The present document provides functional specifications of five features to personalise Mobile Equipment (ME) for GSM and 3G systems. These features are called:

• Network personalisation;
• Network subset personalisation;
• Service Provider (SP) personalisation;
• Corporate personalisation;
• SIM/USIM personalisation (SIM for GSM systems or USIM for 3G systems).

The present document specifies requirements for MEs which provide these personalisation features.

The following documents contain provisions which, through reference in this text, constitute provisions of the present document.

• References are either specific (identified by date of publication, edition number, version number, etc.) or non specific.
• For a specific reference, subsequent revisions do not apply.
• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.

The personalisation features work by storing information in the ME which limits the IMs with which it will operate, and by checking this information against the SIM/USIM whenever the ME is powered up or a SIM/USIM is inserted. If a check fails, the ME enters the "limited service state" in which only emergency calls can be attempted (see Annex A.2). There are five personalisation categories of varying granularity; network, network subset, SP, corporate and SIM/USIM. The personalisation categories are independent in so far as each category can be activated or de activated regardless of the status of the others. Each category has a separate personalisation indicator to show whether it is active or not. The ME can be personalised to one network, one network subset, one SP, one Corporate, one SIM/USIM or any combination thereof. The ME may optionally be personalised to multiple networks, network subsets, SPs, Corporates, IMs or any combinations thereof. The codes used for each personalisation category are shown in Table 1. Some categories require several codes (e.g. SP and network for SP personalisation) and each combination of codes relating to a particular entity (network, SP etc.) is referred to as a code group. To personalise to multiple entities, multiple code groups are stored in the ME. For each activated personalisation category, the ME retrieves the relevant codes from the SIM/USIM and checks the retrieved code group against the (list of) code group(s) stored in the ME. If a match is found with any of the code groups stored in the ME, the check is passed for that category. If checks for all active categories are passed, then the MS goes into normal operation.

Code	Network (MCC, MNC)	Network Subset (IMSI digits 6 and 7)	SP	Corporate	SIM/USIM (IMSI digits 8 to 15)
Personalisation category
Network	X
Network subset	X	X
SP	X		X
Corporate	X		X	X
SIM/USIM	X	X			X

Precautions must be taken to ensure that when more than one personalisation category is to be activated or when the ME is to be personalised to more than one entity of a personalisation category, the new codes are not in conflict with any existing valid codes. To avoid such conflicts, checks are carried out by the ME during the personalisation cycle, as described in clause 13. As an optional ME feature, the status (activated or not) of each personalisation category and the values of the relevant codes may be read by the user.

Service provider or SP personalisation is a feature which allows a service provider to associate a ME with the SP. This feature only works with IMs which support the GID1 file. For the purpose of SP personalisation the GID1 file is programmed with an SP code that identifies the service provider. The ME is SP personalised by storing the SP code group(s) and setting a SP personalisation indicator in the ME to "on". Whenever a SIM/USIM is inserted, or the ME is powered up with a SIM/USIM already in place, the SP code group is read from the SIM/USIM and checked against those stored in the ME. If no match is found the ME shall go into emergency calls only mode as defined in Annex A.2. The SP personalisation feature is controlled by a Service Provider Control Key, (SPCK) which has to be entered into the ME in order to SP de personalise it. In order to support the SP personalisation feature the ME shall have storage for the SP personalisation indicator, the (list of) SP code group(s) and the SPCK.

Corporate personalisation is a refinement of SP personalisation which allows companies to prevent the use of MEs they provide for their employees or customers with other IMs without that corporate personalisation. This feature only works with IMs which support both the GID1 and GID2 files. For the purpose of corporate personalisation the GID1 file is programmed at pre personalisation with an SP code that identifies the service provider and the GID2 file is programmed by the service provider or corporate customer with a code that identifies the corporate customer. The ME is corporate personalised by storing the corporate code group(s) and setting a corporate personalisation indicator in the ME to "on". Whenever a SIM/USIM is inserted, or the ME is powered up with a SIM/USIM already in place, the corporate code group is read from the SIM/USIM and checked against those stored in the ME. If there is no match the ME shall go into emergency calls only mode, as defined in Annex A.2. The corporate personalisation feature is controlled by a Corporate Control Key (CCK), which has to be entered into the ME in order to de personalise it. In order to support the corporate personalisation feature the ME shall have storage for the corporate personalisation indicator, a (list of) corporate code group(s) and the CCK.

