Sim Course3

8/13/2019 Sim Course3

1/57


2/57


3/57

I

6

6ATR

6PPS

OS

3OSROM

3FLASH

3


4/57

II

APDU

APDU

( SW1,SW2) APDU

A3/A8


5/57

1

1

GSM

GSM

Phase 1

GSM

CF1

CB2

3

1

-Call Forward2 -Call Barring3 -Roaming


6/57

2

2

Phase 2

1

SMS-PP1

SMS-CB2

CCF3

CW4

FAX , DATA

CLIP5

CLIR6

Phase 2+

2

STK

VPN7

SDN8

GPRS9

WAP10

(Advice of Charge)

SPN1

Dual IMSI

1 -Short Message Service-Point to Point2 -SMS Cell Broadcast3 -Call Conference4 -Call Waiting5 -Calling Line Identification Presentation6 -Calling Line Identification Restriction7 -Virtual Private Number8

-Service Dialing Number9 -General Packet Switch Service10 -Wireless Application Protocol


7/57

3

3

MicroController

1 -Service Provider Name


8/57

4

4

CPU1

OS

OS2

CPU

CPU

1 -Central Processing Unit2 -Operating System


9/57

5

5

CICS

CPU8051

CPU(Instruction)

Instruction8051

(Read Instruction)8051

RISC1

1 - Reduced Instruction Set Computer


10/57

6

6

CPUInstruction

ROM

Instruction

RISC

ROM1

ROM

OS

ROM

OSOS

OSROM

1 - Read Only Memory


11/57

7

7

OS

ROM

ROMOS

OS

OS

OSROM

CPU

ROM

RAM1

RAM

XRAM2

XRAMRAMCPU

Address BusData BusCPU

IRAM3

IRAMRAMCPU

CPUIRAM

1

-Random Access Memory2 -External RAM3 -Internal RAM


12/57

8

8

EEPROM

1

ROM

Vpp

Vpp

Vcc

Phone BookSMSBCCH2

UART

T0T1

T1T0Protocol

AsynchronousAsynchronousClock

9600bps (PPS Suppor)9600bps (PPS Suppor)Bit Rate

1 Bit1 Bit1 Bit

OptionalOptionalStop Bit

1 Bit1 BitParity Bit

Half DuplexHalf DuplexDirection

Block BasedCharacter BasedTransmition Type

T0T1

9600

bpsPPS

1 -Electrical Erasable ROM2 -Broadcast Common Control Channel


13/57

9

9

100kbps

T0T1T0

T1

T0Reset

ATR

RNG1

PLL2

(Track)

BUS

BUSCPU

DATA BUS

word

CPUBUS

1 - Random Generator2

- Phase Lock Loop


14/57

10

10

Coprocessor

CPU

Coprocessor

Coprocessor

Crypto Processor

ISO

VppEEPROM

Vcc

GSM11.11

Vcc


15/57

11

11

GND

CLK

0015

1MHz10MHz.

RST

Reset

01.

I/O

9600 bps

Half Duplex


16/57

12

12

PluginETSI

ISOID-1ID-000

A10%(4.5-5.5) 5V

B10%(2.7-3.3) 3V

C10%1.8 V(1.62-1.96)

AB

C

Dual Voltage2.8V-5.5V


17/57

13

13

CLK-Stop mode

Operation mode

Operation1mA10mA

6

ATR

PPS

6ATR1

ATRReset

ATR

ATR

1 -Answer To Reset


18/57

14

14

ATR

Ts ( Initial Character)

ATR

ATRTs


19/57

15

15

TsAZZAAAAAAZ(3F)AZZAZZAAZ(3B)

0(Z)1

(A)Msb

0A1ZLsb

Msb

Ts

Ts

T0 ( Format Character)

T0

T0


20/57

16

16

b5b8TA(1)TD(1)b1

b4HistoricalATR

TA( i )TC( i)

GlobalSpecific

TA( 1)TB(1)

