Introduction to

SIM Cards

20 September 2007

Contents
Part 1 : SIM Concepts
1. Overview of GSM Networks
2. SIM in GSM Networks
3. Introduction to GSM 11.11

Part 2 : SIM Applications

1. Anti-Cloning and Authentication Counter
2. Local Applications
3. Point to Point Applications

20 September 2007

Overview of GSM Networks

20 September 2007

What is GSM?
Original name:

GSM now stands for:

Groupe
Spciale
Mobile

Global
System for
Mobile communication

20 September 2007

Key Features of GSM

GSM properties:
n
n
n
n
n

20 September 2007

Open standard
Provision of roaming
SIM
Digital (ISDN compatible)
TDMA (Time Division Multiple Access)

Network Elements
MS
MS

Network
MS

MS: Mobile Station = Mobile equipment + SIM

20 September 2007

Network Elements
Network
BSS

BSS

BSS

BSS

Core

BSS: Base Station System

20 September 2007

Network Elements
Base Station System
BTS

BTS
BTS

BSC
BTS

Core

BSC: Base Station Controller

BTS: Base Transceiver Station
20 September 2007

Network Elements
Abbreviations:
HLR: Home Location Register
VLR: Visiting Location Register
AUC: Authentication Center
EIR: Equipment Identity Register
MSC: Mobile Switching Center
GMSC: Gateway MSC
OMC: Operational and Maintenance Center
SMSC: Short Message Service Center

20 September 2007

Network Elements
The core network
BSC
BSC
BSC

AUC

HLR

VLR

EIR
SMSC

GMSC
OMC

Gateway to
PLMN roaming
PSTN
others

BSC
BSC
20 September 2007

MSC

VLR

10

SIM in GSM Networks

20 September 2007

11

What is a SIM?
SIM stands for:
Subscriber
Identity
Module

20 September 2007

12

What is a SIM?
The purpose of a SIM:
l Identify a user
l Authenticate a user
l Data storage
l Marketing tool
l Portable

20 September 2007

13

What is in a SIM?
Hardware:
CPU
I/O devices
ROM
RAM
EEPROM

ROM :

EEPROM:

Basic OS functionality
GSM functionality
SIM vendor functionality
Network operator functionality (optional)
Fixed data (optional)

Setup for OS
Patches to the OS
Extensions to the OS
Data

20 September 2007

14

Architecture of standard SIM

Architecture of first Generation SIM

APDU Dispatch
ISO 7816-4 APDUs

GSM 11.11
Subscriber Identity Module Mobile Equipment
(SIM-ME) Interface

ISO 7816-4 File System

20 September 2007

15

SIM in GSM networks

What is required to activate the SIM in the
GSM network?

Input file
Output file
Transport Key (Optional)
SIM Card (with network profile)
Algorithm Type
20 September 2007

16

SIM in GSM networks

Network Side

(Stores
ICCID, IMSI,
PINs)

1. Input File, profile, keys

HLR

AUC (Stores IMSI, KI values)

2. Output File

Card Vendor
3. Perso data

Data Gen

20 September 2007

17

Input file format

* HEADER DESCRIPTION
***************************************
Customer: TELCO
Quantity: 4500
Type:
PLUG IN
Profile:
5.0
Batch:
00045
*
Transport_key:
001
*
Address1: TELCO
Address2: COUNTRY
***************************************
* INPUT VARIABLES
***************************************
var_in_list:
IMSI:
238993210070000
Ser_nb:
894502300000070000
***************************************
* OUTPUT VARIABLES
***************************************
var_out:PIN/PUK/PIN2/PUK2/Code_ADM/KI

20 September 2007

Quantity
Transport Key Index

Start IMSI
Start ICCID

18

Output file format

* HEADER DESCRIPTION
***************************************
Customer: TELCO
Quantity: 4500
Type:
PLUG IN
Profile:
5.0
Batch:
00045
*
Transport_key:
001
*
Address1: TELCO
Address2: COUNTRY
***************************************
* INPUT VARIABLES
***************************************
var_in_list:
IMSI:
238993210070000
Ser_nb:
894502300000070000
***************************************
* OUTPUT VARIABLES
***************************************
var_out:PIN/PUK/PIN2/PUK2/Code_ADM/KI

Subscriber data

894502300000070000 238993210070000 1234 12345678 0000 12345678 88888888

12345678901234567890123456789012

20 September 2007

19

How transport key is used?