SIM/USIM personalisation is an anti theft feature. When a ME is SIM/USIM personalised to a particular SIM it will refuse to operate with any other SIM/USIM. Hence, if the ME is stolen the thief will not be able to use it with another SIM/USIM (see note). While this does not stop the ME being stolen it should make it less attractive to the thief. The ME is SIM/USIM personalised by storing the SIM/USIM code group (which is equivalent to the IMSI) of the relevant SIM/USIM in the ME and setting the SIM/USIM personalisation indicator in the ME to "on". Whenever a SIM/USIM is inserted, or the ME is powered up with a SIM/USIM already in place, the SIM/USIM code group (IMSI) is read from the SIM/USIM and checked against the SIM/USIM code group(s) stored in the ME. If there is no match the ME shall go into emergency calls only mode as described in Annex A.2. The SIM/USIM personalisation feature is controlled by a Personalisation Control Key (PCK). This key is selected by the user at SIM/USIM personalisation and shall be entered into the ME to SIM/USIM de personalise the ME. In order to support the SIM/USIM personalisation feature the ME should have storage for the SIM/USIM personalisation indicator, a (list of) SIM/USIM code group(s) and the PCK. Multiple instances of SIM/USIM personalisation can be supported, i.e. whenever a SIM/USIM is inserted, or the ME is powered up with a SIM/USIM already in place, the IMSI is read from the SIM/USIM and checked against a list of SIM/USIM code groups stored in the ME.

As an optional ME feature, the ME may be de personalised over the air (OTA) by the network. The network, network subset, SP and corporate categories may be de personalised in this way. More than one category may be de personalised at the same time. The process results in the relevant personalisation indicator(s) being set to "off". The ME must be registered on a network. Two OTA methods are defined both of which use MT SMS PP messages. With the first method, the IMEI of the ME to be de personalised and the Control Key(s) of the personalisation categories to be de personalised are sent directly to the ME. The ME performs checks on both the IMEI and the key values and the outcome of the attempted de personalisation(s) is acknowledged to the network. With the second method, the keys of the personalisation categories to be de personalised are sent to the ME via the SIM/USIM. The IMEI is not included and the de personalisation process only checks the keys. The outcome of the attempted de personalisation(s) is acknowledged to the network. The network de personalises the ME by one of the following methods:

1. SMS PP, ME specific:
   1. A point to point SMS message is sent by the network to the MS oe UE, the message being marked as being destined for the ME only and for the purposes of ME de personalisation (see TS 23.040). The User Data of the SMS contains the de personalisation key(s) and the IMEI (see Annex A.4). If the ME supports the feature, then it shall not display the data on the ME.
   2. The ME compares the values of the IMEI and the key(s) sent by the network with the corresponding values stored in the ME. If they are the same, the relevant personalisation indicator(s) is (are) set to "off".
      If the IMEI values differ, the personalisation status of all categories shall be left unchanged.
      If any key values differ, the corresponding personalisation status shall be left unchanged.
   3. The MS or UE sends a SMS acknowledgement to the network indicating the result of the attempted de personalisation process (see Annex A.4).
2. SMS PP Data Download:
   1. A SMS message is sent by the network to the IM updating the EFDCK. In the GSM system, it is done by using the SMS PP SIM Data Download of the SIM Tool Kit (see GSM 11.14 [8]). In the 3G system, it is done by using the SMS-PP Data Download of the USIM Toolkit (see TS 31.111).
   2. The SIM/USIM causes the ME to send an SMS acknowledgement to the network, as a result of the terminal response to the ENVELOPE command.
   3. The SIM/USIM shall issue a REFRESH command to instruct the ME to perform an initialisation procedure. During the initialisation procedure the ME reads the de personalisation key field(s) from EFDCK stored in the SIM/USIM after performing all personalisation checks.
   4. For each control key in EFDCK which is empty (set to default), the corresponding personalisation status shall be left unchanged.
   5. For each control key in the EFDCK which is not the same as the corresponding stored key, the personalisation status shall be left unchanged.
   6. For each control key in EFDCK which is the same as the one stored in the ME, the corresponding personalisation indicator is set to "off".
   7. All the keys in the EFDCK are reset to the default value by the ME.

