Removable User Identity Module (R-UIM) for cdma2000 Spread Spectrum Systems

Transcription

1 GPP C.S00-0 Date: June, 000 Removable User Identity Module (R-UIM) for cdma000 Spread Spectrum Systems COPYRIGHT GPP and its Organizational Partners claim copyright in this document and individual Organizational Partners may copyright and issue documents or standards publications in individual Organizational Partner's name based on this document. Requests for reproduction of this document should be directed to the GPP Secretariat at Requests to reproduce individual Organizational Partner's documents should be directed to that Organizational Partner. See for more information.

2 Intentionally left blank. 000 GPP.

3 C.S Introduction...-. General Description Terms References Physical, Electrical, and Logical Interfaces...-. Physical Interface Electrical Interface Logical Interface Security Features Authentication and key generation procedure Algorithms and processes File access conditions...-. Function Description Command Description Content of EFs Application Protocol R-UIM Application Toolkit Coding of Alpha fields in the R-UIM for UCS Multi-Mode R-UIM Dedicated File (DF) and Elementary File (EF) Structure...-. DF and EFs for ANSI- Based Applications File Identifier (ID) Reservation of file IDs Coding of EFs for NAM Parameters and Operational Parameters Call Count IMSI_M IMSI_T TMSI Analog Home SID Analog Operational Parameters Analog Location and Registration Indicators CDMA Home SID, NID CDMA Zone-Based Registration Indicators CDMA System/Network Registration Indicators CDMA Distance-Based Registration Indicators Access Overload Class (ACCOLCp) Call Termination Mode Preferences Suggested Slot Cycle Index Analog Channel Preferences Preferred Roaming List Removable UIMID CDMA Service Table Service Programming Code OTAPA/SPC_Enable NAM_LOCK OTASP/OTAPA Features Service Preferences ESN_ME R-UIM Revision Preferred Languages...- -

4 C.S EF SMS (Short Messages) EF SMSP (Short message service parameters) EF SMSS (SMS status) Supplementary Services Feature Code Table CDMA Home Service Provider Name...- ANSI--Based Authentication...-. Parameter Storage and Parameter Exchange Procedures Description of []-based Security-Related Functions Managing Shared Secret Data Performing Authentication Calculations and Generating Encryption Keys Managing the Call History Parameter...-. Description of []-based OTASP/OTAPA Functions Elementary Files for OTASP/OTAPA Mapping of OTASP/OTAPA Request/Response Messages to R-UIM Commands Description of ANSI--based Security-Related Commands Update SSD BASE STATION CHALLENGE Confirm SSD Run CAVE Generate Key/VPM...-. Description of []-based OTASP/OTAPA Commands MS Key Request Key Generation Request Commit Validate Configuration Request Download Request SSPR Configuration Request SSPR Download Request OTAPA Request...-. ESN Management Command Store ESN_ME...- Additional Air Interface Procedures...-. Registration Procedure R-UIM Insertion Procedure when ESN changes with TMSI Assigned...-. NAM Parameters when no R-UIM is Inserted into the ME IMSI-Related Parameters in the ME when no IMSI is Programmed in the R-UIM Preferred Access Channel Mobile Station ID Type

5 C.S Introduction. General Description This document contains the requirements for the Removable User Identity Module (R-UIM). It is an extension of Subscriber Identity Module (SIM), per latest GSM. capabilities, to enable operation in a [//] radiotelephone environment. Examples of this environment include, but are not limited to, analog, [, ] -based CDMA, and the [] family of standards. These requirements are expressed as additions to the current specification of the SIM; the composite R- UIM is comprised of the current SIM specification and this ancillary, or delta, document. The SIM specification is included as a reference. It is intended that all upgrades to the SIM specification will also apply to the R-UIM. The current SIM specifications (see references) address the physical and electrical characteristics of the removable module, along with the user-to-card interface and terminal-to-card signaling protocol. Operation in a [//] environment requires that additional commands and responses be developed within the context of this document. This document also defines new Elementary Files (EFs) for storage of parameters that are added for operation in a [//] environment. This standard specifies security-related procedures and commands, along with data and information storage items that permit basic operation in the [//] environment. Later versions are expected to also address the delivery of [//] user features and services via the R-UIM. Although the focus of this document is compatibility with [//], the scope of this document may later be expanded to include compatibility with other [] -related technologies such as TDMA and AMPS. -

6 C.S Terms AC. See Authentication Center. A-key. A secret, -bit pattern stored in the mobile station and HLR/AC. It is used to generate or update the mobile station s Shared Secret Data. Authentication. A procedure used by a base station to validate a mobile station s identity. Authentication Center (AC). An entity that manages the authentication information related to the mobile station. Base Station. A fixed station used for communicating with mobile stations. Depending upon the context, the term base station may refer to a cell, a sector within a cell, an MSC, an OTAF, or other part of the wireless system. (See also MSC and OTAF.) CAVE. The algorithm currently used in [] for Authentication and Key Generation. CRC. See Cyclic Redundancy Code. Cyclic Redundancy Code (CRC). A class of linear error detecting codes which generate parity check bits by finding the remainder of a polynomial division. DF. R-UIM Dedicated File. Diffie/Hellman. The key exchange mechanism used by []. EF. R-UIM Elementary File. Electronic Serial Number (ESN). A -bit number assigned by the mobile station manufacturer, uniquely identifying the mobile station equipment. ESN. See Electronic Serial Number. HLR. See Home Location Register. Home Location Register (HLR). The location register to which a MIN/IMSI is assigned for record purposes such as subscriber information. Home System. The cellular system in which the mobile station subscribes for service. ICC. Integrated Circuit(s) Card. ICCID. ICC Identification. IMSI. See International Mobile Subscriber Identity. IMSI_M. MIN-based IMSI using the lower 0-digits to store the MIN. -

