SILTATEL

eSIM & SIM provisioning — specifications

Order, personalise and deliver SIM profiles at any scale — physical cards or eSIM over the air, to GSMA specifications.

Open the interactive sheets

STL-ESIM-01 · GSMA SGP.21 · SGP.22

Consumer eSIM — remote SIM provisioning

In the consumer model the user starts every action. The Local Profile Assistant (LPA) on the phone fetches the operator's profile from the SM-DP+ — by activation code, QR code or SM-DS discovery — and installs it on the eUICC. The profile is encrypted end-to-end between SM-DP+ and eUICC: the device only relays it.

SM-DS discovery SM-DP+ profile server OPERATOR MNO · BSS ES12 ES2+ DEVICE LPA profile assistant eUICC PROFILE 1 · ON PROFILE 2 · OFF ES11 ES9+ ES8+ end-to-end ES10a/b/c
FIG. 1 — RSP roles and interfaces (SGP.22)

Notes

  1. ES2+ — operator ↔ SM-DP+: download order, confirm order, release and cancel.
  2. ES9+ — SM-DP+ ↔ LPA over HTTPS: authentication, bound profile package, notifications.
  3. ES8+ — SM-DP+ ↔ eUICC, end-to-end through the LPA: mutual authentication and the protected profile package.
  4. ES10a/b/c — LPA ↔ eUICC inside the device: discovery, download and local management (enable, disable, delete).
  5. ES11 / ES12 — LPA ↔ SM-DS and SM-DP+ ↔ SM-DS: event registration, so a device finds a waiting profile without an activation code.

Standards and references

BodyDocumentTitle
GSMASGP.21RSP Architecture
GSMASGP.22RSP Technical Specification
GSMASGP.23RSP Test Specification
GSMASGP.29EID Definition and Assignment
GSMASAS-SMSecurity Accreditation Scheme for Subscription Management
TCAeUICC Profile PackageInteroperable Format Technical Specification

STL-ESIM-02 · GSMA SGP.31 · SGP.32

IoT eSIM — remote management with eIM

Meters, trackers and modules have no screen and no user to run an LPA. In the IoT architecture an eSIM IoT Remote Manager (eIM) takes that role remotely: it orders downloads and enables, disables or deletes profiles across a whole fleet, and the IoT Profile Assistant (IPA) executes the commands on each device.

OPERATOR MNO · BSS SM-DP+ profile server eIM IoT remote manager ES2+ ES9+' IoT DEVICE eUICC PROFILE 1 · ON PROFILE 2 · OFF IPA IPAd · or IPAe in eUICC ESipa ES8+ end-to-end ES10b HTTPS · CoAP/DTLS
FIG. 2 — IoT RSP roles and interfaces (SGP.32)

Notes

  1. ESipa — eIM ↔ IPA: eIM packages and download requests, built for constrained devices and networks (HTTPS, or CoAP over DTLS).
  2. ES9+' — eIM ↔ SM-DP+: profile download on behalf of the device.
  3. ES10b — IPA ↔ eUICC: the commands executed on the chip.
  4. ES2+ is the same as in the consumer model, so operator integrations are reused.
  5. IPAd runs in the device; IPAe runs inside the eUICC — for modules with minimal firmware.
  6. SGP.32 is the newer alternative to the M2M model of SGP.02 (SM-DP + SM-SR, operator-driven over SMS).

Questions

How do I connect an eIM?

1. Choose the eIM — your own or a hosted one — and register it with each SM-DP+ it will use (ES9+'). 2. Use devices with an SGP.32 eUICC and an IPA, and provision the eIM configuration on the eUICC at manufacture or later. 3. Agree ES2+ download orders with every operator whose profiles you need. 4. Connect the eIM API to your device platform so profile changes follow your fleet rules.

Do IoT devices need SMS for eSIM?

No. SGP.32 works over IP — HTTPS or CoAP/DTLS — so it suits NB-IoT and LTE-M devices without SMS.

Standards and references

BodyDocumentTitle
GSMASGP.31eSIM IoT Architecture and Requirements
GSMASGP.32eSIM IoT Technical Specification
GSMASGP.02Remote Provisioning Architecture for Embedded UICC (M2M)

STL-ESIM-03 · GlobalPlatform · ETSI · 3GPP

OTA platform and SIM applets

The OTA platform manages SIM cards already in the field: it updates files and parameters, installs and personalises applets and changes roaming and steering settings — over SMS or HTTPS, with every command protected by the card's keys.

