Corporate Personalisation

Description

Corporate personalisation is a 3GPP feature that enables a corporate customer to restrict the use of Mobile Equipment (ME) it provides to its employees or customers, ensuring that these devices can only operate with (U)SIMs issued by the corporation. This is achieved by storing a corporate identifier, such as the Corporate code, in both the ME and the (U)SIM. When a (U)SIM is inserted, the ME verifies that the (U)SIM's corporate code matches its own; if not, the device may refuse to operate or limit functionality. This mechanism is part of the broader personalization framework defined in 3GPP specifications, particularly TS 22.022 and TS 31.102.

The personalization process involves several steps. First, the corporate customer obtains MEs and (U)SIMs that are pre-configured with a unique corporate code. The code is stored in the GID2 file on the (U)SIM and in the ME's non-volatile memory. When the ME is powered on, it reads the (U)SIM's GID2 file and compares the corporate code with its own. If they match, the ME proceeds with normal operation; if not, the ME may display an error or restrict access to certain services. This check can be combined with other personalization categories, such as network or service provider personalization, to create a multi-layered security model.

Corporate personalisation is particularly useful for enterprises that want to control the devices they distribute. It prevents employees from using the devices with personal (U)SIMs, which could lead to security breaches or unauthorized costs. It also ensures that the devices are used only within the corporate environment, aligning with corporate policies. The feature is implemented in the ME and (U)SIM, and it does not require network support, making it a device-centric solution. However, the network can also play a role by verifying the corporate code during authentication or service access.

From a standardization perspective, corporate personalisation has been part of 3GPP since Release 4, with the definition evolving to use the term "(U)SIM" instead of "SIM" to reflect the inclusion of USIM applications. The feature is closely related to other personalization types, such as network personalization and service provider personalization, which together form a comprehensive framework for device control. The specifications define the procedures for personalization, including how the codes are stored and verified, and how the ME should behave when a mismatch occurs.

In practice, corporate personalisation is implemented by ME manufacturers and (U)SIM vendors under the guidance of 3GPP specifications. It provides a flexible and secure way for corporations to manage their device fleets, ensuring that only authorized (U)SIMs are used. This is especially important in industries with strict security requirements, such as government, finance, and healthcare. The feature also supports remote management, as the corporate code can be updated over-the-air, allowing the corporation to change its policies dynamically.

Purpose & Motivation

Corporate personalisation was created to address the need for enterprises to control the mobile devices they provide to employees or customers. Before its introduction, corporations had limited options to prevent devices from being used with unauthorized (U)SIMs, leading to potential security risks, cost leakage, and policy violations. The feature solves this by allowing a corporate customer to personalize MEs so that they only work with the company's own (U)SIMs, effectively locking the device to a specific set of (U)SIMs.

This is particularly important for large enterprises that distribute thousands of devices. Without personalization, an employee could remove the corporate (U)SIM and insert a personal one, bypassing corporate security policies and incurring costs on the corporate account. Corporate personalisation prevents this by embedding a corporate code in both the ME and (U)SIM, and enforcing a match at power-on. It also enables the corporation to enforce its own security policies, such as restricting certain applications or network access.

The feature was introduced in Release 4 as part of the broader personalization framework, which also includes network and service provider personalization. It leverages the existing (U)SIM file system and ME capabilities, making it a cost-effective solution. Over time, the definition has been refined to use "(U)SIM" instead of "SIM", reflecting the evolution of smart cards. Corporate personalisation remains relevant today, especially with the rise of enterprise mobility and the need for robust device management.