The Evolution of eSIM Technology
As connected devices evolve, so do expectations for a seamless digital onboarding experience. eSIM technology has already transformed how connectivity is delivered to smartphones, wearables and IoT devices. However, onboarding an eSIM onto devices without their own data connection — such as embedded modules in vehicles or specialized companion devices — still presents challenges.
Existing methods often require the user to activate system-level tethering or rely on complex pass-through mechanisms. These steps interrupt the onboarding experience and frequently lead to frustration.
We introduce a new architectural approach that removes these barriers: the eSIM profile is first downloaded and validated inside a mobile application — and installed later, without requiring the device to be online at installation time.
The Challenge: Devices That Start Offline
Many devices begin their lifecycle entirely offline. Vehicles, wearables and IoT modules often need an active mobile subscription before they can connect to the network.
Traditional eSIM activation assumes that the device:
- already has mobile data, or
- the user manually sets up tethering, or
- a live pass-through channel is created via the smartphone
— all of which introduce unnecessary friction.
Research on user experience confirms this: Park & Kim highlight that steps like hotspot activation or switching between system apps are among the main reasons users abandon eSIM onboarding ("User Experience Challenges in eSIM Activation", ACM CHI 2021).
The Solution: Decoupling Download and Installation
Our approach separates the provisioning process into two independent phases:
Phase 1: Profile Download Inside the Mobile Application
The user scans the activation QR code provided by their mobile network operator. The app authenticates with the SM-DP+ and downloads the encrypted eSIM profile. This step follows the GSMA ES9+ procedures defined in SGP.22.
Importantly, the user can complete this phase anywhere with internet access.
Phase 2: Offline Installation via Bluetooth (BLE)
When the user later connects their phone to the companion device, the application transfers the previously downloaded profile over a secure BLE channel — without requiring tethering.
The eUICC decrypts and installs the profile according to GSMA installation rules (SGP.22 v2.4).
Why This Matters
- Simplified onboarding — The entire process stays inside the app — no OS settings, no hotspots.
- Fully GSMA-compliant — Our method follows all mandatory RSP flows (authentication, download, installation). SGP.21 defines that the transport mechanism is not fixed and can be implementation-specific (SGP.21 v3.1).
- Ideal for automotive & IoT scenarios — Devices that start offline gain connectivity without infrastructure dependencies.
- Security by design — End-to-end encrypted Bound Profile Package (per SGP.22), secure BLE transmission, and local hardware-based decryption on the eUICC.
Security concerns raised in research — such as firmware vulnerabilities or weak local channels — are mitigated through mutual authentication and strict cryptographic boundaries ("Security Analysis of eUICC", ARES 2019).
High-Level Workflow
The provisioning process follows these steps:
- BLE Connection — User connects to companion device via Bluetooth
- eUICC Info Request — App retrieves eUICC identifiers and challenge
- QR Code Scan — User scans the operator-provided activation code
- Profile Download — App authenticates with SM-DP+ and downloads encrypted profile
- Secure Storage — Profile is stored securely in the app
- Later: BLE Transfer — When reconnected, profile is transferred to the device
- Installation — eUICC decrypts and installs the profile locally
- Confirmation — Installation success is reported back to the app
A Foundation for Next-Generation Connected Experiences
This offline-capable provisioning model rethinks what eSIM onboarding can be:
- Simpler for users — No technical knowledge required
- More flexible for OEMs — Works with any device that has BLE capability
- Secure through established GSMA RSP procedures — Industry-standard cryptography
- Scalable for automotive, IoT and companion-device ecosystems — One architecture, many use cases
By decoupling the download from the installation phase, we reduce friction and open the door for a new class of seamless digital onboarding experiences.