Mobile Application Based On (U) SIM Java Card Applet Patrick Biget

Mobile Application
based on (U)SIM
Java Card Applet
Bantry
Technologies
Patrick Biget
CNAM
17th of December 2007
CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

© Bantry Technologies Ltd. Tel: +353 (0)1 6642930 / Fax: +353 (0)1 6642933 Slide 1
16 Dec 2007 www.bantry-technologies.com
Presentation Overview
SIM Cards & GSM Networks
SIM Technology
SIM Card Applications
SIM Toolkit Technology
Java Card Enabler for SIM Card
Applications
Java Card SIM API
Demonstration (tools and cards)
Questions & Answers
© Bantry Technologies Ltd. 16 déc. 2007 Mobile Applications based on (U)SIM Java Card Applets Slide 2
SIM Card
& GSM Networks
Bantry
Technologies
SIM Technology
(3GPP TS 11. 11)

Overview
Introduction to GSM
Introduction to the SIM card
Functional role in the GSM Network
Physical characteristics
SIM Card Services
Data management
Security
Content data
Introduction to GSM
History of GSM
Services Provided by GSM
Architecture of GSM Networks
History of GSM (1/3)
Analog cellular telephone systems
experienced rapid growth in Europe (early
1980s)
Each country developed its own system
incompatible with everyone else’s
Consequences
mobile equipment were limited within national
boundaries
very limited market for each system (no possible
economies of scale)
Creation of the “Groupe Spécial Mobile” (GSM)
Proposed system had to meet certain criteria:
Good subjective speech quality
Low terminal and service cost
Support for international roaming
Ability to support handheld terminal
Support for range of new services and facilities
Spectral efficiency
ISDN compatibility
1989: GSM responsibility transferred to ETSI
(European Telecommunication Standards Institute)
1990: Publication of the GSM specs phase I
1991: Starting of commercial service
1993: 36 GSM networks in 22 countries
Over 2 billions GSM subscribers (June 2006)

Services Provided by GSM
Telephony Services (voices services)
Basic GSM voice telephony service
Bearer Services (data services)
Facsimile Service
Short Message Service
Data Exchange Service (CSD, GPRS)
Supplementary Services
Call Forward
Call Barring (roaming)
Others like caller identification, call waiting, multi-
party conversations
Architecture of GSM Networks
HLR VLR
SIM ME
BTS PSTN
ISDN
SIM ME BSC MSC
BTS
SIM ME EIR AuC

Mobile Base Station Network
Station Subsystem Subsystem
MSC = Mobile services Switching Center

SIM =BTS
Subscriber
= Base Identity
Transceiver
PSTN Module
= Station
Public Switched Telephone Network
HLR = Home Location Register EIR = Equipment Identity Register
MEBSC
= Mobile
= BaseEquipment
Station
ISDNController
= Integrated Services Digital Network
VLR = Visitor Location Register AuC =Authentication Center
Mobile Station
The Mobile Station is composed of
The Mobile Equipment (ME)
The Subscriber Identity Module (SIM)
The SIM card allows the user to get access to
the subscribed services irrespective of a
specific terminal
Both components are uniquely identified
ME through the IMEI (International Mobile
Equipment Identity)
SIM through the IMSI (International Mobile
Subscriber Identity)
Base Station Subsystem
The Base Station Subsystem is composed of
The Base Transceiver Station
The Base Station Controller
Base Transceiver Station
Houses the radio transceivers that define a cell
Handles the radio-link protocols with the Mobile
Station
Base Station Controller
Manages the radio resources for one or more
BTSs (radio-channel setup, frequency hopping and
handovers)
Network Subsystem (1/3)
Central Component: Mobile services
Switching Center (MSC)
Acts like a normal switching node (PSTN or ISDN)
Provides functionalities to handle mobility
Registration
Authentication
Location updating
Handovers
Call routing to roaming subscribers
Provides the connection to the fixed networks
(PSTN or ISDN)
Home Location Register (HLR)
Administrative information on each subscriber of
the local GSM network
Current location of the mobile
Logically one single HLR per GSM network
Visitor Location Register (VLR)
Selected administrative information of each
subscriber currently located in the geographical
area controlled by the VLR
Equipment Identity Register (EIR)
Contains a list of all valid ME on the network
ME is invalid if:
It has been reported stolen
Its type is not approved
Each ME is identified by its IMEI
Authentication Center (AuC)
Contains a copy of the secret key stored in each
SIM card
Used for authentication and encryption over the
radio channel
Introduction to the SIM Card
Functional role in the GSM Network
Personal mobility
Security services
Download of other services
Physical characteristics
Role of the SIM Card
Personal mobility
Hold the user’s subscription details to make any
mobile phone his/her personal phone
Security services
Hold the secrets necessary to prove that the user
is the one he/she claims to be (and optionally to
cipher the communications)
Download of other services
More recently, the SIM card environment has been
enhanced to let the user download on his/her SIM
card his/her preferred mobile services
Personal Mobility
Subscription details are stored in the card
IMSI: unique identifier of the subscriber
Ki: secret key for authentication
Other subscriber-related information can be
stored in the card
Address book
Language preferences
And much more information…
Security Services
Secret codes (PIN)
7 8 9
User authentication 4 5 6
Operator authentication 1 2 3
(for administrative operations) C 0 V
Secret keys
Authentication of the SIM card by the network
Communication ciphering
Authentication Services
(IMSI, Ki)
IMSI Ki
SIM ME BTS BSC MSC HLR AuC

