Subscriber identity module

A subscriber identity module or subscriber identification module (SIM) is an integrated circuit that is intended to securely store the international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephony devices (such as mobile phones and computers). It is also possible to store contact information on many SIM cards. SIM cards are always used on GSM phones; for CDMA phones, they are only needed for newer LTE-capable handsets. SIM cards can also be used in satellite phones, computers, or cameras.

The SIM circuit is part of the function of a Universal Integrated Circuit Card (UICC) physical smart card, which is usually made of PVC with embedded contacts and semiconductors. "SIM cards" are transferable between different mobile devices. The first UICC smart cards were the size of credit and bank cards; sizes were reduced several times over the years, usually keeping electrical contacts the same, so that a larger card could be cut down to a smaller size.

A SIM card contains its unique serial number (ICCID), international mobile subscriber identity (IMSI) number, security authentication and ciphering information, temporary information related to the local network, a list of the services the user has access to, and two passwords: a personal identification number (PIN) for ordinary use, and a personal unblocking code (PUK) for PIN unlocking.

History and procurement

The SIM was initially specified by the European Telecommunications Standards Institute in the specification with the number TS 11.11. This specification describes the physical and logical behaviour of the SIM. With the development of UMTS the specification work was partially transferred to 3GPP. 3GPP is now responsible for the further development of applications like SIM (TS 51.011^[1]) and USIM (TS 31.102^[2]) and ETSI for the further development of the physical card UICC.

The first SIM card was developed in 1991 by Munich smart-card maker Giesecke & Devrient, who sold the first 300 SIM cards to the Finnish wireless network operator Radiolinja.^[3][4]

Today, SIM cards are ubiquitous, allowing over 7 billion devices to connect to cellular networks around the world. According to the International Card Manufacturers Association (ICMA), there were 5.4 billion SIM cards manufactured globally in 2016 creating over $6.5 billion in revenue for traditional SIM card vendors.^[5] The rise of cellular IoT and 5G networks is predicted to drive the growth of the addressable market for SIM card manufacturers to over 20 billion cellular devices by 2020.^[6] The introduction of Embedded SIM (eSIM) and Remote SIM Provisioning (RSP) from the GSMA ^[7] may disrupt the traditional SIM card ecosystem with the entrance of new players specializing in "digital" SIM card provisioning and other value-added services for mobile network operators.

Inactivation

Many non-contractual "pay-as-you-go" arrangements require you to actively use credit periodically to avoid account expiration, expiration period depends on network operators, typically defining a three months period. This is sometimes associated with the SIM card being made "inactive" by the network.^[8]

Registration

Most countries and operators require an identification in order to activate service, there are some exception such as Hong Kong SAR or Philippines.

Design

There are three operating voltages for SIM cards: 5 V, 3 V and 1.8 V (ISO/IEC 7816-3 classes A, B and C, respectively). The operating voltage of the majority of SIM cards launched before 1998 was 5 V. SIM cards produced subsequently are compatible with 3 V and 5 V. Modern cards support 5 V, 3 V and 1.8 V.

Modern SIM cards allow applications to be loaded when the SIM is in use by the subscriber. These applications communicate with the handset or a server using SIM application toolkit, which was initially specified by 3GPP in TS 11.14 (there is an identical ETSI specification with different numbering). ETSI and 3GPP maintain the SIM specifications; the main specifications are: ETSI TS 102 223, ETSI TS 102 241, ETSI TS 102 588, and ETSI TS 131 111. SIM toolkit applications were initially written in native code using proprietary APIs. In order to allow interoperability of the applications, Java Card was taken as the solution of choice by ETSI. Additional standards and specifications of interest are maintained by GlobalPlatform.