1. Transport key index

Card Vendor

Network Side

2. Get key value

6. . Ki is
decrypted in
AUC

3. Transport key value

Transport
keys

4. Use Transport key to

encrypt Ki in output file

5. Encypted Ki in
output file

Transport
keys

AUC

Objective : To protect the KI

value during transport of file from
SIM vendor to Network Operator

20 September 2007

20

GSM Authentication Process

The action on the air interface

Network
MS

RAND

SRES

RAND: random value

SRES: response for authentication
20 September 2007

21

GSM Authentication Process

RAND

IMSI
Ki

RAND

Ki

RAND

A3

A8

A3
SRES
SRES

Kc
20 September 2007

Comparison

22

Confidentiality in GSM

Encrypted Voice Data

Channel
A5Kc[Data]

20 September 2007

A5Kc[Data]

23

Comp 128 algorithm

SIM Process

Comp 128 consists of

A3 Authentication Algorithm
A8 Kc Calculation Algorithm

ME Process

A5

Voice Data Encryption Algorithm

To use the Comp 128 command, ME calls SIM command:

RUN_GSM_ALGO

RUN_GSM_ALGO returns a 12-bytes response, of which 4

bytes are the SRES, and 8 bytes are the Kc.

20 September 2007

24

Security in GSM
Ki is never revealed in the network
Ki is never passed from SIM card to Mobile Phone
All Authentication Calculations including Kc are
done in the SIM card

20 September 2007

25

Introduction to GSM 11.11

20 September 2007

26

GSM Specifications
Defined by ETSI
AKA European Telecommunications
Standards Institute
All the specs can be downloaded at
[Link]

20 September 2007

27

GSM Specifications
Functions of a SIM card
Phase 1

Phase 2

Subscriber
Authentication to the
network

Fixed Dialing
Numbers (FDNs)

Public Land Mobile

Networks (PLMNs)

PIN protection to
Subscriber Data

More Security PIN2

Phase 2+

Service Dialing
Numbers (SDNs)

Barred Dialing
Numbers (BDNs)

Over The Air (OTA)

Phonebook Storage

SIM ToolKit (STK)

SMS Storage

20 September 2007

28

GSM 11.11 Basic SIM Specifications

File System
Purpose of
each file
Default
Contents
Access
Conditions

Command Set
APDU Coding of
commands
Coding of
responses
Communication
Protocol

Power Up
Procedure

20 September 2007

29

Types of Files
1. Transparent File

2. Linear Fixed File

Consists of sequence
of bytes
Total length of file is
defined in the header
Relative address is
used for reading or
updating data in file

Consists of sequence
of records all having
same fixed length
First record has index
number 1
Number of record and
length is defined in the
header
Record Number is used
for reading or updating
data in file

20 September 2007

3. Cyclic File

Consists of sequence
of records all having
same fixed length
Number of record and
length is defined in the
header
Stores data in
chronological order
When record pointer is
at last record, record 1
will be used next

30

SIM File System, Data and Algo

More important Files (EF) and Folders (DF) includes:

Master File
(Base Directory)

EF_ICCID
Integrated Circuit
Chip ID
Each card is unique
Assigned by operator
19 Digit printed on
exterior of SIM
Follows international
format

DF Telecom

DF GSM

EF_ADN
Phonebook

EF_SMS

EF_IMSI
International Mobile
Subscriber ID
Each card is unique
Assigned by operator
Network to identify
SIM

20 September 2007

31

SIM File System

SIM Card File System
MF ( ROOT )
3F00

EF_ICCID
2FE2

EF_MANU
0002

ICCID
EF_KEY_EXT
0011

EF_CHV1
0000

PIN1

EF_CHV2
0100

PIN2

DF_GSM
7F20
EF_KEY_INT
0001

EF_PLMNSEL
6F30

DF_TELECOM
7F10
EF_ADN
6F3A

Addr Book

20 September 2007

EF_SMS
6F3C

EF_MSISDN
6F40

Short Message

32

SIM Data
Format of ICCID
Primary account number
19 visible characters (maximum)
Issuer identification number (digits variable, maximum 7)

Luhn
check
digit
Individual account identification number
(variable, but fixed number of digits for
each particular issuer identifier number)
Issuer identifier number
(variable, but fixed number of digits within
a country or world zone where appropriate)
T0102740-92/d01

Country code: Recommendation E.164 [2]

(variable, 1 to 3 digits)
Major Industry Identifier (MII)
(Standard ISO/IEC 7812) [1]
"89" is assigned for telecommunication purposes
to ROAs

.
Charge card numbering system

20 September 2007

33

ICCID -format
ICCID is the SIM cards unique identification number and is coded in accordance to
ITU-T recommendation E.118 (18).
Format

: 89 66 15 XTH YYYYYYYYY C

Number of digits ICCID

: 19 digits including check digit

89

: Telecom Application Code

66

: Mobile country Code (eg. Thailand)

