SIM card

The SIM card is a type of smart card, the basis for which is the silicon integrated circuit (IC) chip. The idea of incorporating a silicon IC chip onto a plastic card originates from the late 1960s. The SIM was initially specified by the ETSI in the specification TS 11.11. This describes the physical and logical behaviour of the SIM. With the development of the Universal Mobile Telecommunications System (UMTS), the specification work was partially transferred to 3GPP. 3GPP is now responsible for the further development of applications like SIM (TS 51.011) and USIM (TS 31.102) and ETSI for the further development of the physical card UICC. The first SIM card was manufactured in 1991 by Munich smart-card maker Giesecke+Devrient, who sold the first 300 SIM cards to the Finnish wireless network operator Radiolinja, who launched the world's first commercial 2G GSM cell network that year. Today, SIM cards are considered ubiquitous, allowing over 8 billion devices to connect to cellular networks around the world daily. According to the International Card Manufacturers Association (ICMA), there were 5.4 billion SIM cards manufactured globally in 2016 creating over $6.5 billion in revenue for traditional SIM card vendors. The rise of cellular IoT and 5G networks was predicted by Ericsson to drive the growth of the addressable market for SIM cards to over 20 billion devices by 2020. The introduction of embedded-SIM (eSIM) and remote SIM provisioning (RSP) from the GSMA may disrupt the traditional SIM card ecosystem with the entrance of new players specializing in "digital" SIM card provisioning and other value-added services for mobile network operators. == Design ==

There are three operating voltages for SIM cards: , and (ISO/IEC 7816-3 classes A, B and C, respectively). The operating voltage of the majority of SIM cards launched before 1998 was . SIM cards produced subsequently are compatible with and . Modern cards support , and . A multi-company collaboration called GlobalPlatform defines some extensions on the cards, with additional APIs and features like more cryptographic security and RFID contactless use added. == Data ==

