Slashdot Mirror
Embedded SIM Design Means No More Swapping Cards
judgecorp writes "A new remotely-programmable embedded SIM design from the GSMA operators' group means that devices can be operated on the Internet of things and won't have to be opened up to have their SIM card changed if they move to a different operator. The design could speed up embedded applications."
why is this needed?
Compared to a hard wired chip, we got something controlled by software. And a lot of Devices that likes to be jail braked.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Sounds good in theory, just so long as the "remote provisioning" can be handled by the user of the device, and the user doesn't have to ask permission from anyone.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
If you don't take it out. And don't change it.
Why even have it at all?
You made it a useless part. Remove the useless part.
Neat, an audit trail that follows you, forever.
Yeah, I don't know what all the functions of the SIM is, but I don't understand why it wouldn't need to just be the phone + something:
User inputs their cell number, a passphrase to authenticate with that identity on the network, and selects the network.
Network authorises that instance of the cell number on the network.
Probable downside is the same as a lot of user+pass systems instead of controlled hardware key: multiple logins, probably from attackers.
signature is pants
This also means that users can no longer swap the SIM card to move a device between carriers (e.g. putting in a local SIM when traveling). I doubt that the carriers are going to make this easily changed by users, since it means less lock-in.
This buzzword annoys me even more than Cloud. Cloud has more or less become common vernacular for describing Internet-connected servers which you may or may not own, but the term Internet of Things seems to imply that a) there were no "things" on the Internet before now and b) the "old Internet" simply isn't hip enough to run more devices, and you should be clambering all over a vendor to be a part of it. Ugh.
I can see the utility, but this seems like a security issue. Isn't one of the purposes of the SIM to provide a physical identity chip? Why does it need to be programmable? Shouldn't you just say 'this SIM now has access to this network'?
I probably just don't understand the function of a SIM card well enough to get the significance of this. Can someone clarify? I am not 5, FYI, and I can understand multi-syllabic words.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
How long before the market for phone serials are is just as big as credit card data. I would imagine this technology be jail broken in hours and then the bad guys can easily change phone numbers. Imagining being able to change phones in-between calls, or how about randomly using a stolen one...that said, I do feel moving this to software is a good idea. As long as I can switch carriers as easy as the carriers can switch it.
neorush
a SIM contains a cryptographic signature and some other things.
It's basically a watered down TPM that has a unique ID, a few kilobytes of storage, and a cryptographic key set.
A physical device like that makes it difficult to replicate the functionality of the SIM card, making it harder to make one device use the credentials and system identity of another device. (EG, it makes it harder for an attacker to steal your network identity and make lots of 1-900 number calls, which will then show up on YOUR bill, amongst other things-- like framing you in a murder by making all his calls with your number, etc.)
Making this an easily reprogrammed internal chip makes that physical level of security go away.
That's a bad thing.
Sometimes being inconvenienced is really in your best interest.
... then you need to manage the passphrase. Then all someone needs to do is find your password and they can answer your phone calls, receive your text messages - like two-factor text codes
A sim card is more secure than passphrase, since no one gets told the private key stored inside it and its never transmitted anywhere, except when its initially programmed by the telco.
I view this as bad for a number of reasons:
1. Normally, when you have service, it's attached to the SIM, not the phone. With this new embedded SIM model, this goes away. Your service is attached to the phone. Bad.
2. Remotely programmable means that it will be even easier for hackers to fuck with your phone. Bad.
3. Your phone is really no longer your phone. The carrier will have ultimate jurisdiction over the phone, unless you pull the battery. Bad.
4. If I lose or seriously damage my phone, my SIM is gone, and I HAVE to buy a new phone and activate it again. Bad.
I won't want a phone like this if this is how the carriers want to do business. I'll keep my removable SIM card thank you very much.
To fix this issue, the GSMA has developed a non-removable SIM that can be embedded in a device for the duration of its life, and remotely assigned to a network. This information can be subsequently modified over-the-air, as many times as necessary.
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier. This looks like something where you beg and plead with your old carrier to let you switch your device to a new carrier. There's a lot of elaborate key management in this system, and compromise of certain keys could break the whole system.
Spec for the system architecture.
CableCard was supposed to allow "better interoperability of set top boxes" in the US, but it ended up going almost nowhere because the cablecos could effectively advertise its features while stonewalling its implementation in favor of their own proprietary STBs.
Given the history of carriers to cooperate and interoperate on a device level, I think the result will be similar for this. Consumers need to have control and in my mind that means a thing you can access as a consumer; be it a hardware card you swap or an interface on the device. This solution buts things squarely back in the hands of the carriers.
I live in the USA and I'm in the UK right now, using a local SIM. If you don't offer than capability, you've shrunk your market to only the people who don't travel (hint:not the ones who tend to buy the fanciest phones).
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I'd be OK with this, under one condition - a hardware-based write protection lock that is absolutely 100% not able to be bypassed or circumvented in software.
I'll never understand why this incredibly basic feature that is so easy to design, cheap to implement, and valuable to device security went the way of floppy disks. How awesome would a thumb drive with a hardware write lock be?
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier.
When you say "seems to," do you really mean "could possibly some day"?
This looks like something where you beg and plead with your old carrier to let you switch your device to a new carrier.
That sounds more like something you're inferring than something being implied by the article.
There's nothing in the article to suggest it's going to make it's way into consumer devices just yet. It might one day, but not yet.
The GSMA has published the technical description of a SIM card designed specifically for Machine-to-Machine (M2M) communication
Despite the convenience of over-the-air management, the GSMA says the embedded design is not meant to replace conventional SIM cards
systemd is Roko's Basilisk.
