GSMA SGP.32 contains the technical specifications for the remote eSIM management of Internet of things (IoT) devices and other types of mobile device deployments with limitations on network and user-interface.
This guide will walk you through the new GSMA SGP.32: eSIM IoT standard, how it came to be, its implications for the telecommunications and IoT industries, its technical specifications, and so much more.
But first, we need to get started by clarifying some key concepts that get confusing for many — eSIM and eUICC.
Table of Contents
Key concepts to master: eSIM and eUICC
To reference official Global System for Mobile Communications (GSMA) literature, the term eSIM technically refers to two different things:
- eSIM as a SIM form factor
- And eSIM as a SIM technology standard
Below is the eSIM as a physical form factor of the traditional SIM card, also known technically as MFF2.
With eSIM technology, the Subscriber Identification Module (SIM) is embedded in a secure element called eUICC (Embedded Universal Integrated Circuit Card).
From the official eSIM (technology) whitepaper, the eUICC is defined as:
“The eUICC is a secure element that contains one or more subscription Profiles. Each Profile enables the eUICC to function in the same way as a removable SIM issued by the operator that created it.“
With the eSIM technology, it is worth noting that…
“[An] eUICC may be built using any form factor from the traditional removable card to embedded formats soldered into devices.“
This means that an eUICC doesn’t have to be an MFF2 to be an eSIM in application of the eSIM technology.
If you wish to learn more about the nuances of the eSIM terminology within industry usage, you can read more about it in this blog.
Introduction to eSIM technology
The overarching goal of the GSMA eSIM standard is to minimize complexities when managing connectivity for mobile devices. How?
The eSIM standards changed the way connectivity is established for mobile devices in two major ways:
- Eliminated physical SIM card swaps.
- Introduced technology that allows over-the-air profile management, known as Remote SIM provisioning (RSP)
These two things were simply not possible with traditional SIM cards, where each and every device must be fitted manually with a SIM from a network partner with tight lock-in agreements.
The process was tedious and rigid. And in financial terms, those only entail expenses.
What are the eSIM standards?
The GSMA has outlined separate specifications for eSIM technology standards which enable remote SIM provisioning of many mobile devices. Specifications vary depending on the device type, which are:
- eSIM for M2M devices (2014)
- eSIM for Consumer devices (2016)
- eSIM for IoT devices (2023)
While all three eSIM specifications utilize RSP, the process to do so is different for each of the three.
The differences lie in the way network profiles are managed and the level of user interaction required. IoT and M2M eSIMs are designed for minimal human interaction with a focus on remote management, while consumer eSIMs emphasize user interface and flexibility for the end-user to manage their own network provider. Similarly, both consumer and IoT eSIMs focus on robustness that was notably lacking from M2M eSIM.
| Elements | Description | eSIM M2M | eSIM Consumer | eSIM IoT |
|---|---|---|---|---|
| eUICC | The Embedded Universal Integrated Circuit Card is the physical chip in devices that supports remote SIM provisioning. The eUICC profiles for M2M, consumer, and IoT devices are managed differently. | ✓ | ✓ | ✓ |
| RSP | Remote SIM provisioning | ✓ | ✓ | ✓ |
| SM-DP | The Subscription Manager Data Preparation are components responsible for preparing and securely downloading operator profiles to the eUICC. | ✓ | ||
| SM-SR | The Subscription Manager Secure Routing is responsible for securely managing eUICC profiles through encrypted communications. | ✓ | ||
| SM-DP+ | Adapted functionalities from the SM-SR and SM-DP, plus it supports additional features, including enabling the end-user to download profiles to their device. | ✓ | ✓ | |
| SM-DS | The Subscription Manager Discovery Server is responsible for providing addresses of one or more SM-DP+. Some capabilities of the SM-SR are incorporated here. | ✓ | ✓ | |
| LPA | The Local Profile Assistant is software installed on consumer devices that facilitates the management of SIM profiles through the device’s user interface. Some capabilities of the SM-SR are incorporated on the LPA. | ✓ | ||
| IPA | The IoT Profile Assistant facilitates profile switching and bridges eIM and device or eUICC communications. | ✓ | ||
| eIM | The eSIM IoT Remote Manager is responsible for profile state management on a single IoT device or a fleet. | ✓ |
eSIM M2M
The first eSIM standard, eSIM M2M, is GSMA’s direct response for the automotive industry’s needs to manage remotely and provision network profiles on the SIM. It is the first time remote SIM provisioning was introduced for M2M SIMs, which is central for all eSIM specifications.
It is designed with a server-driven approach (pull-model) and quickly became limited for many applications outside of its original purpose.
eSIM M2M limitations:
- Profile management can’t be initiated from the device: Profile management for some devices can be complex because eSIM M2M requires SMS to update and manage profiles, and SMS is not always a supported feature for networks like NB-IoT.
- Lacks simplicity: Complex integration process between crucial components to remotely provision SIMs.