7 C.S IMSI_O. The operational value of IMSI used by the mobile station for operation with the base station. IMSI_T. True IMSI not associated with MIN, -digits or fewer. International Mobile Subscriber Identity (IMSI). A method of identifying subscribers in the land mobile service as specified in []. Long Code Mask. A -bit binary number that creates the unique identity of the long code. See also Public Long Code, Private Long Code, Public Long Code Mask, and Private Long Code Mask. LSB. Least significant bit. M/O. Mandatory/Optional. MCC. See Mobile Country Code ME. Mobile Equipment. MF. R-UIM Master File. Mobile Country Code (MCC). A part of the E. IMSI identifying the home country. See []. Mobile Directory Number (MDN). A dialable directory number which is not necessarily the same as the mobile station s air interface identification, i.e., MIN, IMSI_M or IMSI_T. Mobile Equipment (ME). An R-UIM capable mobile station without an R-UIM inserted. MIN. See Mobile Identification Number. MNC. See Mobile Network Code. Mobile Identification Number (MIN). The -bit number that is a digital representation of the 0-digit number assigned to a mobile station. Mobile Network Code (MNC). A part of the E. IMSI identifying the home network within the home country. See []. Mobile Station. A station, fixed or mobile, which serves as the end user s wireless communication link with the base station. Mobile stations include portable units (e.g., hand-held personal units) and units installed in vehicles. Mobile Station Originated Call. A call originating from a mobile station. Mobile Station Terminated Call. A call received by a mobile station (not to be confused with a disconnect or call release). MSB. Most significant bit. NAM. See Number Assignment Module. -

8 C.S Network. A network is a subset of a wireless system, such as an area-wide wireless network, a private group of base stations, or a group of base stations set up to handle a special requirement. A network can be as small or as large as needed, as long as it is fully contained within a system. See also System. Network Identification (NID). A number that uniquely identifies a network within a wireless system. See also System Identification. NID. See Network Identification. Number Assignment Module (NAM). A set of MIN/IMSI-related parameters stored in the mobile station. OTAF. See Over-the-Air Service Provisioning Function. Over-the-Air Service Provisioning Function (OTAF). A configuration of network equipment that controls OTASP functionality and messaging protocol. OTAPA. See Over-the-Air Parameter Administration. OTASP. See Over-the-Air Service Provisioning. Over-the-Air Parameter Administration (OTAPA). Network initiated OTASP process of provisioning mobile station operational parameters over the air interface. Over-the-Air Service Provisioning (OTASP). A process of provisioning mobile station operational parameters over the air interface. Parity Check Bits. Bits added to a sequence of information bits to provide error detection, correction, or both. Phase. Revision level of the R-UIM. Preferred Roaming List (PRL). See SSPR. Private Long Code. The long code characterized by the private long code mask. Private Long Code Mask. The long code mask used to form the private long code. Release. A process that the mobile station and base station use to inform each other of call disconnect. RFU. Reserved for future use. Roamer. A mobile station operating in a wireless system (or network) other than the one from which service was subscribed. R-UIM. Removable UIM. -

9 C.S Service Option. A service capability of the system. Service options may be applications such as voice, data, or facsimile. See [0]. Shared Secret Data (SSD). A -bit pattern stored in the mobile station (in semi-permanent memory) and known by the base station. SSD is a concatenation of two -bit subsets: SSD_A, which is used to support the authentication procedures, and SSD_B, which serves as one of the inputs to the process generating the encryption mask and private long code. SID. See System Identification. SIM. Subscriber Identity Module. SPASM. See Subscriber Parameter Administration Security Mechanism. SPC. Service Programming Code. SSD. See Shared Secret Data. SSPR. See System Selection for Preferred Roaming. Subscriber Parameter Administration Security Mechanism (SPASM). Security mechanism protecting parameters and indicators of active NAM from programming by an unauthorized network entity during the OTAPA session. SW/SW. Status Word /Status Word. System. A system is a wireless telephone service that covers a geographic area such as a city, metropolitan region, county, or group of counties. See also Network. System Identification (SID). A number uniquely identifying a wireless system. System Selection Code. A part of the Activation Code that specifies the user selection of a Band and a Block operated by the selected service provider. System Selection for Preferred Roaming (SSPR). A feature that enhances the mobile station system acquisition process based on the set of additional parameters stored in the mobile station in the form of a Preferred Roaming List (PR_LISTs-p). TMSI. Temporary Mobile Station Identity. UCS. Universal Multiple-Octet Coded Character Set. UIM. User Identity Module. VPM. Voice Privacy Mask. -

