eSIM VSM · Virtual Subscription Management

eSIM provisioning at carrier-grade security.

BroadNet eSIM VSM is GSMA-compliant Remote SIM Provisioning for consumer devices — SM-DP+ and SM-DS in a Tier 3 EU data centre, with FIPS 140-2 Level 3 HSM key custody and the ES2+, ES8+ and ES9+ interfaces. Built on SIM expertise since 2003 and 200M+ SIM applications deployed.

Launch eSIM brand Request VSM consultation

GSMA SAS-SM accreditation in progress

FIPS 140-2 Level 3 HSM · Tier-3 EU DC

SGP.22 · consumer eSIM

SIM & OTA since 2003 · 200M+ deployments

The BroadNet snow leopard guarding a glowing eSIM chip inside a security vault, profiles streaming to phones

BroadNet · eSIM VSM

eSIM orchestration

200M+

deployments

200+

countries

99.99%

SLA

Roles

SM-DP+

Plus SM-DS discovery — the full GSMA Remote SIM Provisioning stack, managed.

Standard

SGP.22

GSMA-compliant consumer eSIM — smartphones, wearables, tablets, IoT.

Data centre

Tier 3

EU data sovereignty in Cluj, Romania.

SLA

99.99%

Premium uptime, 24/7 BroadNet operations.

Heritage & scale

SIM expertise that pre-dates the eSIM.

The VSM platform sits on two decades of continuous SIM, OTA and subscription-management practice — the same heritage behind the production HSM ceremonies for every profile shipped.

Heritage

Since 2003

Continuous SIM, OTA and subscription-management practice since 2003.

Deployments

200M+

SIM applications deployed to operators across four continents.

In progress

SAS-SM

GSMA Subscription Management accreditation — in progress.

Key custody

FIPS 140-2 Level 3

HSM cryptographic key storage in a Tier 3 EU data centre.

How a profile gets provisioned

From BSS prepare
to first attach, in 5 hops.

Every eSIM profile rides the same GSMA SGP.22 path — ES2+ from your BSS, key-bound in our FIPS 140-2 Level 3 HSMs, discovered via SM-DS or QR, downloaded over ES9+ and enabled on the eUICC — all inside a Tier 3 EU data centre.

01 · Prepare
BSS · ES2+
Operator BSS calls ES2+ profile/prepare. ICCID, IMSI, OPc, K, MSISDN allocated and pushed to the SM-DP+.
prepare < 600ms
02 · Generate
SM-DP+ · HSM
Profile bound to EID, encrypted under FIPS 140-2 Level 3 HSM-held GSMA keys, queued for download. ES8+ session ready.
generate < 1.2s
03 · Discover
SM-DS · LPA
Device queries SM-DS root or scans LPA QR. Activation code resolves to the awaiting profile in the SM-DP+.
discover < 800ms
04 · Download
Device · ES9+
ES9+ session: handshake, profile package transferred and installed in eUICC, mutual authentication completed.
download < 8s
05 · Activate
Profile enabled
Profile enabled on the eUICC, first network attach, subscription live. Lifecycle events streamed to the operator VSM dashboard.
first attach < 12s
← EDR · audit chain · HSM-signed

01 · Prepare

BSS · ES2+

Operator BSS calls ES2+ profile/prepare. ICCID, IMSI, OPc, K, MSISDN allocated and pushed to the SM-DP+.

prepare < 600ms

02 · Generate

SM-DP+ · HSM

Profile bound to EID, encrypted under FIPS 140-2 Level 3 HSM-held GSMA keys, queued for download. ES8+ session ready.

generate < 1.2s

03 · Discover

SM-DS · LPA

Device queries SM-DS root or scans LPA QR. Activation code resolves to the awaiting profile in the SM-DP+.

discover < 800ms

04 · Download

Device · ES9+

ES9+ session: handshake, profile package transferred and installed in eUICC, mutual authentication completed.

download < 8s

05 · Activate

Profile enabled

Profile enabled on the eUICC, first network attach, subscription live. Lifecycle events streamed to the operator VSM dashboard.

first attach < 12s

Platform

Everything an operator needs to ship eSIM — without building it.

eSIM provisioning (SM-DP+ & SM-DS)

Carrier-grade SM-DP+ and SM-DS in a Tier 3 EU data centre. ES2+, ES8+, ES9+ and ES10. FIPS 140-2 Level 3 HSM key custody, dual-control access, full audit trail.

