Credential handling of an IoT safe applet

A method for handling credentials of an IoT SAFE applet, the method being performed by a network node, the method comprising:

• generating credentials for the IoT SAFE applet;
• providing the credentials for the IoT SAFE applet to a communication device;
• establishing, using at least one of the credentials, secure communication with the communication device;
• providing a trigger to the communication device for establishment of further credentials;
• obtaining a proof of establishment of the further credentials by the IoT SAFE applet of the communication device and a any public part of the further credentials;
• and
• verifying, using the proof of establishment, at least one of the credentials, and the public part of the further credentials, that the further credentials have been securely established inside a security domain of the IoT SAFE applet.

A communication device for handling credentials of an IoT SAFE applet, wherein the communication device is storing the IoT SAFE applet in a first security domain of a subscription module in the communication device, wherein the first security domain is free from any subscription profile and is different from any security domain of the subscription module for storing subscription profiles, and wherein the IoT SAFE applet is independent from any mobile network operator (MNO), and wherein the communication device is without credentials for the IoT SAFE applet for establishing secure communication for the communication device with a network node, the communication device comprising processing circuitry, the processing circuitry being configured to cause the communication device to:

• obtain credentials for the IoT SAFE applet from the network node;
• store the credentials in the first security domain of the subscription module, wherein the credentials, after successful storage, are accessible only from within the first security domain;
• establish, using the IoT SAFE applet and at least one of the credentials, secure communication for the communication device with the network node;
• obtain a trigger for establishment of further credentials, wherein the trigger is set by the network node or an application in the communication device;
• wherein the further credentials are established by the IoT SAFE applet and then stored inside the first security domain of the subscription module, and wherein the further credentials are, when stored in the first security domain, marked as usable independently of which subscription profile is active in the communication device;
• generate a proof of establishment in the first security domain of the subscription module that the further credentials have been established by the IoT SAFE applet, wherein at least one of the credentials already stored in the first security domain of the subscription module is used in establishing the proof;
• and
• provide the proof of establishment and any public part of the further credentials of the communication device to the network node for verification of the proof of establishment.

A network node for handling credentials of an IoT SAFE applet, the network node comprising processing circuitry, the processing circuitry being configured to cause the network node to:

• generate credentials for the IOT SAFE applet;
• provide the credentials for the IoT SAFE applet to a communication device;
• establish, using at least one of the credentials, secure communication with the communication device;
• provide a trigger to the communication device for establishment of further credentials;
• obtain a proof of establishment of the further credentials by the IoT SAFE applet of the communication device and a public part of the further credentials;
• and
• verify, using the proof of establishment, at least one of the credentials, and the public part of the further credentials, that the further credentials have been securely established inside a security domain of the IoT SAFE applet.