TC(1)TA(2)TB(2)GlobalTC(2)Specific

TTD(i-1)TA(i)TB(i)TC(i)Global

Specific

TA(1) -b5b8FIb1b4DI

fDFetu 1*1

FIDI

FIDI


21/57

17

17

TD(1) -EEPROM

Vpp0

b6b7I1b1b5PI1

EEPROM

TC(1)-(Guard Time)

TD(i) -

10TD

b5b8TA

(i+1)TD

(i+1)

b1b4T

T=0Half duplex

T=1Half duplex

T=2T=3

T=4Half duplex


22/57


23/57

19

19

6PPS1

fDFetu 1*1

1MHz

5 MHz

FD372

1

3.5712 MHz

Bps9600372

1*3571200

PPS9600

bps

ME Reset > SIM

< ATR TA1 ='94'

PPSS = 'FF'

PPS0= '10' PPS Request>

PPS1= '94'

PCK = '7B'

PPSS = 'FF'

< PPS Response PPS0= '10'

PPS1= '94'

PCK = '7B'

PPS

1 -& Protocol & Parameter Selection


24/57

20

20

6PPS

PPS

PPS

PPS

PPS

PPS

Reset

Reject

PPSResetReject

PPS

PPS

12PPS


25/57


26/57

22

22

PPS

OS

STK

Native

Native

STK

STKSDK1

1 -SIM Development Kit


27/57

23

23

STK

OTA

Application

Java

Native

Java

JavaJavaJava Applet

Java

Java

GSM

Java

Core

Issuer

Security

Domain

Application

1

(GSM)

Application

2

(Banking)


28/57

24

24

Java

3OSROM

OSC

ROMROM

OSROM

ROM

8

16K Native

32K (Native)

64K ( Java)

128

20

70

140

170

Q1 Q2 Q3 Q4 Q1 Q2

Million

cards


29/57

25

25

3FLASH

OSROM

OS

ROM

OSROM

OS

FLASHOS

LoaderROMLoader

I/OOS

FLASHOS

OSOS

ROM

OS

ROMOS

OS

OS


30/57

26

26

FLASH

OS

3

SMS

( ,PLMN,LOC,IMSI)OS

DOS

MF

DF2

EF

DF1

DF11

DF111 EF

DF12 ....

EF

EF EF

EF EF ....


31/57

27

27

MF1

PartitionDOS

MF3F 00

DF2

DF7F223

DF TELECOM :7F 10

ADN

(LND)(SMS)

DF GSM : 7F20

IMSILOCI

KcPLMN

DF DCS1800 : 7F21

DCS

GSM

GSM

DF GSMDCSDF DCS

1 - Master File2 - Dedicate File


32/57

28

28

EF1

MFDF

EF

FileTransparent

01

headerbodyheader

bodybodyheader

Linear Fixed

( body )

AND

Cyclic

1 - Elementary File


33/57

29

29

Linear Fixed

Linear Fixed

Transparent File

Header

Body Sequence

of bytes

Linear Fixed File

Header

Body Record 1

Record 2

Record n

Cyclic File

HeaderBody Record 1

Record 2

Record n


34/57

30

30

Level Access Condition

01

234to 1415

ALWaysCHV1

CHV2Reserved for GSM Future UseADMNEVer

AlwaysCHV1CHV2

PIN1PIN2

ADM

Never

Ki

.