SIM cards store network-specific information used to authenticate and identify subscribers on the network. The most important of these are the ICCID, IMSI, authentication key (Ki), local area identity (LAI) and operator-specific emergency number. The SIM also stores other carrier-specific data such as the SMSC (Short Message service center) number, service provider name (SPN), service dialing numbers (SDN), advice-of-charge parameters and value-added service (VAS) applications. (Refer to GSM 11.11.) SIM cards can come in various data capacities, from to at least . Its layout is based on ISO/IEC 7812. According to E.118, the number can be up to 19 digits long, including a single check digit calculated using the Luhn algorithm. However, the GSM Phase 1 defined the ICCID length as an opaque data field, 10 octets (20 digits) in length, whose structure is specific to a mobile network operator. The number is composed of three subparts: • Issuer identification number (IIN) • Check digit • Individual account identification Their format is as follows. Issuer identification number (IIN) • Maximum of seven digits: • Major industry identifier (MII), 2 fixed digits, 89 for telecommunication purposes. • Country code, 2 or 3 digits, as defined by ITU-T recommendation E.164. • NANP countries, apart from Canada, use 01, i.e. prepending a zero to their common calling code +1 • Canada uses 302 • Russia uses 701, i.e. appending 01 to its calling code +7 • Kazakhstan uses 997, even though it shares the calling code +7 with Russia • Issuer identifier, 1–4 digits. • Often identical to the Mobile country code (MCC). ITU-T also publishes complete lists: as of August 2023, the list issued on 1 December 2018 was current, having all issuer identifier numbers before 1 December 2018. International mobile subscriber identity (IMSI) SIM cards are identified on their individual operator networks by a unique international mobile subscriber identity (IMSI). Mobile network operators connect mobile phone calls and communicate with their market SIM cards using their IMSIs. The format is: • The first three digits represent the Mobile country code (MCC). • The next two or three digits represent the Mobile network code (MNC). Three-digit MNC codes are allowed by E.212 but are mainly used in the United States and Canada. One MCC can have both 2 digit and 3 digit MNCs, an example is 350 007. • The next digits represent the Mobile identification number (MSIN). • Normally there are 10 digits, but can be fewer in the case of a 3-digit MNC or if national regulations indicate that the total length of the IMSI should be less than 15 digits. • Digits are different from country to country. Authentication key (Ki) The Ki is a 128-bit value used in authenticating the SIMs on a GSM mobile network (for USIM network, the K is still needed but other parameters are also needed). Each SIM holds a unique Ki assigned to it by the operator during the personalisation process. The Ki is also stored in a database (termed authentication center or AuC) on the carrier's network. The SIM card is designed to prevent someone from getting the Ki by using the smart-card interface. Instead, the SIM card provides a function, Run GSM Algorithm, that the phone uses to pass data to the SIM card to be signed with the Ki. This, by design, makes using the SIM card mandatory unless the Ki can be extracted from the SIM card, or the carrier is willing to reveal the Ki. In practice, the GSM cryptographic algorithm for computing a signed response (SRES_1/SRES_2: see steps 3 and 4, below) from the Ki has certain vulnerabilities that can allow the extraction of the Ki from a SIM card and the making of a duplicate SIM card. Authentication process: • When the mobile equipment starts up, it obtains the international mobile subscriber identity (IMSI) from the SIM card, and passes this to the mobile operator, requesting access and authentication. The mobile equipment may have to pass a PIN to the SIM card before the SIM card reveals this information. • The operator network searches its database for the incoming IMSI and its associated Ki. • The operator network then generates a random number (RAND, which is a nonce) and signs it with the Ki associated with the IMSI (and stored on the SIM card), computing another number, that is split into the Signed Response 1 (SRES_1, 32 bits) and the encryption key Kc (64 bits). • The operator network then sends the RAND to the mobile equipment, which passes it to the SIM card. The SIM card signs it with its Ki, producing Signed Response 2 (SRES_2) and Kc, which it gives to the mobile equipment. The mobile equipment passes SRES_2 on to the operator network. • The operator network then compares its computed SRES_1 with the computed SRES_2 that the mobile equipment returned. If the two numbers match, the SIM is authenticated and the mobile equipment is granted access to the operator's network. Kc is used to encrypt all further communications between the mobile equipment and the operator. Location area identity The SIM stores network state information, which is received from the location area identity (LAI). Operator networks are divided into location areas, each having a unique LAI number. When the device changes locations, it stores the new LAI to the SIM and sends it back to the operator network with its new location. If the device is power cycled, it takes data off the SIM, and searches for the prior LAI. SMS messages and contacts Most SIM cards store a number of SMS messages and phone book contacts. It stores the contacts in simple "name and number" pairs. Entries that contain multiple phone numbers and additional phone numbers are usually not stored on the SIM card. When a user tries to copy such entries to a SIM, the handset's software breaks them into multiple entries, discarding information that is not a phone number. The number of contacts and messages stored depends on the SIM; early models stored as few as five messages and 20 contacts, while modern SIM cards can usually store over 250 contacts. == Formats ==

