# US 2026/0095751 A1 · Anti-replay protection techniques for dynamically shareable profiles on embedded universal integrated circuit cards

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0095751 A1
- Document ID: US20260095751A1
- Status: Published application
- Kind: A1
- Application number: 18/900,503
- Filed: 2024-09-27
- Published: 2026-04-02
- Earliest claimed: 2024-09-27
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Viswanath Nagarajan; Jean-Marc Padova; Ngabin S. Ng; Aurelien P. Raboisson; Didimo Raffo; Abishek Kumar Vaidyanathan
- Web page: https://patentgrep.com/patent/US20260095751A1

## CPC

- H04W 8/205: {Transfer to or from user equipment or user record carrier}
- H04W 8/265: {for initial activation of new user}
- H04W 8/30: Network data restoration; {Network data reliability; Network data fault tolerance}
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A user equipment (UE), baseband processor, embedded universal integrated circuit card (eUICC), and network device (e.g., a shared profile vendor server) are described. A UE that includes an eUICC can perform transmitting, for receipt by a shared profile vendor server, a first message of a shared profile operational international mobile subscriber identity (IMSI) provisioning procedure. The first message may include a randomized IMSI. In response to the first message, the UE may receive a second message that includes an indication of a time counter value. In response to the second message, the UE may transmit, in response to determining that the time counter value is valid, a third (e.g., penultimate) message to the bootstrap vendor server. The UE may then receive in response a fourth message (e.g., final) of the shared profile operational IMSI provisioning procedure, the fourth message including a shared profile operational IMSI for the eUICC.

## Claims

### Claim 1

A method of wireless communication at an embedded universal integrated circuit card (eUICC), comprising:
receiving a request for a randomized international mobile subscriber identity (IMSI);
transmitting a randomized IMSI responsive to the request;
receiving, at least in part in response to the request for the randomized IMSI, an indication of a time counter value and a first nonce value associated with a shared profile operational IMSI provisioning procedure;
determining whether the time counter value and the first nonce value are valid;
determining, based at least in part on the time counter value and the first nonce value, whether a message comprising the indication of the time counter value and the first nonce value is accepted for processing;
determining, based at least in part on the acceptance of the message for processing, whether the subsequent messages should be generated or accepted for processing; and
receiving, based at least in part on a determination that the time counter value and the first nonce value are valid, a shared profile operational IMSI for the eUICC.

### Claim 2 (depends on 1)

The method of claim 1, wherein determining whether the time counter value is valid comprises:
comparing the indicated time counter value with a second time counter value stored at the eUICC prior to the receipt of the request for the randomized IMSI;
determining that the indicated time counter value and the first nonce value are invalid based at least in part on the indicated time counter value being older than the second time counter value; and
transmitting a failure message that indicates that the indicated time counter value and the first nonce value are invalid.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
comparing the indicated time counter value and the first nonce value with a second time counter value and a second nonce value stored at the eUICC prior to the receipt of the request for the randomized IMSI;
determining that the indicated time counter value is invalid based at least in part on both the first nonce value and the second nonce value having a same value, and the indicated time counter value and the second time counter value having a same value; and
transmitting a failure message that indicates that the indicated time counter value is invalid.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
determining, based at least in part on receiving the indicated time counter value and the first nonce value, that a threshold quantity of time counter value-nonce value tuples has been exceeded;
determining that the indicated time counter value is invalid based at least in part on the threshold quantity of time counter value-nonce value tuples having been exceeded; and
transmitting a failure message that indicates that the indicated time counter value is invalid.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
transmitting, based at least in part on the determination that the time counter value is valid, a message for receipt by a bootstrap vendor server; and
receiving, at least in part in response to the message, the shared profile operational IMSI from the bootstrap vendor server.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving a plurality of messages associated with the shared profile operational IMSI provisioning procedure and including a plurality of tuples, each tuple of the plurality of tuples including a time counter value, a nonce value, and a randomized IMSI for the message;
storing the plurality of tuples at the eUICC; and
comparing the time counter value with the plurality of tuples to determine whether the time counter value is valid.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
obtaining a first key of a key pair, wherein a second key of the key pair is known to a bootstrap vendor server that provides the shared profile operational IMSI; and
decrypting, by the eUICC and using the first key, a message that comprises the indication of the time counter value associated with the shared profile operational IMSI provisioning procedure to obtain the time counter value.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
generating the randomized IMSI, wherein the eUICC checks a set of time counter value-nonce value tuples such that the randomized IMSI is not in the set of time counter value-nonce value tuples.

### Claim 9 (depends on 1)

The method of claim 1, wherein the eUICC determines whether the time counter value and the first nonce value are valid without a UE that includes the eUICC validating the time counter value.