Data

SIM cards store network-specific information used to authenticate and identify subscribers on the network. The most important of these are the ICCID, IMSI, Authentication Key (Ki), Local Area Identity (LAI) and Operator-Specific Emergency Number. The SIM also stores other carrier-specific data such as the SMSC (Short Message Service Center) number, Service Provider Name (SPN), Service Dialing Numbers (SDN), Advice-Of-Charge parameters and Value Added Service (VAS) applications. (Refer to GSM 11.11^[9])

SIM cards can come in various data capacities, from 8 KB to at least 256 KB. All allow a maximum of 250 contacts to be stored on the SIM, but while the 32 KB has room for 33 Mobile Network Codes (MNCs) or "network identifiers", the 64 KB version has room for 80 MNCs. This is used by network operators to store information on preferred networks, mostly used when the SIM is not in its home network but is roaming. The network operator that issued the SIM card can use this to have a phone connect to a preferred network, in order to make use of the best commercial agreement for the original network company instead of having to pay the network operator that the phone 'saw' first. This does not mean that a phone containing this SIM card can connect to a maximum of only 33 or 80 networks, but it means that the SIM card issuer can specify only up to that number of preferred networks; if a SIM is outside these preferred networks it will use the first or best available network.

ICCID

Each SIM is internationally identified by its integrated circuit card identifier (ICCID). ICCIDs are stored in the SIM cards and are also engraved or printed on the SIM card body during a process called personalisation. The ICCID is defined by the ITU-T recommendation E.118 as the Primary Account Number.^[10] Its layout is based on ISO/IEC 7812. According to E.118, the number is up to 22 digits long, including a single check digit calculated using the Luhn algorithm. However, the GSM Phase 1^[11] defined the ICCID length as 10 octets (20 digits) with operator-specific structure.

The number is composed of the following subparts:

Issuer identification number (IIN)

Maximum of seven digits:

• Major industry identifier (MII), 2 fixed digits, 89 for telecommunication purposes.
• Country code, 1–3 digits, as defined by ITU-T recommendation E.164.
• Issuer identifier, 1–4 digits.

Individual account identification

• Individual account identification number. Its length is variable, but every number under one IIN will have the same length.

Check digit

• Single digit calculated from the other digits using the Luhn algorithm.

With the GSM Phase 1 specification using 10 octets into which ICCID is stored as packed BCD, the data field has room for 20 digits with hexadecimal digit "F" being used as filler when necessary.

In practice, this means that on GSM SIM cards there are 20-digit (19+1) and 19-digit (18+1) ICCIDs in use, depending upon the issuer. However, a single issuer always uses the same size for its ICCIDs.

To confuse matters more, SIM factories seem to have varying ways of delivering electronic copies of SIM personalization datasets. Some datasets are without the ICCID checksum digit, others are with the digit.

As required by E.118, The ITU publishes a list of all current internationally assigned IIN codes in its Operational Bulletins.^[12] As of October 2016 the list issued on 15 November 2013 was current.^[13]

International mobile subscriber identity (IMSI)

SIM cards are identified on their individual operator networks by a unique International Mobile Subscriber Identity (IMSI). Mobile network operators connect mobile phone calls and communicate with their market SIM cards using their IMSIs. The format is:

• The first three digits represent the Mobile Country Code (MCC).
• The next two or three digits represent the Mobile Network Code (MNC). Three-digit MNC codes are allowed by E.212 but are mainly used in the United States and Canada.
• The next digits represent the Mobile Subscriber Identification Number (MSIN). Normally there will be 10 digits but would be fewer in the case of a 3-digit MNC or if national regulations indicate that the total length of the IMSI should be less than 15 digits.
• Digits are different from country to country.

Authentication key (K_i)

The Kn_i is a 128-bit value used in authenticating the SIMs on a GSM mobile network (for USIM network, you still need K_i but other parameters are also needed). Each SIM holds a unique K_i assigned to it by the operator during the personalization process. The K_i is also stored in a database (termed authentication center or AuC) on the carrier's network.

The SIM card is designed not to allow the K_i to be obtained using the smart-card interface. Instead, the SIM card provides a function, Run GSM Algorithm, that allows the phone to pass data to the SIM card to be signed with the K_i. This, by design, makes usage of the SIM card mandatory unless the K_i can be extracted from the SIM card, or the carrier is willing to reveal the K_i. In practice, the GSM cryptographic algorithm for computing SRES_2 (see step 4, below) from the K_i has certain vulnerabilities^[14] that can allow the extraction of the K_i from a SIM card and the making of a duplicate SIM card.

