Slashdot Mirror
Embedded SIM Design Means No More Swapping Cards
judgecorp writes "A new remotely-programmable embedded SIM design from the GSMA operators' group means that devices can be operated on the Internet of things and won't have to be opened up to have their SIM card changed if they move to a different operator. The design could speed up embedded applications."
why is this needed?
Compared to a hard wired chip, we got something controlled by software. And a lot of Devices that likes to be jail braked.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
If all firmware was open source I would have designed this when I needed it six years ago.
Sounds good in theory, just so long as the "remote provisioning" can be handled by the user of the device, and the user doesn't have to ask permission from anyone.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
If you don't take it out. And don't change it.
Why even have it at all?
You made it a useless part. Remove the useless part.
Neat, an audit trail that follows you, forever.
This also means that users can no longer swap the SIM card to move a device between carriers (e.g. putting in a local SIM when traveling). I doubt that the carriers are going to make this easily changed by users, since it means less lock-in.
This buzzword annoys me even more than Cloud. Cloud has more or less become common vernacular for describing Internet-connected servers which you may or may not own, but the term Internet of Things seems to imply that a) there were no "things" on the Internet before now and b) the "old Internet" simply isn't hip enough to run more devices, and you should be clambering all over a vendor to be a part of it. Ugh.
I can see the utility, but this seems like a security issue. Isn't one of the purposes of the SIM to provide a physical identity chip? Why does it need to be programmable? Shouldn't you just say 'this SIM now has access to this network'?
I probably just don't understand the function of a SIM card well enough to get the significance of this. Can someone clarify? I am not 5, FYI, and I can understand multi-syllabic words.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
How long before the market for phone serials are is just as big as credit card data. I would imagine this technology be jail broken in hours and then the bad guys can easily change phone numbers. Imagining being able to change phones in-between calls, or how about randomly using a stolen one...that said, I do feel moving this to software is a good idea. As long as I can switch carriers as easy as the carriers can switch it.
neorush
I view this as bad for a number of reasons:
1. Normally, when you have service, it's attached to the SIM, not the phone. With this new embedded SIM model, this goes away. Your service is attached to the phone. Bad.
2. Remotely programmable means that it will be even easier for hackers to fuck with your phone. Bad.
3. Your phone is really no longer your phone. The carrier will have ultimate jurisdiction over the phone, unless you pull the battery. Bad.
4. If I lose or seriously damage my phone, my SIM is gone, and I HAVE to buy a new phone and activate it again. Bad.
I won't want a phone like this if this is how the carriers want to do business. I'll keep my removable SIM card thank you very much.
To fix this issue, the GSMA has developed a non-removable SIM that can be embedded in a device for the duration of its life, and remotely assigned to a network. This information can be subsequently modified over-the-air, as many times as necessary.
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier. This looks like something where you beg and plead with your old carrier to let you switch your device to a new carrier. There's a lot of elaborate key management in this system, and compromise of certain keys could break the whole system.
Spec for the system architecture.
Haven't seen a single person who used freaking roaming when buying a local SIM card for the time being was cheaper.
CableCard was supposed to allow "better interoperability of set top boxes" in the US, but it ended up going almost nowhere because the cablecos could effectively advertise its features while stonewalling its implementation in favor of their own proprietary STBs.
Given the history of carriers to cooperate and interoperate on a device level, I think the result will be similar for this. Consumers need to have control and in my mind that means a thing you can access as a consumer; be it a hardware card you swap or an interface on the device. This solution buts things squarely back in the hands of the carriers.
well maybe that wasn't so important
I'd be OK with this, under one condition - a hardware-based write protection lock that is absolutely 100% not able to be bypassed or circumvented in software.
I'll never understand why this incredibly basic feature that is so easy to design, cheap to implement, and valuable to device security went the way of floppy disks. How awesome would a thumb drive with a hardware write lock be?
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier.
When you say "seems to," do you really mean "could possibly some day"?
This looks like something where you beg and plead with your old carrier to let you switch your device to a new carrier.
That sounds more like something you're inferring than something being implied by the article.
There's nothing in the article to suggest it's going to make it's way into consumer devices just yet. It might one day, but not yet.
