# eSIM provisioning at carrier-grade security. - Canonical URL: https://www.broadnet.me/operators/esim-vsm - Language: en - Last updated: 2026-09-29 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. eSIM VSM · Virtual Subscription Management BroadNet eSIM VSM is GSMA-compliant Remote SIM Provisioning for consumer devices — SM-DP+ and SM-DS in a Tier 3 EU data centre, with FIPS 140-2 Level 3 HSM key custody and the ES2+, ES8+ and ES9+ interfaces. Built on SIM expertise since 2003 and 200M+ SIM applications deployed. [Launch eSIM brand](https://www.broadnet.me/contact?topic=esim-launch&product=esim-vsm) [Request VSM consultation](https://www.broadnet.me/contact?topic=vsm-consultation&product=esim-vsm) GSMA SAS-SM accreditation in progress FIPS 140-2 Level 3 HSM · Tier-3 EU DC SGP.22 · consumer eSIM SIM & OTA since 2003 · 200M+ deployments ![The BroadNet snow leopard guarding a glowing eSIM chip inside a security vault, profiles streaming to phones](https://www.broadnet.me/marketing/art/op-esim-vsm.webp) BroadNet · eSIM VSM eSIM orchestration 200M+ deployments 200+ countries 99.99% SLA Roles SM-DP+ Plus SM-DS discovery — the full GSMA Remote SIM Provisioning stack, managed. Standard SGP.22 GSMA-compliant consumer eSIM — smartphones, wearables, tablets, IoT. Data centre Tier 3 EU data sovereignty in Cluj, Romania. SLA 99.99% Premium uptime, 24/7 BroadNet operations. Heritage & scale ## SIM expertise that pre-dates the eSIM. The VSM platform sits on two decades of continuous SIM, OTA and subscription-management practice — the same heritage behind the production HSM ceremonies for every profile shipped. Heritage Since 2003 Continuous SIM, OTA and subscription-management practice since 2003. Deployments 200M+ SIM applications deployed to operators across four continents. In progress SAS-SM GSMA Subscription Management accreditation — in progress. Key custody FIPS 140-2 Level 3 HSM cryptographic key storage in a Tier 3 EU data centre. How a profile gets provisioned ## From BSS prepare to first attach, in 5 hops. Every eSIM profile rides the same GSMA SGP.22 path — ES2+ from your BSS, key-bound in our FIPS 140-2 Level 3 HSMs, discovered via SM-DS or QR, downloaded over ES9+ and enabled on the eUICC — all inside a Tier 3 EU data centre. 1. 01 · Prepare BSS · ES2+ Operator BSS calls ES2+ profile/prepare. ICCID, IMSI, OPc, K, MSISDN allocated and pushed to the SM-DP+. prepare < 600ms 2. 02 · Generate SM-DP+ · HSM Profile bound to EID, encrypted under FIPS 140-2 Level 3 HSM-held GSMA keys, queued for download. ES8+ session ready. generate < 1.2s 3. 03 · Discover SM-DS · LPA Device queries SM-DS root or scans LPA QR. Activation code resolves to the awaiting profile in the SM-DP+. discover < 800ms 4. 04 · Download Device · ES9+ ES9+ session: handshake, profile package transferred and installed in eUICC, mutual authentication completed. download < 8s 5. 05 · Activate Profile enabled Profile enabled on the eUICC, first network attach, subscription live. Lifecycle events streamed to the operator VSM dashboard. first attach < 12s 6. ← EDR · audit chain · HSM-signed 01 · Prepare BSS · ES2+ Operator BSS calls ES2+ profile/prepare. ICCID, IMSI, OPc, K, MSISDN allocated and pushed to the SM-DP+. prepare < 600ms 02 · Generate SM-DP+ · HSM Profile bound to EID, encrypted under FIPS 140-2 Level 3 HSM-held GSMA keys, queued for download. ES8+ session ready. generate < 1.2s 03 · Discover SM-DS · LPA Device queries SM-DS root or scans LPA QR. Activation code resolves to the awaiting profile in the SM-DP+. discover < 800ms 04 · Download Device · ES9+ ES9+ session: handshake, profile package transferred and installed in eUICC, mutual authentication completed. download < 8s 05 · Activate Profile enabled Profile enabled on the eUICC, first network attach, subscription live. Lifecycle events streamed to the operator VSM dashboard. first attach < 12s Platform ## Everything an operator needs to ship eSIM — without building it. ### eSIM provisioning (SM-DP+ & SM-DS) Carrier-grade SM-DP+ and SM-DS in a Tier 3 EU data centre. ES2+, ES8+, ES9+ and ES10. FIPS 140-2 Level 3 HSM key custody, dual-control access, full audit trail. GSMA SGP.22 FIPS 140-2 Level 3 ES2+/ES8+/ES9+ ### Multi-device provisioning One platform for smartphones, wearables, tablets, laptops and IoT. Full GSMA SGP.22 Consumer Universal Profile compliance across every eUICC device class. SGP.22 eUICC Consumer ### Provision, manage, monetise Everything