SIM cards have been made smaller over the years; functionality is independent of format. Full-size SIM was followed by mini-SIM, micro-SIM, and nano-SIM. SIM cards are also made to embed in devices. All versions of the non-embedded SIM cards share the same ISO/IEC 7816 pin arrangement. Mini-SIM , which is approx. 18 mm in diameter The mini-SIM or (2FF, 2nd form factor) card has the same contact arrangement as the full-size SIM card and is normally supplied within a full-size card carrier, attached by a number of linking pieces. This arrangement (defined in ISO/IEC 7810 as ID-1/000) lets such a card be used in a device that requires a full-size card or in a device that requires a mini-SIM card, after breaking the linking pieces. As the full-size SIM is obsolete, some suppliers refer to the mini-SIM as a "standard SIM" or "regular SIM". Micro-SIM The micro-SIM (or 3FF) card has the same thickness and contact arrangements, but reduced length and width as shown in the table above. The micro-SIM was introduced by the European Telecommunications Standards Institute (ETSI) along with SCP, 3GPP (UTRAN/GERAN), 3GPP2 (CDMA2000), ARIB, GSM Association (GSMA SCaG and GSMNA), GlobalPlatform, Liberty Alliance, and the Open Mobile Alliance (OMA) for the purpose of fitting into devices too small for a mini-SIM card. The form factor was mentioned in the December 1998 3GPP SMG9 UMTS Working Party, which is the standards-setting body for GSM SIM cards, and the form factor was agreed upon in late 2003. The micro-SIM was designed for backward compatibility. The major issue for backward compatibility was the contact area of the chip. Retaining the same contact area makes the micro-SIM compatible with the prior, larger SIM readers through the use of plastic cutout surrounds. The SIM was also designed to run at the same speed (5 MHz) as the prior version. The same size and positions of pins resulted in numerous "How-to" tutorials and YouTube videos with detailed instructions how to cut a mini-SIM card to micro-SIM size. The chairman of EP SCP, Klaus Vedder, said The nano-SIM (or 4FF) card was introduced in June 2012, when mobile service providers in various countries first supplied it for phones that supported the format. The nano-SIM measures and reduces the previous format to the contact area while maintaining the existing contact arrangements. A small rim of isolating material is left around the contact area to avoid short circuits with the socket. The nano-SIM can be put into adapters for use with devices designed for 2FF or 3FF SIMs, and is made thinner for that purpose, and telephone companies give due warning about this. 4FF is thick, compared to the of its predecessors. == Security ==

In July 2013, Karsten Nohl, a security researcher from SRLabs, described vulnerabilities in some SIM cards that supported DES, which, despite its age, is still used by some operators. In response, the International Telecommunication Union said that the development was "hugely significant" and that it would be contacting its members. In February 2015, The Intercept reported that the NSA and GCHQ had stolen the encryption keys (Ki's) used by Gemalto (now known as Thales DIS, manufacturer of 2 billion SIM cards annually) ), enabling these intelligence agencies to monitor voice and data communications without the knowledge or approval of cellular network providers or judicial oversight. Having finished its investigation, Gemalto claimed that it has “reasonable grounds” to believe that the NSA and GCHQ carried out an operation to hack its network in 2010 and 2011, but says the number of possibly stolen keys would not have been massive. In September 2019, Cathal Mc Daid, a security researcher from Adaptive Mobile Security, described how vulnerabilities in some SIM cards that contained the S@T Browser library were being actively exploited. This vulnerability was named Simjacker. Attackers were using the vulnerability to track the location of thousands of mobile phone users in several countries. Further details of the research were provided at VirusBulletin on 3 October 2019. == Developments ==

When GSM was already in use, the specifications were further developed and enhanced with functionality such as SMS and GPRS. These development steps are referred as releases by ETSI. Within these development cycles, the SIM specification was enhanced as well: new voltage classes, formats and files were introduced. USIM In GSM-only times, the SIM consisted of the hardware and the software. With the advent of UMTS, this naming was split: the SIM was now an application and hence only software. The hardware part was called UICC. This split was necessary because UMTS introduced a new application, the universal subscriber identity module (USIM). The USIM brought, among other things, security improvements like mutual authentication and longer encryption keys, and an improved address book. UICC "SIM cards" in developed countries today are usually UICCs containing at least a SIM application and a USIM application. This configuration is necessary because older GSM only handsets are solely compatible with the SIM application and some UMTS security enhancements rely on the USIM application. Other variants On cdmaOne networks, the equivalent of the SIM card is the R-UIM and the equivalent of the SIM application is the CSIM. A virtual SIM is a mobile phone number provided by a mobile network operator that does not require a SIM card to connect phone calls to a user's mobile phone. Embedded SIM (eSIM) An embedded SIM (eSIM) is a form of programmable SIM that is embedded directly into a device. The surface mount format provides the same electrical interface as the full size, 2FF and 3FF SIM cards, but is soldered to a circuit board as part of the manufacturing process. In M2M applications where there is no requirement An eSIM can be provisioned remotely; end-users can add or remove operators without the need to physically swap a SIM from the device or use multiple eSIM profiles at the same time. The eSIM standard, initially introduced in 2016, has progressively supplanted traditional physical SIM cards across various sectors, notably in cellular telephony. Integrated SIM (iSIM) An integrated SIM (iSIM) is a form of SIM directly integrated into the modem chip or main processor of the device itself. As a consequence they are smaller, cheaper and more reliable than eSIMs, they can improve security and ease the logistics and production of small devices i.e. for IoT applications. In 2021, Deutsche Telekom introduced the nuSIM, an "Integrated SIM for IoT". == Usage in mobile phone standards ==