10 C.S References. C.S000-A, Introduction to cdma000 Spread Spectrum Systems, March C.S000-A, Physical Layer Standard for cdma000 Spread Spectrum Systems, March Reserved.. C.S000-A, Signaling Link Access Control (LAC) Standard for cdma000 Spread Spectrum Systems, March C.S000-A, Upper Layer (Layer ) Signaling Standard for cdma000 Spread Spectrum Systems, March Reserved.. C.S00-0, Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Systems, June.. C.S00-0, Short Message Service for Spread Spectrum Systems, April.. ITU-T Recommendation E., Identification Plan for Land Mobile Stations,. 0. C.R00-0, Administration of Parameter Value Assignments for TIA/EIA Wideband Spread Spectrum Standards, December.. TIA/EIA/IS--A, Mobile Station Base Station Compatibility Standard for Dual-Mode Wideband Spread Spectrum Cellular Systems, May.. TIA/EIA/IS- Annex A, OTASP CCA, March.. TIA/EIA/IS- A Annex A, OTASP CCA, January.. TIA/EIA--B, Mobile Station - Base Station Compatibility Standard for Dual-Mode Wideband Spread Cellular Systems, December.. ANSI-TIA/EIA-, Cellular Radio-Telecommunications Intersystem Operations,.. TIA/EIA-, Mobile Station - Base Station Compatibility Standard for 00 MHz Analog Cellular, October.. GSM.; Digital cellular telecommunications system (Phase +); Specification of the Subscriber Identity Module - Mobile Equipment (SIM - ME) Interface.. GSM.; Digital cellular telecommunications system (Phase ); Specification of the volt Subscriber Identity Module Mobile Equipment (SIM-ME) Interface.. GSM.; Digital cellular telecommunications system; Specification of the. volt Subscriber Identity Module Mobile Equipment (SIM-ME) Interface. -0

11 C.S00-0 (Note: References [], [], and [] are to the latest published version of the ETSI documents.) -

12 C.S00-0 Physical, Electrical, and Logical Interfaces. Physical Interface The physical characteristics of the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.- Physical Characteristics. Table.- Physical Characteristics Section of GSM. Title Physical Characteristics. Format and Layout.. ID- SIM.. Plug-In SIM, including Annex A (Normative). Temperature range for card operations. Contacts.. Provision of contacts.. Activation and deactivation.. Inactive contacts.. Contact pressure. Precedence (Informative). Static protection -

13 C.S00-0. Electrical Interface The electrical characteristics of the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.-. Table.- Electronic Signals and Transmission Protocols Section of GSM. Title Electronic Signals and Transmission Protocols. Supply voltage Vcc (contact C). Reset (RST) (contact C). Programming voltage Vpp (contact C). Clock CLK (contact C). I/O (contact C). States. Baudrate. Answer To Reset (ATR).. Structure and contents.. PPS procedure.. Speed enhancement. Bit/character duration and sampling time.0 Error handling Annex A Plug-In SIM -

14 C.S Logical Interface The logical interface of the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.-. The Dedicated file ID for CDMA (used for EFs in section.) is F. Table.- Logical Model Section of GSM. Title Logical Model. General description. File identifier. Dedicated files. Elementary files.. Transparent EF.. Linear fixed EF.. Cyclic EF. Methods for selecting a file. Security Features Security-Related procedures and protocols are defined in section... Authentication and key generation procedure See section. and section.... Algorithms and processes The algorithm used by the R-UIM is CAVE (see section. and section.)... File access conditions The file access conditions of the R-UIM shall follow the definitions specified in the section of GSM. shown in Table.- Table.- File access conditions Section of GSM. Title File Access Conditions -

15 C.S00-0. Function Description The functions of the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.-. For [], the following functions from section are used: Base Station Challenge, Update SSD, Run CAVE, and Generate Key/VPM. Table.- Description of the Functions Section of GSM. Title Description of The Functions. SELECT. STATUS. READ BINARY. UPDATE BINARY. READ RECORD. UPDATE RECORD. SEEK. INCREASE. VERIFY.0 CHANGE. DISABLE. ENABLE. UNBLOCK. INVALIDATE. REHABILITATE. SLEEP. TERMINAL PROFILE. ENVELOPE.0 FETCH. TERMINAL RESPONSE -

16 C.S00-0. Command Description The commands used with the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.-. The commands used to run CAVE are specified in section.. Table.- Description of the Commands (Part of ) Section of GSM. Title Description of the Commands. Mapping Principles. Coding of the Commands.. SELECT.. STATUS.. READ BINARY.. UPDATE BINARY.. READ RECORD.. UPDATE RECORD.. SEEK.. INCREASE.. VERIFY..0 CHANGE.. DISABLE.. ENABLE.. UNBLOCK.. INVALIDATE.. REHABILITATE -

17 C.S00-0 Table.- Description of the Commands (Part of ).. SLEEP.. GET RESPONSE.. TERMINAL PROFILE..0 ENVELOPE.. FETCH.. TERMINAL RESPONSE. Definition and coding. Status conditions returned by the card.. Responses to commands which are correctly executed.. Responses to commands which are postponed.. Memory management... Referencing management.. Security management.. Application independent errors.. Commands versus possible status responses -

18 C.S00-0. Content of EFs The content of the EFs of the R-UIM shall include the sections of GSM. shown in Table.-. Table.- Content of EFs Section of GSM. Title 0. Contents of the EFs at the MF level 0.. EF ICCID (ICC Identification) 0. DFs at the GSM application level 0. Contents of files at the telecom level 0.. EF ADN (Abbreviated dialling numbers) 0.. EF FDN (Fixed dialling numbers) EF MSISDN 0.. EF LND (Last number dialled) 0.. EF SDN (Service Dialling Numbers) 0..0 EF EXT (Extension) 0.. EF EXT (Extension) 0.. EF EXT (Extension) 0. DFs at the telecom level 0.. Contents of files at the telecom graphics level 0... EF IMG (Image) 0... Image Instance Data Files * The number stored in EF MSISDN is used as the MDN in [] systems. -

