Card Session (UICC/IC Card Communication Session)

Description

A card session is defined in 3GPP specifications (21.905 and 31.121) as the link between the card and the external world starting with the ATR (Answer To Reset) and ending with a subsequent reset or a deactivation of the card. In practical terms, this refers to the period during which a UICC (Universal Integrated Circuit Card), such as a SIM, USIM, or ISIM card, is actively communicating with a terminal or card reader, from the moment the card responds to a reset signal until the card is reset again or powered down.

The session begins when the card is powered up and a reset signal is applied. The card responds with the ATR, a byte sequence that announces the card's supported communication parameters, such as the transmission protocol (T=0, T=1), supported clock rates, and historical bytes that may identify the card type. The ATR effectively opens the card session. During the session, the terminal and card exchange Application Protocol Data Units (APDUs) to perform functions such as authentication, file access, and application management. The card may contain multiple logical channels, each of which can host an application, but all operate within the context of the card session.

The session ends when the terminal initiates a reset, which causes the card to terminate the current session and begin a new one with a fresh ATR, or when the card is deactivated (e.g., powered off, removed, or placed in a low-power state). The session boundary is important because certain card states, such as security status and file selection, are reset at the start of each session. Applications must therefore re-establish their required state at the beginning of each new card session.

From a security standpoint, the card session is significant because it defines the lifetime within which authentication and key agreement procedures occur. For example, in a UICC hosting a USIM application, the AKA procedure may be executed during a card session, producing keys that are then used by the terminal for network authentication. If the session is terminated, the security context may be lost or need to be re-established, depending on the application.

The card session concept is standardized to ensure interoperability between cards from different vendors and terminals from different manufacturers. By specifying that the session begins with the ATR and ends with reset or deactivation, 3GPP and ETSI (which defines the underlying smart card standards) provide a common lifecycle model. This is essential for the global roaming model, where a subscriber's card must work in any compliant terminal worldwide. The definition has remained stable across Releases 4 through 19, underscoring the maturity and universality of the underlying smart card technology.

Purpose & Motivation

The card session concept exists to provide a precise, standardized definition of when a smart card is actively communicating with a terminal, and to delineate the boundaries of that interaction. Smart cards, particularly UICCs used in mobile networks, must operate reliably across a vast ecosystem of devices and manufacturers. Without a common definition of a session, different implementations might interpret card state persistence differently, leading to interoperability failures — for example, a card might expect file selections to persist across a reset, while a terminal might assume they are cleared.

The session's beginning at the ATR is deliberate: the ATR is the first communication from the card after reset, and it establishes the communication parameters for the session. Defining the session to end at reset or deactivation ensures that all volatile card state relevant to the session is cleared, providing a clean slate for the next session. This is particularly important for security-sensitive applications such as USIM authentication, where stale state could lead to security vulnerabilities.

Historically, the term was introduced in Release 4, aligning with 3GPP's adoption of UICC-based applications beyond simple GSM SIM. As cards became multi-application platforms hosting USIM, ISIM, and other applets, a clear session model became essential for application isolation and lifecycle management. The stability of the definition through Release 19 reflects that this foundational smart card interaction model has not required revision — it remains a robust and universally applicable concept.