Preventing the need to open up devices to swap a SIM could be easily resolved by using a simple spring-loaded insert/eject slot for SIM cards (the same way most SD card slots work). That this is because of the "Internet of Things" is a cover story, and a weak one. What's more of a hassle? Spending 30 seconds to swap SIM cards or spending 30 minutes on hold before mentally parsing the unintelligible engrish of a slave-wage phone drone?
This is a solution to a problem that doesn't exist. The only "problem" this solves is enabling the carriers to revert to the abusive and restrictive CDMA model.
The main idea is to lower deployment costs for M2M applications.
I operate a GPS tracking business and somthing like this would save a lot of bux.
As it is right now I need to send a guy to the location where the tracker is and have them swap out the SIM.
apparently solves a nagging prroblem? Isn't that like saying: "No more swapping car keys"?
"Embedded SIM Design Means No Longer Able To Swap Cards"
There, that reads better
If it's more profitable for the carriers to sell embedded-sim phones, then that is exactly what they will do, regardless of the intent of the specification or the wishes of it's designers.
So...GSM now has an ESN? All this talk about the "Internet of Things" is really just saying that the devices are getting the equivalent of a MAC Address and can be remotely provisioned. And phones will still have SIM cards.
Guess there's nothing wrong with that, but I thought there was a big reason for GSM's push to have SIM cards in the first place.
And international travel.
It's marketing, like "the cloud". It's such a gross oversimplification that it's meaningless.
I want to delete my account but Slashdot doesn't allow it.
Because I have 100% control with a removable SIM. I don't need yet another thing held hostage by the telephone carrier.
Do not look at laser with remaining good eye.
"The design could speed up embedded applications."
And it can introduce problems, such as making an expensive piece of electronics useless when the non-replaceable SIM fails or does not update properly.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
SIMs that can be fully reprogrammed by OTA already exist. All SIMs support changing the identity (IMSI) and a few also support changing authentication data (Ki, Op, algorithm). Most likely this is just a method to take away one of subscriber's freedoms - to become somebody else's subscriber.
I don't think this is meant for cell phones, as the spec says: "This document addresses: The Machine-to-Machine use cases as described in GSMA ‘Embedded SIM Task Force Requirements and Use Cases’ Version 1.0 [1]. This solution is not intended to apply to traditional consumer telecommunication devices as they are not concerned with the problem statement above."
You were always able to physically program a SIM card...
You were always able to emulate a sim card, making it 'easily reprogrammed'.
What you didn't have was the availability of cryptographic keys making those options useful.
Compare cloning sim cards with changing IMEI's on today devices, or bypassing boot loader signatures. They all implemented on hardware and really difficult to beat, I don't see why you having your SIM card cloned to extract your sim card credentials, rather than having your "embedded device" hacked, to extract it's sim card credentials.
At the end of day if your device is completely hacked, it could be used to clone your physical SIM card.
> RTFA. They're not talking about phones; they're talking about assorted
> Internet-of-Things devices--how your toaster and your microwave talk to your Roomba.
[...deletia...]
> Of course, if someone hacks the network and reprograms your meter,
> that's bad. But don't we have the same risk now?
NO. Right now my toaster and microwave do not talk to, or take orders from other devices, let alone the guy in the car parked out in front of my home, or terrorists on the other side of the planet. This is downright stupid, and treasonous in how it makes us vulnerable to terrorists. All you need is a really hot summer day, with everybody's air-conditioners going full blast, and the electrical utilities pushed to their limits. Now imagine a botnet of things (toasters/microwaves/ovens/whatever) suddenly ramping up a in a couple of million households in a large city. The local system overloads and we have a local blackout. Properly co-ordinate 3 or 4 large cities simultaneously, and you've got a major regional blackout, possibly cascading to a national scale. Who dreamt up this "advance"? Some Al-Quaeda mole?
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier.
When you say "seems to," do you really mean "could possibly some day"?
No, I mean that's what the documentation seems to say. The user can't swap SIM cards when there is no removable SIM card. It has to be done remotely. From the documentation, it seems that the carrier has the keys to do that, but the user does not. Some devices start out in "provisioning mode", from which point (I think) the first carrier to talk to the device downloads a profiile and has control of the device until they release it. Or the device might come pre-locked to a carrier. Whether the user can force the device back to provisioning mode seems to be under the control of the profile downloaded by the carrier.
it's a lot like the way domain transfer works between registrars, with the "domain locked" status being under the control of the "losing registrar". That's led to disputes.
Who tells whom what to do? - V. Lenin
Imagine you have deployed 100k devices on the field. Or just 1k. Then, the operator that you're using starts charging more or their service level drops. Remember, the M2M lifecycles may be long compared to the cellphones. Like 10-15 years.
What do you do ? Currently, you'd have to get new SIM cards and go to each and every device to change the devices. This is because the SIM cards are controlled by the operator who issued the card.
How much does it cost to send someone somewhere to change the SIM card ? Multiply this with 100k.
From one case, I know that sending a serviceman to 6k sites around the continent to perform a simple operation (open-flash-close) costs around 600kUSD.
No, I mean that's what the documentation seems to say.
Where can that be found? The closest thing I've found amounts to little more than a speculative brochure.
systemd is Roko's Basilisk.
Finally, the curse of Verizon is coming to GSM!
So you're telling me that I should be excited the GSM is now doing what Verizon and CDMA phones did for nearly 15 years now?
See above. But here's the link again: GSM Association Official Document 12FAST.13 - Embedded SIM Remote Provisioning Architecture.