# US 2019/0246265 A1 · Management systems for multiple access control entities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0246265 A1 - Document ID: US20190246265A1 - Status: Published application - Kind: A1 - Application number: 16/267,160 - Filed: 2019-02-04 - Published: 2019-08-08 - Earliest claimed: 2010-10-28 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: Stephan V. SCHELL; David T. HAGGERTY - Web page: https://patentgrep.com/patent/US20190246265A1 ## CPC - H04W 8/205: {Transfer to or from user equipment or user record carrier} - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - H04W 12/43: using shared identity modules, e.g. SIM sharing - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and apparatus for managing multiple user access control entities or clients. For example, in one embodiment, a “wallet” of electronic subscriber identity modules (eSIMs) may be stored and used at a user device and/or distributed to other devices for use thereon. In another embodiment, a networked server may store and distribute eSIM to a plurality of user devices in communication therewith. A database of available eSIM is maintained at the wallet entity and/or at the network which enables request for a particular eSIM to be processed and various rules for the distribution thereof to be implemented. Security precautions are implemented to protect both user and network carrier specific data as the data is transmitted between networked entities. Solutions for eSIM backup and restoration are also described. ## Claims ### Claim 1 A method for managing electronic Subscriber Identity Modules (eSIMs) for mobile devices, the method comprising, at a server device: receiving a request to provide an eSIM to a mobile device; and in response to validating the request: retrieving the eSIM, personalizing the eSIM to the mobile device based on one or more of a Mobile Network Operation (MNO), the mobile device, or a user associated with the mobile device, generating a new record for the eSIM in a database, wherein: the new record associates the mobile device with the eSIM, and the new record indicates the eSIM is in-use by the mobile device, and providing the eSIM to the mobile device. ### Claim 2 (depends on 1) The method of claim 1, wherein the request is received from: the mobile device; a computing device associated with the mobile device; or an account management entity associated with the mobile device. ### Claim 3 (depends on 1) The method of claim 1, further comprising, prior to providing the eSIM to the mobile device: encrypting the eSIM based on asymmetric cryptography, and/or generating a hash of the eSIM. ### Claim 4 (depends on 3) The method of claim 3, wherein encrypting the eSIM based on asymmetric cryptography comprises: encrypting the eSIM using a public key associated with the mobile device, wherein a counterpart private key to the public key is known only to the mobile device. ### Claim 5 (depends on 1) The method of claim 1, further comprising, subsequent to providing the eSIM to the mobile device: initiating an over-the-air-service-provisioning (OTASP) with the mobile device to provide updates to the eSIM, wherein the updates enable the mobile device to access at least one new service that was previously not accessible to the mobile device. ### Claim 6 (depends on 1) The method of claim 1, wherein validating the request comprises: issuing a cryptographic challenge to the mobile device; receiving a response to the cryptographic challenge; and verifying the response. ### Claim 7 A method for managing electronic Subscriber Identity Modules (eSIMs) for mobile devices, the method comprising, at a server device: receiving a request to provide an eSIM to a mobile device; and in response to validating the request: providing, to the mobile device, a list of eSIMs that are eligible to be provided to the mobile device, receiving, from the mobile device, a selection of a particular eSIM from the list of eSIMs, providing the particular eSIM to the mobile device, and updating a database to reflect that the particular eSIM is stored by the mobile device. ### Claim 8 (depends on 7) The method of claim 7, wherein the request is received from: the mobile device; a computing device associated with the mobile device; or an account management entity associated with the mobile device. ### Claim 9 (depends on 7) The method of claim 7, further comprising, prior to providing the particular eSIM to the mobile device: encrypting the particular eSIM based on asymmetric cryptography, and/or generating a hash of the particular eSIM. ### Claim 10 (depends on 9) The method of claim 9, wherein encrypting the particular eSIM based on asymmetric cryptography comprises: encrypting the particular eSIM using a public key associated with the mobile device, wherein a counterpart private key to the public key is known only to the mobile device. ### Claim 11 (depends on 7) The method of claim 7, further comprising, subsequent to providing the particular eSIM to the mobile device: initiating an over-the-air-service-provisioning (OTASP) with the mobile device to provide updates to the particular eSIM, wherein the updates enable the mobile device to access at least one new service that was previously not accessible to the mobile device. ### Claim 12 (depends on 7) The method of claim 7, wherein validating the request comprises: issuing a cryptographic challenge to the mobile device; receiving a response to the cryptographic challenge; and verifying the response. ### Claim 13 (depends on 12) The method of claim 12, wherein validating the request further comprises, subsequent to verifying the response: verifying that the mobile device is included in a list of authorized devices. ### Claim 14 (depends on 7) The method of claim 7, wherein validating the request comprises: verifying a username and a password included in the request. ### Claim 15 A method for managing electronic Subscriber Identity Modules (eSIMs) for mobile devices, the method comprising, at a server device: receiving, from a mobile device, a request to store an eSIM managed by the mobile device; and in response to validating the request: receiving the eSIM from the mobile device, storing the eSIM into a plurality of eSIMs managed by the server device, and updating a database to reflect that the eSIM is stored by the server device. ### Claim 16 (depends on 15) The method of claim 15, wherein validating the request comprises at least one of: verifying an identify of a user of the mobile device, determining whether at least one first condition associated with at least one eSIM managed by the mobile device is satisfied, determining whether at least one second condition associated with at least one eSIM managed by the server device is satisfied, wherein the at least one eSIM is associated with the mobile device, determining whether a first threshold is satisfied for fraudulent activity, or determining whether a second threshold is satisfied for accidental activity. ### Claim 17 (depends on 15) The method of claim 15, wherein updating the database to reflect that the eSIM is stored by the server device comprises: updating a status indicator to indicate that the eSIM is available. ### Claim 18 (depends on 15) The method of claim 15, further comprising, subsequent to updating the database to reflect that the eSIM is stored by the server device: causing the mobile device to delete the eSIM. ### Claim 19 (depends on 15) The method of claim 15, wherein, when the eSIM remains stored on both the mobile device and the server device, updating the database comprises: reflecting that the eSIM is in use and cannot be provided to another mobile device. ### Claim 20 (depends on 15) The method of claim 15, wherein the mobile device transmits the request in response to an expiration of a predetermined period of time.