IMSI
Rnd
Rnd Ki Rnd Ki
A3 A3
SIM Network
Result Check Result
Accepte Refused
d
Ciphering Services
(IMSI, Ki)
IMSI Ki
SIM ME BTS BSC MSC HLR AuC

IMSI
Rnd
Rnd Ki Rnd Ki
A8 A8
Session Session
Key Key
Encrypted Voice Channel
Download of Services
Secure execution environment for trusted
applications
Able to interact with the mobile phone
Display information on the screen
Get inputs from the user
Place phone calls
Able to interact with the network
Send and receive messages (SMS, CSD, GPRS, etc.)
Get localization information
Able to interact with the SIM file system
Read/write into SIM files
Physical Characteristics
Two different formats
ID-1 SIM (standard credit card format)
Plug-in SIM (specific SIM format)
54 mm
15 mm
25 mm
Plug-in SIM
85.6 mm
ID-1 SIM
SIM Card Services
Data management
File management
Security
Data protection
Authentication/Ciphering
Content data
Overall file structure
Details of the file contents
File Management
Logical file model
File identifiers
File selection
SELECT command
STATUS command
File access commands
READ BINARY command
UPDATE BINARY command
READ RECORD command
UPDATE RECORD command
SEEK command
Logical File Model (1/2)
2 different classes of file
Dedicated files (directories)
Elementary files (data files)
3 different types of elementary files
Transparent files
Linear fixed files
Cyclic files
Record #1 Record #1
Record #2 Record #2
Sequence Record #3
Record #3
of bytes
etc… etc…
Record #n Record #n
Transparent Linear Fixed Cyclic
Logical File Model (2/2)
MF
DF2
DF22
EF
EF
DF21
DF1
EF
EF
EF
EF
EF
EF
EF
Data Protection
File access conditions
CHV management commands
VERIFY CHV command
CHANGE CHV command
DISABLE CHV command
ENABLE CHV command
UNBLOCK CHV command
File invalidation commands
INVALIDATE command
REHABILITATE command
File Access Conditions
Every EF has its own access conditions for
each command
Read
Update
Invalidate
Rehabilitate
Access conditions can be
Always:no restrictions
CHV1: the CHV1 code must have been presented
CHV2: the CHV2 code must have been presented
ADM: an admin. code must have been presented
Never: no access
PIN Codes
The SIM card uses two different types of PIN
codes
CHV codes (subscriber’s responsibility)
ADM codes (telco’s responsibility)
CHV
2 CHVs are defined (only one used today)
No hierarchy between the 2 codes
Unblock code available for each CHV
ADM
Up to 14 ADM codes can be defined
Generally 2/4 are defined and only 1 really used
ADM code verification is not defined in the standard
Authentication/Ciphering
A3/A8 GSM algorithm used for
Authentication (A3)
Ciphering (A8)
One single command
RUN GSM ALGORITHM command
Overall File Structure
MF
DF GSM DF Telecom EF ICCID EF ELP
EF LP EF ADN
EF IMSI EF FDN
MF
EF Kc EF SMS ID = 3F00
General
EF PLMNsel EF CCP information
DF GSM
EF HPLMN EF MSISDN
ID = 7F20
EF ACMmax EF SMSP
Network-related
information
EF SST EF SMSS DF Telecom
ID = 7F10
EF ACM DF Graphics Service-related
information
EF GID1 EF IMG
etc… etc…
Bantry
Technologies
SIM Toolkit Technology