19 C.S00-0. Application Protocol The application protocol of the R-UIM shall follow the definitions specified in the sections of GSM. shown in Table.-. Table.- Application Protocol Section of GSM. Title Application protocol. General procedures.. Reading an EF.. Updating an EF.. Increasing an EF.. Administrative information request.. SIM service table request.. SIM revision request.. SIM Presence Detection and Proactive Polling -

20 C.S00-0. R-UIM Application Toolkit (Reserved).0 Coding of Alpha fields in the R-UIM for UCS (Reserved) -0

21 C.S00-0 Multi-Mode R-UIM Dedicated File (DF) and Elementary File (EF) Structure Figure depicts the multi-mode R-UIM file structure. MF F00 DF F0 Telecom DF F0 GSM evolved IMT-000 DF EF EF EF DF F0 PCS 00 EF EF DF EF EF EF DF F TDMA DF F CDMA DF EF EF DF EF EF 0 EF EF Specified for TDMA evolution Specified for CDMA evolution Figure Dedicated File Structure. DF and EFs for ANSI- Based Applications Efs assigned under DF F for storage of Number Assignment Module (NAM) parameters and operational parameters that are required for Analog/CDMA operation are based on [/]-based CDMA, and the [] family of standards. Section. shows the detailed coding of these EFs. In this document, only single-nam operation for CDMA is supported and therefore, each parameter is included once. -

22 C.S File Identifier (ID) A file ID is used to address or identify each specific file. The file ID consists of two bytes and shall be coded in hexadecimal notation. File IDs are specified in section.. The first byte identifies the type of file. The numbering scheme for DFs and Efs is inherited from GSM. as: 'F': Master File; 'F': st level Dedicated File; 'F': nd level Dedicated File; 'F': Elementary File under the Master File; 'F': Elementary File under the st level Dedicated File; 'F': Elementary File under the nd level Dedicated File. File IDs shall be subject to the following conditions: the file ID shall be assigned at the time of creation of the file concerned; no two files under the same parent shall have the same ID; a child and any parent, either immediate or remote in the hierarchy, e.g. grandparent, shall never have the same file ID. In this way each file is uniquely identified.. Reservation of file IDs In addition to the identifiers used for the files specified in the present document, the following file IDs are reserved for use by GSM. Dedicated Files: administrative use: 'F X', 'FX', 'FX' operational use: 'F 0' (DF TELECOM ), 'F 0' (DF GSM ), 'F ' (DF DCS00 ), 'F ' (DF IS- ), 'F ' (DF FP-CTS ), 'F ' (DF TIA/EIA- ), 'F ' (DF TIA/EIA- ), and 'F X', where X ranges from '' to 'F'. reserved under 'F0': 'F0' (DF GRAPHICS ) reserved under 'F0': 'F0' (DF IRIDIUM ), 'F' (DF Globalstar ), 'F' (DF ICO ), 'F' (DF ACeS ), 'FX', where X ranges from '' to 'F' for other MSS. 'F0'(DF PCS-00 ), 'FY' where Y ranges from '' to 'F'; 'FX' where X ranges from '0' to 'F'; 'F0'(DF CTS ), 'FY' where Y ranges from '' to 'F'; 'F0' (DF SoLSA ), 'FY' where Y ranges from '' to 'F'; 'FYX' where Y ranges from '' to 'F' and X from '0' to 'F'. Elementary files: administrative use: 'F XX' in the DFs 'F X'; 'F XX' in the DFs 'F X', 'FX' 'F X' in the DFs 'F 0', 'F 0', 'F ', F ; 'F X' in all nd level DFs 'F 0', 'F EX' in the MF 'F 00'; -

23 C.S00-0 operational use: 'F X', 'F X', 'F X' in 'F 0' and 'F X'; 'F YX', where Y ranges from '' to 'F' in all nd level DFs. 'F X' in the MF 'F 00'. In all the above, X ranges, unless otherwise stated, from '0' to 'F', inclusive. -

24 C.S Coding of EFs for NAM Parameters and Operational Parameters All quantities shown in the EF descriptions are represented in binary format, unless otherwise specified. All unused, allocated bytes of memory are set to 00 unless otherwise specified. The dedicated file ID used for EFs in this section is F (CDMA). [/] and [] store parameters in several different types of memory. Variables stored in permanent memory use the subscript p. Variables stored in semi-permanent memory use the subscript s-p. When an R-UIM is used, some of these variables are maintained in the R-UIM while other variables are maintained in the ME. -

25 C.S Call Count This EF stores the value of Call Count, COUNTs-p. Identifier: F Structure: cyclic Mandatory File size: bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - COUNTs-p M bytes COUNTs-p is contained in the least significant bits of the two-byte field. -

