IoT Hacking Series #2: eSIM Supported Hardware

Updated in April 2024.

The value of eSIM (eUICC) for IoT businesses is usually understood. Managing a global IoT business demands flexibility. With eSIM, companies can have a streamlined process from manufacturing the devices to deploying them globally without shuffling multiple SIM cards.

So, there's is no doubt in our eyes that eSIM is and will be the choice for new deployments. Currently, only the lack of information about the hardware and the modules supporting remote SIM provisioning slows the eSIM adoption.

This article aims to clear the chaos and shares a few tools to get started quickly.

Let's look into the documents to understand what's required from the cellular modules to support eSIM functionalities.

The latest GSM specification specifies mandatory functions, file types, structure and standardises the physical SIM was released in 1996. It has been updated over the years, so today's hardware is built based on the GSM 11.11 specifications.

The standard defines Application Protocol Data Units (APDU), the transmission protocol commands for mapping general functions. Application Protocol Data Units can either be a command APDU or response APDU. Once a response and command APDU pair is set, a new Transport Protocol Data Unit (TPDU) will be created to send and receive data over commonly used protocols like T=0 and T=1.

This has been an essential part of SIMs and cellular hardware modules to communicate. Still, with today's high speed and high throughput needs, these two protocols can be limited.

An eSIM has to fetch new or update existing carrier profiles Over the Air (OTA). This requires the Bearer Independent Protocol (BIP).

BIP is bridging the high-speed data channels to the SIM card, allowing OTA remote SIM management. The eSIM connects to the SM-SR (Subscription Manager Secure Routing Server) using BIP, where the underlying bearer can be SMS, CAT_TP, or HTTPS. However, it is important to note that the choice of a bearer impacts accomplishing an eSIM specific task. For example, using SMS for profile download can be slow and unreliable, resulting in a failed task.

The device or hardware itself needs to fully support BIP for an eSIM to have the possibility to be remotely provisioned.

The GSMA has released a new specification targeting consumer and M2M/IoT eSIM. You can find more specific information on the device requirements in GSMA Remote Provisioning Architecture for Embedded UICC Technical Specification (Annex G).

The essential BIP functions that need to be supported:

• Open Channel
• Close Channel
• Receive Data
• Send Data
• Get Channel Status
• Envelop for data download

A list of SIM Application Toolkit (SAT) commands that need to be supported by the device:

• Terminal Profile
• Fetch
• Terminal Response
• Provide Local Information
• Send Short Message
• Poll Interval
• Polling Off
• Timer Management
• Setup Event
• List Envelop for data download by SMS

• Refresh Command

Not all devices support BIP yet. Some of the manufacturers are promising software updates in the future that will add the possibility. Others are starting to release hardware with BIP.

Furthermore, modules might need to be configured separately to allow BIP, SIM ToolKit, or other functionality to work with eSIM. You'll find more info by looking into the hardware documentation of your module.

Few resources to get started quickly

At 1oT, we're gathering information about BIP supported hardware and actively testing them to know which devices work with 1oT eSIM. 

You'll find the full list of eSIM supporting cellular modules from many manufacturers on our eSIM technical page.

• SierraWireless EM7455
• SIMCom SIM7500x
• SIMCom SIM7600x
• SIMCom SIM7070
• Telit GL865
• Telit UL865
• Telit LE910 V2
• Telit LE910B4
• Thales EXS62-W
• Thales PLS62-W
  
• uBlox LARA-R211
• uBlox SARA-G350-02S
• uBlox SARA-U201
• uBlox TOBY-L210
• Quectel BG95
• Quectel EC21
• Quectel EC25
• Quectel EG21-G
• Quectel EG25-G
• Quectel EG91

We're always looking for more modules to test. Contact us at hacking@1oT.com to discuss the details of arranging a test or if you want to see your module on our eSIM-supported hardware list.