4G/LTE - USIM

 

 

 

USIM Parameters

 

USIM parameters (files) refer to a set of data stored on a USIM (Universal Subscriber Identity Module) card, which is used in 3G, 4G, and 5G networks. These files contain various information and configurations that help manage a mobile device's connection to the network. Some key USIM files include:

  • IMSI (International Mobile Subscriber Identity): A unique identifier for the user on the network.
  • Authentication Keys (e.g., Ki): Used for secure communication and authentication.
  • EF files (Elementary Files): Store SMS, contacts, and network settings.
  • PLMN (Public Land Mobile Network) List: Determines preferred and forbidden networks.

These files are structured according to 3GPP TS 31.102 and provide the necessary data for functions like authentication, network selection, and secure communication.

NOTE : I would mostly focus on EF files in this note, but I would not explain every EF files defined in the specification. I would just list some of EF files that are familiar to me. For further details of each of these parameters or for EF files not listed here, refer to TS 31.102

Which EF files control access and emergency calls ?

Let's start with two files that the UE reads before it makes any access attempt. EF_ACC tells the UE which access classes it belongs to, so the UE knows whether a barring setting in a SIB applies to it. EF_ECC tells the UE which dialled numbers are emergency calls. Both decisions happen before the network knows anything about the call, so the USIM has to carry them.

EF_ACC : ACC stands for Access Control Class. The access control class is a parameter to control the access attempts. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes allocated to specific high priority users. When UE sees any Access Control settings from Network (e.g, ac-Barring setting in SIB message), UE refer to this UICC parameter to figure out which Class it belongs. Refer to 31.102 4.2.15 EFACC  for the detailed data format)

EF_ECC : ECC stands for Emergency Call Codes. This field contains the list of Emergency Call Codes. the emergency call code is of a variable length with a maximum length of 6 digits. Each emergency call code is coded on three bytes, with each digit within the code being coded on four bits as shown below. If a code of less than 6 digits is chosen, then the unused nibbles shall be set to 'F'( Refer to 31.102 4.2.21 EFECC  for the detailed data format)   

The EF_ACC file is 2 bytes long, and each access class is one bit. A normal subscriber has exactly one bit set among classes 0 to 9. A special user can also have one or more bits among classes 11 to 15. TS 22.011 allocates them as follows. Class 11 is for PLMN use, class 12 for security services, class 13 for public utilities, class 14 for emergency services and class 15 for PLMN staff. The bit for class 10 is always 0 in EF_ACC. Class 10 is not a subscriber class. The network signals it over the radio interface to allow or bar emergency calls.

The special classes do not apply everywhere. Classes 11 and 15 apply only in the HPLMN, or in an EHPLMN when the EHPLMN list is present. Classes 12, 13 and 14 apply in the HPLMN and in visited PLMNs of the home country. So a police USIM with class 12 behaves like a normal class 0 to 9 USIM when it roams abroad.

EF_ECC has one more field that the paragraph above does not show. Each record carries the 3-byte emergency call code, an optional alpha identifier and a 1-byte Emergency Service Category. The category bits follow TS 24.008 and mark the service, such as police, ambulance or fire brigade. The UE sends this category to the network when it sets up the emergency call. EF_ECC is readable without PIN verification, so the UE can use it even when the user has not entered the PIN.

  • EF_ACC is a bitmap : one random class from 0 to 9 for every subscriber, plus special classes 11 to 15 for high priority users.
  • Access class 10 is not stored in the USIM : the network broadcasts it to control emergency calls.
  • Special classes depend on the network : they apply in the home PLMN or the home country, not everywhere.
  • EF_ECC works without the PIN : each record also carries an Emergency Service Category.

Which EF files drive PLMN selection ?

Now let's look at the files that decide which network the UE picks. In automatic mode, the UE does not scan every PLMN and take the strongest one. It follows a priority order, and most of that order comes from the USIM. The next five files each fill one part of that order, and EF_HPPLMN decides how often the UE looks for a better network.

EF_EHPLMN : EHPLMN stands for Equivalent HPLMN (Home PLMN). It contains the list of PLMNs which can be regarded as a Home PLMN. The items are listed in order of decreasing priority, meaning that the first PLMN in the list has the highest priority and the last item has the lowest priority. (Refer to 31.102 4.2.84 EFEHPLMN for the detailed data format, refer to 23.122 4.4.3.1.1 for the determination of the priority in cell selection)

EF_HPLMNwAcT : PLMNwACT stands for 'HPLMN with Access Technology'. Basically there is where your HPLMN and list of avaiable Access Technologies are stored. This parameter contains the list of (PLMN, Access Technology) pairs. These PLMNs are listed in decreasing order of priority, meaning the first PLMN has the highest priority.(Refer to 31.102 4.2.54 EFHPLMNwAcT for the detailed data format, refer to 23.122 4.4.3.1.1 for the determination of the priority in cell selection).

