01 The importance of Embedded SIM certification to scale the Internet of Things gsma.com/connectedliving THE IMPORTANCE OF EMBEDDED SIM CERTIFICATION #connectedliving TO SCALE THE INTERNET OF THINGS 02 Contents 03 Introduction About the GSMA 04 M2M and IoT: gathering momentum The GSMA represents the interests of mobile operators worldwide, uniting nearly 800 The evolution of the SIM lifecycle operators with almost 300 companies in the 05 broader mobile ecosystem, including handset and device makers, software companies, 05 Ensuring confidence and trust equipment providers and internet companies, in the new Embedded SIM ecosystem as well as organisations in adjacent industry sectors. The GSMA also produces industry-leading events such as Mobile 07 What is being certified, why and by whom? World Congress, Mobile World Congress Shanghai, Mobile World Congress Americas and the Mobile 360 Series of conferences. 09 How testing and certification takes place For more information, please visit the GSMA 10 A new SIM, a new ecosystem corporate website at www.gsma.com. Follow the GSMA on Twitter: @GSMA. 11 What are the benefits of Embedded SIM certification? 12 Why the GSMA certification standard? 12 Sources gsma.com/connectedliving THE IMPORTANCE OF EMBEDDED SIM CERTIFICATION #connectedliving TO SCALE THE INTERNET OF THINGS INTRODUCTION 03 Embedded SIM and THE UICC AND THE EUICC What is a UICC (Universal What is a eUICC? Integrated Circuit Card)? This is an Embedded UICC, one the Internet of Things It is the physically secure computing capable of supporting the GSMA device that conforms to the Embedded SIM Specification, specifications written by the ETSI which is not easily removable Smart Card Platform project – a from the radio module. The Subscriber Identity Module – better known as the SIM SIM is one example of a UICC. – has been a vital part of our mobile experience for around a quarter of a century. The SIM controls authentication, 2FF - Mini Sim 3FF - Micro Sim 4FF - Nano Sim MFF2 - M2M Form Factor 25mm x 15 x 0.76mm 15mm x 12 x 0.76mm 12.3mm x 8.8 x 0.67mm 5.0mm x 6.0mm identity and security on a chosen mobile network, effectively operating as trusted ‘gate keeper’ and enabling us to securely access the network and use our mobile devices. Embedded SIM represents be registered on the network. This The SIM has changed form factor several times, getting a shift from the traditional enables simple and seamless mobile physical, removable SIM connections for all kinds of devices smaller with each iteration, before reaching the eUICC to the SIM being part of the device. in IoT. New value offerings and form factor to be used in our new Internet of Things (IoT) When changing mobile networks we business models can be developed and machine to machine communications (M2M) world. have typically had to open up mobile in IoT, for example in the insurance devices and physically swap out the industry – providers can leverage the SIM card. IoT devices are commonly connected car model to create more deployed remotely, so their SIM cards flexible and affordable insurance are not accessible – which is where policies for safer younger drivers. Embedded SIM comes in. Embedded SIM enables digital swapping of The GSMA has worked with SIMs, bringing greater flexibility, industry stakeholders to develop convenience and choice to how we a set of specifications for global connect devices to the global network. Embedded SIM technology that provides a mechanism for remote Embedded SIM in IoT provisioning and management means that manufacturers of IoT and M2M connections. The of connected devices GSMA Embedded SIM specification like connected cars, enables “over the air” provisioning smart meters, eHealth devices and of initial operator subscriptions and more deliver devices with a SIM the ability to change subscriptions already embedded and ready to from one operator to another. gsma.com/connectedliving THE IMPORTANCE OF EMBEDDED SIM CERTIFICATION #connectedliving TO SCALE THE INTERNET OF THINGS 04 Another key difference Ultimately, the growth M2M and IoT: for the industry is of IoT and Embedded SIM that it will change presents an opportunity the way connected for operators to introduce a whole new world for the SIM device manufacturers interact with new commercial solutions based on suppliers and can even impact the an interoperable and unified global way they source SIMs. Manufacturers standard that enables scalable, The adoption of the Embedded SIM specification of connected devices also have the reliable and secure connectivity. option of sourcing Embedded SIMs While the interoperability of the by the world’s leading mobile operators will bring directly as well as the tried and trusted Embedded SIM also means reduced consumers and manufacturers greater choice method of sourcing from MNOs. fragmentation and the chance to take advantage of the IoT market’s and flexibility in how they connect devices and The remote provisioning capability potential - estimated to be valued combined with the non-removable at as much as US$1.3 trillion by 2025 