operators and MVNOs need to provision, manage and monetise eSIM subscriptions — consumer plans, travel and roaming bundles, secondary-device profiles. Powers TripoSIM on the same VSM. Consumer Travel & roaming TripoSIM ### MVNO enablement Multi-tenant by design. MVNOs launch on eSIM without building their own RSP — wholesale eSIM, per-operator isolation and reporting on the shared BroadNet VSM. Multi-tenant Multi-operator Wholesale ### Multiple activation flows QR code, SM-DS instant activation, carrier app and manual entry — all supported in parallel. Standard LPA format 1$smdp_url$matchingid, with QR images and matching IDs generated in batch. QR · SM-DS · App Manual entry Batch QR ### VSM operator GUI Inventory by ICCID, EID and profile state. Prepare, cancel, release, retry and regenerate confirmation codes. Standard reporting, KPIs and role-based access. Inventory Lifecycle Reporting Where it ships ## Four ways operators put VSM to work. [Discuss your scenario](https://www.broadnet.me/contact?topic=vsm-consultation&product=esim-vsm) Travel & roaming ### Travel eSIM & roaming Travel eSIM offers, roaming bundles and secondary-device profiles. Quick-activation tourist plans on the same SM-DP+ that powers TripoSIM. MVNO enablement ### Enable an MVNO on eSIM MVNOs launch on eSIM without building their own Remote SIM Provisioning. Wholesale eSIM on a multi-tenant VSM tenant, with per-operator isolation and reporting. Wearables & IoT ### Wearables & connected devices Secondary-device profiles for smartwatches, tablets and connected vehicles. Companion-device management across the eUICC device classes under GSMA SGP.22. MNO launch ### Launch eSIM as an MNO Replace physical SIM logistics with digital activation. Reduce CAPEX, speed customer onboarding, and provision from a GSMA SGP.22 platform. Architecture ## One platform. SM-DP+, SM-DS and the operator GUI. The VSM core sits between operator BSS and the device LPA — orchestrating profile preparation, generation, activation and lifecycle, with the VSM operator GUI and reporting layered on top. Operator side BSS / OSS Subscriber DB HLR · BSS ES2+ Web Service profile/prepare Profile types Milenage AKA ES2+ BroadNet VSM Virtual Subscription Management SM-DP+ ES8+ · ES9+ SM-DS discovery ES9+ · ES11 MVNO tenancy Multi-tenant HSM key custody FIPS 140-2 Level 3 ES9+ Device side eUICC / LPA QR / SM-DS / App ES10 Consumer eSIM SGP.22 Wearables & IoT SGP.22 · eUICC Operator dashboard Lifecycle · EDR · KPIs 24/7 BroadNet NOC SGP.22 · FIPS 140-2 Level 3 For your integration team ## ES2+ prepare. Lifecycle actions. Signed EDRs. The three calls your BSS team will touch on day one — the profile/prepare request, a VSM lifecycle action, and the reporting EDR that closes the lifecycle loop into your billing. esim.broadnet.rsp · v1 · SGP.22 Example ``` 1# Illustrative GSMA SGP.22 ES2+ call — operator BSS → BroadNet SM-DP+.2# ES2+ is the GSMA-standard operator interface, not part of the public3# BroadNet REST API: the endpoint and mutual-TLS credentials are agreed4# per operator during onboarding.5POST /gsma/rsp2/es2plus/downloadOrder6Content-Type: application/json7X-Admin-Protocol: gsma/rsp/v2.1.08 9{10 "header": {11 "functionRequesterIdentifier": "mno-acme",12 "functionCallIdentifier": "TX-000123"13 },14 "eid": "89043032123456789012345678901234",15 "iccid": "8901260247000123456",16 "profileType": "consumer_data_voice_v3"17}18 19# → then confirmOrder with the MSISDN and matching ID; the SM-DP+20# returns the activation code, e.g.21# LPA:1$esim.broadnet.rsp$AB12-CD34-EF56 ``` Key custody ## Keys derived inside the HSM. Never plaintext. Never copied. The cryptographic core of the platform is a NIST FIPS 140-2 Level 3 HSM cluster in a Tier-3 EU data centre, operated under documented dual-control procedures. Master keys are generated in-HSM under split-knowledge ceremony. Per-profile keys are derived in-HSM and applied directly to the profile package — the plaintext key material never leaves the cryptographic boundary. FIPS 140-2 Level 3 HSM Split-knowledge ceremony Dual control Tamper-evident EU data sovereignty ### Master keys Generated in-HSM under multi-officer split-knowledge ceremony. No officer ever sees a complete key. ### Per-profile derivation Profile-specific keys derived inside the HSM at provisioning time, applied directly to the profile package. ### Operational separation Cryptographic officers, system administrators and audit officers are strictly