part of establishing the secure communication with the communication device, wherein the second message is provided as a combination of a ServerHello message, a CertificateRequest message indicating a request for an identity module certificate, a Certificate message comprising an ID backend certificate, a Certificate Verify message comprising an ID backend signature for authentication of the ID backend server at the communication device, and a Finished message of the TLS handshake protocol;
• receive a third message from the communication device as a part of establishing the secure communication with the communication device, wherein the third message comprises an identity module signature for authentication of the communication device at the ID backend server;
• establish a secure connection between the communication device and the ID backend server based on the received third message;
• and
• transmit a fourth message to the communication device, wherein the fourth message comprises an application level identity information and is protected using the established secure communication with the communication device.