GSMA SGP.22FIPS 140-2 Level 3ES2+/ES8+/ES9+

Multi-device provisioning

One platform for smartphones, wearables, tablets, laptops and IoT. Full GSMA SGP.22 Consumer Universal Profile compliance across every eUICC device class.

SGP.22eUICCConsumer

Provision, manage, monetise

Everything operators and MVNOs need to provision, manage and monetise eSIM subscriptions — consumer plans, travel and roaming bundles, secondary-device profiles. Powers TripoSIM on the same VSM.

ConsumerTravel & roamingTripoSIM

MVNO enablement

Multi-tenant by design. MVNOs launch on eSIM without building their own RSP — wholesale eSIM, per-operator isolation and reporting on the shared BroadNet VSM.

Multi-tenantMulti-operatorWholesale

Multiple activation flows

QR code, SM-DS instant activation, carrier app and manual entry — all supported in parallel. Standard LPA format 1$smdp_url$matchingid, with QR images and matching IDs generated in batch.

QR · SM-DS · AppManual entryBatch QR

VSM operator GUI

Inventory by ICCID, EID and profile state. Prepare, cancel, release, retry and regenerate confirmation codes. Standard reporting, KPIs and role-based access.

InventoryLifecycleReporting

Where it ships

Four ways operators put VSM to work.

Discuss your scenario

Travel & roaming

Travel eSIM & roaming

Travel eSIM offers, roaming bundles and secondary-device profiles. Quick-activation tourist plans on the same SM-DP+ that powers TripoSIM.

MVNO enablement

Enable an MVNO on eSIM

MVNOs launch on eSIM without building their own Remote SIM Provisioning. Wholesale eSIM on a multi-tenant VSM tenant, with per-operator isolation and reporting.

Wearables & IoT

Wearables & connected devices

Secondary-device profiles for smartwatches, tablets and connected vehicles. Companion-device management across the eUICC device classes under GSMA SGP.22.

MNO launch

Launch eSIM as an MNO

Replace physical SIM logistics with digital activation. Reduce CAPEX, speed customer onboarding, and provision from a GSMA SGP.22 platform.

Architecture

One platform. SM-DP+, SM-DS and the operator GUI.

The VSM core sits between operator BSS and the device LPA — orchestrating profile preparation, generation, activation and lifecycle, with the VSM operator GUI and reporting layered on top.

Operator side

BSS / OSS

Subscriber DB

HLR · BSS

ES2+ Web Service

profile/prepare

Profile types

Milenage AKA

ES2+

BroadNet VSM

Virtual Subscription Management

SM-DP+

ES8+ · ES9+

SM-DS discovery

ES9+ · ES11

MVNO tenancy

Multi-tenant

HSM key custody

FIPS 140-2 Level 3

ES9+

Device side

eUICC / LPA

QR / SM-DS / App

ES10

Consumer eSIM

SGP.22

Wearables & IoT

SGP.22 · eUICC

Operator dashboard

Lifecycle · EDR · KPIs

24/7 BroadNet NOC

SGP.22 · FIPS 140-2 Level 3

For your integration team

ES2+ prepare. Lifecycle actions. Signed EDRs.