There shall be a means to disable the personalisation at each level individually such that the ME shall operate with any (i.e. all) SIM/USIM at that level. The process of disable personalisation can only be carried out on a currently unpersonalised ME, i.e., if the personalisation indicator for that level is set to "off". It results in the personalisation indicator remaining set to "off". When a particular level is disabled in this manner there shall be a means to make it impossible to change this status i.e. the disable becomes irreversible thus eliminating the need for key administration.

Manufacturers may enter into private arrangements to personalise MEs before delivery or at other times. They may also have the capability to de personalise/reset MEs for example, when a ME needs repairing, when the relevant control key has been forgotten or lost or if the ME has been blocked as a result of excessive failed attempts at de personalisation. In all cases, secure arrangements shall be followed with the transfer and handling of the critical data such as the IMSI and the associated control keys. In common with the normal de personalisation processes, the manufacturer controlled processes should be secure and be key or password controlled.

ME manufacturers may offer alternative means of personalizing the ME such as adding functionality to the ME so that it automatically personalises itself to the first IM inserted in it, using one or more of the five personalisation levels described in clauses 5 to 8. In the case of SP and corporate personalisation, this is subject to the SIM/USIM supporting GID1 and GID2 (as required) and the contents of those files being non default.

Security mechanisms shall be implemented to ensure that additions or changes to any personalisation category shall only be made by persons authorised to do so for that category (see Section 14). During the Personalisation cycle of a category, before any changes are made to the existing personalisation data, it shall be checked that :

• the category to be personalised is not currently activated;
• the new codes to be stored are a subset of the existing codes.

(e.g. for a ME which is already network-personalised with the network code N1 and that is to be personalised for the SP category, N1-SP1 can be added but N2-SP2 cannot be added).

This clause lists a number of security requirements which should be satisfied if the personalisation features are to be effective. The requirements are not arranged in any particular order.

1. The control keys shall be decimal strings with an appropriate number of digits for the level of personalisation. PCK should be at least 6 digits, and the remaining control keys at least 8 digits in length. The maximum length for any control key is 16 digits.
2. Where more than one of the personalisation features are in use, distinct control keys should be used for the different features.
3. The NCK, NSCK, SPCK and CCK should be randomly selected or pseudo randomly generated and differ from ME to ME.
4. The PCK should be randomly selected for each ME. In particular, subscribers should be strongly encouraged not to use obvious values such as part of the dialling number.
5. It should be impractical to read or recover any of the control keys from the ME.
6. It should be impractical to alter or delete the values of the personalisation indicators, the control keys, the stored IMSI or the stored network operator, SP and corporate codes, other than by the defined personalisation and de personalisation processes, without completely disabling the ME from working with any SIM/USIM. (Possible methods that might be used by criminals to alter or delete the values include freezing, baking, exposure to magnetic fields or UV light.)
7. For each de personalisation procedure, there shall be a mechanism to prevent unauthorised attempts to de personalise the ME. These may include blocking the ME if the number of failed attempts to de personalise the ME exceeds a certain limit, or alternatively introducing an increasing delay after each successive failed de personalisation attempt. Other mechanisms may be also be used.
8. The SIM/USIM personalisation feature will only succeed in discouraging thieves if they know or suspect that the ME is SIM/USIM personalised. Therefore, unless and until SIM/USIM personalised MEs become the norm, it is desirable that the ME should advertise the fact that it is SIM/USIM personalised.
9. Manufacturers should not de personalise a ME for a user unless they have obtained the appropriate level of approval, e.g., from the network operator for network personalisation, from the service provider for service provider personalisation, etc.
10. ME manufacturers should ensure that the personalisation processes (except for SIM/USIM personalisation) are protected against unauthorised, accidental or malicious operation.