18

: Mobile Network Code (eg. DTAC)

: Card Manufacture Code

: Type of card (ID-1=1 and Plug-in=2)

: HLR ID (HLR1=0,HLR2=1,HLR3=2)

YYYYYYYYY: Sequential Number

C

: Luhn key computed from the 18 previous digits (1 nibble)

Example : 89661 51100 00000 001 -7

20 September 2007

34

Use of ICCID in Graphical Personalisation

ICCID

2 rows vertical x 10 digits each row or

5 rows horizontal x 4 digits each row

8966
1811
0000
0000
01 7

89661 81100 00000 001-7

Barcode

20 September 2007

35

SIM Data
Format of IMSI

IMSI
MCC

20 September 2007

MNC

MSIN

10 11 1 2 13 14 15

36

IMSI - format
IMSI Format IMSI is the International Mobile subscriber Identity. Length
of IMSI coding must be according to GSM 04.48 [15]. IMSI is coded on
15 digits, according to the following structure:

MCCNCXXXXXXXXXX e.g. 520181000000001

MCC

Mobile network country code defined by GSM11.11.

520for Thailand.

NC

Network code registered in ITU for the operator.

18for DTAC.

XX..X

Running number of serial number , included HLR ID

Note : The running number taken from the input file and automatically
incremented from the initial value.

20 September 2007

37

SIM File System, Data and Algo

Important Data
Ki
Unique 16 byte secret key used for authentication
Usually encrypted with transport key
PIN / PUK (Max 8 bytes)
Personal Identification Number (3 tries)
PIN Unblocking Key (10 tries)
Can be fixed or random specified by operators
ADM (Max 8 bytes)
Administrative PIN (5 tries)

Important Algo
A3/A8 (COMP128)
Authentication algorithm
Version 1, 2 and 3
20 September 2007

38

GSM Command Set

Basic GSM 11.11 command set includes
Select MF/DF/EF
Read Binary
Update Binary
Read Record
Update Record
Verify PIN/PUK/ADM
Run GSM Algo

Transpatent
File

20 September 2007

Linear Fixed File

39

Part 2 : SIM Applications

20 September 2007

40

Anti Cloning &

Authenication Counter

20 September 2007

41

Hacking of Ki

Cloning Kits call RUN_GSM_ALGO command

many times with a series of Fake RAND

Analyze SRES returned by the RUN_GSM_ALGO

commands

Ki can be found in 40000 to 80000

RUN_GSM_ALGO commands

Only Comp128-1 can be hacked now. Comp128-2

and Comp128-3 are safe from hacking

20 September 2007

42

Methods to curb hacking

20 September 2007

43

Authentication Counter
1. SIM Solution
How

Advantages

Disadvantages

20 September 2007

Limit the Number of times

RUN_GSM_ALGO command can be called

Effective in reducing possibility of SIM

cloning

Life Span of SIM compromised

Difficult to find optimal limit

44

Strong Ki
2. Non SIM Solution
How

Advantages

Disadvantages

20 September 2007

Software generates Ki values that can

withstand Cloning Kits Analysis
Only these Ki values are used in Perso
No SIM technology needed
Easy to Implement
Does not compromise SIM Life-Span
Ki values may still be hacked with new
analysis algorithm in the future
Customers may not feel safe

45

Pattern Recognition
3. SIM Solution
How

20 September 2007

Detect Fake RAND eg: Running numbers

Detect unusually high percentage of
RUN_GSM_ALGO commands received by
the SIM card
Once Hacking Pattern is detected, return a
Wrong SRES value, which will thwart the
Analysis
Wrong SRES value generation
Random Number Generation
Dummy Ki

46

Pattern Recognition
3. SIM Solution
Advantages

Does not compromise SIM Life-Span

Very effective as it will not be affected by new
Cloning Kits

20 September 2007

47

Comparison of Methods

20 September 2007

48

Comparison table
Authentication
Counter

Strong Ki

Pattern
Recognition

SIM Solution

Easy to
Implement

Maintain SIM
Life Span

Protection
against New
Cloning Kits

20 September 2007

49

User Applications

20 September 2007

50

Value-Added Applications
Applications Portfolio

Eastcompeace Applications

Portfolio may be divided into 2

main categories:

Info on demand
Data back up

m-Banking

Local
Point to Point
Internet/E-mail

Prepaid
Loyalty

20 September 2007

51

Value-Added Applications
Local Applications

Local Applications are stand-alone applications, running

into the Mobile Station without producing traffic.

