3GPP TSG-T3 (USIM) #3	Tdoc T3-99069
16-18 th of March, 1999
Espoo, Finland

Secret information related to the ADN feature

Source: Nokia

At the second TSG-T3 meeting it was discussed how to store secret information related to the AND feature. The purpose is to make a particular ADN entry non-visible to the user. The secret entries can be accessed/made visible by entering a code, similar to the PIN. 

The ISO/IEC 7816-series standards do not support access conditions set to a record level. Access conditions are on a file level. Furthermore a set of access conditions that are associate with a file do not all have to be satisfied in order to access the file. The access conditions logical function is OR, only one of them has to be satisfied in order to access the file.

Two solutions can be outlined. The first solution is where the actual secret record can be read but it is not displayed by the terminal. In this case the administration index file contains an indication that the all the information related to this record is not to be displayed. The other solution is where the secret data is moved to a dedicated file that has different access conditions. In this case the secret data can not be read by the terminal if the access condition is not met, i.e. the secret code is entered.

Hidden Entry
In this case the information related to if the data is to be displayed or not is located in the administration index file. The administration index file may contain other control information such as grouping. The administration index file could look as follows.

Table 1 Structure of the combined Group/Administration File
Identifier: '6FXX'	Structure: linear fixed	Optional	
Record Length: X bytes	Update activity: low	
Access Conditions:
	READ	Original EF
	UPDATE	ADM
	INVALIDATE	ADM
	REHABILITATE	ADM
	
Bytes	Description	M/O	Length	
1 - X	Grouping Information	M	X bytes	
X+1 – X+2	Pointer to record number in EFEXT1(6F4A)	M	1 byte	
X+3 – X+4	Pointer to record number in EF"nicknames"	O	1 byte	

Coding of first byte:

		b8	b7	b6	b5	b4	b3	b2	b1	
										Grouping informationion	
										RFU	
										b8=0: Contents of record not to be displayed
b8=1: Contents of record to be displayed	

The advantage with this approach is that there is no need to transfer data from one file to an other when the information is to be hidden. The verification of the secret code is done by the terminal in this case. The drawback is that there is no security related to this approach. There is nothing that prevents the contents of the record from being read by the terminal.

Secret Entry
In this case the information that is indicated to be secret is moved to an other file. This file may be part of the index file structure. In case that there are several files related to this record entry all information must be moved and a corresponding amount of files must be available. The implementation would look as described in the figure. 

In this case the ADN file and the second name files are duplicated. Secret ADN and second name file do not have to be of the same size as the original ADN file. The secret files will now have a different access condition than the other files. This means that in order to read from or write to the secret files the access condition must be satisfied.

This means that when an ADN number is moved from the public part to the secret part the content is copied. The content can only be moved between files if both access conditions are met. In order to access the secret files two access conditions should be valid. First the access condition of the original ADN which is the application PIN as a second access condition the secret code for the secret files should be satisfied. Existing access conditions rules do not allow this implementation, as there is a need to meet two access conditions in order to get the access. Normally if the secret code which is the access condition for the secret files is satisfied access to the file is allowed even if the PIN is not verified. The existing standard does not prevent a file from being selected although the access condition is not satisfied. In order to achieve the required functionality it is necessary to create new mechanisms if there is a requirement to have two access conditions satisfied in order to get the access.

This arrangement is also memory consuming, as memory space for the secret ADN field must be reserved. The amount entries can be restricted in order to minimise the memory consumption.