EF_PLMNwACT: PLMNwACT stands for 'User Controlled PLMN with Access Technology'. This parameter contains the list of (PLMN, Access Technology) pairs. This information is determined by the user and defines the preferred PLMNs of the user in priority order.

These PLMNs are listed in decreasing order of priority, meaning the first PLMN has the highest priority. This parameter plays important roles to determine which PLMN should be selected first under various cell selection, reselection test. (Refer to 31.102 4.2.5 EFPLMNwAcT for the detailed data format, refer to 23.122 4.4.3.1.1 for the determination of the priority in cell selection)

EF_OPLMNwACT : OPLMNwACT stands for Operator controlled PLMN selector with Access Technology. This parameter is set by Network Operator. This is where Network operator put another networks which has roaming agreenment with. This parameter contains the list of (PLMN, Access Technology) pairs. These PLMNs are listed in decreasing order of priority, meaning the first PLMN has the highest priority. (Refer to 31.102 4.2.53 EFOPLMNwACT for the detailed data format, refer to 23.122 4.4.3.1.1 for the determination of the priority in cell selection)

EF_HPPLMN: EF_HPPLMN stands for "Higher Priority PLMN search period" (Be careful. This is a Timer value, not a PLMN)

This parameter specifies the interval of time between searches for a higher priority PLMN (Refer to 31.102 4.2.6 EFHPPLMN for the detailed data format)

One typical example for this parameter is as follows

  • i) UE is registered to a VPLMN cell. (It means that UE is not registered to cell with the highest priority)
  • ii) Now UE is in Idle mode.
  • iii) Since UE is not in connection to the highest priority cells, UE periodically search for the higher priority cell.

Now the question is how often UE search for the higher priority cells. This is determined by EF_HPPLMN. The basic periodicity is 6 min and EF_HPPLMN specifies the multiples of the 6 min. For example, if EF_HPPLMN = 2, UE searchs for the higher priority cells every 12 mins (2 x 6 min).

How about if EF_HPPLMN = 0. In this case, UE never searches the higher priority cells.

TS 23.122 puts these files into one order for automatic network selection. The UE tries the HPLMN first, or the highest priority EHPLMN if the EHPLMN list is present. Next it tries each entry of EF_PLMNwAcT in priority order. Then it tries each entry of EF_OPLMNwACT in priority order. After that it takes other PLMNs with a high quality signal in random order, and finally the rest in order of decreasing signal quality. EF_HPLMNwAcT does not add a step to this order. The UE may use it to decide which access technology to search first for the HPLMN.

The 6 minute step above applies to normal UEs. TS 31.102 codes the value as a multiple of n minutes, and TS 23.122 gives the range of 6 minutes to 8 hours in 6 minute steps. A UE that uses NB-IoT, EC-GSM-IoT or Category M1 reads the same byte in hours instead, from 2 hours up to 240 hours. If the USIM holds no value, the UE uses a default of 60 minutes. So the same stored byte gives a very different period on an IoT device than on a phone.

  • The home network comes first : the HPLMN, or the highest priority EHPLMN, is always step one of automatic selection.
  • User list before operator list : EF_PLMNwAcT is tried before EF_OPLMNwACT.
  • EF_HPLMNwAcT only orders access technologies : it does not change which PLMN the UE selects.
  • EF_HPPLMN = 0 disables the search : any other value sets the period, in minutes for phones and in hours for IoT UEs.

Which EF files keep the registration and security state ?

The next group of files does not configure the UE. Instead, the UE writes into them, so that its registration survives a power cycle or a move to another phone. Each domain has its own file. EF_LOCI is for CS, EF_PSLOCI for PS, and EF_EPSLOCI and EF_EPSNSC for EPS.

EF_LOCI: LOCI stands for 'Location Information'. This field is the one that stores TMSI value.

When the domain preference is set to be CS Only or CS + PS, UE gets RPLMN from this field.

This field stores following informations.

  •   Temporary Mobile Subscriber Identity (TMSI);
  •   Location Area Information (LAI);
  •   Location update status.

One thing you have to notice here is the 'location update status'. This part indicate one of the following status.

  • 0 0 0 : updated.
  • 0 0 1 : not updated.
  • 0 1 0 : PLMN not allowed.
  • 0 1 1 : Location Area not allowed.
  • 1 1 1 : reserved.