(3GPP TS 11. 14)

Overview
Introduction to SIM Toolkit
SIM Toolkit Processing
Proactive SIM commands
Profile download mechanism
Event management
Introduction to SIM Toolkit
Allow applications in the SIM to interact with
any ME
ETSI GSM 11.14 standard defines the
interface between the SIM and the ME to have
a full interoperability
STK applications can
Initiate actions
pro-active commands
Be triggered on external actions
event management
Get the characteristics of the ME
ME profile
SIM Toolkit Processing
SIM has to be “pro-active”
Smart card protocols doesn’t allow this
The card is never active
It only answers to APDU commands coming from
the terminal (master/slave relation)
4 new APDU commands are defined to
manage SIM Toolkit features
FETCH
TERMINAL RESPONSE
ENVELOPE
TERMINAL PROFILE
Processing Proactive Commands
 FETCH
 Proactive Command (e.g. display text)
 TERMINAL RESPONSE
SIM
 Status & Response (if any)
ME
Processing Events
 ENVELOPE (e.g. menu selection)
 Status
SIM
ME
Processing Profile Download
 TERMINAL PROFILE
 Status & Profile Information
SIM
ME
Proactive Polling
STATUS
Response with SW=90 00
Poll Intervall
STATUS
Response with SW=90 00
SIM
STATUS
Response with SW=91 XX
FETCH
ME
Proactive Commands
Man-Machine Interface Dual-Slot
Display Text Perform Card APDU
Get Inkey Power Off Card
Get Input Power On Card
Select Item Get Reader Status
More Time Miscellaneous
Play Tone Provide Local Information
Set Up Menu Timer Management
Set Up Idle Mode Text Set Up Event List
Communication Refresh
Send Short Message Poll Interval
Send SS Polling Off
Send USSD Run AT Command
Set Up Call Language Notification
Send DTMF Launch Browser
Open Channel
Close Channel
Receive Data
Send Data
Get Channel Status
Proactive Command Examples
NETWORK The weather Please enter
BANKING today is going name:
NEWS to be fine.
WEATHER ok ok
Setup Menu Display Text Get Input
BANKING SMS in CALLING