26 C.S IMSI_M This EF stores the five components of IMSI_M. Identifier: F Structure: transparent Mandatory File size: 0 bytes Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length IMSI_M_CLASSp M byte - IMSI_M_S from IMSI_M_Sp M bytes - IMSI_M_S from IMSI_M_Sp M bytes IMSI_M p M byte IMSI_M_PROGRAMMED/IMSI_M_ADDR_NUMp M byte -0 MCC_Mp M bytes 0 0 IMSI_M_CLASSp - Class assignment of the IMSI_M. IMSI_M_ADDR_NUMp - Number of IMSI_M address digits. MCC_Mp - Mobile country code. IMSI M p - th and th digits of the IMSI_M. IMSI_M_Sp - The least significant 0 digits of the IMSI_M. Byte : b b b b b b b b < =Class 0, =Class < > < RFU Byte, byte, byte, byte, and byte are encoded as described in [], section..., Encoding of IMSI_M_S and IMSI_T_S. Byte : b b b b b b b b < LSB of IMSI_M_S < > < IMSI_M_S bits in ascending order Byte : b b b b b b b b < Next-MSB of IMSI_M_S -

27 C.S < MSB of IMSI_M_S < > < RFU Byte : b b b b b b b b < LSB of IMSI_M_S < > < IMSI_M_S bits in ascending order Byte : b b b b b b b b < > <----IMSI_M_S bits in ascending order Byte : b b b b b b b b < > <---IMSI_M_S bits in ascending order < MSB of IMSI_M_S Byte is encoded as described in [], Section..., Encoding of IMSI_M and IMSI_T. Byte : b b b b b b b b < LSB of IMSI_M < > < middle bits of IMSI_M < MSB of IMSI_M < RFU Byte is the binary equivalent of the IMSI_M_ADD_NUM, as described in [], Section.., Mobile Station Identification Number. Byte : b b b b b b b b < LSB of IMSI_M_ADD_NUM < middle bit of IMSI_M_ADD_NUM < MSB of IMSI_M_ADD_NUM < > < RFU < IMSI_M_PROGRAMMED indicator IMSI_M_PROGRAMMED shall be set to if an IMSI_M has been programmed (IMSI_M would contain a MIN for systems that comply with []); if an IMSI_M has not been programmed, it shall be set to 0. -

28 C.S Byte and byte 0 are encoded as described in [] Section..., Encoding of the MCC_M and MCC_T. Byte : b b b b b b b b < LSB of MCC_M < > < MCC_M bits in ascending order Byte 0: b b b b b b b b < Next-MSB of MCC_M < MSB of MCC_M < > < RFU For R-UIM applications in systems that comply with [], the parameter MIN is stored in EF IMSI_M. For these instances, the 0 bits of MIN are stored in bytes and, with the coding shown above, while the bits of MIN are stored in bytes,, and. The selection of IMSI_M or IMSI_T for use in the authentication process shall be in accordance with [] section... and [] section..., which stipulate that the MIN portion of IMSI_M shall be used as an input parameter of the authentication calculation if IMSI_M is programmed and that a -bit subset of IMSI_T shall be used if only IMSI_T has been programmed. -

29 C.S IMSI_T This EF stores the five components of IMSI_T. Identifier: F Structure: transparent Mandatory File size: 0 bytes Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length IMSI_T_CLASSp M byte - IMSI_T_S from IMSI_T_Sp M bytes - IMSI_T_S from IMSI_T_Sp M bytes IMSI_T p M byte IMSI_T_PROGRAMMED/IMSI_T_ADDR_NUMp M byte -0 MCC_Tp M bytes All byte descriptions, encodings, and [] Sections are identical to those described in Section..above, except that all references to IMSI_M shall apply to IMSI_T. EF IMSI_T is not used to store a MIN. -

30 C.S TMSI This EF stores the Temporary Mobile Station Identity (TMSI). TMSI is assigned by the serving network and consists of components, Assigning TMSI Length, ASSIGNING_TMSI_ZONEs-p, TMSI_CODEs-p, and TMSI_EXP_TIMEs-p. Identifier: F Structure: transparent Mandatory File size: bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length Assigning TMSI Length M byte - ASSIGNING_TMSI_ZONEs-p M bytes 0- TMSI_CODEs-p M bytes - TMSI_EXP_TIMEs-p M bytes Byte : b b b b b b b b < LSB of TMSI Length <-----> middle bits of TMSI Length < MSB of TMSI Length < > < RFU Bytes through store the (up to) octet TMSI Zone as described in Sections..,..., and... of []. These sections are entitled Temporary Mobile Station Identity, Overview, and TMSI Assignment Memory, respectively. In each case the lowest-order octet shall be stored in the lowest-order byte (i.e., byte ) of each set of contiguous bytes, and successively higher octets stored in the next highest order bytes. Unused bytes shall be set to 00. Bytes 0 through store the ( to octet) TMSI Code as described in the sections of [] referenced above. In each case the lowest-order octet shall be stored in the lowest-order byte (i.e., byte 0) of each set of contiguous bytes, and successively higher octets stored in the next highest order bytes. Unused bytes shall be set to 00. Bytes through store the TMSI Expiration Time as described in the sections of [] referenced above. In each case the lowest-order octet shall be stored in the lowest-order byte (i.e., byte ) of each set of contiguous bytes, and successively higher octets stored in the next highest order bytes. -0

31 C.S Analog Home SID This EF identifies the home SID when the mobile station is operating in the analog mode. Identifier: F Structure: transparent Mandatory File size: bytes Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - Analog home SID (HOME_SIDp) M byte Byte : b b b b b b b b < LSB of SID < > < SID bits in ascending order Byte : b b b b b b b b < > < SID bits in ascending order < MSB of SID < RFU -