machines. This will have a significant impact on IoT, form factor enables connected devices (source Machina Research 2016). as everything from smart meters to autonomous cars with long life cycles to be equipped during production, operate reliably connect to the Internet. To address these challenges in difficult environmental conditions IOT MARKET VALUE and be managed easily, in market, ESTIMATED the GSMA Embedded SIM specification provides a over periods of years. This lets device AT mechanism for remote provisioning and management manufacturers invest confidently US$1.3 trillion BY of machine to machine (M2M) connections – and in connected products safe in the 2025 knowledge that they can be remotely enables a simple, seamless mobile connection upgraded without product recall to for different types of connected machines. dealers or the factory. gsma.com/connectedliving THE IMPORTANCE OF EMBEDDED SIM CERTIFICATION #connectedliving TO SCALE THE INTERNET OF THINGS 05 Ensuring confidence and trust in the new Embedded SIM ecosystem The Embedded SIM secures access to the mobile network and is there to ensure that the end-user and device are who and what they say that they are, that they can be trusted to act as intended on the network and, equally, that the network can trust them. Certification is there to ensure The evolution of peace of mind for Embedded SIM users and customers. the SIM lifecycle GSMA Embedded SIM - Compliance Recent research has estimated that immediate industry- wide adoption and deployment of the GSMA Embedded CERTIFICATION ACCREDITATION COMPLIANCE Based on GSMA Protection World-class security auditing Test Houses certified by Profile (SGP.05), Common companies conduct audits GlobalPlatform have to test SIM Specification will deliver 34 per cent higher market Criteria licensed laboratories on behalf of the GSMA compliance of vendors’ platforms realize security evaluation based on auditing standards and eUICCs based on GSMA growth by 2020 (source: Beecham Research). The lifecycle of eUICC products. and methodologies for Test Specification (SGP.11). GSMA Secure Accreditation of the SIM has changed and operators and manufacturers Scheme (GSMA SAS). (Common Criteria EAL4+ certificate) (GSMA certificate) (GlobalPlatform certificate) can leverage Embedded SIM and RSP to their advantage. INCREASING CONFIDENCE HIGHER MARKET GROWTH BY 2020 34% Traditional SIMs have a high degree of confidence, that been very successful if you replace the SIM card in your because they have been mobile handset, it will connect to a proven to be secure new network. This “interoperability” and they behave in a predictable is necessary to ensure broad fashion. It can be expected, with adoption of the technology. gsma.com/connectedliving THE IMPORTANCE OF EMBEDDED SIM CERTIFICATION #connectedliving TO SCALE THE INTERNET OF THINGS 06 Why is test and certification important? The GSMA Embedded SIM specification describes what is intended to be a robust, secure, scalable and interoperable solution. But these promises can The changing landscape only be delivered if every technology provider interprets and implements the specification in a compliant manner. Compliance is assured with a multi-layered approach. The GSMA Embedded Embedded SIM manufacturers and subscription managers are required to submit their SIM specification defines products to a series of tests to achieve various certifications to prove compliance. various roles in the service delivery chain. Traditionally, MNOs The testing methodology for The software and data purchased SIMs. In the new landscape, eUICC focuses on functional installed on the eUICC is device manufacturers may choose behaviour and the interfaces tested to ensure that it is to purchase eUICC directly from SIM with backend servers such hack-proof. This “penetration vendors. It will then be necessary for the as the Operator SM-DP (Subscription testing” is done at specialised security manufacturer to “over the air provision” Manager Data Preparation) and SM- laboratories and products that succeed the eUICC to activate it on a network. These features of the GSMA SR (Subscription Manager Secure are certified by national security This function is performed by the Embedded SIM specification - the Routing). Qualified tools are used agencies such as BSI.bund.de. subscription management platforms. eUICC, the remote management and to check the compliance of eUICCs with the GSMA specifications. The The eUICCs must behave in a predictable This flexibility of roles highlights the the flexibility of roles has a profound testing methodology is designed way in response to inputs. This common importance of certification, because impact on the overall life cycle a “new to ensure that the eUICC works functional behaviour is very important entities might be acting in roles that SIM” fit for a “new purpose”. This properly and is interoperable. because eUICCs can have a long life they have not performed traditionally. is illustrated in the figure below; in the field and ownership can change The manufacturing many times.