BALANCE progress. 01 4746 6667
PURCHASE
TRANSFER Please Wait... Please Wait...
Select Item Send SMS Setup Call
Display Text
This command instructs the ME to display a text message and/or an icon. It
allows the SIM to define the priority of that message and the text string
format.
Description M/O Len Command Qualifier
Proactive SIM command tag M 1 Bit Description
0 Normal priority
Length (A+B+C+D+E) M 1 or 2 1 1 High priority
0 RFU
Command details TLV M A 2 1 RFU
Device identities TLV M B 0 RFU
3 1 RFU
Text string TLV M C 0 RFU
4 1 RFU
Icon identifier TLV O D 0 RFU
5 1 RFU
Immediate response TLV O E
0 RFU
6 1 RFU
Immediate
Command
Device
Icon
TextIdentifier
Identities
String
Response
Details
TLV
TLV
TLV
TLV
TLV 0 RFU
7 1 RFU
Byte(s) Description Len
0 Clear after delay
1 Command
Text string details tagtag
tagtagtag 1 8 1 Wait for user to clear
1 Device
Icon
Immediate
identifier
identities
response 1
2
2 to (Y-1)+2 Length
Length (=03)
(=X) 1
Y
2 Length (=00)
(=02) 1 Device Identities
3
(Y-1)+3 Command
Data codingnumber
scheme 1
1
3
4 to Source
Icon qualifier
device
Type of command identities 1
1 Source SIM
(Y-1)+4
4
5 Text string qualifier
Destination
Icon identifier
Command device identities X-1
1 Dest. Display
(Y-1)+X+2
Display Text (example)
Byte(s) Value Description
1 D0 Proactive SIM command tag T
2 0F Length L
3 81 Command details tag T
4 03 Length L
5 01 Command number
6 21 Type of command (display text) V
7 00 Command qualifier (normal priority, clear after delay)
8 82 Device identities tag T
9 02 Length L
V
10 81 Source = SIM
V
11 02 Destination = Display
12 8D Text string tag T
13 04 Length L
14 04 Data coding scheme (8-bit default SMS)
V
15 - 17 53 41 54 Text string (“SAT”)
Profile Download Mechanism
ME sends to the SIM card (if Phase 2+) during
initialization procedure
This profile states the facilities relevant to SIM
Application Toolkit that are supported by the
ME
STK commands supported
STK events managed
Options managed
Alpha-identifier, UCS2
CSD, GPRS
Soft keys
Screen sizing, text wrapping & scrolling
Event Management
Menu selection Event download
MT call
Data download to SIM Call connected
SMS-PP Download Call disconnected
Location status
Cell Broadcast Download
User activity
Idle screen
Control by SIM available
Call control Card reader status
MO SMS control Language selection
Browser termination
Timer expiration Data available
Channel status
Java Card Enabler for
Bantry
Technologies
Java Card SIM API

(3GPP TS 43.019)

Overview
SIM Toolkit Framework
SIM Toolkit Management
sim.toolkit package
SIM File Management
sim.access package
SIM Toolkit Framework
Toolkit Toolkit
Applet 1 Applet 2 Applet 3 … Applet n
Proactive
commands SIM-API
Install Activation File
Uninstall P/C access
responses
SIM API Framework

Applet Proactive Applet
triggering command manager install/uninstall
Applet security
Security
manager
APDU Proactive polling, 91XX, Fetch,

e.g. Proactive commands, File access
Envelopes Terminal Response
GSM SIM Kernel Files
APDU
Interface to terminal
Java Card SIM API Overview
Packages
sim.toolkit Provides classes that enable to
communicate with the Toolkit application
(3GPP TS 11.14 functions), e.g. GUI
management, SMS management, etc…
sim.access Provides classes that enable to
communicate with the GSM application
(3GPP TS 11.11 functions), mainly file
management
sim.toolkit Interfaces
Interface Summary
ToolkitConstants ToolkitConstants encapsulates constants related to
the Toolkit applets.
ToolkitInterface ToolkitInterface must be implemented by a Toolkit

applet so that it can be triggered by the Toolkit Handler
according to the registration information.
sim.toolkit Classes (1/2)
Class Summary
EditHandler This class is the basic class for the construction of
a list of simple TLV elements
EnvelopeHandler The EnvelopeHandler class contains basic
methods to handle the Envelope data field.
EnvelopeResponseHandler The EnvelopeResponseHandler class contains
basic methods to handle the Envelope response
data field.
ProactiveHandler This class is the basic class for the definition of
Proactive commands.
ProactiveResponseHandler The ProactiveResponseHandler class
contains basic methods to handle the Terminal
Response data field.
ViewHandler The ViewHandler class offers basic services
and contains basic methods to handle TLV list.
sim.toolkit Classes (2/2)
Class Summary
ToolkitRegistry The Registry class offers basic services and methods to
allow any Toolkit applet to register its configuration during
the install phase and possibly to change it during all the
applet life time.
MEProfile The MEProfile class contains methods to question the
handset profile.
sim.toolkit Exceptions
Exception Summary
ToolkitException This exception extends the Throwable class and allows
the classes of this package to throw specific exceptions in
case of problems.
Toolkit Registry
public class MyToolkitApplet extends Applet implements ToolkitInterface,
ToolkitConstants {
private ToolkitRegistry reg;
private byte[] menuEntry = { ... };
private byte menuId;
public MyToolkitApplet() {
reg = ToolkitRegistry.getEntry();
menuId = reg.initMenuEntry(menuEntry, (short)0,
(short)menuEntry.length, PRO_CMD_SET_UP_CALL, false, 0, 0);
reg.disableMenuEntry(menuId);
reg.setEvent(EVENT_FORMATTED_SMS_PP_ENV);
reg.setEvent(EVENT_CALL_CONTROL_BY_SIM);
}
public static void install(byte bArray[], short bOffset, byte