Authentication process:

1. When the Mobile Equipment starts up, it obtains the International Mobile Subscriber Identity (IMSI) from the SIM card, and passes this to the mobile operator, requesting access and authentication. The Mobile Equipment may have to pass a PIN to the SIM card before the SIM card will reveal this information.
2. The operator network searches its database for the incoming IMSI and its associated K_i.
3. The operator network then generates a Random Number (RAND, which is a nonce) and signs it with the K_i associated with the IMSI (and stored on the SIM card), computing another number, that is split into the Signed Response 1 (SRES_1, 32 bits) and the encryption key K_c (64 bits).
4. The operator network then sends the RAND to the Mobile Equipment, which passes it to the SIM card. The SIM card signs it with its K_i, producing SRES_2 and K_c, which it gives to the Mobile Equipment. The Mobile Equipment passes SRES_2 on to the operator network.
5. The operator network then compares its computed SRES_1 with the computed SRES_2 that the Mobile Equipment returned. If the two numbers match, the SIM is authenticated and the Mobile Equipment is granted access to the operator's network. K_c is used to encrypt all further communications between the Mobile Equipment and the network.

Location area identity

The SIM stores network state information, which is received from the Location Area Identity (LAI). Operator networks are divided into Location Areas, each having a unique LAI number. When the device changes locations, it stores the new LAI to the SIM and sends it back to the operator network with its new location. If the device is power cycled, it will take data off the SIM, and search for the prior LAI.

SMS messages and contacts

Most SIM cards will orthogonally store a number of SMS messages and phone book contacts. The contacts are stored in simple "name and number" pairs: entries containing multiple phone numbers and additional phone numbers will usually not be stored on the SIM card. When a user tries to copy such entries to a SIM, the handset's software will break them up into multiple entries, discarding any information that is not a phone number. The number of contacts and messages stored depends on the SIM; early models would store as few as five messages and 20 contacts while modern SIM cards can usually store over 250 contacts.

Formats

SIM cards have been made smaller over the years; functionality is independent of format. Full-size SIM were followed by mini-SIM, micro-SIM, and nano-SIM. SIM cards are also made to be embedded in devices.

SIM card sizes

SIM card	Introduced	Standard reference	Length (mm)	Width (mm)	Thickness (mm)	Volume (mm3)
Full-size (1FF)	1991	ISO/IEC 7810:2003, ID-1	85.60	53.98	0.76	3511.72
Mini-SIM (2FF)	1996	ISO/IEC 7810:2003, ID-000	25.00	15.00	0.76	285.00
Micro-SIM (3FF)	2003	ETSI TS 102 221 V9.0.0, Mini-UICC	15.00	12.00	0.76	136.80
Nano-SIM (4FF)	early 2012	ETSI TS 102 221 V11.0.0	12.30	8.80	0.67	72.52
Embedded-SIM (eSIM)		JEDEC Design Guide 4.8, SON-8 ETSI TS 103 383 V12.0.0 GSMA SGP.22 V1.0	6.00	5.00	<1.00	<30.00

Full-size SIM

The full-size SIM (or 1FF, 1st form factor) was the first form factor to appear. It has the size of a credit card (85.60 mm × 53.98 mm × 0.76 mm). Later smaller SIMs are often supplied embedded in a full-size card that they can be pushed out of.

Mini-SIM

The mini-SIM (or 2FF) card has the same contact arrangement as the full-size SIM card and is normally supplied within a full-size card carrier, attached by a number of linking pieces. This arrangement (defined in ISO/IEC 7810 as ID-1/000) allows such a card to be used in a device requiring a full-size card, or in a device requiring a mini-SIM card after breaking the linking pieces. As the full-size SIM is no longer used, some suppliers refer to this form factor as a standard or regular SIM.

Micro-SIM

The micro-SIM (or 3FF) card has the same thickness and contact arrangements, but reduced length and width as shown in the table above.^[15]

The micro-SIM was introduced by the European Telecommunications Standards Institute (ETSI) along with SCP, 3GPP (UTRAN/GERAN), 3GPP2 (CDMA2000), ARIB, GSM Association (GSMA SCaG and GSMNA), GlobalPlatform, Liberty Alliance, and the Open Mobile Alliance (OMA) for the purpose of fitting into devices too small for a mini-SIM card.^[16][17]

The form factor was mentioned in the December 1998 3GPP SMG9 UMTS Working Party, which is the standards-setting body for GSM SIM cards,^[18] and the form factor was agreed upon in late 2003.^[19]

