IoT bootstrap profiling explained

A bootstrap profile, also known as a provisioning or default profile, provides an eSIM with its default SIM credentials for connecting to a mobile network so that it can establish a connection for devices when first activated on the production line or when it is deployed to the field.

The bootstrap profile can also be retained as the main operational profile or it can be replaced by alternative operational profiles (also called virtual profiles) downloaded to the SIM by a process called Remote SIM Provisioning (RSP).

Here’s a closer look at the role of the bootstrap profile and how Remote SIM provisioning (RSP) works.

Although most use the term eSIM, it is more technically correct to say Embedded Universal Integrated Circuit Card (eUICC). This refers to a particular type of SIM software that enables a physical SIM, could be card format of embedded chip format, to host multiple profiles. eUICC also makes it possible to add, remove, and manage these profiles via a method known as Remote SIM Provisioning (RSP).

When it is first switched on, a device with an eUICC SIM needs a way of making communication with the network server that controls the subscription on that device. A bootstrap profile provides the credentials for this initial default connection.

In other words, the bootstrap profile is loaded onto the eSIM during the SIM manufacturing stage and when activated and deployed in an IoT device, enables access to the service providers mobile network and to roaming network partners as defined by the profile.

Remote SIM Provisioning is performed by two network functions SM-DP (Subscription Manager-Data Preparation) and SM-SR (Subscription Manager-Secure Routing).

The SM-DP creates, prepares, and stores profiles for download, while the SM-SR schedules and delivers the profile over the air onto the eSIM; the new profile is stored on the eSIM and only becomes active when a specific instruction is received from the SM-SR. The bootstrap is usually maintained as a fallback option – although it could be deleted.

The leading MVNO service providers will typically offer access to their RSP platforms (SM-DP and SM-SR) and handle all the factory provisioning of SIMs and security keys as well as the in-life operation. It’s not necessary to license an RSP platform of your own, although that option does exist.

RSP for IoT applications

For IoT (M2M) applications such as sensors, trackers, meters in industrial, commercial B2B markets as well as some use cases with consumer end-users (B2B2C) – the RSP standard is based on a ‘push’ model. This is where the RSP platform performs profile download transaction based on API calls from customer business systems into the RSP, or via the control of a Rules Engine.

RSP for consumer devices

For consumer devices like phones, and watches, however, the RSP standard is different. It’s based on a ‘pull’ model. This is where the profile download transaction can be initiated remotely from the device via a User Interface or under the control of another device acting on information obtained via a QR Code or over Bluetooth.

Convergence of these two standards is expected over time.

Through eUICC technology, connectivity for IoT and M2M devices can be managed remotely through their entire life-cycle without the need to physically access SIM cards.

Bootstrap profiles provide the default connectivity and are typically retained as a fall-back option throughout the eSIM lifetime even if new operational profiles are deployed.

The RSP capability provides insurance against commercial, performance, and quality issues should they arise in the future.

RSP also localises specific country/region profiles to achieve better commercials, lower latency, satisfy data sovereignty regulations, or to resolve roaming restrictions.

eSIM Bootstrap Profile Explained

A default profile for eSIMs (also known as eUICC SIMs).