separated — no one role can act alone. ### Audit chain Every key event is signed and chained — ceremony, derivation, use, retirement — for audit and incident review. Profile personalisation ## Milenage and TUAK, by the book. Profiles are personalised against the 3GPP authentication algorithms operators actually deploy. Milenage parameters and operator-variant keys (OPc) are derived per profile inside the HSM. TUAK is supported end-to-end for operators that have migrated to the SHA-3-based algorithm set. The same generation pipeline runs production batches under dual-control HSM key ceremonies. Milenage 3GPP TS 35.205 / 35.206 f1–f5* authentication functions, per-operator OPc derived in-HSM, OP held under split-knowledge custody. TUAK 3GPP TS 35.231 / 35.232 Keccak-based authentication for operators standardising on the SHA-3 algorithm family, fully supported in the personalisation pipeline. Batch generation File-based batch generation Batch profile generation runs from files — IMSI start range, ICCID start range and profile type — returning the ICCID list, activation codes, .OUT security files and .SMS OTA files over SFTP with PGP encryption. Each batch runs under a dual-control HSM key ceremony with a per-ICCID provenance chain. - Signed batch manifest per ceremony - Per-ICCID provenance chain - Rate-limited release to SM-DP+ queue eUICC architecture ## Every GSMA domain. Speaking every interface. The platform speaks the full GSMA Remote SIM Provisioning stack — SM-DP+, SM-DS and the ES2+ / ES8+ / ES9+ / ES10 interfaces — and operates against every eUICC security domain the specification defines. ISD-R ### Issuer Security Domain — Root The root domain on the eUICC. Manages profile installation, enablement, disablement and deletion under operator authority. ISD-P ### Issuer Security Domain — Profile Per-profile security domain that isolates one operator subscription from another on the same eUICC. MNO-SD ### MNO Security Domain Operator-controlled domain inside the profile. Holds operator OTA keys and the live authentication credentials. ECASD ### eUICC Controlling Authority SD Stores the eUICC root certificate and the certificate-issuer trust chain — the basis for mutual authentication with SM-DP+ / SM-DS. SM-DP+ · SM-DS · ES2+ · ES8+ · ES9+ · ES10 Compliance ## Audited where it matters. eSIM is a security product before it is a UX product. The VSM platform is built on GSMA SGP.22 controls and NIST-certified key custody — so procurement, security and regulators get the paperwork they need on day one. GSMA SGP.22 · FIPS 140-2 Level 3 GSMA SGP.22 Consumer eSIM (RSP) Compliant with GSMA SGP.22 for consumer Remote SIM Provisioning — SM-DP+ and SM-DS, the ES2+/ES8+/ES9+/ES10 interfaces and the Universal Profile across smartphones, wearables, tablets and IoT. GSMA SAS-UP UICC Production Production aligned with the GSMA SAS-UP (Security Accreditation Scheme for UICC Production) controls — secure profile generation and OTA delivery. GSMA SAS-SM Subscription Management — in progress Accreditation in progress, not yet awarded. Covers SM-DP+ and SM-DS service management, key/certificate handling, and physical and logical security. FIPS 140-2 Level 3 HSM Key custody Cryptographic keys held in NIST FIPS 140-2 Level 3 certified HSMs in a Tier-3 EU data center. Dual-control access. Tamper-evident. EU data sovereignty. Deployment scenarios ## What an eSIM launch looks like on a managed VSM. Regional MNO MNO · illustrative scenario JO An MNO ships a consumer eSIM line without physical SIM logistics. BroadNet's SM-DP+ and SM-DS handle profile preparation over ES2+, QR and SM-DS reach the subscriber's device, and the VSM operator GUI runs the full profile lifecycle — all from a Tier 3 EU data centre. Illustrative MNO deployment · results vary ES2+ BSS integration QR · SM-DS Activation flows 99.99% Premium SLA MVNO on shared VSM MVNO · illustrative scenario DZ An MVNO launches on eSIM without building its own Remote SIM Provisioning. Wholesale eSIM runs on a multi-tenant VSM tenant with per-operator isolation and reporting, provisioned and managed by BroadNet on the same core platform. Illustrative MVNO deployment · results vary Multi-tenant MVNO enablement Wholesale eSIM model SGP.22 GSMA standard Travel eSIM brand Travel eSIM · illustrative scenario PH A travel and roaming eSIM offer runs on the same VSM that powers TripoSIM. Consumer plans, roaming bundles and secondary-device profiles are provisioned