De-personalisation

Description

De-personalisation is a security-related procedure in 3GPP specifications that allows a Mobile Equipment (ME) to be freed from personalisation restrictions. Personalisation refers to the configuration of an ME to only accept specific types of SIM cards or to operate only with a particular network operator. When an ME is personalised, it performs verification checks (e.g., comparing the SIM's IMSI or operator identifier with a stored list) before allowing normal operation. De-personalisation is the process of deactivating these checks, enabling the ME to accept any SIM card and operate on any compatible network.

The concept of personalisation and de-personalisation is defined in 3GPP TS 21.905 (Vocabulary for 3GPP Specifications). Personalisation is typically used by operators to subsidise handsets, ensuring that the device is used only on their network for a certain period. De-personalisation can be performed by the operator (e.g., after the contract period) or by the user using a special code (e.g., a SIM unlock code). The process involves modifying the ME's internal configuration to remove or disable the personalisation checks.

De-personalisation can be categorised into different types based on the level of personalisation: network personalisation, network subset personalisation, service provider personalisation, corporate personalisation, and SIM/USIM personalisation. Each type restricts the ME to a specific network, service provider, or SIM. De-personalisation removes these restrictions, either partially or completely, depending on the type. For example, network de-personalisation allows the ME to accept SIMs from any network, while service provider de-personalisation allows SIMs from any service provider.

The de-personalisation process is usually controlled by the operator and may require a de-personalisation code (e.g., a 16-digit code) that is entered into the ME. The ME verifies the code and, if correct, deactivates the personalisation. The process is defined in 3GPP specifications to ensure interoperability and security. It is important to note that de-personalisation does not affect the SIM card itself; it only modifies the ME's behaviour.

In summary, de-personalisation is a security mechanism that allows a personalised ME to be unlocked for use with any SIM card. It is a standardised procedure that ensures flexibility for users and operators while maintaining security during the personalisation period.

Purpose & Motivation

De-personalisation exists to provide flexibility and control over Mobile Equipment (ME) usage. When operators subsidise handsets, they often personalise them to ensure the device is used on their network for a minimum period, protecting their investment. However, after the contract period or under certain conditions, users may want to use the device with other SIM cards. De-personalisation allows this transition, enabling the ME to be reused or sold.

The concept addresses the need for a standardised method to remove personalisation restrictions without compromising security. It ensures that only authorised parties (e.g., the operator or the user with a valid code) can de-personalise the device. This prevents unauthorised unlocking and maintains the integrity of the subsidy model.

Historically, personalisation was introduced in early mobile networks to support operator subsidies. De-personalisation was defined in 3GPP specifications to provide a clear, interoperable procedure for unlocking devices. It has evolved over releases, but the fundamental purpose remains the same: to allow MEs to be freed from operator-specific restrictions in a controlled manner.