The micro-SIM was designed for backward compatibility. The major issue for backward compatibility was the contact area of the chip. Retaining the same contact area allows the micro-SIM to be compatible with the prior, larger SIM readers through the use of plastic cutout surrounds. The SIM was also designed to run at the same speed (5 MHz) as the prior version. The same size and positions of pins resulted in numerous "How-to" tutorials and YouTube video with detailed instructions how to cut a mini-SIM card to micro-SIM size.^[20]

The chairman of EP SCP, Dr. Klaus Vedder, said^[19]

"ETSI has responded to a market need from ETSI customers, but additionally there is a strong desire not to invalidate, overnight, the existing interface, nor reduce the performance of the cards."

Micro-SIM cards were introduced by various mobile service providers for the launch of the original iPad, and later for smartphones, from April 2010. The iPhone 4 was the first smartphone to use a micro-SIM card in June 2010, followed by many others.

Nano-SIM

The nano-SIM (or 4FF) card was introduced on 11 October 2012, when mobile service providers in various countries started to supply it for phones that supported the format. The nano-SIM measures 12.3 × 8.8 × 0.67 mm and reduces the previous format to the contact area while maintaining the existing contact arrangements. A small rim of isolating material is left around the contact area to avoid short circuits with the socket. The nano-SIM is 0.67 mm thick, compared to the 0.76 mm of its predecessor. 4FF can be put into adapters for use with devices designed for 2FF or 3FF SIMs, and is made thinner for that purpose,^[21] but many phone companies do not recommend this.^[22]

The iPhone 5, released in September 2012, was the first device to use a nano-SIM card, followed by other handsets.

Embedded-SIM/Embedded Universal Integrated Circuit Card (eUICC)

Upcoming new generation of SIM is called e-SIM or eSIM (embeddedSIM), which is non-replaceable embedded chip in SON-8 package which may be soldered directly onto a circuit board. It will have M2M and remote SIM provisioning capabilities.

The surface mount format provides the same electrical interface as the full size, 2FF and 3FF SIM cards, but is soldered to the circuit board as part of the manufacturing process. In M2M applications where there is no requirement to change the SIM card, this avoids the requirement for a connector, improving reliability and security. GSMA has been discussing the possibilities of a software based SIM card since 2010.^[23] While Motorola noted that eUICC is geared at industrial devices, Apple "disagreed that there is any statement forbidding the use of an embedded UICC in a consumer product." in 2012,^[24] The European Commission has selected the Embedded UICC format for its in-vehicle emergency call service known as eCall. All new car models in the EU will need to have one by 2018 to instantly connect the car to the emergency services in case of an accident. In Russia there is a similar plan with the ERA-GLONASS regional satellite positioning system and in Brazil with the SIMRAV anti-theft system.^[25]

Security

In July 2013, it was revealed that Karsten Nohl, a cryptographer and security researcher from SRLabs,^[26][27] had discovered vulnerabilities in some SIM cards that enabled them to be hacked to provide root access.^[28] The cards affected use the Data Encryption Standard (DES) which, despite its age, is still used by some operators.^[28] Cards using the more recent Advanced Encryption Standard (AES) or Triple DES standards are not affected.^[28] Among other risks, the hack could lead to the phone being remotely cloned or allow payment credentials from the SIM to be stolen.^[28] Further details of the research were to be given at BlackHat on July 31, 2013.^[28][29]

In response, the International Telecommunication Union said that the development was "hugely significant" and that it would be contacting its members.^[30]

In February, 2015 it was reported by The Intercept that the NSA and GCHQ had stolen the encryption keys (Ki's) used by Gemalto (the manufacturer of 2 billion SIM cards annually), enabling these intelligence agencies to monitor voice and data communications without the knowledge or approval of cellular network providers or judicial oversight.^[31] Having finished its investigation, Gemalto claimed that it has “reasonable grounds” to believe that the NSA and GCHQ carried out an operation to hack its network in 2010 and 2011, but says the number of possibly stolen keys would not have been massive.^[32]

Developments

When GSM was already in use, the specifications were further developed and enhanced with functionality such as SMS and GPRS. These development steps are referred as releases by ETSI. Within these development cycles, the SIM specification was enhanced as well: new voltage classes, formats and files were introduced.