(Refer to 31.102 4.2.17 EFLOCI (Location Information) for the detailed data format)

EF_PSLOCI : This field is the one that stores P-TMSI

When the domain preference is set to be PS only, UE gets RPLMN from this field.

EF_LRPLMNSI : LRPLMNSI means 'Last Registered PLMN Selection Indication.

  • If this value is set to be 1, UE attempt to camp on Home PLMN when power on.
  • If this value is set to be 0, UE attempt to camp on the last RPLMN when power on.

(Refer to 31.102 4.2.86 EFLRPLMNSI (Last RPLMN Selection Indication) for the detailed data format)

EF_EPSNSC : This field contains EPS NAS Security Context Information. K_ASME(Access Security Management Entity) is master key derived from CK/IK and used to derive subsequent Keys. (Refer to PDCP Integrity Process section for Key Relations). This is a LTE specific field.

EF_EPSLOCI : This field contains EPS location information such as GUTI(Globally Unique Temporary Identifier), Last visited TAI (Tracking Area Identity), EPS Update Status. This is a LTE specific field.

EF_EPSLOCI is 18 bytes long. It holds the 12-byte GUTI, the 5-byte last visited registered TAI and 1 byte of EPS update status. The status value 000 means UPDATED, 001 means NOT UPDATED and 010 means ROAMING NOT ALLOWED. At the next power on, the UE uses the stored GUTI in the Attach Request instead of the IMSI when the status allows it. EF_EPSNSC holds the EPS NAS security context. It carries KSIASME, KASME, the uplink and downlink NAS counts and the selected NAS algorithms. With this context, the UE and the MME can resume NAS security without a new authentication.

5G adds the same kind of files in the 5GS folder of the USIM. EF_5GS3GPPLOCI holds the 5G-GUTI, the last visited registered TAI in 5GS and the 5GS update status. EF_5GS3GPPNSC holds the 5GS NAS security context for 3GPP access. EF_5GSN3GPPLOCI and EF_5GSN3GPPNSC hold the same information for non-3GPP access. The folder also holds EF_SUCI_Calc_Info and EF_Routing_Indicator, which the UE uses to build the SUCI.

  • The UE writes these files : they store the result of the last registration rather than an operator setting.
  • One location file per domain : EF_LOCI for CS, EF_PSLOCI for PS, EF_EPSLOCI for EPS and EF_5GS3GPPLOCI for 5GS.
  • EF_LRPLMNSI decides where the UE starts : value 0 means the last RPLMN, and value 1 lets the UE go to the home network.
  • A stored security context saves an authentication : EF_EPSNSC keeps KASME and the NAS counts across a power cycle.

Which EF files select Cell Broadcast messages ?

The last file on this list controls which Cell Broadcast messages the UE accepts. This matters more than it seems, because the public warning messages of ETWS and CMAS are delivered as Cell Broadcast messages. The UE builds a search list from the USIM and from its own settings, and it only receives the messages whose identifiers are on that list.

EF_CBMI : CBMI stands for Cell Broadcast Message identifier selection. This EF contains the Message Identifier Parameters which specify the type of content of the cell broadcast messages that the subscriber wishes the UE to accept. Any number of CB Message Identifier Parameters may be stored in the USIM. No order of priority is applicable.

(Refer to 31.102 4.2.14 for the detailed data format)

EF_CBMI is one of three related files. EF_CBMI holds single message identifiers, 2 bytes each, for messages that the UE shows to the user. EF_CBMIR holds ranges of message identifiers, which is shorter than listing every value. EF_CBMID holds identifiers of messages that the UE passes to the USIM for data download rather than showing them. TS 23.041 says the UE search list contains the identifiers from all three files. If the UE can search only a limited number of identifiers, the ones from the USIM take priority over the ones stored in the UE.

The message identifier values come from TS 23.041. The range 4352 to 6399, which is 1100 to 18FF in hex, is reserved for the Public Warning System. For example, 4352 is the ETWS earthquake warning and 4353 the ETWS tsunami warning. 4370 is the CMAS Presidential Level Alert, and the UE must not filter it by language. In LTE, the eNodeB carries ETWS in SIB10 and SIB11 and CMAS in SIB12, and the same message identifier appears in those SIBs.

  • Three files build one search list : EF_CBMI for single identifiers, EF_CBMIR for ranges and EF_CBMID for data download to the USIM.
  • USIM entries win over UE entries : when the UE cannot search for all identifiers.
  • Public warning uses 4352 to 6399 : ETWS and CMAS messages are Cell Broadcast messages with identifiers in this range.

Reference