1. 1 Schlumberger SIM Toolkit in GSM Wilson Cheung Schlumberger Technologies (Asia) Ltd. SIM Toolkit in GSM Wilson Cheung Schlumberger Technologies (Asia) Ltd.

2. 2 Schlumberger Communication Communication between any smart card and Terminal must follow ISO 7816-3 Schlumberger Electronic Transactions Command Status Word

3. 3 Schlumberger Command and Status Word Examples of commands: What are status words: CREATE FILE UPDATE RECORD SELECT SUCCESSFUL FILE ALREADY EXISTS ACCESS CONDITION NOT FULFIL

4. 4 SchlumbergerCommand Each command must have this format: ClsInsP1P2P3Data (Optional) Class Instruction Parameter 1 Parameter 2 Parameter 3

5. 5 Schlumberger Example of Command A0D60510Data For the Command UPDATE BINARY: 00 Instruction code for UPDATE BINARY Offset in file to update (5 bytes) length of data to update (16 bytes)

6. 6 Schlumberger Example of Status Word Status Word only contains 2 bytes: SW1SW2 Example: 9000 = successful 9804 = access condition not fulfilled

7. 7 Schlumberger Phase 2 and Phase 2+ The essence of Phase 2 (w/o STK) is that the mobile phone is the MASTER and the SIM is the SLAVE Schlumberger Electronic Transactions Give me the content of the 12th phone number OK. Here is the phone number you want

8. 8 Schlumberger Example of phase 2 operation What did the phone and SIM actually send in the previous slide? Schlumberger Electronic Transactions Select file 6F3A No data sent, SW = 9000 Read Record no. 12 Data sent, SW = 9000

9. 9 Schlumberger What is different in phase 2+ ? Now, SIM can be the MASTER! The applications in phase 2+(with STK) is done by sending PROACTIVE COMMANDS to the phone. OK, and here is the status of your command Do this Proactive Command for me!

10. 10 Schlumberger 4 new ME commands New ME commands: 1. TERMINAL PROFILE (Which proactive commands ME can do) 2. FETCH (ME gets the proactive command from SIM) 3. TERMINAL RESPONSE (Status of the execution of the command) 4. ENVELOPE (Activation of STK)

11. 11 Schlumberger What are Proactive Commands? Proactive Commands to be executed by the phone Examples: Display Text Get Input Select Item Send Short Message Set Up Call Send SS Play Tone Provide Loci

12. 12 Schlumberger How to send Proactive Commands within ISO 7816-3? By the status word 91XX and the command FETCH SW = 91XX (some Proactive Command pending) FETCH XX bytes Send XX bytes containing Proactive command, SW = 9000 Execution of Proactive Command

13. 13 Schlumberger How does the phone send status to the SIM ? By the command TERMINAL RESPONSE SW = 91XX (if more Proactive Command pending) Execution of Proactive Command TERMINAL RESPONSE (status = OK) SW = 9000 (if no Proactive Command pending)

14. 14 Schlumberger Initialization Procedure ( Normal ) ME SIM Read EF phase ID Phase = 03 TERMINAL PROFILE 91XX FETCH XX bytes SETUP MENU ME setup level 1 and 2 of user menu, then send TERMINAL RESPONSE 9000

15. 15 Schlumberger SIM Application Operating Procedure Initialization Procedure When user selects any item in level 2 of the user menu ENVELOPE (MENU SELECTION) ME “FETCH” proactive command ME sends TERMINAL RESPONSE to SIM SIM sends sw = 91XX SIM sends sw = 9000 End of session, phone will go to idle mode SIM sends sw = 91XX

16. 16 Schlumberger The structure of proactive commands : TLV TLV is the short form for Tag, Length and Value V TL Tag: meaning / identifier for this data field Length: Length for the Value part Value: the actual data for this data field * GSM 11.14 contain the complete reference for structures of all Proactive Command

17. 17 Schlumberger Proactive Command - Setup Call Address T L V 81 09 82 08 00 91 58 92 20 08 00 F0 = local call, 90288000 = int call, 852 90288000 TONNPI Address in BCD format Address TLV ` Setup Call BER-TLV

18. 18 Schlumberger Proactive Command - Send SMS address alpha tpdu (SMS-SUBMIT) T L V 01 00 03 81 21 F3 00 04 05 32 31 32 31 31 No of digits in dest. addr TONNPI for dest addr Dest addr = 123 PIDDCS 7-bit, 8-bit and 16-bit (=UCS2) User data length User data Send SMS BER-TLV tpdu TLV

19. 19 Schlumberger SMS-PP data download (SMS from network to SIM) SMSPP is an other way to receive a SMS from the network. With Phase 2 SMS the SIM is the SLAVE With Phase 2+ SMSPP the SIM can be THE MASTER - decrypt a message like stock trading information - activation of application already stored in the SIM -...

20. 20 Schlumberger SMSPP download 04 03 81 21 F3 7F F6 05 32 31 32 31 31 No of digits in dest. addr TONNPI for dest addr Dest addr = 123 PIDDCS User data length User data GSM SMS Service Center