32 C.S Analog Operational Parameters This EF includes the Extended Address bit (Exp), the Local Use Mark (LCM) and the Group ID (GID) field. Identifier: F Structure: transparent Mandatory File size: byte Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length Analog Operational Parameters (Exp, LCM, GID) M byte Byte : b b b b b b b b < Extended Address < Local Use Mark < > < Group ID <-----> < RFU -

33 C.S Analog Location and Registration Indicators This EF stores parameters related to Autonomous Registration memory (NXTREGs-p and SIDs-p) as well as the Location Area memory (LOCAIDs-p and PUREGs-p). Identifier: F Structure: transparent Mandatory File size: bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - NXTREGs-p M bytes - SIDs-p M bytes - LOCAIDs-p, PUREGs-p M bytes Byte : b b b b b b b b < LSB of NXTREGs-p < > < NXTREGs-p bits in ascending order Byte : b b b b b b b b < > < NXTREGs-p bits in ascending order Byte : b b b b b b b b < > < NXTREGs-p bits in ascending order < MSB of NXTREGs-p < > RFU -

34 C.S Byte : b b b b b b b b < LSB of SIDs-p < > < SIDs-p bits in ascending order Byte : b b b b b b b b < > < SIDs-p bits in ascending order < MSB of SIDs-p < RFU Byte : b b b b b b b b < LSB of LOCAIDs-p < > < LOCAIDs-p bits in ascending order Byte : b b b b b b b b < > < LOCAIDs-p bits in ascending order < MSB of LOCAIDs-p < > < RFU < PUREG -

35 C.S CDMA Home SID, NID This EF identifies the home SID and NID when the mobile station is operating in the CDMA mode. Identifier: F Structure: linear fixed Mandatory File size: x N bytes, N = number of records Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - CDMA home SID (SIDp) M bytes - CDMA home NID (NIDp) M bytes Band Class M byte Byte : B b b b b b b b < LSB of SID < > < SID bits in ascending order Byte : B b b b b b b b < > < SID bits in ascending order < MSB of SID < RFU Byte : B b b b b b b b < LSB of NID < > < NID bits in ascending order Byte : B b b b b b b b < > < NID bits in ascending order < MSB of NID Byte : B b b b b b b b < > < Band Class < > RFU -

36 C.S CDMA Zone-Based Registration Indicators This EF stores eight entries in the zone-based registration list ZONE_LIST. Each stored element includes a REG_ZONE, a corresponding SID, NID pair, a Band Class/Frequency Block identifier, and a ZONE_TIMER. Details are described in [] Sections..,..., and..., titled Registration Memory, Zone-Based Registration, and Registration Procedures, respectively. Identifier: F Structure: transparent Mandatory File size: bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length TOTAL_ZONES M byte - REG_ZONE M bytes - SID M bytes - NID M bytes Frequency Block M byte Band Class/ZONE_TIMER M byte - REG_ZONE M bytes 0- SID M bytes - NID M bytes Frequency Block M byte Band Class/ZONE_TIMER M byte Byte : b b b b b b b b < LSB of TOTAL_ZONES < Middle bit of TOTAL_ZONES < MSB of TOTAL_ZONES < > RFU Byte : b b b b b b b b < LSB of REG_ZONE < > < REG_ZONE bits in ascending order Byte : b b b b b b b b < > < REG_ZONE bits in ascending order < MSB of REG_ZONE < > RFU -

37 C.S Byte : b b b b b b b b < LSB of SID < > < SID bits in ascending order Byte : b b b b b b b b < > < SID bits in ascending order < MSB of SID < RFU Byte : b b b b b b b b < LSB of NID < > < NID bits in ascending order Byte : b b b b b b b b < > < NID bits in ascending order < MSB of NID Byte : b b b b b b b b < > < Frequency Block: 000 Block A < > < RFU 00 Block B 00 Block C 0 Block D 00 Block E 0 Block F All others RFU Note: Frequency Block entry is ignored if Band Class is Byte : b b b b b b b b < > <------ZONE_TIMER < > < Band Class MHz 0000 PCS : as defined in [] MHz -

38 C.S00-0 Bytes 0- are used for the second through seventh registration zones in the zone list. Bytes - are used for the eighth zone in the zone list. Bytes 0- are coded the same as bytes -. -

39 C.S CDMA System/Network Registration Indicators This EF stores its SID, NID List on the R-UIM. This is described in [] Sections.. and..., titled Registration Memory, and Zone-Based Registration, respectively. Identifier: FA Structure: transparent Mandatory File size: N + bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length N, Size of SID/NID List M byte - SID, first entry M bytes - NID, first entry M bytes Frequency Block, first entry M byte Band Class/ZONE_TIMER, first entry M byte N-, N- SID M bytes N-, N- NID M bytes N Frequency Block M byte N + Band Class/ZONE_TIMER M byte Byte : b b b b b b b b < LSB of SID < > < SID bits in ascending order Byte : b b b b b b b b < > < SID bits in ascending order < MSB of SID < RFU Byte : b b b b b b b b < LSB of NID < > < NID bits in ascending order Byte : b b b b b b b b < > < NID bits in ascending order < MSB of NID -

40 C.S Byte : b b b b b b b b < > < Frequency Block: 000 Block A < > < RFU 00 Block B 00 Block C 0 Block D 00 Block E 0 Block F All others RFU Note: Frequency Block entry is ignored if Band Class is Byte : b b b b b b b b < > <------ZONE_TIMER < > < Band Class MHz 0000 PCS : as defined in [] MHz Bytes to N+ are coded the same as bytes -. -0