The three calls your BSS team will touch on day one — the profile/prepare request, a VSM lifecycle action, and the reporting EDR that closes the lifecycle loop into your billing.

esim.broadnet.rsp · v1 · SGP.22

Example

1# Illustrative GSMA SGP.22 ES2+ call — operator BSS → BroadNet SM-DP+.
2# ES2+ is the GSMA-standard operator interface, not part of the public
3# BroadNet REST API: the endpoint and mutual-TLS credentials are agreed
4# per operator during onboarding.
5POST /gsma/rsp2/es2plus/downloadOrder
6Content-Type: application/json
7X-Admin-Protocol: gsma/rsp/v2.1.0
8 
9{
10  "header": {
11    "functionRequesterIdentifier": "mno-acme",
12    "functionCallIdentifier":      "TX-000123"
13  },
14  "eid":         "89043032123456789012345678901234",
15  "iccid":       "8901260247000123456",
16  "profileType": "consumer_data_voice_v3"
17}
18 
19# → then confirmOrder with the MSISDN and matching ID; the SM-DP+
20#   returns the activation code, e.g.
21#   LPA:1$esim.broadnet.rsp$AB12-CD34-EF56

Key custody

Keys derived inside the HSM. Never plaintext. Never copied.

The cryptographic core of the platform is a NIST FIPS 140-2 Level 3 HSM cluster in a Tier-3 EU data centre, operated under documented dual-control procedures. Master keys are generated in-HSM under split-knowledge ceremony. Per-profile keys are derived in-HSM and applied directly to the profile package — the plaintext key material never leaves the cryptographic boundary.

FIPS 140-2 Level 3 HSMSplit-knowledge ceremonyDual controlTamper-evidentEU data sovereignty

Master keys

Generated in-HSM under multi-officer split-knowledge ceremony. No officer ever sees a complete key.

Per-profile derivation

Profile-specific keys derived inside the HSM at provisioning time, applied directly to the profile package.

Operational separation

Cryptographic officers, system administrators and audit officers are strictly separated — no one role can act alone.

Audit chain

Every key event is signed and chained — ceremony, derivation, use, retirement — for audit and incident review.

Profile personalisation

Milenage and TUAK, by the book.

Profiles are personalised against the 3GPP authentication algorithms operators actually deploy. Milenage parameters and operator-variant keys (OPc) are derived per profile inside the HSM. TUAK is supported end-to-end for operators that have migrated to the SHA-3-based algorithm set. The same generation pipeline runs production batches under dual-control HSM key ceremonies.

Milenage

3GPP TS 35.205 / 35.206

f1–f5* authentication functions, per-operator OPc derived in-HSM, OP held under split-knowledge custody.

TUAK

3GPP TS 35.231 / 35.232

Keccak-based authentication for operators standardising on the SHA-3 algorithm family, fully supported in the personalisation pipeline.

Batch generation

File-based batch generation

Batch profile generation runs from files — IMSI start range, ICCID start range and profile type — returning the ICCID list, activation codes, .OUT security files and .SMS OTA files over SFTP with PGP encryption. Each batch runs under a dual-control HSM key ceremony with a per-ICCID provenance chain.

Signed batch manifest per ceremony
Per-ICCID provenance chain
Rate-limited release to SM-DP+ queue

eUICC architecture

Every GSMA domain. Speaking every interface.

The platform speaks the full GSMA Remote SIM Provisioning stack — SM-DP+, SM-DS and the ES2+ / ES8+ / ES9+ / ES10 interfaces — and operates against every eUICC security domain the specification defines.

ISD-R

Issuer Security Domain — Root

The root domain on the eUICC. Manages profile installation, enablement, disablement and deletion under operator authority.

ISD-P

Issuer Security Domain — Profile

Per-profile security domain that isolates one operator subscription from another on the same eUICC.

MNO-SD

MNO Security Domain

Operator-controlled domain inside the profile. Holds operator OTA keys and the live authentication credentials.

ECASD

eUICC Controlling Authority SD

Stores the eUICC root certificate and the certificate-issuer trust chain — the basis for mutual authentication with SM-DP+ / SM-DS.

