Methods and apparatus for establishing a secure communication channel

An embedded Universal Integrated Circuit Card (eUICC) comprising:

• a memory;
• and
• one or more processors, wherein the eUICC is present in a wireless device, and wherein the memory includes instructions that when executed by a processor of the one or more processors, cause the eUICC to perform operations comprising:
• transmitting, to a server via the wireless device, a request to establish the secure connection with the server, wherein the server is associated with a long-term public key (PKserver) and a long-term private key (SKserver),
• producing a signature by using an eUICC long-term private key (SKeUICC),
• sending the signature to the server via the wireless device,
• authenticating the server using PKserver,
• generating an ephemeral public key (ePKeUICC) and an ephemeral private key (eSKeUICC),
• signing ePKeUICC using SKeUICC to produce a signed ePKeUICC,
• providing the signed ePKeUICC to the server via the wireless device,
• receiving, from the server via the wireless device, an ephemeral key (ePKserver) that is signed using SKserver,
• generating a shared symmetric key using SKeUICC and ePKserver, and
• establishing a secure connection with the server using the shared symmetric key.

An apparatus comprising:

• an embedded universal integrated circuit card, wherein the eUICC includes a memory;
• and one or more processors, wherein the memory includes instructions that when executed by a processor of the one or more processors, cause the eUICC to perform operations comprising:
• transmitting, to the server via the apparatus, a request to establish the secure connection with a server, wherein the request includes PKeUICC, wherein the server is associated with a long-term public key (PKserver) and a long-term private key (SKserver),
• producing a signature by using an eUICC a long-term private key (SKeUICC),
• sending the signature to the server via the apparatus,
• authenticating the server using PKserver,
• providing PKeUICC to the server,
• receiving, from the server via the apparatus, an ephemeral key (ePKserver) that is signed using SKserver,
• generating a shared symmetric key using SKeUICC and ePKserver, and
• establishing the secure connection using the shared symmetric key.