# US 9,882,594 B2 · Apparatus and methods for controlled switching of electronic access clients without requiring network access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,594 B2 - Document ID: US9882594B2 - Status: Granted - Kind: B2 - Application number: 14/685,547 - Filed: 2015-04-13 - Published: 2015-08-06 - Granted: 2018-01-30 - Earliest claimed: 2012-09-21 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: Xiangying Yang; Jerrold Von Hauck - Web page: https://patentgrep.com/patent/US9882594B2 ## CPC - H04B 1/3816: Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices - H04W 4/50: Service provisioning or reconfiguring - H04W 12/12: Detection or prevention of fraud - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04W 12/30: Security of mobile devices; Security of mobile applications - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - G05B 11/01: electric - H04B 1/38: Transceivers, i.e. devices in which transmitter and receiver form a structural unit and in which at least one part is used for functions of transmitting and receiving - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04W 12/45: using multiple identity modules - H04W 12/61: Time-dependent - H04W 12/63: Location-dependent; Proximity-dependent - H04B: TRANSMISSION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and apparatuses for providing controlled switching of electronic access control clients without requiring network access are set forth herein. In one embodiment, a method for swapping of subscriptions and/or profiles for electronic Subscriber Identity Modules (eSIMs) without network supervision that prevents possibly malicious high frequency switching is disclosed. The disclosed embodiments offer reasonable management capabilities for network operators, without compromising the flexibility of eSIM operation. ## Claims ### Claim 1 A method for providing controlled switching of access control clients within a mobile device without requiring access to a network, the method comprising: at a security module included in the mobile device, wherein the security module is separate and distinct from a secure element included in the mobile device: receiving, from the secure element, a request to swap a first access control client with a second access control client, wherein the first access control client is active and the second access control client is inactive; obtaining content from at least one sensor included in the mobile device; referencing the content against at least one pre-defined threshold to determine whether at least one module is operating within pre-defined thresholds; and when the at least one module is operating within the pre-defined thresholds: determining, based on an internal time component that corresponds to the at least one module, whether the request is valid, and when the request is valid: causing the secure element to deactivate the first access control client, and causing the secure element to activate the second access control client. ### Claim 2 (depends on 1) The method of claim 1, wherein the at least one module is selected from: the security module and the secure element. ### Claim 3 (depends on 1) The method of claim 1, wherein the internal time component counts a number of clock ticks that have occurred after a receipt of a previous request to swap access control clients. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one sensor is selected from: one or more temperature sensors, one or more voltage sensors, and one or more operating frequency sensors. ### Claim 5 (depends on 1) The method of claim 1, wherein the request is generated based on one or more of: a geographic location of the mobile device and a usage level of the mobile device. ### Claim 6 (depends on 1) The method of claim 1, wherein the internal time component is maintained by sampling clock ticks produced by a clock that corresponds to the at least one module. ### Claim 7 (depends on 1) The method of claim 1, further comprising, prior to receiving the request: establishing the pre-defined thresholds in accordance with hardware characteristics of the at least one module. ### Claim 8 (depends on 1) The method of claim 1, further comprising, when the at least one module is not operating within the pre-defined thresholds, or when the request is not valid: causing the secure element to ignore the request. ### Claim 9 A non-transitory computer readable storage medium configured to store instructions that, when executed by a security module included in a mobile device, cause the mobile device to provide controlled switching of access control clients without requiring access to a network, by carrying out steps that include: receiving, from a secure element that is included in the mobile device and is distinct from the security module, a request to swap a first access control client with a second access control client, wherein the first access control client is active and the second access control client is inactive; obtaining content from at least one sensor included in the mobile device; referencing the content against at least one pre-defined threshold to determine whether at least one module is operating within pre-defined thresholds; and when the at least one module is operating within the pre-defined thresholds: determining, based on an internal time component that corresponds to the at least one module, whether the request is valid, and when the request is valid: causing the secure element to deactivate the first access control client, and causing the secure element to activate the second access control client. ### Claim 10 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the internal time component counts a number of clock ticks that have occurred after a receipt of a previous request to swap access control clients. ### Claim 11 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the at least one sensor is selected from: one or more temperature sensors, one or more voltage sensors, and one or more operating frequency sensors that monitor the operation of the secure element. ### Claim 12 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the request is generated based on one or more of: a geographic location of the mobile device and a usage level of the mobile device. ### Claim 13 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the internal time component is maintained by sampling clock ticks produced by a clock that corresponds to the secure element. ### Claim 14 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the steps further include, prior to receiving the request: establishing the pre-defined thresholds in accordance with hardware characteristics of the secure element. ### Claim 15 (depends on 9) The non-transitory computer readable storage medium of claim 9, wherein the steps further include, subsequent to deactivating the first access control client and activating the second access control client: receiving a second request to swap the second access control client with a third access control client, wherein the second access control client enables the mobile device to consume voice services and data services, and the third access control client enables the mobile device only to consume emergency services, and in response to the second request: deactivating the second access control client, and activating the third access control client. ### Claim 16 A mobile device configured to control switching of access control clients without requiring access to a network, the mobile device comprising: a secure element configured to manage at least a first access control client and a second access control client; and a security module that is separate and distinct from the secure element, wherein the security module is configured to carry out steps that include: receiving, from the secure element, a request to swap the first access control client with the second access control client, wherein the first access control client is active and the second access control client is inactive; obtaining content from at least one sensor included in the mobile device; referencing the content against at least one pre-defined threshold to determine whether at least one module is operating within pre-defined thresholds; and when the at least one module is operating within the pre-defined thresholds: determining, based on an internal time component that corresponds to the at least one module, whether the request is valid, and when the request is valid: causing the secure element to deactivate the first access control client, and causing the secure element to activate the second access control client. ### Claim 17 (depends on 16) The mobile device of claim 16, wherein the at least one module is selected from: the security module and the secure element. ### Claim 18 (depends on 16) The mobile device of claim 16, wherein the internal time component counts a number of clock ticks that have occurred after a receipt of a previous request to swap access control clients. ### Claim 19 (depends on 16) The mobile device of claim 16, wherein the internal time component is maintained by sampling clock ticks produced by a clock that corresponds to the at least one module. ### Claim 20 (depends on 16) The mobile device of claim 16, wherein, when the at least one module is not operating within the pre-defined thresholds, or when the request is not valid, the steps further include: causing the secure element to ignore the request.