- Vendor-locked: Often, network connectivity has to be agreed pre-deployment (typically at the manufacturing stage). This configuration is inflexible and unsuitable for the dynamic needs of many IoT devices with global deployments.
So it naturally needed to evolve for the varying needs of many different types of mobile-connected device applications, one of which is for consumer devices.
eSIM Consumer
eSIM Consumer differs from eSIM M2M with the user doing it locally using a client-driven methodology (pull model). This implies that remotely managing and provisioning a SIM profile occurs when enabled by the end-users (e.g. through the smartphone, the user scans a QR code which then starts the process of switching the mobile operator profile assigned to the eSIM instead of manually swapping out the SIM card to change network providers).
The architecture was also streamlined to avoid the integration complexities faced in the eSIM M2M specification.
A list of GSMA’s official documentations for eSIM Consumer:
What is GSMA SGP.32: eSIM IoT?
Imagine a zero-touch connectivity management experience for globally-distributed IoT devices of scale. With the GSMA SGP.32: eSIM IoT standard this should now be possible.
The new eSIM IoT takes the best of both M2M and Consumer eSIM specifications into a standard that fits the purpose of IoT while utilizing two key elements of the eSIM technology:
- Directly incorporating the eUICC onto the device (note that the SIM can be in any form factor, and may be embedded or not)
- Profile switching between network providers — remotely and en masse (the innovation lies on the “en masse” part)
GSMA SGP.32 forms part of the entire technology ecosystem for eSIM IoT, which includes the following official documentations:
- GSMA SGP.31: eSIM IoT Architecture and Requirements Specifications
- GSMA SGP.32: eSIM IoT Technical Specification
- GSMA SGP.33: eSIM IoT Test Specification for the eUICC
The key features of eSIM IoT
eSIM IoT builds upon the successes of the two previous standards and enriches it with a new key improvement:
- Remotely provision and manage SIM profiles in bulk.
This is key for IoT that are deployed in fleets across locations with varying connectivity needs. What eSIM IoT aims to address is to simplify the eSIM solution and make connectivity more cost-effective for different IoT use cases. Whether that will actually happen is yet to be determined.
Additionally, other specific features that make eSIM IoT fit for IoT use cases are:
- Utilizes a light profile template for optimized profile downloads
- End-user intent is moved from the device to cloud/server
- No SMS or TCP/IP dependencies
- Covers devices that have no SMS capabilities
- Supports wider range of transport protocols (CoAP/UDP/DTLS)
GSMA SGP.32: eSIM IoT technical specifications
While “eSIM IoT” is a term often used interchangeably with GSMA SGP.32, it is important to note that IoT applications can span across both M2M and consumer devices. However, the technical specifications and key components for eSIM in M2M, consumer, and IoT contexts do have distinct differences.
For eSIM IoT, these two components are crucial to making it work for IoT use cases:
- the IoT Profile Assistant (IPA), and
- the eSIM IoT Remote Manager (eIM).
What is IPA?
The IPA (IoT Profile Assistant) is a component of the GSMA SGP.32: eSIM IoT which was adapted from the eSIM Consumer component, LPA (Local Profile Assistant).
The IPA acts as an intermediary between the eSIM and the eIM and facilitates communication and commands from the eIM to the device, which is crucial for the remote management of the eSIM profiles.
The IPA can either reside on the IoT device itself (IPAd) or on the eUICC (IPAe). For makers of IoT devices, a benefit to using IPAe rather than IPAd may result in less development work.
What is eIM?
The eIM (eSIM IoT Remote Manager) is a component that handles remote profile state management operations for eSIM IoT devices. It enables the remote enabling, disabling, deletion, and downloading of profiles on eUICCs, all of which are standardized by the GSMA.
An eUICC must be linked to an eIM to manage profiles, achieved by sending eIM configuration data to the eUICC from the eIM or a backend system. This association can occur at any stage in the device lifecycle.
Once linked, one or multiple eIMs can be associated with a single eUICC or a fleet. Introducing a new eIM involves sending its configuration data from an existing eIM without needing technical integration between eIMs. Associations can also be removed, preventing lock-in issues like those in eSIM M2M.
This flexibility allows deployments to switch between connectivity providers, adopt multi-vendor strategies, and efficiently manage large volumes of profiles and queued operations.
The eIM also improves interoperability as it can communicate with any SM-DP+ device without any pre-agreements between parties.
The eIM is key to making the eSIM IoT flexible on top of these benefits:
- Reduces the integration time.
- Handles bulk volumes of profiles.
- Queue profile operations are easier.
- Profile switching is simplified.
- The eIM can be owned by the IoT device manufacturer to oversee device connectivity.
What is PSMO?
In GSMA SGP.32, the Profile State Management Operations (PSMOs) are securely handled by the eIM and are cryptographically authenticated to prevent malicious operations. This ensures that IoT fleet owners receive verifiable confirmation of the status of each PSMO from a trusted eUICC. This cryptographic authentication is new to the eSIM IoT standard, and was not present in the previous standards.
