Subscriber identity module provider apparatus for over-the-air provisioning of subscriber identity module containers and methods

A non-transitory computer-readable storage medium that stores instructions for execution by one or more processors of a subscriber identity module (SIM) provider apparatus to perform operations to configure the SIM provider apparatus to:

• derive a first service provider key (SPK) based on master attributes, comprising a Master-International Mobile Subscriber Identity (M-IMSI), that include a master key (MK) and are shared by the SIM provider apparatus and a SIM container operably coupled to a device, wherein the first SPK is derived by a key derivation function (KDF) represented by SPK=KDF(MK, M-IMSI, SP-IMSI, nonce, “SPK_Derivation”), wherein SP-IMSI represents a Service Provider-International Mobile Subscriber Identity;
• sign a first nonce with the first SPK and transmit the signed first nonce to the device;
• receive, from the SIM container, the first nonce and a second nonce;
• verify that the received first and second nonces were signed with a second SPK;
• compare a received signature of the first and second nonces, generated using the second SPK, with the signature of the first SPK, and the second nonce generated using the first SPK;
• and
• send an acknowledgement to the SIM container when the first SPK is the same as the second SPK.