41 C.S CDMA Distance-Based Registration Indicators This EF stores the Base Station Latitude (BASE_LAT_REG), the Base Station Longitude (BASE_LONG_REG) and the Registration Distance (REG_DIST_REG) of the base station to which the first access probe (for a Registration Message, Origination Message, or Page Response Message) was transmitted after entering the System Access State. Identifier: FB Structure: transparent Mandatory File size: bytes Update Activity: high Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - BASE_LAT_REG M bytes - BASE_LONG_REG M bytes - REG_DIST_REG M bytes The parameters for Distance-Based Registration are described in [], Section... Byte : b b b b b b b b < LSB of BASE_LAT_REG < > < BASE_LAT_REG bits in ascending order Byte : b b b b b b b b < > <----BASE_LAT_REG bits in ascending order Byte : b b b b b b b b < > <---BASE_LAT_REG bits in ascending order < MSB of BASE_LAT_REG <-----> < RFU Byte : b b b b b b b b < LSB of BASE_LONG_REG < > < BASE_LONG_REG bits in ascending order -

42 C.S Byte : b b b b b b b b < > <--BASE_LONG_REG bits in ascending order Byte : b b b b b b b b < > <----BASE_LONG_REG bits in ascending order < MSB of BASE_LONG_REG <-----> < RFU Byte : b b b b b b b b < LSB of REG_DIST_REG < > < REG_DIST_REG bits in ascending order Byte : b b b b b b b b <-----> <----REG_DIST_REG bits in ascending order < MSB of REG_DIST_REG < > < RFU -

43 C.S Access Overload Class (ACCOLCp) This EF defines the access overload class for the mobile station. This access overload class identifies which overload class controls access attempts by the mobile station and is used to identify redirected overload classes in global service redirection. For normal mobile stations, the ACCOLC is the set of the last digits of the IMSI_M. [] Identifier: FC Structure: transparent Mandatory File size: byte Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length Access Overload Class (ACCOLCp) M byte Byte : b b b b b b b B <------LSB of ACCOLCp <-----> < middle bits of ACCOLCp < MSB of ACCOLCp < > < RFU -

44 C.S Call Termination Mode Preferences This EF contains the call termination preference MOB_TERM_HOMEp, MOB_TERM_SIDp, and MOB_TERM_FOR_NIDp. Identifier: FD Structure: transparent Mandatory File size: byte Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length Analog/Digital/Call Termination preferences M byte Byte : b b b b b b b b b mob_term_for_nidp 0 : Disallow mobile-terminated call while a NID roamer : Allow mobile-terminated call while a NID roamer b mob_term_for_sidp 0 : Disallow mobile-terminated call while a SID roamer : Allow mobile-terminated call while a SID roamer b mob_term_homep 0 : Disallow mobile-terminated call while using home (SID, NID) pair : Allow mobile-terminated call while using home (SID, NID) pair < > RFU -

45 C.S Suggested Slot Cycle Index This EF suggests a value for the mobile station s preferred slot cycle index for CDMA operation (see.. of []). Identifier: FE Structure: transparent Optional File size: byte Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length Suggested slot cycle index M byte Byte : b b b b b b b b < LSB of suggested slot cycle index < middle bit of suggested slot cycle index < MSB of suggested slot cycle index < > RFU -

46 C.S Analog Channel Preferences This EF specifies the analog mode channel preferences as determined by the service provider in accordance with the terms of the subscription. The items addressed are the Analog Initial Paging Channel, the Analog First Dedicated Control Channel for System A, the Analog First Dedicated Control Channel for System B, and the Number of Dedicated Control Channels to scan. Identifier: FF Structure: transparent Mandatory File size: bytes Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - Analog Initial Paging Channel M bytes - Analog First Dedicated Control Channel, Sys. A M bytes - Analog First Dedicated Control Channel, Sys. B M bytes Number of Dedicated Control Channels to Scan M byte Each Channel is represented by an -bit binary number. Bytes,, : b b b b b b b b <---LSB of channel number < > < channel number bits, in ascending order Bytes,, : b b b b b b b b <---> <-----channel number bits, in ascending order < MSB of channel number < > < RFU -

47 C.S Preferred Roaming List This EF stores the Preferred Roaming List, as described in Section.. of [], Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Systems. The Preferred Roaming List includes selection parameters from [], Annex F. Identifier: F0 Structure: transparent Mandatory File size: PR_LIST_SIZE + Update Activity: low Access Conditions: READ UPDATE INVALIDATE REHABILITATE Bytes Description M/O Length - PR_LIST_MAX_SIZE M bytes - PR_LIST_SIZE M bytes - PR_LIST_ID M bytes PREF_ONLY M byte DEF_ROAM_IND M byte -0 NUM_SYS_RECS, N M bytes - NUM_ACQ_RECS, M M bytes - PR_LIST_CRC M bytes - SYS_TABLE entry: SID M bytes SYS_TABLE entry: attributes (NID_INCL, GEO, M byte PRI, PREF_NEG) - SYS_TABLE entry: ACQ_INDEX M bytes 0- SYS_TABLE entry: NID (if included) M bytes SYS_TABLE entry: ROAM_IND (if included) M byte :... : SYS_TABLE entry(n): SID M bytes : SYS_TABLE entry(n): attributes (NID_INCL, GEO, M byte PRI, PREF_NEG) : SYS_TABLE entry(n): ACQ_INDEX M bytes : SYS_TABLE entry(n): NID (if included) M bytes N + SYS_TABLE entry(n): ROAM_IND (if included) M byte N + ACQ_TABLE entry: M variable Refer to text below. Storage requirement depends on TYPE. There are TYPES. TYPES,, and require byte for Storage. TYPE requires between and bytes. TYPES and require between and bytes of storage. : : :... : ACQ_TABLE entry(m): M -