bLength)
throws ISOException {
MyToolkitApplet applet = new MyToolkitApplet();
applet.register();
}
public void processToolkit(byte event) throws ToolkitException {

if (event == EVENT_FORMATTED_SMS_PP_ENV) {
reg.enableMenuEntry(menuId);
} else if (event == EVENT_MENU_SELECTION) {
© Bantry Technologies Ltd. 16 déc. 2007
//... Mobile Applications based on (U)SIM Java Card Applets Slide 55
Proactive Handler
private static final byte MY_COMMAND = (byte)0x33;
private static final byte MY_TAG = (byte)0x45;
ProactiveHandler proHdlr;
proHdlr = ProactiveHandler.getTheHandler();
proHdlr.init(MY_COMMAND, (byte)0, DEV_ID_ME);

proHdlr.appendTLV((byte)(MY_TAG | TAG_SET_CR), (byte)0);
short len = proHdlr.getLength();
byte result = proHdlr.send();
private byte[] text = new byte[12];

text[0] = (byte)'S';
text[1] = (byte)'A';
text[2] = (byte)'T';
result = proHdlr.initDisplayText((byte)0x80, DCS_8_BIT_DATA,

text, (short)0, (short)3);
result = proHdlr.send();
Proactive Response Handler
private byte[] data;
data = new byte[32];
ProactiveResponseHandler ProRespHdlr;
ProRespHdlr = ProactiveResponseHandler.getTheHandler();
byte result = ProRespHdlr.getGeneralResult();
respHdlr.findTLV(TAG_DEVICE_IDENTITIES, 1);
byte sourceDev = ProRespHdlr.getValueByte((short)0);
byte destinDev = ProRespHdlr.getValueByte((short)1);
if (ProRespHdlr.findTLV(TAG_TEXT_STRING, (byte)1) ==
TLV_FOUND_CR_SET) {
if ((short len = ProRespHdlr.getValueLength()) > 1) {
ProRespHdlr.copyValue((short)1, data, (short)0,
(short)(len - 1));
}
}
Envelope Handler
private static final byte MY_TAG = (byte)0x54;
private byte[] data;
data = new byte[32];
void processToolkit(byte event) throws ToolkitException {

// get the EnvelopeHandler system instance
EnvelopeHandler theEnv = EnvelopeHandler.getTheHandler();
// look for MY_TAG TLV
if (theEnv.findTLV(MY_TAG, (byte)1) != TLV_NOT_FOUND) {
// check first element byte
if (theEnv.getValueByte((short)0) == (byte)1) {
// copy element part into data buffer
theEnv.copyValue((short)1,
data,
(short)0,
(short)(theEnv.getValueLength() - 1));
}
}
}
HelloWorld SIM Toolkit Applet
import javacard.framework.*;
import sim.toolkit.*;
public class HelloWorld

extends Applet
implements ToolkitConstants, ToolkitInterface {
private final byte COMMAND_QUALIFIER = (byte)0x80;

private final byte[] MENU_ENTRY =
{'S','e','r','v','i','c','e','1'};
private final byte[] HELLO_WORLD =
{'H','e','l','l','o',' ','w','o','r','l','d',' ','!'};
private ToolkitRegistry registry;
public HelloWorld() {
registry = ToolkitRegistry.getEntry();
registry.initMenuEntry(menuEntry, (short)0,
(short) MENU_ENTRY.length, PRO_CMD_DISPLAY_TEXT,
false, 0, 0);
}
HelloWorld SIM Toolkit Applet
public static void install(byte bArray[], short bOffset,
byte bLength) throws ISOException {
HelloWorld applet = new HelloWorld();
applet.register();
}
public void processToolkit(byte event)