USIM

In GSM-only times, the SIM consisted of the hardware and the software. With the advent of UMTS this naming was split: the SIM was now an application and hence only software. The hardware part was called UICC. This split was necessary because UMTS introduced a new application, the Universal Subscriber Identity Module (USIM). The USIM brought, among other things, security improvements like the mutual authentication and longer encryption keys and an improved address book.

UICC

"SIM cards" in developed countries are today usually UICCs containing at least a SIM and a USIM application. This configuration is necessary because older GSM only handsets are solely compatible with the SIM [application] and some UMTS security enhancements do rely on the USIM [application].

Other variants

The equivalent of SIM on CDMA networks is the R-UIM (and the equivalent of USIM is CSIM).

A virtual SIM is a mobile phone number provided by a mobile network operator that does not require a SIM card to connect phone calls to a user's mobile phone.

At the 2015 Mobile World Congress in Barcelona, Simless, Inc., a US-based startup unveiled world's first GSM phone without a SIM card slot. The reference phone was capable of downloading multiple virtual SIM cards over-the-air.^[33]

Usage in mobile phone standards

The use of SIM cards is mandatory in GSM devices.

The satellite phone networks Iridium, Thuraya and Inmarsat's BGAN also use SIM cards. Sometimes, these SIM cards work in regular GSM phones and also allow GSM customers to roam in satellite networks by using their own SIM card in a satellite phone.

Japan's 2G PDC system (which was shut down in 2012; SoftBank Mobile has already shut down PDC from March 31, 2010) also specifies a SIM, but this has never been implemented commercially. The specification of the interface between the Mobile Equipment and the SIM is given in the RCR STD-27 annex 4. The Subscriber Identity Module Expert Group was a committee of specialists assembled by the European Telecommunications Standards Institute (ETSI) to draw up the specifications (GSM 11.11) for interfacing between smart cards and mobile telephones. In 1994, the name SIMEG was changed to SMG9.

Japan's current and next generation cellular systems are based on W-CDMA (UMTS) and CDMA2000 and all use SIM cards. However, Japanese CDMA2000-based phones are locked to the R-UIM they are associated with and thus, the cards are not interchangeable with other Japanese CDMA2000 handsets (though they may be inserted into GSM/WCDMA handsets for roaming purposes outside Japan).

CDMA-based devices originally did not use a removable card, and the service for these phones bound to a unique identifier contained in the handset itself. This is most prevalent in operators in the Americas. The first publication of the TIA-820 standard (also known as 3GPP2 C.S0023) in 2000 defined the Removable User Identity Module (R-UIM). Card-based CDMA devices are most prevalent in Asia.

The equivalent of a SIM in UMTS is called the Universal Integrated Circuit Card (UICC), which runs a USIM application. The UICC is still colloquially called a SIM card.

• 
  SIM card for Thuraya satellite phone
• 
  KDDI's au IC-Card
• 
  NTT DoCoMo's FOMA Card
• 
  UMTS modem with Beeline's SIM card
• 
  SIM card and the mobile phone
• 
  Three UK SIM Card with Packaging
• 
  Chunghwa Telecom's LTE Card
• 
  China Mobile's LTE SIM card
• 
  H2O Wireless prepaid SIM card
• 
  Hotlink (Maxis) Nano SIM card
• 
  Dual SIM slots as shown on Chinese cell phone
• 
  Deutsche Telekom Nano SIM Card with NFC capabilities in the phone's SIM tray

SIM and carriers

The SIM card introduced a new and significant business opportunity for MVNOs — mobile virtual network operators — who lease capacity from one of the network operators rather than owning or operating a cellular telecoms network, and only provide a SIM card to their customers. MVNOs first appeared in Denmark, Hong Kong, Finland and the UK. Today they exist in over 50 countries, including most of Europe, United States, Canada, Mexico, Australia and parts of Asia, and account for approximately 10% of all mobile phone subscribers around the world.

