Orange — Telecommunications
Securing Secure Element Provisioning at Carrier Scale
Subscriber credentials are the one asset we cannot afford to get wrong, across hundreds of device models we do not control. A certified base that every model inherits is the only version of that problem we can realistically staff.
Key outcome
Certified Isolation for Subscriber Credentials
Subscriber credentials are among the most attacked assets a carrier holds. Running the provisioning path inside a formally verified environment means the code handling those credentials is separated from the rest of the device software by a boundary that has been mathematically proven, not just tested.
The challenge
Assurance Requirements That Scale Across Device Generations
The GSMA’s eUICC Protection Profile allows a composite evaluation in which secure hardware and the operating system are certified once, and applications such as USIM or ISIM are evaluated independently on top. Realising that model in practice requires a base platform whose isolation properties hold across every device generation it ships on.
The solution
A Shared Certified Platform for Multiple Trusted Applications
ProvenCore is aligned with GlobalPlatform TEE specifications, so existing Trusted Applications can be reused rather than rewritten. Multiple operators and profiles coexist securely on the same chip, each evaluated independently, without restarting the whole evaluation when one of them changes.
Being able to reuse our existing trusted applications meant the migration was an integration project rather than a rewrite.