throws ToolkitException {
ProactiveHandler proHdlr = ProactiveHandler.getTheHandler();
if (event == EVENT_MENU_SELECTION) {
proHdlr.init((byte) PRO_CMD_DISPLAY_TEXT,
(byte)COMMAND_QUALIFIER, DEV_ID_ME);
proHdlr.appendTLV((byte)(TAG_TEXT_STRING),
HELLO_WORLD,(short)0, (short) HELLO_WORLD.length);
proHdlr.send();
}
}
sim.access Interfaces
Interface Summary
SIMView SIMView is the interface between the GSM application and
any SIM Toolkit applet.
sim.access Classes
Class Summary
SIMSystem The Class SIMSystem provides a way to get access to the
GSM file system.
In any case, the SIM Toolkit applet will only access to
methods of the SIMView interface. No instance of this class
is needed.
sim.access Exceptions
Exception Summary
SIMView SIMViewException encapsulates specific exceptions
Exception which can be generated by the methods of the SIMView
interface in case of error.
Example
import javacard.framework.*;
import sim.toolkit.*;
public class MyApplet extends Applet implements ToolkitInterface {
private SIMView simView;

private byte[] buffer;
private ToolkitRegistry registry;
public MyApplet () {
registry = ToolkitRegistry.getEntry();
simView = SIMSystem.getTheSIMView();
buffer = new byte[32];
}
public static void install(APDU apdu) throws ISOException {

MyApplet applet = new MyApplet();
applet.register();
}
public void getADN(short adnNumber) {

simView.select(SIMView.FID_EF_TELECOM);
simView.select(SIMView.FID_EF_ADN);
simView.readRecord((short)adnNumber,
SIMView.MODE_ABSOLUTE,(short)0, buffer, (short)0, (short)32);
}
}
Demonstrations
Bantry
Technologies
VirtuoSimo Development Tool

maXim/jTOP SIM Cards

Questions & Answers
Bantry
Technologies
patrick.biget@bantry-technologies.com


Mobile Application Based On (U) SIM Java Card Applet Patrick Biget

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Mobile Application Based On (U) SIM Java Card Applet Patrick Biget

Uploaded by

Copyright:

Available Formats

Mobile Application

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

Over 2 billions GSM subscribers (June 2006)

SIM ME EIR AuC

MSC = Mobile services Switching Center

SIM ME BTS BSC MSC HLR AuC

SIM ME BTS BSC MSC HLR AuC

Encrypted Voice Channel

Transparent Linear Fixed Cyclic

DF GSM DF Telecom EF ICCID EF ELP

SIM Toolkit Technology

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

 Proactive Command (e.g. display text)

 ENVELOPE (e.g. menu selection)

 Status & Profile Information

Response with SW=90 00

Response with SW=90 00

Response with SW=91 XX

Setup Menu Display Text Get Input

BANKING SMS in CALLING

Select Item Send SMS Setup Call

Java Card SIM API

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

SIM API Framework

APDU Proactive polling, 91XX, Fetch,

GSM SIM Kernel Files

ToolkitInterface ToolkitInterface must be implemented by a Toolkit

according to the registration information.

public static void install(byte bArray[], short bOffset, byte

public void processToolkit(byte event) throws ToolkitException {

proHdlr.init(MY_COMMAND, (byte)0, DEV_ID_ME);

private byte[] text = new byte[12];

result = proHdlr.initDisplayText((byte)0x80, DCS_8_BIT_DATA,

byte result = ProRespHdlr.getGeneralResult();

void processToolkit(byte event) throws ToolkitException {

public class HelloWorld

private final byte COMMAND_QUALIFIER = (byte)0x80;

public void processToolkit(byte event)

public class MyApplet extends Applet implements ToolkitInterface {

private SIMView simView;

public static void install(APDU apdu) throws ISOException {

public void getADN(short adnNumber) {

VirtuoSimo Development Tool

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

CNAM 17-Dec-2007 25 Ballsbridge Terrace, Ballsbridge, Dublin 4, Ireland

You might also like