Slashdot Mirror
Embedded SIM Design Means No More Swapping Cards
judgecorp writes "A new remotely-programmable embedded SIM design from the GSMA operators' group means that devices can be operated on the Internet of things and won't have to be opened up to have their SIM card changed if they move to a different operator. The design could speed up embedded applications."
why is this needed?
Compared to a hard wired chip, we got something controlled by software. And a lot of Devices that likes to be jail braked.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Sounds good in theory, just so long as the "remote provisioning" can be handled by the user of the device, and the user doesn't have to ask permission from anyone.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
This buzzword annoys me even more than Cloud. Cloud has more or less become common vernacular for describing Internet-connected servers which you may or may not own, but the term Internet of Things seems to imply that a) there were no "things" on the Internet before now and b) the "old Internet" simply isn't hip enough to run more devices, and you should be clambering all over a vendor to be a part of it. Ugh.
How long before the market for phone serials are is just as big as credit card data. I would imagine this technology be jail broken in hours and then the bad guys can easily change phone numbers. Imagining being able to change phones in-between calls, or how about randomly using a stolen one...that said, I do feel moving this to software is a good idea. As long as I can switch carriers as easy as the carriers can switch it.
neorush
a SIM contains a cryptographic signature and some other things.
It's basically a watered down TPM that has a unique ID, a few kilobytes of storage, and a cryptographic key set.
A physical device like that makes it difficult to replicate the functionality of the SIM card, making it harder to make one device use the credentials and system identity of another device. (EG, it makes it harder for an attacker to steal your network identity and make lots of 1-900 number calls, which will then show up on YOUR bill, amongst other things-- like framing you in a murder by making all his calls with your number, etc.)
Making this an easily reprogrammed internal chip makes that physical level of security go away.
That's a bad thing.
Sometimes being inconvenienced is really in your best interest.
I view this as bad for a number of reasons:
1. Normally, when you have service, it's attached to the SIM, not the phone. With this new embedded SIM model, this goes away. Your service is attached to the phone. Bad.
2. Remotely programmable means that it will be even easier for hackers to fuck with your phone. Bad.
3. Your phone is really no longer your phone. The carrier will have ultimate jurisdiction over the phone, unless you pull the battery. Bad.
4. If I lose or seriously damage my phone, my SIM is gone, and I HAVE to buy a new phone and activate it again. Bad.
I won't want a phone like this if this is how the carriers want to do business. I'll keep my removable SIM card thank you very much.
To fix this issue, the GSMA has developed a non-removable SIM that can be embedded in a device for the duration of its life, and remotely assigned to a network. This information can be subsequently modified over-the-air, as many times as necessary.
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier. This looks like something where you beg and plead with your old carrier to let you switch your device to a new carrier. There's a lot of elaborate key management in this system, and compromise of certain keys could break the whole system.
Spec for the system architecture.
I'd be OK with this, under one condition - a hardware-based write protection lock that is absolutely 100% not able to be bypassed or circumvented in software.
I'll never understand why this incredibly basic feature that is so easy to design, cheap to implement, and valuable to device security went the way of floppy disks. How awesome would a thumb drive with a hardware write lock be?
Preventing the need to open up devices to swap a SIM could be easily resolved by using a simple spring-loaded insert/eject slot for SIM cards (the same way most SD card slots work). That this is because of the "Internet of Things" is a cover story, and a weak one. What's more of a hassle? Spending 30 seconds to swap SIM cards or spending 30 minutes on hold before mentally parsing the unintelligible engrish of a slave-wage phone drone?
This is a solution to a problem that doesn't exist. The only "problem" this solves is enabling the carriers to revert to the abusive and restrictive CDMA model.
"Embedded SIM Design Means No Longer Able To Swap Cards"
There, that reads better
It's marketing, like "the cloud". It's such a gross oversimplification that it's meaningless.
I want to delete my account but Slashdot doesn't allow it.
What this seems to do is take control away from the user, who could swap SIM cards, and give it to some carrier.
When you say "seems to," do you really mean "could possibly some day"?
No, I mean that's what the documentation seems to say. The user can't swap SIM cards when there is no removable SIM card. It has to be done remotely. From the documentation, it seems that the carrier has the keys to do that, but the user does not. Some devices start out in "provisioning mode", from which point (I think) the first carrier to talk to the device downloads a profiile and has control of the device until they release it. Or the device might come pre-locked to a carrier. Whether the user can force the device back to provisioning mode seems to be under the control of the profile downloaded by the carrier.
it's a lot like the way domain transfer works between registrars, with the "domain locked" status being under the control of the "losing registrar". That's led to disputes.
Who tells whom what to do? - V. Lenin