The GSMA has published the technical description of a SIM card designed specifically for Machine-to-Machine (M2M) communication
Despite the convenience of over-the-air management, the GSMA says the embedded design is not meant to replace conventional SIM cards
systemd is Roko's Basilisk.
Preventing the need to open up devices to swap a SIM could be easily resolved by using a simple spring-loaded insert/eject slot for SIM cards (the same way most SD card slots work). That this is because of the "Internet of Things" is a cover story, and a weak one. What's more of a hassle? Spending 30 seconds to swap SIM cards or spending 30 minutes on hold before mentally parsing the unintelligible engrish of a slave-wage phone drone?
This is a solution to a problem that doesn't exist. The only "problem" this solves is enabling the carriers to revert to the abusive and restrictive CDMA model.
I prefer plain generic unlocked SIM free phones even at the added cost.
The advantages an unlocked and unsubsidized SIM free phone is no carrier bloatware or carrier O/S mutilation....
I have more then 1 phone and more then 1 SIM.
I swap them out as I need for the current situation.
A.) Work SIM
B.) Personal SIM
Never the 2 shall meet and even different carriers.
1.) $mart phones - unfortunately a requirement of modern life and work.
2.) Rugged phones - for situations when I don't want to chance damaging the $mart phone but still have to be available "electronic leash".
3.) Cheap "burner" quality "disposable" grade phones - for security when I go out for the evening, to parties or special events etc. If damaged, trashed, lost or stolen I wont be out much other then the inconvenience of possibly having to replace a SIM with only a few core contacts and none of my personal / private data that lives on the $mart phone.
Would just be another way for the carriers to hold you hostage.
It would facilitate a resurgence in phone cloning.
What else could go wrong?
The carriers only have our best interest at hart? Don't they?
Like resisting the creation of an industry black list of stolen phones to combat phone thefts.
The main idea is to lower deployment costs for M2M applications.
I operate a GPS tracking business and somthing like this would save a lot of bux.
As it is right now I need to send a guy to the location where the tracker is and have them swap out the SIM.
From this story on Oct 2010 at GigaOM:
"It’s rumored that Apple and Gemalto have created a SIM card, which is typically a chip that carries subscriber identification information for the carriers, that will be integrated into the iPhone itself. Then customers will then be able to choose their carrier at time of purchase at the Apple web site or retail store, or buy the phone and get their handset up and running through a download at the App Store as opposed to visiting a carrier store or calling the carrier. Either way, it reduces the role of the carrier in the iPhone purchase. Gemalto and Apple have not responded to requests for comment. I’m also waiting to hear back from other sources to get more details."
http://gigaom.com/2010/10/27/is-apple-about-to-cut-out-the-carriers/
apparently solves a nagging prroblem? Isn't that like saying: "No more swapping car keys"?
"Embedded SIM Design Means No Longer Able To Swap Cards"
There, that reads better
If it's more profitable for the carriers to sell embedded-sim phones, then that is exactly what they will do, regardless of the intent of the specification or the wishes of it's designers.
So...GSM now has an ESN? All this talk about the "Internet of Things" is really just saying that the devices are getting the equivalent of a MAC Address and can be remotely provisioned. And phones will still have SIM cards.
Guess there's nothing wrong with that, but I thought there was a big reason for GSM's push to have SIM cards in the first place.
Vendors hate having expandability and cross-compatibility in their products; they want you to have to buy a new one.
Google didn't put a micro-SD card slot in the Nexus-7 because you'd be able to upgrade storage cheaply and easily. They want you to buy another one when your apps get too big for the builtin. There's a bazillion people running CyanogenMod on old, cheap Nook Colors who are very happy they had a card slot... users like media slots, vendors don't.
It's marketing, like "the cloud". It's such a gross oversimplification that it's meaningless.
I want to delete my account but Slashdot doesn't allow it.
Because I have 100% control with a removable SIM. I don't need yet another thing held hostage by the telephone carrier.
Do not look at laser with remaining good eye.
"The design could speed up embedded applications."