This secure binding between the eIM and the eUICC protects against unauthorized profile management (for example, from malware) by only allowing operations that are correctly signed by the eIM. The eUICC responds to these operations with its own secure, signed messages. This authentication process, which protects both the issuing and execution of PSMOs, is consistent throughout all profile management activities, including profile downloads.
What are the advantages of GSMA SGP.32: eSIM IoT?
Technology from 10 years ago doesn’t fit the needs of IoT devices today. The eSIM IoT standard provides a layer of future-proofing to IoT while providing flexibility and simplicity lacking from the previous eSIM M2M standard.
- Support for user interface (UI)-constrained IoT device deployments
- Ideal for LPWAN devices
- Bulk SIM management
- Enables simplified integration: using the eIM to remotely trigger profile downloads from the SM-DP+ server.
- Enterprise-oriented and less telco-centric: geared for large-scale IoT deployments with global connectivity requirements that can be restricted by vendor lock-ins.
As of time of writing, the full ecosystem for eSIM IoT is still under development, and is expected to be completed towards the end of 2024. With this timeline in mind, here are other caveats with eSIM IoT:
- The standard (including testing and certifications specifications) is set to be released within 2024. This means that the market may not be ready until 2025.
- While the eSIM IoT component eIM can communicate with any SM-DP+ device (eg. SGP.22: eSIM Consumer), eSIM IoT is not “backward compatible” with eSIM M2M and there are no standardized migration processes for migration to eSIM IoT from eSIM M2M.
- Operator lock-ins: While it may not be technically needed to pre-set an agreed network provider from the start of the device lifecycle (eSIM IoT can come with a bootstrapped profile that can be connected to a chosen network), providers may still offer “out-of-the-box” solutions that tie you with networks with irreversible configurations.
💡How does eSIM IoT stack up against eSIM M2M and Consumer? Learn which eSIM standard works best for your deployment in this article.
How the GSMA SGP.32: eSIM IoT will impact the industry
The GSMA SGP.32: eSIM IoT standard is expected to drive the growth of connected devices in the near future. It is seen to benefit companies deploying IoT devices, as well as connectivity providers. Similarly, IoT device manufacturers can streamline production and create more reliable devices.
Because of these changes, the new standard is predicted to play a key role in expanding the IoT device market.
eSIM IoT works with a range of deployment sizes, from smaller-scale to enterprises, expanding service offerings for IoT devices:
- Covers global connectivity but with the option to use local networks for specific use case requirements or to comply with local laws.
- Optimizes costs: Inserting SIMs is a costly logistical issue, with the eSIM IoT you only need one SIM for a device even when switching to different profiles.
- Flexible connectivity setup: Businesses can pre-assign the network during the manufacturing process, or initially use a bootstrapped profile to later add a preferred list of network profiles.
Proprietary solutions aligned with the new standard are already in demand. However, for a solution to be advantageous, it must be compatible with the GSMA SGP.32, easy to implement across device types, and commercially tested.
→ Download our free cheat sheet for a quick reference to basic technical information about the GSMA SGP.32: eSIM IoT, including a checklist for the next steps to prepare your IoT deployment for SGP.32
What to look for when choosing an eSIM IoT solution?
The introduction of eSIM technology approximately a decade ago marked a significant breakthrough: for the first time, it enabled users to manage network profile changes without the physical act of swapping SIM cards. This process is known as Remote SIM Provisioning, or RSP.
At the heart of the technology, RSP is an integral component of the latest eSIM technology specifications, issued by the GSMA for various applications, most notably in M2M, consumer devices, and more recently with IoT devices.
Specifically tailored for IoT devices, eSIM IoT aims to streamline RSP, simplifying the technology and offering a flexible solution for managing connectivity. This flexibility has substantial practical benefits, particularly for deployments that span multiple countries or for those who have found a more competitive connectivity provider and wish to switch.
For the longest time, the IoT market lacked such a solution. Now that eSIM IoT is here, it brings with it the promise of simplicity, flexibility, and interoperability. These qualities lead to easier deployment and, ultimately, reduced costs.
Despite its numerous advantages, it’s important to approach the eSIM IoT market with caution. When evaluating an “out-of-the-box” eSIM IoT solution, you must verify that it doesn’t restrict you with vendor lock-ins.
Vendor lock-ins can limit your ability to choose the best connection options for your IoT deployments, potentially compromising the efficiency and cost-effectiveness of your operations. To fully benefit from an eSIM IoT solution, it should be business-oriented—offering the freedom to make changes as needed without being constrained by restrictive telecom agreements.
While the entire eSIM IoT ecosystem guidelines are still being built by the GSMA, you can get started today with Onomondo’s range of global IoT SIMs, embedded or SoftSIM.
Test the features and capabilities you require through our free trial. When you’re ready to onboard, our APIs and webhooks are available to enable seamless integrations to fit your system requirements.
Get early access to the eSIM IoT platform
If you want to test SGP.32 for your IoT deployment before the entire ecosystem is released, we welcome you to join the eSIM IoT Alliance. Click the button below to learn about the benefits of being an alliance member.