SM-DP+ · SM-DS · ES2+ · ES8+ · ES9+ · ES10

Compliance

Audited where it matters.

eSIM is a security product before it is a UX product. The VSM platform is built on GSMA SGP.22 controls and NIST-certified key custody — so procurement, security and regulators get the paperwork they need on day one.

GSMA SGP.22 · FIPS 140-2 Level 3

GSMA SGP.22

Consumer eSIM (RSP)

Compliant with GSMA SGP.22 for consumer Remote SIM Provisioning — SM-DP+ and SM-DS, the ES2+/ES8+/ES9+/ES10 interfaces and the Universal Profile across smartphones, wearables, tablets and IoT.

GSMA SAS-UP

UICC Production

Production aligned with the GSMA SAS-UP (Security Accreditation Scheme for UICC Production) controls — secure profile generation and OTA delivery.

GSMA SAS-SM

Subscription Management — in progress

Accreditation in progress, not yet awarded. Covers SM-DP+ and SM-DS service management, key/certificate handling, and physical and logical security.

FIPS 140-2 Level 3 HSM

Key custody

Cryptographic keys held in NIST FIPS 140-2 Level 3 certified HSMs in a Tier-3 EU data center. Dual-control access. Tamper-evident. EU data sovereignty.

Deployment scenarios

What an eSIM launch
looks like on a managed VSM.

Regional MNOMNO · illustrative scenario

An MNO ships a consumer eSIM line without physical SIM logistics. BroadNet's SM-DP+ and SM-DS handle profile preparation over ES2+, QR and SM-DS reach the subscriber's device, and the VSM operator GUI runs the full profile lifecycle — all from a Tier 3 EU data centre.

Illustrative MNO deployment · results vary

ES2+

BSS integration

QR · SM-DS

Activation flows

99.99%

Premium SLA

MVNO on shared VSMMVNO · illustrative scenario

An MVNO launches on eSIM without building its own Remote SIM Provisioning. Wholesale eSIM runs on a multi-tenant VSM tenant with per-operator isolation and reporting, provisioned and managed by BroadNet on the same core platform.

Illustrative MVNO deployment · results vary

Multi-tenant

MVNO enablement

Wholesale

eSIM model

SGP.22

GSMA standard

Travel eSIM brandTravel eSIM · illustrative scenario

A travel and roaming eSIM offer runs on the same VSM that powers TripoSIM. Consumer plans, roaming bundles and secondary-device profiles are provisioned over ES2+ and activated by QR or SM-DS, with lifecycle and reporting in the operator dashboard.

Illustrative travel-eSIM deployment · results vary

Travel · roaming

Consumer eSIM

TripoSIM

Same VSM

SGP.22

Consumer profile

Operator due diligence

Eight answers
for the launch committee.

eSIM VSM is delivered as a managed service. Onboarding covers ES2+ web-service integration with your BSS, eSIM profile type definition and creation, QR activation including code generation, and standard reporting through the VSM operator GUI. Training is typically two days, followed by UAT with test devices before go-live. The platform runs on a premium 99.99% SLA with 24/7 BroadNet operations.

Not yet. GSMA SAS-SM accreditation for BroadNet's SM-DP+ and SM-DS is in progress, and we will publish it once it is awarded. Cryptographic keys are held on NIST FIPS 140-2 Level 3 HSMs in a Tier 3 EU data centre, and our security documentation is available under NDA.

eSIM VSM is a GSMA SGP.22 Consumer Universal Profile platform. It provisions smartphones, wearables, tablets, laptops and IoT devices — anything with a GSMA-compliant eUICC. SM-DP+ and SM-DS, and the ES2+, ES8+, ES9+ and ES10 interfaces, are supported end-to-end.

