Content for TR 33.812 Word version: 9.2.0
6 Analysis
7 Evaluation of Candidate Solutions
8 Summary and conclusions
A Collection of views expressed by external bodies
B Details and options for Alternative 1
$ Change history
6 Analysis p. 40
6.1 Threat Analysis p. 40
6.1.1 Methodology p. 40
6.1.1.1 Risk-Level Matrix p. 40
6.1.1.1.1 Impact p. 40
6.1.1.1.2 Likelihood of Threat Occurring p. 41
6.1.1.1.3 The Risk Matrix p. 42
6.1.1.2 Definitions of Risk Level p. 42
6.1.2 Threats and Suggested Counter-Measures p. 42
6.1.2.1 Introduction p. 42
6.1.2.2 Generic threats p. 43
6.1.2.3 Threat analysis of Alternative 1: Non UICC based solution with remote subscription provisioning and change p. 43
6.1.2.4 Threat analysis of Alternative 2: UICC based solution without remote subscription provisioning and change p. 51
6.1.2.4.1 Introduction p. 52
6.1.2.4.2 Summary of Threats and Assigned Risk Levels p. 52
6.1.2.4.3 Threats and Counter-Measures p. 52
6.1.2.5 Threat analysis of Alternative 3: UICC based solutions with remote subscription change p. 52
6.2 Security comparison of UICC and non-UICC approaches p. 55
7 Evaluation of Candidate Solutions p. 59
7.1 General p. 59
7.2 Alternative 1: TRE based solution with remote subscription provisioning and change p. 59
7.3 Solution Alternative 2: UICC based solution with no remote subscription provisioning and change p. 61
7.4 Alternative 3 p. 62
8 Summary and conclusions p. 67
8.1 Summary of the report methodology and solutions presented p. 67
8.1.1 General p. 67
8.1.2 Alternative 1: TRE based solution with remote subscription provisioning and change p. 68
8.1.3 Alternative 2: UICC-based solution with no remote subscription provisioning and change p. 68
8.1.4 Alternative 3a: UICC-based solution with remote subscription change; Ki transfer between operators p. 68
8.1.5 Alternative 3b: UICC-based solution with remote subscription change; Pre-configured Ki list on UICC p. 69
8.2 Summary of the solution evaluations against the use cases and against the evaluation criteria p. 69
8.2.1 Summary of the solutions evaluated against the use cases p. 69
8.2.1.1 Alternative 1: TRE based solution with remote subscription provisioning and change p. 70
8.2.1.2 Alternative 2: UICC-based solution with no remote subscription provisioning and change p. 70
8.2.1.3 Alternative 3a: UICC-based solution with remote subscription change; IMSI change and key (K) transfer between operators p. 70
8.2.1.4 Alternative 3b: UICC-based solution with remote subscription change; Pre-configured K list on UICC p. 71
8.3 Conclusions p. 71
A Collection of views expressed by external bodies p. 73
A.1 GSMA SCaG p. 73
A.2 GSMA SG p. 73
B Details and options for Alternative 1 p. 74
B.1 Delayed Activation p. 74
B.2 Detailed example for Network Interactions using decentralized Registration Operator and OMA DM p. 74
B.2.1 Overview p. 74
B.2.2 Establishing Initial IP Connectivity p. 74
B.2.3 Change of Selected Home Operator p. 76
B.2.3.1 Procedure p. 76
B.2.3.2 Subscription Registration p. 78
B.2.3.3 Triggering provisioning using OMA DM bootstrap p. 78
B.2.3.4 MCIM Application Provisioning Scenario Using OMA DM p. 79
B.2.3.5 IP Connectivity p. 80
B.2.3.6 Form of data protection p. 80
B.2.4 Example: Algorithm and MCIM data details p. 80
B.2.5 Example of potential OMA DM Management Object p. 81
B.2.6 Example of potential ASN.1 encoded MCIM p. 83
B.3 Trust Model p. 85
$ Change history p. 87
