Service Provider personalisation

Description

SP personalisation, or Service Provider personalisation, is a security feature in 3GPP specifications that enables a service provider to restrict the usage of a mobile equipment (ME) to only those SIM/USIM cards that belong to that service provider. This is achieved by storing a service provider identifier or a set of parameters in the ME's non-volatile memory, which are then checked against the corresponding parameters on the SIM/USIM during the initialisation procedure. If the SIM/USIM does not match the stored service provider personalisation data, the ME will refuse to operate with that SIM/USIM, effectively locking the device to the original service provider. This mechanism is defined in 3GPP TS 22.022 (Personalisation of Mobile Equipment) and TS 21.905 (Vocabulary for 3GPP Specifications).

The personalisation process involves several steps. First, the service provider obtains a personalisation code or key from the ME manufacturer or through a secure process. This code is used to program the ME with the service provider's identity. The ME stores this information in a secure area, often protected by a password or cryptographic means to prevent unauthorised modification. When a SIM/USIM is inserted into the ME, the ME reads the service provider identifier from the SIM/USIM (typically stored in the EF_SPN or EF_SPDI files) and compares it with the stored personalisation data. If they match, the ME proceeds with normal operation; if not, the ME may display an error message and refuse to register on the network. The personalisation can be removed or changed by the service provider using the appropriate control codes, allowing for flexibility in device management.

SP personalisation is one of several personalisation categories defined in 3GPP, including network personalisation, network subset personalisation, corporate personalisation, and SIM/USIM personalisation. Each category targets a different aspect of the mobile equipment's usage restrictions. SP personalisation specifically focuses on the service provider level, which is typically the mobile network operator or a mobile virtual network operator (MVNO). It is often used in conjunction with SIM lock mechanisms to enforce subsidies and contractual agreements. For example, a service provider may sell a subsidised handset with the condition that it can only be used with their SIM for a certain period. SP personalisation enforces this condition technically.

The implementation of SP personalisation relies on the ME's ability to securely store and verify the personalisation data. The 3GPP specifications define the procedures for personalisation and de-personalisation, including the use of control keys and the handling of multiple personalisation categories. The ME must support the personalisation features as per the specifications, and the SIM/USIM must contain the necessary service provider information. The specifications also define the behaviour when personalisation fails, such as limiting emergency calls or displaying appropriate notifications to the user.

In the context of 3GPP releases, SP personalisation was introduced in Rel-4 and has been maintained through Rel-19. The definition has remained essentially unchanged, indicating that the fundamental concept has not required modification. However, the evolution of mobile equipment and SIM/USIM technologies, such as the introduction of USIM and ISIM, has not altered the core principle of SP personalisation. It continues to be a relevant tool for service providers to protect their investments and enforce business models. As mobile devices become more sophisticated, personalisation mechanisms may evolve to include additional security features, but the basic concept of SP personalisation remains a cornerstone of device management in the cellular industry.

Purpose & Motivation

SP personalisation exists to protect the business interests of service providers who subsidise mobile equipment. In many markets, service providers offer handsets at reduced prices in exchange for a commitment from the subscriber to use the provider's services for a certain period. Without a technical enforcement mechanism, subscribers could simply insert a different provider's SIM card into the subsidised handset and use it on another network, undermining the provider's investment. SP personalisation solves this problem by locking the handset to the service provider's SIM/USIM cards, ensuring that the subsidy is recouped through service revenue.

Before the introduction of SP personalisation, service providers had limited technical means to enforce such agreements. They relied on contractual terms and legal measures, which were often difficult to enforce. The introduction of personalisation features in 3GPP specifications provided a standardised, secure way to implement device locking. SP personalisation specifically targets the service provider level, allowing providers to differentiate their offerings and manage their device portfolios. It also enables providers to offer flexible pricing plans and upgrade paths, as the personalisation can be removed once the contract obligations are met.

The feature has been part of 3GPP specifications since Rel-4 and has evolved alongside the SIM/USIM technology. Its continued presence in the specifications up to Rel-19 demonstrates its ongoing relevance, even as the industry moves towards eSIM and remote provisioning. SP personalisation provides a foundation for more advanced device management features and remains a key tool for service providers in competitive markets.