And it can introduce problems, such as making an expensive piece of electronics useless when the non-replaceable SIM fails or does not update properly.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
SIMs that can be fully reprogrammed by OTA already exist. All SIMs support changing the identity (IMSI) and a few also support changing authentication data (Ki, Op, algorithm). Most likely this is just a method to take away one of subscriber's freedoms - to become somebody else's subscriber.
I don't think this is meant for cell phones, as the spec says: "This document addresses: The Machine-to-Machine use cases as described in GSMA ‘Embedded SIM Task Force Requirements and Use Cases’ Version 1.0 [1]. This solution is not intended to apply to traditional consumer telecommunication devices as they are not concerned with the problem statement above."
> RTFA. They're not talking about phones; they're talking about assorted
> Internet-of-Things devices--how your toaster and your microwave talk to your Roomba.
[...deletia...]
> Of course, if someone hacks the network and reprograms your meter,
> that's bad. But don't we have the same risk now?
NO. Right now my toaster and microwave do not talk to, or take orders from other devices, let alone the guy in the car parked out in front of my home, or terrorists on the other side of the planet. This is downright stupid, and treasonous in how it makes us vulnerable to terrorists. All you need is a really hot summer day, with everybody's air-conditioners going full blast, and the electrical utilities pushed to their limits. Now imagine a botnet of things (toasters/microwaves/ovens/whatever) suddenly ramping up a in a couple of million households in a large city. The local system overloads and we have a local blackout. Properly co-ordinate 3 or 4 large cities simultaneously, and you've got a major regional blackout, possibly cascading to a national scale. Who dreamt up this "advance"? Some Al-Quaeda mole?
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier.
When you say "seems to," do you really mean "could possibly some day"?
No, I mean that's what the documentation seems to say. The user can't swap SIM cards when there is no removable SIM card. It has to be done remotely. From the documentation, it seems that the carrier has the keys to do that, but the user does not. Some devices start out in "provisioning mode", from which point (I think) the first carrier to talk to the device downloads a profiile and has control of the device until they release it. Or the device might come pre-locked to a carrier. Whether the user can force the device back to provisioning mode seems to be under the control of the profile downloaded by the carrier.
it's a lot like the way domain transfer works between registrars, with the "domain locked" status being under the control of the "losing registrar". That's led to disputes.
Who tells whom what to do? - V. Lenin
Imagine you have deployed 100k devices on the field. Or just 1k. Then, the operator that you're using starts charging more or their service level drops. Remember, the M2M lifecycles may be long compared to the cellphones. Like 10-15 years.
What do you do ? Currently, you'd have to get new SIM cards and go to each and every device to change the devices. This is because the SIM cards are controlled by the operator who issued the card.
How much does it cost to send someone somewhere to change the SIM card ? Multiply this with 100k.
From one case, I know that sending a serviceman to 6k sites around the continent to perform a simple operation (open-flash-close) costs around 600kUSD.
It's there to lock in the users and make it harder to change between different devices. Instead of having a rugged phone for outdoor use and a smartphone for other use and just swap the card you will need two different subscriptions and the operators will make more money.
If anybody can think of a secure way to make this happen without the user losing control, please leave a comment.
Hmmm... Maybe, something out of band... requiring physical access to the device...
No, I mean that's what the documentation seems to say.
Where can that be found? The closest thing I've found amounts to little more than a speculative brochure.
systemd is Roko's Basilisk.
"Despite the convenience of over-the-air management, the GSMA says the embedded design is NOT meant to replace conventional SIM cards, even though this exact idea was floated when ETSI was deciding on the future of the nano-SIM in 2012."
*emphasis added*
the cell companies are not dumb enough to allow this to happen to cellphones. do you realize what complications this would have on their systems to have to implement the level of security necessary for OTA Management.. that and they move at about the speed of molasses on a cold Canadian winter. they don't want to have to change any of their systems any time soon
Finally, the curse of Verizon is coming to GSM!
So you're telling me that I should be excited the GSM is now doing what Verizon and CDMA phones did for nearly 15 years now?
See above. But here's the link again: GSM Association Official Document 12FAST.13 - Embedded SIM Remote Provisioning Architecture.