Subscriber Identity Module personalisation

Description

SIM personalisation is a security and customization feature defined in 3GPP specifications that allows a user to configure a Mobile Equipment (ME) to operate only with specific Subscriber Identity Module (SIM) cards. This mechanism is part of the broader personalization framework for mobile devices, which includes network personalization, service personalization, and corporate personalization. The primary purpose is to give users and operators control over which SIM cards can be used with a particular device, thereby preventing unauthorized use and supporting business models such as subsidized handsets.

The technical implementation of SIM personalisation involves storing a list of authorized SIM identifiers (such as the SIM code group or IMSI) in the ME's non-volatile memory. When a SIM is inserted, the ME compares the SIM's identifier against the stored list. If the SIM is not authorized, the ME may restrict access to certain features or refuse to operate entirely, depending on the personalization category. The personalization can be managed through a personalization code, which is typically a numeric password that allows the user to enable, disable, or modify the personalization settings.

3GPP TS 22.022 specifies the requirements for personalization of Mobile Equipment, including the different categories: network personalization, network subset personalization, service provider personalization, corporate personalization, and SIM personalization. Each category targets a different level of the identity hierarchy. SIM personalisation is the most granular, focusing on individual SIM cards. This allows a user to lock their phone to a specific SIM, which is useful for preventing theft or unauthorized usage.

The personalization process is typically performed by the user through the ME's interface, often requiring a personalization code that is provided by the manufacturer or operator. The ME must support the storage of multiple personalization codes and the ability to verify them securely. The specifications also define procedures for unlocking the ME, which may involve entering the correct personalization code or using a special unlock code provided by the operator.

From a security perspective, SIM personalisation enhances the binding between the ME and the SIM, reducing the risk of unauthorized access to network services. It also supports operator strategies for handset subsidies, where a device is sold at a reduced price but locked to a specific network or SIM. The feature has been part of 3GPP specifications since Release 4 and remains relevant in modern networks, although its usage has evolved with the advent of eSIM and remote provisioning.

Purpose & Motivation

SIM personalisation was created to address the need for controlling the usage of Mobile Equipment with specific SIM cards. In the early days of GSM, operators often subsidized handsets to attract subscribers, but needed a way to ensure that the subsidized device was used with their SIM cards. Without personalization, a user could purchase a subsidized phone and use it with a competitor's SIM, undermining the operator's investment. SIM personalisation provided a technical solution by allowing the ME to be locked to a particular SIM or set of SIMs.

Additionally, SIM personalisation enhances security for end users by preventing unauthorized use of their device if it is lost or stolen. By locking the ME to a specific SIM, a thief cannot simply insert another SIM and use the device. This adds a layer of protection beyond traditional SIM PIN locks, which only protect the SIM itself.

The feature also supports corporate and enterprise scenarios, where an organization may want to restrict the use of company-issued devices to specific SIM cards. This ensures that only authorized employees can use the devices with the intended SIMs, reducing the risk of data breaches or misuse. The personalization framework in 3GPP TS 22.022 provides a standardized approach that is interoperable across different ME vendors and SIM manufacturers, which was a significant improvement over proprietary locking mechanisms.