The use of SIM cards is mandatory in GSM devices. The satellite phone networks Iridium, Thuraya and Inmarsat's BGAN also use SIM cards. Sometimes, these SIM cards work in regular GSM phones and also allow GSM customers to roam in satellite networks by using their own SIM cards in a satellite phone. Japan's 2G PDC system (which was shut down in 2012; SoftBank Mobile shut down PDC from 31 March 2010) also specified a SIM, but this has never been implemented commercially. The specification of the interface between the Mobile Equipment and the SIM is given in the RCR STD-27 annexe 4. The Subscriber Identity Module Expert Group was a committee of specialists assembled by the European Telecommunications Standards Institute (ETSI) to draw up the specifications (GSM 11.11) for interfacing between smart cards and mobile telephones. In 1994, the name SIMEG was changed to SMG9. Japan's current and next-generation cellular systems are based on W-CDMA (UMTS) and CDMA2000 and all use SIM cards. However, Japanese CDMA2000-based phones are locked to the R-UIM they are associated with and thus, the cards are not interchangeable with other Japanese CDMA2000 handsets (though they may be inserted into GSM/WCDMA handsets for roaming purposes outside Japan). CDMA-based devices originally did not use a removable card, and the service for these phones is bound to a unique identifier contained in the handset itself. This is most prevalent in operators in the Americas. The first publication of the TIA-820 standard (also known as 3GPP2 C.S0023) in 2000 defined the Removable User Identity Module (R-UIM). Card-based CDMA devices are most prevalent in Asia. The equivalent of a SIM in UMTS is called the universal integrated circuit card (UICC), which runs a USIM application. The UICC is still colloquially called a SIM card. == SIM and carriers ==

