Resources

Reading, References, and Architecture Notes

Concept-first articles for engineering and architecture readers. Nothing on this page is marketing collateral — it's how we think.

Featured · Authentication infrastructure

SMS OTP fraud in India & the case for SIM-based authentication

Authentication · Global policy

The Global Shift Away from SMS OTP: Why Hardware-Backed Authentication Is Becoming the Standard

Regulators, banks, and digital identity providers worldwide are moving authentication beyond SMS OTP. UAE Central Bank, FBI/CISA, PSD3, RBI, and Microsoft — and where SIM/eSIM-rooted hardware-backed authentication fits.

13 min · Read article →
eSIM · Cross-domain

SGP.32 and V2X PKI: The Common Architectural Pattern

GSMA SGP.32 IoT eSIM and ETSI/IEEE V2X PKI map onto the same hardware-rooted identity pattern. A side-by-side architectural read — eUICC ↔ Secure Element, SM-DP+ ↔ Enrolment Authority, SM-DS ↔ Authorisation Authority.

12 min · Read article →
Authentication · India policy

SMS OTP Fraud in India: Why Authentication Infrastructure Needs to Evolve

A sourced read of OTP-fraud trends, the RBI / TRAI / DoT / CERT-In regulatory response, and the architectural case for SIM/eSIM-based secure authentication.

14 min · Read article →
Architecture · Whitepaper

SIM-Based Authentication Architecture

The architecture page — moving trust into the SIM/eSIM secure identity boundary with operator infrastructure as substrate.

Read whitepaper →
Technical knowledge base

Trust chain & manufacturing

Architecture

Trust Chain Architecture: From Manufacturing HSM to Deployed Device

The end-to-end trust chain — HSM, secure element, SCP03 OTA, PKI, lifecycle — as one architectural commitment.

12 min · Read article →
Manufacturing

Device Identity at Manufacturing Scale: Fleet Provisioning Architecture

HSM, key diversification, atomic identity records, and PKI hierarchy for fleet-scale provisioning.

13 min · Read article →
OTA · SCP03

SCP03-Protected OTA Channel: What It Does and What It Doesn't Protect

What SCP03 secures, what it doesn't, and why the distinction matters for OTA security architecture.

11 min · Read article →

eSIM, eUICC & telecom integration

RSP · SGP.22

eSIM/eUICC Provisioning Architecture: RSP, SM-DP+, and LPA Integration

The GSMA RSP architecture and provisioning sequence — and the failure modes most commonly encountered at fleet scale.

14 min · Read article →
LTE · PKI

Telecom Authentication and Enterprise Identity: Where LTE and PKI Meet

Two identity contexts on one device — and the integration boundary that governs revocation, decommissioning, and incident response.

12 min · Read article →
Foundations

eSIM vs eUICC vs iSIM: Understanding the Difference

What each term denotes, how they map to silicon, and why the distinction matters for IoT engineering.

9 min · Read article →
eUICC

eUICC Applet Development

Security and architecture considerations for eUICC-resident applets — Security Domains, profile lifecycle, vendor independence.

10 min · Read article →
Java Card

Java Card and eSIM Applet Development

Patterns for building eSIM identity logic on Java Card — state machines, key roles, transaction boundaries.

10 min · Read article →
Telecom

What Makes IoT Security "Telecom-Grade"?

An honest unpacking of an overused phrase — what the bar actually is, who sets it, and how to credibly aspire to it.

8 min · Read article →

Hardware trust & PKI for embedded

Decision framework

Hardware-Backed Authentication: SE vs TEE vs TPM

A precise comparison of Secure Element, Trusted Execution Environment, and TPM 2.0 — with a decision framework.

15 min · Read article →
PKI

PKI for Embedded Systems: Five Enterprise Assumptions That Break

Chain length, online revocation, RSA-2048, on-demand rotation, reliable clocks — and the embedded adjustments for each.

16 min · Read article →
PKI

Embedded PKI Architectures for IoT Security

PKI under embedded constraints — clocks, memory, connectivity, and revocation that works in the field.

10 min · Read article →
Identity

Hardware-Backed Identity for IoT Devices

Why software-only identity isn't enough at fleet scale, and what hardware actually buys you.

10 min · Read article →
Secure Element

Why Secure Elements Matter in Connected Infrastructure

The case for hardware-isolated execution in connected products — and what the boundary actually buys you.

9 min · Read article →

Provisioning, attestation & offline trust

Offline trust

Offline-Capable Trust: Maintaining Device Identity Without Network Connectivity

Hardware-resident credentials, pre-loaded revocation, SE RTC discipline, and explicit degradation policy.

11 min · Read article →
Provisioning

Secure Provisioning Workflows for Connected Devices

Reducing the trusted handoff surface during onboarding and lifecycle re-provisioning.

9 min · Read article →
Attestation

Device Attestation in IoT Security Architectures

Producing signed assertions about device state that a relying party can actually act on.

9 min · Read article →
Resilience

Offline-Capable Authentication for Low-Connectivity IoT

Trust assertions that hold when the network does not — short-lived credentials, capability tokens, monotonic counters.

9 min · Read article →
Capability documents

Whitepaper & capability briefs

Documentation made available on request to operator and ecosystem reviewers under appropriate terms.

D1

eSIM / eUICC capability brief

Architecture, applet scope, identity workflows, and assumptions. Available on request under NDA.

Request brief →
D2

IoT identity reference

End-to-end identity reference: silicon RoT, Secure Element, embedded PKI, attestation, lifecycle.

Request reference →
D3

Sandbox collaboration scope

What we can validate, what we will not claim, and proposed shape of an engagement.

Request scope →

Frequently asked questions

What kind of material is in the AmbiSecure resource library?

It is a concept-first library of engineering and architecture articles spanning eSIM and eUICC provisioning, Secure Elements, embedded PKI, attestation, OTA security, and IoT identity. The writing reflects how the team reasons about these problems rather than marketing collateral.

Where should someone new to eSIM start reading?

Begin with the foundations piece distinguishing eSIM, eUICC, and iSIM, then move to the eUICC RSP provisioning architecture and the trust chain article that runs from the manufacturing HSM to the deployed device. From there the hardware-trust section goes deeper on Secure Element, TEE, and TPM trade-offs.

Are capability documents available beyond the articles?

Yes. The eSIM and eUICC capability brief, the IoT identity reference, and the sandbox collaboration scope are available on request to operator and ecosystem reviewers under appropriate terms.