EF ICCID

HLR

IMSI

IMSI

Check Bit


35/57

31

31

Identifier: '2FE2' Structure: transparent Mandatory

File size: 10bytes Update activity: low

Access Conditions:READ ALWAYSUPDATE NEVERINVALIDATE ADMREHABILITATE ADM

Bytes Description M/O Length

1 - 10 Identification number M 10 bytes

EF ICCID

EF IMSI

IMSIIMSI

MMC(3)-MNC(2)-HLRID(2 to 4)-SN(6 to 8)

Identifier: '6F07' Structure: transparent MandatoryFile size: 9bytes Update activity: low

Access Conditions:READ CHV1UPDATE ADMINVALIDATE ADMREHABILITATE CHV1


1 length of IMSI M 1byte

2 - 9 IMSI M 8bytes

EF IMSI


36/57

32

32

EFKC

KcA8Identifier: '6F20' Structure: transparent Mandatory

File size: 9bytes Update activity: high

Access Conditions:READ CHV1UPDATE CHV1INVALIDATE ADMREHABILITATE ADM


1 - 8 Ciphering key Kc M 8bytes

9 Ciphering key sequence number n M 1byte

EF Kc

EF PLMNSel

Update

.Identifier: '6F30' Structure: transparent Optional

File size: 3n (n 8) bytes Update activity: low

Access Conditions:READ CHV1

UPDATE CHV1

INVALIDATE ADMREHABILITATE ADM


1 - 3 1stPLMN (highest priority) M 3bytes

22- 24 8thPLMN M 3bytes

25- 27 9thPLMN O 3bytes

(3n-2)-3n nth PLMN (lowest priority) O 3bytes

EF PLMNsel


37/57

33

33

EF HPLMN

Update

Location Update

Identifier: '6F31' Structure: transparent Mandatory

File size: 1byte Update activity: low


UPDATE ADMINVALIDATE ADMREHABILITATE ADM


1 Time interval M 1byte

EF HPLMN

EF SST

FDN1FDN

0

FDN


38/57

34

34

File size: X bytes, X 2 Update activity: low




1 Services n1to n4 M 1byte

2 Services n5to n8 M 1byte

3 Services n9ton12 O 1byte

4 Services n13to n16 O 1byte





etc.X Services (4X-3) to (4X) O 1byte

-ServicesContents: Service n1: CHV1disable function

Service n2: Abbreviated Dialling Numbers (ADN)Service n3: Fixed Dialling Numbers (FDN)Service n4: Short Message Storage (SMS)Service n5: Advice of Charge (AoC)Service n6: Capability Configuration Parameters (CCP)Service n7: PLMN selectorService n8: RFUService n9: MSISDNService n10: Extension1Service n11: Extension2

Service n12: SMS ParametersService n13: Last Number Dialled (LND)Service n14: Cell Broadcast Message IdentifierService n15: Group Identifier Level 1Service n16: Group Identifier Level 2Service n17: Service Provider NameService n18: Service Dialling Numbers (SDN)Service n19: Extension3Service n20: RFUService n21: VGCS Group Identifier List (EFVGCSand EFVGCSS)Service n22: VBS Group Identifier List (EFVBSand EFVBSS)Service n23: enhanced Multi-Level Precedence and Pre-emption ServiceService n24: Automatic Answer for EmlppService n25: Data download via SMS-CBService n26: Data download via SMS-PPService n27: Menu selection

Service n28: Call controlService n29: Proactive SIMService n30: Cell Broadcast Message Identifier RangesService n31: Barred Dialling Numbers (BDN)Service n32: Extension4Service n33: De-personalization Control KeysService n34: Co-operative Network ListService n35: Short Message Status ReportsService n36: Network's indication of alerting in the MSService n37: Mobile Originated Short Message control by SIMService n38: GPRSService n39: Image (IMG)Service n40: SoLSA (Support of Local Service Area)Service n41: USSD string data object supported in Call ControlService n42: RUN AT COMMAND command

Service n 43: User controlled PLMN Selector with Access Technology

Service n44: Operator controlled PLMN Selector with Access TechnologyService n45 HPLMN Selector with Access TechnologyService n46: CPBCCH Information


39/57

35

35

Service n47: Investigation ScanService n48: Extended Capability Configuration ParametersService n49: MExEService n50 RPLMN last used Access Technology