### Claim 10

An embedded universal integrated circuit card (eUICC) comprising a memory and configured to:
receive a request for a randomized international mobile subscriber identity (IMSI);
transmit a randomized IMSI responsive to the request;
receive, at least in part in response to the request for the randomized IMSI, an indication of a time counter value associated with a shared profile operational IMSI provisioning procedure;
determine whether the time counter value and the first nonce value are valid;
determine, based at least in part on the time counter value and the first nonce value, whether a message comprising the indication of the time counter value and the first nonce value is accepted for processing;
determine, based at least in part on the acceptance of the message for processing, whether the subsequent messages should be generated or accepted for processing; and
receive, based at least in part on a determination that the time counter value and the first nonce value are valid, a shared profile operational IMSI for the eUICC.

### Claim 11 (depends on 10)

The eUICC of claim 10, further configured to:
compare the indicated time counter value with a second time counter value stored at the eUICC prior to the receipt of the request for the randomized IMSI;
determine that the indicated time counter value and the first nonce value are invalid based at least in part on the indicated time counter value being older than the second time counter value; and
transmit a failure message that indicates that the indicated time counter value and the first nonce value are invalid.

### Claim 12 (depends on 10)

The eUICC of claim 10, further configured to:
compare the indicated time counter value and the first nonce value with a second time counter value and a second nonce value stored at the eUICC prior to the receipt of the request for the randomized IMSI;
determine that the indicated time counter value is invalid based at least in part on both the first nonce value and the second nonce value having a same value, and the indicated time counter value and the second time counter value having a same value; and
transmit a failure message that indicates that the indicated time counter value is invalid.

### Claim 13 (depends on 10)

The eUICC of claim 10, further configured to:
determine, based at least in part on receiving the indicated time counter value and the first nonce value, that a threshold quantity of time counter value-nonce value tuples has been exceeded;
determine that the indicated time counter value is invalid based at least in part on the threshold quantity of time counter value-nonce value tuples having been exceeded; and
transmit a failure message that indicates that the indicated time counter value is invalid.

### Claim 14 (depends on 10)

The eUICC of claim 10, further configured to:
transmit, based at least in part on the determination that the time counter value is valid, a message for receipt by a bootstrap vendor server; and
receive, at least in part in response to the message, the shared profile operational IMSI from the bootstrap vendor server.

### Claim 15 (depends on 10)

The eUICC of claim 10, further configured to:
receive a plurality of messages associated with the shared profile operational IMSI provisioning procedure and including a plurality of tuples, each tuple of the plurality of tuples including a time counter value, a nonce value, and a randomized IMSI for the message;
store the plurality of tuples at the eUICC; and
compare the time counter value with the plurality of tuples to determine whether the time counter value is valid.

### Claim 16 (depends on 10)

The eUICC of claim 10, further configured to:
obtain a first key of a key pair, wherein a second key of the key pair is known to a bootstrap vendor server that provides the shared profile operational IMSI; and
decrypt, by the eUICC and using the first key, a message that comprises the indication of the time counter value associated with the shared profile operational IMSI provisioning procedure to obtain the time counter value.

### Claim 17 (depends on 10)

The eUICC of claim 10, further configured to:
generate the randomized IMSI, wherein the eUICC checks a set of time counter value-nonce value tuples such that the randomized IMSI is not in the set of time counter value-nonce value tuples.

### Claim 18

A non-transitory computer-readable media storing instructions to cause an embedded universal integrated circuit card (eUICC) to:
receive a request for a randomized international mobile subscriber identity (IMSI);
transmit a randomized IMSI responsive to the request;
receive, at least in part in response to the request for the randomized IMSI, an indication of a time counter value and a first nonce value associated with a shared profile operational IMSI provisioning procedure;
determine whether the time counter value and the first nonce value are valid;
determine, based at least in part on the time counter value and the first nonce value, whether a message comprising the indication of the time counter value and the first nonce value is accepted for processing
determine, based at least in part on the acceptance of the smessage for processing, whether the subsequent messages should be generated or accepted for processing; and
receive, based at least in part on a determination that the time counter value and the first nonce value are valid, a shared profile operational IMSI for the eUICC.

### Claim 19 (depends on 18)

The non-transitory computer-readable media of claim 18, wherein the instructions further cause the eUICC to:
compare the indicated time counter value with a second time counter value stored at the eUICC prior to the receipt of the request for the randomized IMSI;
determine that the indicated time counter value and the first nonce value are invalid based at least in part on the indicated time counter value being older than the second time counter value; and
transmit a failure message that indicates that the indicated time counter value and the first nonce value are invalid.

### Claim 20 (depends on 18)

The non-transitory computer-readable media of claim 18, wherein the instructions further cause the eUICC to:
receive a plurality of messages associated with the shared profile operational IMSI provisioning procedure and including a plurality of tuples, each tuple of the plurality of tuples including a time counter value, a nonce value, and a randomized IMSI for the message;
store the plurality of tuples at the eUICC; and
compare the time counter value with the plurality of tuples to determine whether the time counter value is valid.