eSIM and Remote SIM Provisioning

Introduction¶

A traditional SIM is a smart card with one operator's credentials burned in. An eSIM is an eUICC (embedded Universal Integrated Circuit Card) — a chip (soldered or a removable MFF2/2FF form) that can download and store multiple operator profiles and switch between them, all remotely. GSMA RSP (Remote SIM Provisioning) is the standard.

Profiles¶

A profile is the equivalent of everything a physical SIM holds: the IMSI, the Ki/authentication keys (OP/OPc), the file system, network parameters, applets. It's provisioned onto the eUICC over the air.

• Enabled profile — the active one; the device uses it to attach.
• Disabled profiles — stored, not in use. Only one enabled at a time (for the network the modem presents).
• Deleting a profile is irreversible (the keys are gone); you'd need a new profile from the operator.

The consumer RSP architecture (SGP.22)¶

Four roles:

• eUICC — the chip, with its EID (a 32-digit unique identifier, like an ICCID for the chip itself) and an embedded certificate (eUICC Manufacturer cert chain, GSMA-rooted).
• SM-DP+ (Subscription Manager – Data Preparation +) — the operator's (or their vendor's) server that prepares and holds profiles and delivers them to eUICCs. It authenticates the eUICC, binds the profile to that specific EID, and encrypts it end to end.
• SM-DS (Subscription Manager – Discovery Server) — an optional discovery service. The device polls it: "does anyone have a pending profile for my EID?" It answers with the SM-DP+ address. Enables "just insert the eSIM, it finds its profile".
• LPA (Local Profile Assistant) — software on the device (in the OS, e.g. Android/iOS, or in the eUICC). It drives the download: talks to the SM-DP+, does the mutual authentication, installs the profile, and provides the UI for enabling/disabling/deleting.

The download flow¶

1. User gets an activation code: LPA:1$smdp.example.com$MATCHING-ID (often as a QR code), or the device queries the SM-DS and gets pointed at the SM-DP+.
2. LPA connects to the SM-DP+ over HTTPS.
3. Mutual authentication — the SM-DP+ verifies the eUICC's certificate (is this a genuine, GSMA-certified eUICC?); the eUICC verifies the SM-DP+'s certificate.
4. SM-DP+ binds the prepared profile to this EID and sends it, encrypted with a key only this eUICC can derive (protected against interception even by the LPA).
5. The eUICC installs the profile. User enables it. The device attaches to the new operator.

The profile package is one-time — once downloaded, that matching ID / QR is consumed. Re-downloading needs a new one from the operator.

Consumer vs M2M/IoT¶

• Consumer model (SGP.22) — the user initiates via the LPA UI (scan QR, tap enable). Phones, tablets, watches, laptops.
• M2M model (SGP.02) — the operator/platform pushes profiles and enable/disable commands to devices with no UI, via SM-SR (Subscription Manager – Secure Routing) + SM-DP. For fleets of IoT devices, cars, meters.
• IoT (SGP.32) — a newer model bridging the two: an eIM (eSIM IoT remote Manager) orchestrates, an IPA on constrained devices replaces the full LPA. Designed for massive constrained-device deployments.

Operational gotchas¶

• The profile is bound to one EID — you can't move a downloaded profile to another eUICC. Device replacement = a new profile (operator "eSIM swap" process, often a support interaction).
• QR / activation code is single-use — a failed download mid-way can consume it; the operator must re-issue.
• Storage limits — an eUICC holds a limited number of profiles (often ~5–10 on phones, fewer on IoT). Delete unused ones.
• Enabling requires a reboot / refresh on many devices (the modem re-reads the eUICC).
• Roaming and eSIM — a downloaded profile behaves exactly like a physical SIM for roaming; nothing special. Travel eSIMs are just a second profile.
• Operator support — the operator must run (or contract) an SM-DP+ and support the consumer eSIM process. Not all do, and MVNOs vary.
• eUICC OS updates — the eUICC firmware itself can be updated OTA (rare, operator/OEM driven).

Verification and troubleshooting¶

Device-side (varies by OS): Settings shows the EID, installed profiles, and enabled state. Android's carrier/engineering menus and iOS's eSIM settings expose most of it.

• "Unable to add eSIM" / "Cannot complete" — activation code already used, network issue reaching the SM-DP+ (needs data — Wi-Fi or another SIM), the SM-DP+ rejected the eUICC (blocklisted EID, region lock), or the eUICC is full.
• Profile downloads but won't enable / no service — the operator hasn't activated the subscription on their side yet, wrong APN, or the profile is for a network the device band doesn't support.
• Lost service after a phone reset / restore — eSIM profiles are not restored from a backup; you must re-download (operator swap). Physical SIMs don't have this problem — a reason some users still prefer them.
• IoT device unreachable after a remote profile switch (M2M) — the enable command was sent but the device didn't apply it (offline, or the SM-SR ↔ device path failed); needs a fallback profile / bootstrap profile that always works to recover.
• eSIM works on Wi-Fi calling but not cellular — the profile's network config or the operator provisioning; same troubleshooting as a physical SIM from here.

Related tools and reading¶

• On-site: (no dedicated tool).
• Related posts: Core telco architecture: 2G to 5G in one read, Number portability and ENUM.