EF SST

EF SPN

Identifier: '6F46' Structure: transparent Optional

File Size: 17 bytes Update activity: low

Access Conditions:READ ALWAYS



1 Display Condition M 1byte

2 - 17 Service Provider Name M 16 bytes

EF SPN

EF Phase

112

22+STK

.Identifier: '6FAE' Structure: transparent Mandatory

File size: 1byte Update activity: low

Access Conditions:READ ALW



1 SIM Phase M 1byte

EF Phase


40/57

36

36

EF BCCH

BCCH

Handover


File size: 16bytes Update activity: high


UPDATE CHV1INVALIDATE ADMREHABILITATE ADM


1 - 16 BCCH information M 16 bytes

EF BCCH

EF loci

Update

Handover

Location Update Status, TMSI TIME,

TMSI, LAILAIMNCMCC

Identifier: '6F7E' Structure: transparent MandatoryFile size: 11bytes Update activity: high

Access Conditions:READ CHV1UPDATE CHV1INVALIDATE ADMREHABILITATE CHV1


1 - 4 TMSI M 4bytes

5 - 9 LAI M 5bytes

10 TMSI TIME M 1byte

11 Location update status M 1byteEF Loci


41/57

37

37

EF AND

EF LND

FDN

AND

PIN2FDN

FDN

FDNPIN2

SMS

SMS

SMSP

SMSSMS

SMS

SDN


42/57

38

38

EF ACC

ACC

RACH


File size: 2bytes Update activity: low

Access Conditions:READ CHV1UPDATE ADMINVALIDATE ADMREHABILITATE ADM


1 - 2 Access control classes M 2bytes

(SW1,SW2)

(Application Protocol Data Unit) APDU


43/57

39

39

COMMAND INS P1 P2 P3 S/R

SELECT 'A4' '00' '00' '02' S/RSTATUS 'F2' '00' '00' lgth R

READ BINARY 'B0' offset high offset low lgth RUPDATE BINARY 'D6' offset high offset low lgth SREAD RECORD 'B2' rec No. mode lgth RUPDATE RECORD 'DC' rec No. mode lgth SSEEK 'A2' '00' type/mode lgth S/RINCREASE '32' '00' '00' '03' S/R

VERIFY CHV '20' '00' CHV No. '08' SCHANGE CHV '24' '00' CHV No. '10' SDISABLE CHV '26' '00' '01' '08' SENABLE CHV '28' '00' '01' '08' SUNBLOCK CHV '2C' '00' see note '10' S

INVALIDATE '04' '00' '00' '00' -

REHABILITATE '44' '00' '00' '00' -

RUN GSMALGORITHM

'88' '00' '00' '10' S/R

SLEEP 'FA' '00' '00' '00' -

GET RESPONSE 'C0' '00' '00' lgth RTERMINAL PROFILE '10' '00' '00' lgth SENVELOPE 'C2' '00' '00' lgth S/RFETCH '12' '00' '00' lgth RTERMINAL

RESPONSE'14' '00' '00' lgth S

NOTE If the UNBLOCK CHV command applies to CHV1then P2is coded '00'; if it appliesto CHV2then P2is coded '02'.

APDU

A command APDU has the following general format

ME ---------------- > SIM

CLA INS P1 P2 P3 Data


44/57

40

40

CLACLA

GSMA0

INS

P3P2P1P3

MESIMP3 = 00

SIMMEP3 = 00

APDU

SW1SW2Status

Read Binary

Status

The response APDU has the following general format

SIM ------------------>> ME

Data SW1 SW2

SELECT

MFDFEFSELECTEF

DFDFEF


45/57

41

41

MF

MFDF

CHV

EF

EF

STATUS

DFEF

SELECTSTATUS

Pro-activeSTK

READ BINARY

Transparent EF

UPDATE BINARY

Transparent

READ RECORD


46/57

42

42

Linear FixedCyclic

UPDATE RECORD

Linear FixedCyclic

READ RECORDUPDATE RECORD

Absolute )((Current, Next, Previous )

