Problem
Research questions and friction points this paper is trying to address.
Privacy
Anonymity
eSIM
RSP
Cross-session tracking
ZK-eSIM: A Privacy-Centric Zero-Knowledge Approach for eSIM Provisioning
🤖 AI Summary
为解决eSIM配置过程中的隐私泄露问题，ZK-eSIM采用零知识证明、一次性伪身份凭证等方法确保用户匿名性和会话不可链接性。
📝 Abstract
GSMA Remote SIM Provisioning (RSP) enables over-the-air delivery of eSIM profiles, but it exposes long-lived identifiers during profile ordering and download. In particular, stable device identifiers (e.g., EID), profile identifiers, and long-lived certificate material enable mobile operators and profile-delivery infrastructure to link provisioning events to the same eUICC and, when combined with account records, to the same subscriber. This undermines subscriber anonymity and enables cross-session tracking. We present ZK-eSIM, a privacy-preserving redesign that achieves subscriber anonymity and provisioning-session unlinkability while retaining accountable traceability by exception. ZK-eSIM (i) replaces direct disclosure of device identifiers with a zero-knowledge proof of device validity and eligibility; (ii) enforces session unlinkability through short-lived, one-time pseudonymous credentials and per-session identifiers to prevent cross-session tracking; and (iii) provides privacy-preserving accountable traceability through a jointly authorised escrow mechanism, so that no single entity can unilaterally deanonymise a user. We formalise a multi-entity, honest-but-curious threat model and prove subscriber anonymity and the unlinkability of provisioning sessions under standard cryptographic assumptions. We implement a Java Card applet on a test eUICC to evaluate performance on commodity hardware with a modified LPA and SM-DP+ server. Our experiments quantify end-to-end cryptographic overhead relative to conventional RSP, confirming that ZK-eSIM adds only practical overhead, closing a critical privacy gap while preserving deployability within existing GSMA roles and interfaces.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Zero-Knowledge Proof
Pseudonymous Credentials
Session Unlinkability
Privacy-Preserving
Accountable Traceability
🔎 Similar Papers
No similar papers found.