48 C.S Bytes and : PR_LIST_MAX_SIZE The PR_LIST_MAX_SIZE is the memory that may be allocated for the Preferred Roaming List on the R- UIM. This parameter may be passed to the ME in order that only PR lists of an appropriate size may be updated on the R-UIM. PR_LIST_MAX_SIZE is not an input to the calculation of PR_LIST_CRC. Bytes and : PR_LIST_SIZE These two bytes define the length of the Preferred Roaming List as it is stored on the R-UIM. This is determined by the service provider, and must be no greater than PR_LIST_MAX_SIZE. Bytes and : PR_LIST_ID Refer to [], section... Byte : PREF_ONLY Refer to [], section... b b b b b b b b < : non-preferred operation allowed : operate if PREF_NEG = < > < RFU Byte : DEF_ROAM_IND Refer to [], section... Byte : LSB s of NUM_SYS_RECS Refer to [], section... b b b b b b b b < LSB of NUM_SYS_RECS < > < NUM_SYS_RECS bits in ascending order Byte 0: MSB s of NUM_SYS_RECS Refer to [], section... b b b b b b b b < > <---NUM_SYS_RECS bits in ascending order < MSB of NUM_SYS_RECS <------> < RFU Byte : LSB s of NUM_ACQ_RECS Refer to [], section... b b b b b b b b < LSB NUM_ACQ_RECS < > < NUM_ACQ_RECS bits in ascending order -

49 C.S Byte : MSB of NUM_ACQ_RECS Refer to [], section... b b b b b b b b < MSB of NUM_ACQ_RECS < > < RFU Bytes and : PR_LIST_CRC Refer to [], sections.. and... Byte : SYS_TABLE, SID (lower of bytes) b b b b b b b b <-----LSB of SID < > < SID bits in ascending order Byte : SYS_TABLE, SID (upper of bytes) b b b b b b b b < > < SID bits in ascending order < MSB of SID < RFU Byte : SYS_TABLE, attributes Refer to [], section... b b b b b b b b <----> < NID_INCL < PREF_NEG < GEO < PRI < > RFU Byte : SYS_TABLE, ACQ_INDEX (lower of bytes) Refer to [], section... b b b b b b b b <-----LSB ACQ_INDEX < > < ACQ_INDEX bits in ascending order -

50 C.S Byte : SYS_TABLE, ACQ_INDEX (upper of bytes) Refer to [], section... b b b b b b b b < MSB of ACQ_INDEX < > < RFU Byte 0: SYS_TABLE, NID (lower of bytes), if included. If NID is not included, this field shall be set to 00. b b b b b b b b <-----LSB of NID < > < SID bits in ascending order Byte : SYS_TABLE, NID (upper of bytes), if included. If NID is not included, this field shall be set to 00. b b b b b b b b < > < NID bits in ascending order < MSB of NID Byte : ROAM_IND Refer to [], section... If ROAM_IND is not included, this field shall be set to 00. Byte through byte (N + ) represent SYS_TABLE entries through the end of the table. SYS_TABLE consists of N entries, each containing bytes. The structure is as shown for bytes to above. Byte N + : ACQ_TABLE entries The ACQ_TABLE consists of M entries (M is defined in bytes and above); each entry may have variable length depending on the entry type. There are six types; each type is shown below. In order to show byte addressing, each ACQ_TABLE type is shown as if it were the entry having a starting address of N + i.e., the top of ACQ_TABLE. Type names are from [], section... Each type is identified by a bold title. Type : Cellular Analog Byte N + : ACQ_TABLE TYPE and Preferences, for Cellular Analog Refer to [], section... b b b b b b b b < > <----TYPE field = 000, <----> --A/B selection -0

51 C.S : System A 0 : System B 0 : Reserved : System A or B <----> --Unused, set to 00 Type : Cellular CDMA (Standard Channels) Byte N + : ACQ_TABLE TYPE and Preferences, for Cellular CDMA (Standard Channels) Refer to [], section... b b b b b b b b < > <----TYPE field = 000, <----> --A/B selection 0 0 : System A 0 : System B 0 : Reserved : System A or B <-----> ---PRI_SEC selection 0 0 : Reserved 0 : Primary CDMA Channel 0 : Secondary CDMA Channel : Primary or Secondary CDMA Channel Type : Cellular CDMA (Custom Channels) Byte N + : ACQ_TABLE TYPE, for Cellular CDMA (Custom Channels) Refer to [], section... b b b b b b b b < > <----TYPE field = 00, < > <---Unused, set to 0000 Byte N + : ACQ_TABLE, number of channels, for Cellular CDMA (Custom Channels) b b b b b b b b < > < number of channels < > < Unused, set to 000 Byte N + : ACQ_TABLE, channel (lower of bytes) for Cellular CDMA (Custom Channels) There may be up to channels in this section. b b b b b b b b <-----LSB of channel < > < channel bits in ascending order -