Embedded subscriber identification module with secure profiles

A device, comprising:

• a processor;
• and
• an embedded subscriber identification module (eSIM), comprising:
• a secure memory;
• and
• a physical memory manager configured to;
• receive a first request, to load a first profile for accessing a first mobile network in the secure memory of the eSIM, from a first mobile network operator,
• responsive to authenticating the first request:
• create a first partition, in the secure memory of the eSIM, associated with the first mobile network operator;
• store, in the first partition in the eSIM, the first profile;
• and
• limit access to the first partition in the eSIM to the first mobile network operator,
• receive a second request to access the first profile in the first partition,
• authenticate the second request using a credential in the second request, and
• responsive to determining that the second request corresponds to the first mobile network operator, allow the second request.

A device, comprising:

• a processor;
• and
• an embedded subscriber identification module (eSIM), comprising:
• a secure memory;
• and
• a physical memory manager configured to:
• receive a first request, to load a first profile for accessing a first mobile network in the secure memory of the eSIM, from a first mobile network operator, and
• responsive to authenticating the first request:
• create a first partition, in the secure memory of the eSIM, associated with the first mobile network operator;
• store, in the first partition in the eSIM, the first profile;
• lock the first partition after storing in the first partition the first profile;
• and
• limit access to the first partition in the eSIM to the first mobile network operator.

A method for securing profiles in an embedded subscriber identification module (eSIM), comprising:

• receiving, from a first mobile network operator, a first request to load, in a secure memory of a device, a first profile for accessing a first mobile network using a transceiver of the device;
• responsive to authenticating the first request, creating a first partition, in the secure memory, associated with the first mobile network operator;
• storing the first profile in the first partition;
• limiting access to the first partition to the first mobile network operator;
• receiving a second request, from a second mobile network operator, to load a temporary profile for accessing a second mobile network using the transceiver;
• responsive to authenticating the second request, storing the temporary profile in a temporary partition in the secure memory;
• and
• erasing the temporary profile after termination of services with the second mobile network operator.

A device, comprising:

• a transceiver;
• and
• an embedded subscriber identification module (eSIM), comprising:
• a secure memory comprising:
• a temporary partition;
• a first partition storing a first profile, associated with a first mobile network operator, for accessing a first mobile network using the transceiver, and
• a second partition storing a second profile, associated with a second mobile network operator, for accessing a second mobile network using the transceiver;
• and
• a physical memory manager configured to:
• limit access to the first partition to the first mobile network operator,
• limit access to the second partition to the second mobile network operator,
• receive a request from a third mobile network operator to load, in the secure memory, a temporary profile for accessing a third mobile network using the transceiver, and
• responsive to authenticating the request:
• store, in the temporary partition, the second profile;
• and
• erase the temporary profile after termination of services with the third mobile network operator.