On some networks, the mobile phone is locked to its carrier SIM card, meaning that the phone only works with SIM cards from the specific carrier. This is more common in markets where mobile phones are heavily subsidised by the carriers, and the business model depends on the customer staying with the service provider for a minimum term (typically 12, 18 or 24 months). SIM cards that are issued by providers with an associated contract are called SIM only deals. Common examples are the GSM networks in the United States, Canada, Australia, the UK and Poland. Many businesses offer the ability to remove the SIM lock from a phone, effectively making it possible to then use the phone on any network by inserting a different SIM card. Mostly, GSM and 3G mobile handsets can easily be unlocked and used on any suitable network with any SIM card.

In countries where the phones are not subsidised, e.g., India, Israel and Belgium, all phones are unlocked. Where the phone is not locked to its SIM card, the users can easily switch networks by simply replacing the SIM card of one network with that of another while using only one phone. This is typical, for example, among users who may want to optimise their carrier's traffic by different tariffs to different friends on different networks, or when traveling internationally.

In 2016, carriers started using the concept of automatic SIM reactivation^[34] whereby they let users reuse expired SIM cards instead of purchasing new ones when they wish to re-subscribe to that operator. This is particularly useful in countries where prepaid calls dominate and where competition drives high churn rates, as users had to return to a carrier shop to purchase a new SIM each time they wanted to churn back to an operator.

SIM only

Commonly sold as a product by mobile telecommunications companies, the term SIM only refers to a type of legally binding contract between a mobile network provider and a customer. The contract itself takes the form of a credit agreement and is subject to a credit check.

Within a SIM only contract the mobile network provider supplies their customer with just one piece of hardware, a SIM card, which includes an agreed amount network usage in exchange of set monthly payment to be made by the customer. Network usage within a SIM only contract can be measured in minutes, text, data or any combination of these. The duration of a SIM only contract can vary depending on the deal selected by the customer but in the UK they are available over 1, 3, 6 and 12 month periods.

SIM only contracts differ from mobile phone contracts in that they do not include any hardware other than a SIM card. In terms of network usage SIM only is typically more cost effective than other mobile device contracts because unlike these other contracts a SIM only deal does not offset the cost of a mobile device over the contract period. Short contract length is one of the key features of SIM only which are made possible due to the absence of a mobile device.

SIM only is increasing in popularity very quickly.^[35] In 2010 pay monthly based mobile phone subscriptions grew from 41 percent to 49 percent of all UK mobile phone subscriptions.^[36] According to German research company Gfk, 250,000 SIM-only mobile contracts were taken up in the UK during July 2012 alone, the highest figure since GfK began keeping records.

Increasing smartphone penetration combined with financial concerns are leading customers to save money by moving onto a SIM-only when their initial contract term is over.

Multiple-SIM devices

Devices with two SIM slots are known as dual SIMs. Dual-SIM mobile phones usually come with two slots for SIMs, one behind the battery and another on the side of the phone, though in some devices both slots can be found on the battery tray, or on the side of the phone if the device does not have a removable battery. Multiple-SIM devices are commonplace in developing markets such as in Africa, East Asia, the Indian subcontinent and South East Asia, where billing rates and variable network coverage make it desirable for consumers to use multiple SIMs from competing networks. They are not common in the Western world.

See also

• Apple SIM
• International Mobile Equipment Identity (IMEI)
• GSM 03.48
• SIM cloning
• SIM connector
• IP Multimedia Services Identity Module (ISIM)
• W-SIM (Willcom-SIM)
• Mobile equipment identifier (MEID)
• VMAC
• Mobile signature
• Single Wire Protocol (SWP)
• SIM Application Toolkit (STK)
• Mobile broadband
• Tethering
• Smart card
• Regional lockout
• GSM USSD codes - Unstructured Supplementary Service Data: list of standard GSM codes for network and SIM related functions
• Remote SIM provisioning

References

External links

Wikimedia Commons has media related to SIM cards.

• ETSI Smart Card standards (102 221)
• GSM 11.11 – Specification of the Subscriber Identity Module – Mobile Equipment (SIM-ME) interface.
• GSM 11.14 – Specification of the SIM Application Toolkit for the Subscriber Identity Module – Mobile Equipment (SIM-ME) interface
• GSM 03.48 – Specification of the security mechanisms for SIM application toolkit
• GSM 03.48 Java API – API and realization of GSM 03.48 in Java
• ITU-T E.118 – The International Telecommunication Charge Card 2006 ITU-T