Smart Card Web Server

Description

The Smart Card Web Server (SCWS) is a functional component embedded within a UICC (Universal Integrated Circuit Card), such as a SIM, USIM, or ISIM. It implements a lightweight HTTP/HTTPS server stack, allowing the UICC to host web pages and applications. External entities, like a mobile handset's browser (acting as an HTTP client) or a remote OTA (Over-The-Air) platform, can establish a secure connection to the SCWS using standard web protocols. Communication typically occurs via the Bearer Independent Protocol (BIP), which provides a data channel between the terminal and the UICC. The SCWS manages a local file system on the UICC containing web resources (HTML, images, scripts) and can execute server-side logic (e.g., via S@T, Javacard). This enables interactive user interfaces served directly from the SIM card, accessible from the mobile device's browser. For remote OTA management, a dedicated OTA platform can connect to the SCWS using HTTPS to install, update, or delete applications and files on the UICC securely. The SCWS acts as a gateway, interpreting HTTP requests, accessing the UICC's file system or applets, and returning appropriate HTTP responses, thus bridging web technology with the secure, tamper-resistant environment of the smart card.

Purpose & Motivation

The SCWS was developed to modernize and simplify the management of applications and services on UICCs. Prior to SCWS, OTA provisioning often relied on proprietary, binary SMS-based protocols which were complex and limited in functionality. The growth of mobile data services and the need for dynamic service provisioning required a more flexible, standardized approach. By embedding a web server in the UICC, SCWS leverages ubiquitous web standards (HTTP/HTTPS) to create a universal interface for service management. This allows operators to deploy and update value-added services (like mobile banking, loyalty programs, or secure storage) remotely without requiring physical card replacement. It also enables the creation of rich, browser-accessible interfaces hosted directly on the secure element, enhancing user experience and security for SIM-based applications. Its introduction in 3GPP Release 8 was a key step in transforming the UICC from a static authentication module into a dynamic service delivery platform.