Eastcompeace offer of Local Applications includes:

Dual IMSI
Phonebook plus
Enhanced Phonebook
Multi-Inbox
Password Manager
Welcome Note

20 September 2007

52

Value-Added Applications
Dual IMSI

Dual IMSI application allows the operator to offer two different

accounts on the same SIM card without any impact on the
network side.

Applications:

Private/Business
Roaming

Operator Benefits:

Differentiate the product

Increase customer satisfaction
Target specific subscribers segment

20 September 2007

53

Value-Added Applications
Phonebook Plus

Phonebook Plus application provides the SIM card with an increased

phonebook, up to 500 entries.

The standard phonebook is duplicated, the user can access by menu

two phonebooks, pbook1 and pbook2, each up to 250 entries.

Phonebook is the unique solution that allows increasing SIM phonebook

without changing the user experience.

Operator Benefits:

Differentiate the product

Increase customer satisfaction

20 September 2007

54

Value-Added Applications
Enhanced Phonebook

USIM:

Enhanced Phonebook for USIM allows to access all the 3G Phone

Book functionalities (more than 250 entries, second name, additional
number, e-mail, ) even from a 2G handset.
Enhanced Phonebook makes smoother the 2G migration toward 3G.

SIM:

Enhanced Book for SIM makes 3G Phonebook functionalities (more

than 250 entries, second name, additional number, e-mail, )
available on a 2G SIM card.

Operator Benefits:

Differentiate the product

Increase customer satisfaction

20 September 2007

Mr. White
principal number
second number
email address
second name
group

55

Value-Added Applications
Multi-Inbox

Multi-Inbox application satisfies the need to store as many SMS as

possible.

The standard Inbox is duplicated, the user can access by menu two
Inbox, Inbox1 and Inbox2.

Once an Inbox is selected, it is managed as the standard SIM Inbox

folder, through the ME commands, without changing the user experience.

Operator Benefits:

Differentiate the product

Increase customer satisfaction

20 September 2007

56

Value-Added Applications
Password Manager

Password Manager application allows the operator to dedicate a certain

amount of memory to the user, where he can store his highly sensitive
personal data (credit card number, access codes, ).

The dedicated space can only be accessed by code presentation.

The secured data can be stored into a secure application server and
securely retrieved in case of the SIM card is lost or stolen.

Operator Benefits:

Differentiate the product

Increase customer satisfaction
Increase ARPU

20 September 2007

57

Value-Added Applications
Welcome Note

This application provides a personalized welcome note when the phone

is powered up. This application can be used by the operator to display
the service branding and the customer
s subscription plan, which will
help our customers to guarantee loyalty by improving the user
experience.

Welcome

message can be modified via OTA, which is a perfect

marketing tool to inform each customer of relevant new services or offers
available!

20 September 2007

58

Value-Added Applications
Point-to-Point Applications

Point to point applications provide end to end connections to the users.

The aim is to offer value added services, generating traffic and revenue
for the operator.

Eastcompeace offer of Point to Point applications includes:

Smart Lock
Group SMS
My Secret SMS
Flash SMS

20 September 2007

59

Value-Added Applications
Smart Lock

Smart Lock application provides a feature to prevent unauthorized use

of your mobile phone. If the user forgot to carry his/her mobile phone or
lose it, the user can send a special SMS to his/her phone to lock the SIM
card with PIN1.
The STK-SMS must follow a special format and include a password
The password can be set through your SIM card
s STK menu
The SIM card can be unlocked by presenting the password again
through the STK menu

20 September 2007

60

Value-Added Applications
Group SMS

Group SMS application assists the user to broadcast information.

Once a group is defined, the application allows to send a SMS to the
entire group by single operation.

Definitely, this application produce revenue for the operator, leading to

increase SMS traffic per user.

Operator Benefits:

Differentiate the product

Increase customer satisfaction
Increase ARPU

20 September 2007

61

Value-Added Applications
My Secret SMS

My Secret SMS application allows the user to send/receive anonymous

SMS, protected by PIN.

Upon the arrival of a secret SMS, the user experience is to receive a

standard SMS, the text of which, configurable by the same user,
represents the notification of the arrival of a secret SMS.

The Secret Inboxcan be accessed via menu after a PIN code

presentation.

Operator Benefits:

Differentiate the product

Increase customer satisfaction
Increase ARPU

20 September 2007

62

Value-Added Applications
Flash SMS

Flash SMS application offers mobile subscribers the following features:

Upon receiving SMS, the contents of the SMS are displayed on the
mobile phone screen
the SMS will not be stored in inbox directly
User scroll down to read the SMS
At the end of the SMS, the user shall be prompted to save or
discard the SMS

20 September 2007

63

Thank you J

We are always willing to grow with you.

20 September 2007

64