RSP

RSP

Remote SIMSIMApplicationSmart card for mobile network authentication.Click to view → Provisioning (RSPRSPApplicationOver-the-air SIM profile management.Click to view →) is the GSMA-standardized framework for securely downloading, installing, and managing mobile network operator profiles on eSIM (eUICC) devices over the internet or cellular network. RSP eliminates the need for physical SIM card logistics — operators can provision subscribers remotely, and users can switch carriers without visiting a store.

RSP Architecture

The RSP ecosystem involves several interacting entities:

Consumer RSP Flow (GSMA SGP.22)

A typical consumer profile download proceeds as follows:

1. The user obtains an activation code (QR code or manual entry) from the operator
2. The LPA on the device parses the activation code to extract the SM-DP+ address
3. The LPA establishes a TLS connection to the SM-DP+ server
4. Mutual authentication occurs between the eUICC and SM-DP+ using ECKA (Elliptic Curve Key Agreement) with certificates rooted in the GSMA CI
5. The SM-DP+ sends the encrypted subscription profile (bound to the target eUICCeUICCProvisioningReprogrammable SIM chip supporting remote profile switching.Click to view →'s EIDEIDIdentityNational ID with embedded chip.Click to view →)
6. The eUICC decrypts and installs the profile in its secure storage
7. The user enables the profile, and the device registers on the operator's network

M2M RSP (GSMA SGP.02)

For IoT and M2M devices without user interfaces, the GSMA defines a push-based provisioning architecture:

Security Model

RSP security relies on multiple layers:

• PKI: GSMA CI-issued certificates authenticate all parties (eUICC, SM-DP+, SM-DS)
• Bound profile package: Profiles are encrypted specifically for the target eUICC's EID using ephemeral ECDH keys
• Secure Element: All profile decryption and key storage occurs inside the tamper-resistant eUICC
• Attestation: The eUICC proves its identity and platform integrity before profile download

The GSMA manages the root certificate infrastructure (CI), and all eUICC manufacturers and SM-DP+ operators must obtain GSMA SAS certification to participate in the RSP ecosystem.