CFJ-LINK Global eSIM Distribution Platform Architecture

1Abstract

CFJ-LINK is a global instant eSIM distribution platform built on the GSMA RSP (Remote SIM Provisioning) standard. By aggregating carrier partnerships across 200+ countries and regions, and leveraging GSMA SGP.22-compliant SM-DP+ (Subscription Manager Data Preparation+) servers, the platform delivers eSIM profiles to end-user devices instantly.

This whitepaper describes CFJ-LINK's technical architecture, carrier onboarding process, security design principles, and compliance framework, intended as a technical reference for enterprise partners, API integrators, and regulatory bodies.

2Industry Background & Pain Points

The traditional cross-border roaming model has three structural deficiencies that constrain user experience and industry efficiency:

• High physical SIM logistics costs: Traditional roaming SIM cards require physical production, distribution, inventory management, and shipping. The full-chain cost per card far exceeds the marginal cost of the data service itself.
• Opaque roaming pricing: Inter-operator international roaming settlement relies on the TAP (Transferred Account Procedure) protocol with billing cycles of several weeks, resulting in retail prices that embed multiple unnecessary markup layers.
• Cumbersome activation process: Switching to a foreign SIM card requires visiting a physical store or waiting for mail delivery, failing to meet the instant connectivity needs of travelers.

eSIM technology (embedded SIM) and the GSMA RSP standard (SGP.22) fundamentally address these issues: profiles are delivered over the network instantly with no physical medium, reducing activation time from days to minutes.

3Technical Architecture

The CFJ-LINK platform is composed of four core technical layers:

3.1 SM-DP+ Server Layer

The SM-DP+ (Subscription Manager Data Preparation+) is the core server role defined in GSMA SGP.22, responsible for eSIM profile generation, encrypted packaging, and secure delivery. CFJ-LINK's SM-DP+ infrastructure uses redundant multi-region deployment, establishing encrypted channels with devices over TLS 1.3. Each profile is bound to a unique EID (Embedded SIM Identifier) and hardware-locked upon delivery.

3.2 Carrier Aggregation Layer

The platform aggregates carrier resources from 200+ countries by establishing MVNE (Mobile Virtual Network Enabler) wholesale agreements with MNOs and MVNOs. The traffic scheduling engine selects the optimal carrier profile for each user request in real time based on destination, signal quality, and cost.

3.3 Distribution & API Layer

CFJ-LINK exposes RESTful APIs supporting B2B distributors, travel platforms, and enterprise customers. API endpoints cover plan queries, QR code generation, profile status queries, and usage alert push notifications. All API calls require API Key authentication with rate limiting protection.

3.4 Usage Monitoring Layer

The platform integrates carrier real-time data interfaces, providing near real-time usage data (typically within 5 minutes delay). Automatic alert notifications are pushed when plan usage reaches thresholds, with Webhook callbacks to enterprise systems supported.

4Network Coverage & Carrier Framework

CFJ-LINK's coverage network comprises two layers: direct-agreement carriers and transit networks. Core markets (East Asia, Southeast Asia, Europe, North America) have direct MNO agreements ensuring minimum QoS commitments. Long-tail markets are accessed indirectly through certified MVNE partners, covering 200+ countries in total.

All onboarded carriers must meet the following admission requirements: hold a valid telecommunications operating license in the target country, support 4G LTE or higher, pass GSMA interconnection testing, and comply with CFJ-LINK's SLA minimum requirements for success rate and latency.

5Security Architecture & Compliance

The platform's security architecture follows a defense-in-depth principle, covering transport, application, and data layers:

• Transport Security: All API communication uses TLS 1.3 with globally trusted CA-issued certificates. SM-DP+ to device profile delivery is protected by mutual authentication per GSMA SGP.22 Annex G.
• Data Minimization: The platform does not collect user personal data unrelated to the service. Activation records retain only the necessary device identifier (EID) and plan information, without logging communication content or traffic details.
• Sanctions Compliance (OFAC): The platform embeds geofencing detection in the profile provisioning process, refusing service to sanctioned countries and regions.
• Access Control: The management backend uses Role-Based Access Control (RBAC). We are rolling out mandatory Multi-Factor Authentication (MFA) and audit logging for administrative operations, and are progressively strengthening our log-retention policy.

6Payment & Settlement Architecture

CFJ-LINK supports multiple payment channels to meet the needs of users and enterprise clients across different regions:

• Fiat Payment Channel: Card and digital wallet payments are processed through PCI DSS Level 1 certified third-party payment gateways. The platform does not directly store cardholder data (CHD).
• Digital Currency Channel: Multiple major stablecoins and digital currencies are supported, processed through compliant aggregators meeting AML/KYT monitoring requirements.
• B2B Prepaid Balance: Enterprise clients can prepay via bank transfer, deducted by actual usage, with API-based real-time balance and transaction history queries.

All settlement currencies are priced in USD equivalent, with exchange rates refreshed hourly and spreads transparently disclosed. Enterprise invoices are generated monthly, supporting PDF and machine-readable format exports.

7Disclaimer