OTA PLATFORM keys · campaigns SMSC SMS centre HANDSET UICC ISD · SSD GlobalPlatform APPLETS Java Card FILES ETSI TS 102 221 SMPP SMS-PP SCP80 HTTPS · BIP SCP81
FIG. 3 — OTA channels to the UICC

Notes

  1. SMS-PP: secured packets (ETSI TS 102 225 / 3GPP TS 31.115, SCP80) delivered through the SMSC, which the platform reaches over SMPP.
  2. HTTPS: the card opens a BIP session and the platform answers as the admin server (GlobalPlatform Amendment B, SCP81, TLS-PSK) — for large updates.
  3. Remote APDU format, file and application management: ETSI TS 102 226 / 3GPP TS 31.116.
  4. Security domains and card content management follow the GlobalPlatform Card Specification; SCP03 (Amendment D) protects management sessions.
  5. Applets run on Java Card with the UICC and (U)SIM APIs (ETSI TS 102 241, 3GPP TS 31.130) and the Card Application Toolkit (ETSI TS 102 223, 3GPP TS 31.111).

Questions

Can SIM settings change without replacing cards?

Yes. Steering PLMN lists, the SMSC address, applet parameters and new applets can be pushed over the air to cards in use, as long as the OTA keys of those cards are available.

Standards and references

BodyDocumentTitle
GlobalPlatformCard Specification v2.3Card content management, security domains
GlobalPlatformAmendment BRemote Application Management over HTTP (SCP81)
GlobalPlatformAmendment DSecure Channel Protocol 03
ETSITS 102 225 / 102 226Secured packets; remote APDU structure
3GPPTS 31.115 / 31.116Secured packet structure; remote APDU (3GPP)
ETSITS 102 221UICC-terminal interface
ETSITS 102 241 · TS 102 223UICC API for Java Card; Card Application Toolkit
3GPPTS 31.130 · TS 31.111(U)SIM API for Java Card; USAT

STL-ESIM-04 · ITU-T E.118 · E.212 · E.164

Identifiers on a SIM

Three numbers tie a subscription together: the ICCID names the card or profile, the IMSI identifies the subscriber inside mobile networks, and the MSISDN is the phone number people dial. The eUICC chip itself has a fourth — the EID.

ICCID — ITU-T E.118 89 MII 358 CC 99 ISSUER 00000000003 ACCOUNT · 11 C LUHN 19 IIN IMSI — ITU-T E.212 244 MCC · FI XX MNC XXXXXXXXXX MSIN ≤ 15 MSISDN — ITU-T E.164 +358 CC · FI XX NDC XXXXXXX SUBSCRIBER ≤ 15
FIG. 4 — Identifier structure. The ICCID uses the 89 358 99 prefix printed on this site's cards.

Notes

  1. ICCID (ITU-T E.118): 89 for telecommunications, the country code (358 = Finland) and the issuer identifier form the IIN; the last digit is a Luhn check digit.
  2. IMSI (ITU-T E.212): MCC (244 = Finland) + MNC (2–3 digits) + MSIN, at most 15 digits.
  3. MSISDN (ITU-T E.164): country code (358) + national destination code + subscriber number, at most 15 digits.
  4. EID (GSMA SGP.29): the 32-digit identity of an eUICC, used by SM-DP+ and eIM to target the chip.

Standards and references

BodyDocumentTitle
ITU-TE.118International telecommunication charge card (ICCID)
ITU-TE.212International identification plan for public networks and subscriptions
ITU-TE.164International public telecommunication numbering plan
GSMASGP.29EID Definition and Assignment Process

STL-ESIM-05 · Questions · glossary

eSIM in questions and answers

Short answers to the questions operators and device makers ask most often.

Questions

What is an SM-DP+?

Subscription Manager Data Preparation+: the server that prepares, encrypts and delivers operator profiles to eUICCs. It runs in a GSMA SAS-SM accredited site and connects to each operator over ES2+.

SGP.22 or SGP.32 — what is the difference?

SGP.22 is the consumer model: the LPA on a phone or tablet, driven by the user. SGP.32 is the IoT model: an eIM manages profiles remotely across fleets of devices without a user interface.

What is an eIM?

The eSIM IoT Remote Manager of SGP.31/SGP.32: a server that tells IoT eUICCs which profile to download, enable or delete — in bulk and without user interaction.

Can a device move to another operator remotely?

Yes. The new operator's profile is downloaded from its SM-DP+ and enabled; the old one is disabled or deleted — through the LPA on consumer devices, through the eIM on IoT devices.

eSIM or iSIM?

An eSIM (eUICC) is a separate chip that holds downloadable profiles; an iSIM puts the same secure function inside the device's system-on-chip. Both use the GSMA provisioning model.

Glossary

eUICC
Embedded UICC: a SIM chip that can hold several downloadable profiles.
EID
eUICC identifier, 32 digits (SGP.29).
ICCID
Card or profile serial number (E.118).
IMSI
Subscriber identity used by mobile networks (E.212).
LPA
Local Profile Assistant: the consumer-device side of RSP.
IPA
IoT Profile Assistant: the IoT-device side of RSP (in the device or the eUICC).
SM-DP+
Server that prepares and delivers profiles.
SM-DS
Discovery server that tells a device a profile is waiting.
eIM
eSIM IoT Remote Manager (SGP.32).
OTA
Over-the-air management of SIM files and applets.
SCP80 / SCP81
OTA security over SMS / over HTTPS.
Applet
Java Card application on the SIM.