SEEK

Linear Fixed

READ

INCREASE

Cyclic

INCREASECyclicME

FF


47/57

43

43

VERIFY CHV

MECHVCHV

MESIM

CHV

CHANGE CHV

CHV

CHV

ENABLE CHV

CHV

CHVCHV

DISABLECHV

CHV

CHVCHV

CHV1CHV2

ADM

UNBLOCK CHV


48/57

44

44

CHV1CHV2

PUK1PUK2

PUK1PUK2

VERIFYCHVCHANGECHVENABLE CHV

DISABLECHVCHV

UNBLOCK CHV

INVALIDATE

INVALIDATE

REHABILITATE

RUN GSM ALGORITM

RAND

A8/ A3KiSRESKc


49/57

45

45

DF GSMCHV1

SLEEP

TERMINAL PROFILE

STK

STK

ENVELOPE

MESTKSIM

FETCH

STKDataME

TERMINAL RESPONSE

MESTKFETCH

STK


50/57

46

46

( SW1,SW2) APDU

ME

SW1SW2

Case 1: No input/ "OK" response with no output, plus additional command

from SIMCLA INS P1 P2 P3 SW1 SW2

lgth (='00') '91' lgth1

[Possible "normal GSM operation" command/response pairs]

FETCH

CLA INS P1 P2 P3 DATA with length lgth1 SW1 SW2

lgth1 '90' '00'

NOTE: lgth1='00' causes a data transfer of 256bytes.

Case 2: No input/ "OK" response with data of known length, plus additional

command from SIM

CLA

INS P1 P2 P3

DATA with length lgth

SW1

SW2

lgth '91' lgth1


FETCH


lgth1

'90' '00'

NOTE: lgth='00' causes a data transfer of 256bytes. The same applies to lgth1.

Case 3: No Input/ "OK" response with data of unknown length, plus additional

command from SIMCLA INS P1 P2 P3 SW1 SW2

lgth (='00') '9F' lgth1

GET RESPONSE

CLA INS P1 P2 P3 DATA with length lgth2 lgth1SW1 SW2

lgth2 '91' lgth3


FETCH


lgth3 '90' '00'


51/57

47

47

Case 4: Input/ "OK" response with no output data, plus additional command

from SIMCLA INS P1 P2 P3 DATA with length lgth SW1 SW2

lgth '91' lgth1


FETCH


lgth1 '90' '00'

Case 5: Input/ "OK" response with data of known or unknown length, plus

additional command from SIM

CLA INS P1 P2 P3 DATA with length lgth SW1 SW2

lgth '9F' lgth1

GET RESPONSE

CLA INS P1 P2 P3 DATA with length lgth2 lgth1SW1 SW2

lgth2 '91' lgth3


FETCH

CLA INS P1 P2 P3 DATA with length lgth3

SW1 SW2

lgth3 '90' '00'

.

SW1SW2

IMSI

Ki

AUCLocation

UpdateAUC

RAND


52/57

48

48

KiA3

SRES

KiRANDA3

SIM Authentication

Ki

Ki

Ki


53/57

49

49

KiRANDA8

KC

A3/A8

XOR

Comp 128-1

XOR

RANDSRESKi

KiA3/A8

Ki

A3/A8

Authentication Counter

Comp 128-2,3


54/57

50

50

Comp128-1

Comp128-2,3

Comp128-3Kiki

A3/A8Kc

DF GSM

A5/1A5/2Kc


55/57

51

51

ROM

FLASH

Per Personalization

SPN,

SDN, SMSP

ICC ID

IMSI

Ki

CHVADM

MSISDNHLR

IMSIKiAUC


56/57

52

52

CHV1

CHV2FDN

PUK2 , PUK1CHV1CHV2

ADM1ADM8


57/57

This document was created with Win2PDF available at http://www.daneprairie.com.The unregistered version of Win2PDF is for evaluation or non-commercial use only.
http://www.daneprairie.com/http://www.daneprairie.com/http://www.daneprairie.com/http://www.daneprairie.com/

Documents

Sim Course3