QR code activation (the operator generates a QR encoding the SM-DP+ URL and a matching ID, which the user scans), SM-DS 'instant activation' (no QR — the eUICC discovers the profile via the SM-DS root), carrier app activation and manual activation-code entry. All flows run in parallel. The standard LPA format is 1$smdp_url$matchingid.

eSIM VSM is delivered as a managed, multi-tenant service from BroadNet's Tier 3 data centre in Cluj, Romania (EU), where the FIPS 140-2 Level 3 HSMs physically reside. European operators get EU data sovereignty. Dedicated-tenant options are available; talk to us about your requirements.

Multi-tenant SM-DP+ (and SM-DS where applicable) in the Tier 3 data centre, eSIM profile type definition and creation, ES2+ web-service integration, QR activation including code generation, standard reporting and the VSM operator GUI, training (typically two days) and UAT with test devices, a premium 99.99% SLA and 24/7 BroadNet operations. Commercial terms are scoped per deployment — talk to sales.

Batch profile generation takes files as input — IMSI start range, ICCID start range and profile type — and returns the ICCID list, activation codes, confirmation codes, .OUT security files and .SMS OTA files. Delivery is over SFTP with PGP encryption, and authentication keys use the standard Milenage AKA algorithm. BroadNet also generates the QR images and matching IDs in batch from operator-provided profile types.

In a Tier 3 data centre in Cluj, Romania — inside the EU, giving European operators data sovereignty. Cryptographic keys are held in a FIPS 140-2 Level 3 certified HSM. The facility has 24/7 CCTV, strict access control, high-security zones, dual-control logical access and hardened infrastructure. GSMA SAS-SM accreditation is in progress.

Need our eSIM security documentation or a working session with our eSIM platform engineers? Request VSM consultation →

Operator-grade

Protect and monetize at the signaling layer.

In-network SMS and SS7 firewalls stop grey routes and fraud at line rate while legitimate traffic flows untouched.

<5ms

Inspection

99.99%

Uptime

1,000+

MNO links

Talk to our carrier team

Your eSIM brand, on a certified platform.

A single contract, a single platform, a single team. SM-DP+ and SM-DS, MVNO tenancy, QR and SM-DS activation and the VSM operator dashboard — all on one managed core, at a premium 99.99% SLA.

Launch eSIM brand Request VSM consultation

$ POST /gsma/rsp2/es2plus/downloadOrder · GSMA SGP.22 ES2+

Related guides & answers

Go deeper on the concepts behind this product.

eSIM provisioning at carrier-grade security.

SIM expertise that pre-dates the eSIM.

From BSS prepare to first attach, in 5 hops.

Everything an operator needs to ship eSIM — without building it.

eSIM provisioning (SM-DP+ & SM-DS)

Multi-device provisioning

Provision, manage, monetise

MVNO enablement

Multiple activation flows

VSM operator GUI

Four ways operators put VSM to work.

Travel eSIM & roaming

Enable an MVNO on eSIM

Wearables & connected devices

Launch eSIM as an MNO

One platform. SM-DP+, SM-DS and the operator GUI.

ES2+ prepare. Lifecycle actions. Signed EDRs.

Keys derived inside the HSM. Never plaintext. Never copied.

Master keys

Per-profile derivation

Operational separation

Audit chain

Milenage and TUAK, by the book.

Every GSMA domain. Speaking every interface.

Issuer Security Domain — Root

Issuer Security Domain — Profile

MNO Security Domain

eUICC Controlling Authority SD

Audited where it matters.

What an eSIM launch looks like on a managed VSM.

Eight answers for the launch committee.

Protect and monetize at the signaling layer.

Your eSIM brand, on a certified platform.

eUICC — the embedded UICC chip explained

SM-DP+ — Subscription Manager Data Preparation, explained

EID — the eUICC identifier, explained

SAS-SM certification — what it means for SIM and eSIM trust

From BSS prepare
to first attach, in 5 hops.

What an eSIM launch
looks like on a managed VSM.

Eight answers
for the launch committee.