Selasa, 06 Mei 2008

Inside Your SIM Card


Today many GSM Network subscribers have SIM Cards inside their Mobile Phones in order to be authenticated to GSM Network. Well, in other words, you need a SIM card to connect to your GSM Network then make a call and utilizing Mobile Services such as Short Message Services (SMS), or Content Browsing.

SIM card basically is an EPROM which has Operating System (OS) and Applications inside it. This can be compared to your PC which has OS such as MS Windows, UNIX, etc and many Applications. But you can not imagine that SIM Card also has Applications just like MS Office or Image Editor. Applications inside the SIM Card are more simple. Most of the Applications that owned by SIM Card are to support SIM Card so it can be connected to the GSM Network and to make SIM Card communicate with your Mobile Phone. One example of SIM Card Application is when you use content browsing some drag drop menus displayed on your Mobile Phone's screen.

Files and Directories

SIM Card has many files inside it which needed by SIM Card to connect to GSM Network.
File Structure of SIM Card can be compared to UNIX hierarcial file system which in UNIX
many Applications and information of devices stored as files. The UNIX file structure
can be represented by this file tree structure :

\root
|
|
+---- \etc
|
+---- \bin
|
+---- \usr
|
+---- \tmp

Similar to UNIX, we will find Files and Directories inside a SIM Card in a hierarcial structure. A file contain information or data, and a directory contain files. How a Mobile Phone or a Card Reader access these files and directories is related to the security features which managed by SIM Card Operating System. Every file and directory have their
owned security feature based on some technical requirements.

SIM Card also manages files and directories inside it in hierarcial structure. The logical model of files and directories is related with how Operating System inside the SIM Card manage them. If in UNIX every file and directory has it's name, in SIM Card logical model, every files and directory have it's file ID. File ID used to addresed or identify
the file. The first byte of File ID identify the file's type.

The Logial Model of a SIM Card devided into :

Master File (MF)
An MF can be compare to /root directory in UNIX. An MF act as a "root" for DF and EF. The File ID of an MF is 3F.

Dedicated File (DF)
DF can be refer to directory which contain files inside it. Some EF which have related functional purpose grouped into the same DF. So the functional grouping of a DF refer to it self and all it's complete EF subtree. A DF also act as a 'second door' to access an EF. So to access an EF you need to access the MF and the 'main door' and then DF as the 'second door'. This is quite similar to UNIX file system. For example files that handle device configuration grouped into /dev directory. Because of it's function, a DF does not contain data, it only contain header part.

File ID of DF are :

7F -> First level Dedicated File
5F -> Second level Dedicated File

The are several DFs inside the SIM Card, but in this article I will describe only two DFs which mandatory
for GSM subscriber requirements :

File Name

File ID

Function

DF Telcom

7F10

Contain EFs those hold telecom service features

DF GSM

7F20

Contain applications for both GSM and/or DCS 1800


Elementary File (EF)
An EF consist of header and body part. The body part contain data which have attributes related to the security aspects, file size, record length, and how the data can be accessed. The first information that read from an EF is it's File Structure. Starting from the File Structure then can be known the file type, record length, and access method of an EF. The total data length that stored in the body of an EF is indicated in it's header.

File ID of EF are :

2F -> EF under Master File

6F -> EF under first level DF
4F -> EF under second level EF

EF grouping

Inside the SIM Card, EFs grouped under MF and DF. This grouping based on functional purpose of an EF. For example EF that support or hold data for telecom service features will be grouped under DF Telecom (7F10). The existing of these EF are may Mandatory or Optional. Mandatory EF means that this EF should be exist inside the SIM Card for the minimum requirement based on 3GPP TS 11.11 document. Optional EF means that this EF maybe
exist inside the SIM Card based on the Network Operator specific requirement. Below, I will describe all of EFs those have Mandatory requirement based on 3GPP TS 11.11 document. Well, here they are :

EF under Master File

File Name

File ID

Size

EF ICCID

2FE2

10 bytes


EF under DF GSM

File Name

File ID

Size

EF LP

6F05

1-n bytes

n = nth language code

EF IMSI

6F07

9 bytes

EF KC

6F20

9 bytes

EF HPPLMN

6F31

1 byte

EF SST

6F38

X bytes

X >= 2

EF BCCH

6F74

16 bytes

EF ACC

6F78

2 bytes

EF FPLMN

6F7B

12 bytes

EF LOCI

6F7E

11 bytes

EF AD

6FAD

3 + X bytes

EF Phase

6FAE

1 byte



EF under DF Telecom

File Name

File ID

Size

EF ADN

6F3A

X + 14 bytes

EF FDN

6F0B

X + 14 bytes

EF SMS

6F3C

176 bytes

EF MSISDN

6F40

X + 14 bytes


The File Structure of EF are :

Elementary Files usually has attributes that related with file size, how the file can be accessed, record length, etc. File Structure of an EF represent security feature of EF and how it will be managed.

Transparent

An EF with Transparent File Structure consist of a sequence of bytes. This sequence of bytes used when the file need to be updated or read which indicates the starting bytes position and the number of bytes to be updated or read. Starting bytes position known as relative address (offset). The first byte in a Transparent EF has an offset '00 00'

Linier Fixed

An EF with Linier Fixed File Structure consist of sequence of records which have the same fixed record length. The first record is starting from record number 1.

Cyclic

An EF with Cyclic File Strucutre used to store records in chronological order. When all records have used to store data, then the next data will be overwrite the oldest information. All records in a Cyclic EF has a fixed number of quantity and the fixed record length. In a Cyclic EF there is a link between record number 1 and the last record (n). When the pointer is set to the last record (n), then the next record would be record number 1.

Security Features

SIM Card which reside inside your Mobile Phone contain data that needed to logon to the network then after that you can make your call or sending your SMS. The Security Features supported by SIM Card utilized to enable the following :

SIM Card authentication to the network

After your Mobile Phone turned on, then the network send Random Signal or RAND (128 bit) to your Mobile Phone, then your Mobile Phone pass the RAND to your SIM Card using RUM GSM ALGORITHM command. Other value for the input of RAND calculation is KI (128 bit). The calculation of RAND and KI utilized A38 Algorithm. In this process, IMSI is used to retrived KI in the network.

The result of RAND and KIcalculation that done by SIM Card is Signal Respond or SRES (32 bit) and Kc.
SRES passed to the Mobile Phone and then to the network. The network will compare this SRES with SRES that
owned by the network. The comparison of these SRES values provide authentication. The Kc value will be used
by SIM Card for any future enchipered communication.

File Access Condition.

Every EF has it's own specific access condition for each command. The differentiation of access condition for each command based on the security level of each file. File access condition will limit your access to an EF. For example for several EFs, READ command will have ALWAYS access condition for READ command which mean that you can READ this EF with input any parameter key. But for some EFs, they have NEVER access condition for READ command which mean you can not READ this EF.

Level Access Condition
------------- ----------------------------
Level 0 ALWAYS
Level 1 CHV1
Level 2 CHV2
Level 3 RFU
Level 4 ADM 1
..... ......
Level 14 ADM 14
Level 15 NEVER

For more complete and detail SIM Card specification, please refer to 3GPP RS 11.11 Digital Cellular Tellecommunication System (Pahse 2+), Specification of SIM-ME Interface. But this document is quite hard to understand, except for you those has been long period involved in smart card industries.

Reference :
3GPP RS 11.11 Digital Cellular Tellecommunication System (Pahse 2+), Specification of SIM-ME Interface, en.wikipedia.org



Some of GSM, CDMA, and Network topics will be posted in this blog. Please feel free to give comments, additional advices, also correction if needed.