over ES2+ and activated by QR or SM-DS, with lifecycle and reporting in the operator dashboard. Illustrative travel-eSIM deployment · results vary Travel · roaming Consumer eSIM TripoSIM Same VSM SGP.22 Consumer profile Operator due diligence ## Eight answers for the launch committee. eSIM VSM is delivered as a managed service. Onboarding covers ES2+ web-service integration with your BSS, eSIM profile type definition and creation, QR activation including code generation, and standard reporting through the VSM operator GUI. Training is typically two days, followed by UAT with test devices before go-live. The platform runs on a premium 99.99% SLA with 24/7 BroadNet operations. Not yet. GSMA SAS-SM accreditation for BroadNet's SM-DP+ and SM-DS is in progress, and we will publish it once it is awarded. Cryptographic keys are held on NIST FIPS 140-2 Level 3 HSMs in a Tier 3 EU data centre, and our security documentation is available under NDA. eSIM VSM is a GSMA SGP.22 Consumer Universal Profile platform. It provisions smartphones, wearables, tablets, laptops and IoT devices — anything with a GSMA-compliant eUICC. SM-DP+ and SM-DS, and the ES2+, ES8+, ES9+ and ES10 interfaces, are supported end-to-end. QR code activation (the operator generates a QR encoding the SM-DP+ URL and a matching ID, which the user scans), SM-DS 'instant activation' (no QR — the eUICC discovers the profile via the SM-DS root), carrier app activation and manual activation-code entry. All flows run in parallel. The standard LPA format is 1$smdp_url$matchingid. eSIM VSM is delivered as a managed, multi-tenant service from BroadNet's Tier 3 data centre in Cluj, Romania (EU), where the FIPS 140-2 Level 3 HSMs physically reside. European operators get EU data sovereignty. Dedicated-tenant options are available; talk to us about your requirements. Multi-tenant SM-DP+ (and SM-DS where applicable) in the Tier 3 data centre, eSIM profile type definition and creation, ES2+ web-service integration, QR activation including code generation, standard reporting and the VSM operator GUI, training (typically two days) and UAT with test devices, a premium 99.99% SLA and 24/7 BroadNet operations. Commercial terms are scoped per deployment — talk to sales. Batch profile generation takes files as input — IMSI start range, ICCID start range and profile type — and returns the ICCID list, activation codes, confirmation codes, .OUT security files and .SMS OTA files. Delivery is over SFTP with PGP encryption, and authentication keys use the standard Milenage AKA algorithm. BroadNet also generates the QR images and matching IDs in batch from operator-provided profile types. In a Tier 3 data centre in Cluj, Romania — inside the EU, giving European operators data sovereignty. Cryptographic keys are held in a FIPS 140-2 Level 3 certified HSM. The facility has 24/7 CCTV, strict access control, high-security zones, dual-control logical access and hardened infrastructure. GSMA SAS-SM accreditation is in progress. Need our eSIM security documentation or a working session with our eSIM platform engineers? [Request VSM consultation →](https://www.broadnet.me/contact?topic=vsm-consultation&product=esim-vsm) Operator-grade ## Protect and monetize at the signaling layer. In-network SMS and SS7 firewalls stop grey routes and fraud at line rate while legitimate traffic flows untouched. <5ms Inspection 99.99% Uptime 1,000+ MNO links [Talk to our carrier team](https://www.broadnet.me/operators/contact) ## Your eSIM brand, on a certified platform. A single contract, a single platform, a single team. SM-DP+ and SM-DS, MVNO tenancy, QR and SM-DS activation and the VSM operator dashboard — all on one managed core, at a premium 99.99% SLA. [Launch eSIM brand](https://www.broadnet.me/contact?topic=esim-launch&product=esim-vsm) [Request VSM consultation](https://www.broadnet.me/contact?topic=vsm-consultation&product=esim-vsm) $ POST /gsma/rsp2/es2plus/downloadOrder · GSMA SGP.22 ES2+ Related guides & answers Go deeper on the concepts behind this product. [eUICC — the embedded UICC chip explained Read](https://www.broadnet.me/answers/what-is-euicc) [SM-DP+ — Subscription Manager Data Preparation, explained Read](https://www.broadnet.me/answers/sm-dp-plus) [EID — the eUICC identifier, explained Read](https://www.broadnet.me/answers/what-is-eid) [SAS-SM certification — what it means for SIM and eSIM trust Read](https://www.broadnet.me/answers/sas-sm-certification)