The SIM card introduced a new and significant business opportunity for mobile virtual network operator| who lease capacity from one of the network operators rather than owning or operating a cellular telecoms network and only provide a SIM card to their customers. MVNOs first appeared in Denmark, Hong Kong, Finland and the UK. By 2011 they existed in over 50 countries, including most of Europe, the United States, Canada, Mexico, Australia and parts of Asia, and accounted for approximately 10% of all mobile phone subscribers around the world. On some networks, the mobile phone is locked to its carrier SIM card, meaning that the phone only works with SIM cards from the specific carrier. This is more common in markets where mobile phones are heavily subsidised by the carriers, and the business model depends on the customer staying with the service provider for a minimum term (typically 12, 18 or 24 months). SIM cards that are issued by providers with an associated contract, but where the carrier does not provide a mobile device (such as a mobile phone) are called SIM-only deals. Common examples are the GSM networks in the United States, Canada, Australia, and Poland. UK mobile networks ended SIM lock practices in December 2021. Many businesses offer the ability to remove the SIM lock from a phone, effectively making it possible to then use the phone on any network by inserting a different SIM card. Mostly, GSM and 3G mobile handsets can easily be unlocked and used on any suitable network with any SIM card. In countries where the phones are not subsidised, e.g., India, Israel and Belgium, all phones are unlocked. Where the phone is not locked to its SIM card, the users can easily switch networks by simply replacing the SIM card of one network with that of another while using only one phone. This is typical, for example, among users who may want to optimise their carrier's traffic by different tariffs to different friends on different networks, or when travelling internationally. In 2016, carriers started using the concept of automatic SIM reactivation whereby they let users reuse expired SIM cards instead of purchasing new ones when they wish to re-subscribe to that operator. This is particularly useful in countries where prepaid calls dominate and where competition drives high churn rates, as users had to return to a carrier shop to purchase a new SIM each time they wanted to churn back to an operator. SIM-only Commonly sold as a product by mobile telecommunications companies, "SIM-only" refers to a type of legally liability contract between a mobile network provider and a customer. The contract itself takes the form of a credit agreement and is subject to a credit check. SIM-only contracts can be pre-pay - where the subscriber buys credit before use (often called pay as you go, abbreviated to PAYG), or post-pay, where the subscriber pays in arrears, typically monthly. Within a SIM-only contract, the mobile network provider supplies their customer with just one piece of hardware, a SIM card, which includes an agreed amount of network usage in exchange for a monthly payment. Network usage within a SIM-only contract can be measured in minutes, text, data or any combination of these. The duration of a SIM-only contract varies depending on the deal selected by the customer, but in the UK they are typically available over 1, 3, 6, 12 or 24-month periods. SIM-only contracts differ from mobile phone contracts in that they do not include any hardware other than a SIM card. In terms of network usage, SIM-only is typically more cost-effective than other contracts because the provider does not charge more to offset the cost of a mobile device over the contract period. The short contract length is one of the key features of SIM-only made possible by the absence of a mobile device. SIM-only is increasing in popularity very quickly. In 2010 pay monthly based mobile phone subscriptions grew from 41 percent to 49 percent of all UK mobile phone subscriptions. According to German research company GfK, 250,000 SIM-only mobile contracts were taken up in the UK during July 2012 alone, the highest figure since GfK began keeping records. Increasing smartphone penetration combined with financial concerns is leading customers to save money by moving onto a SIM-only when their initial contract term is over. == Multiple-SIM devices ==

smartphone Dual SIM devices have two SIM card slots for the use of two SIM cards, from one or multiple carriers. Multiple SIM devices are commonplace in developing markets such as in Africa, East Asia, South Asia and Southeast Asia, where variable billing rates, network coverage and speed make it desirable for consumers to use multiple SIMs from competing networks. Dual-SIM phones are also useful to separate one's personal phone number from a business phone number, without having to carry multiple devices. Some devices, such as the BlackBerry KeyOne, have dual-SIM variants; however, dual-SIM devices were not common in the US or Europe due to lack of demand. This has changed with more recent smartphones featuring either two SIM slots or a combination of a physical SIM slot and an eSIM. == Thin SIM==

A thin SIM (or overlay SIM or SIM overlay) is a very thin device shaped like a SIM card, approximately 120 microns ( inch) thick. It has contacts on its front and back. It is used by placing it on top of a regular SIM card. It provides its own functionality while passing through the functionality of the SIM card underneath. It can be used to bypass the mobile operating network and run custom applications, particularly on non-programmable cell phones. Its top surface is a connector that connects to the phone in place of the normal SIM. Its bottom surface is a connector that connects to the SIM in place of the phone. With electronics, it can modify signals in either direction, thus presenting a modified SIM to the phone, and/or presenting a modified phone to the SIM. (It is a similar concept to the Game Genie, which connects between a game console and a game cartridge, creating a modified game). In 2014, Equitel, an MVNO operated by Kenya's Equity Bank, announced its intention to begin issuing thin SIMs to customers, raising security concerns by competition, particularly concerning the safety of mobile money accounts. However, after months of security testing and legal hearings before the country's Parliamentary Committee on Energy, Information and Communications, the Communications Authority of Kenya (CAK) gave the bank the green light to roll out its thin SIM cards. == See also ==