7 Implementation for SMS-CB

03.483GPPRelease 1999Security mechanisms for SIM application toolkitStage 2TS

7.1 Structure of the CBS page in the SMS-CB Message

The CBS page sent to the MS by the BTS is a fixed block of 88 octets as coded in TS 04.12 [12]. The 88 octets of CBS information consist of a 6-octet header and 82 user octets.

The 6-octet header is used to indicate the message content as defined in TS 03.41 [11]. This information is required to be transmitted unsecured in order for the ME to handle the message in the correct manner (e.g. interpretation of the DCS).

The content of the message shall be secured as defined in this clause.

A range of values has been reserved in TS 03.41 [11] to indicate SMS-CB Data Download messages that are secured and unsecured. A subset of these values is used to indicate the Command Packet for CBS messages. This range is from (hexadecimal) ‘1080’ to ‘109F’ and is included in the structure of the Command Packet as illustrated in Table 9.

7.2 A Command Packet contained in a SMS-CB message

The relationship between the Command Packet and its inclusion in the SMS-CB message structure is indicated in tableĀ 9.

Table 9: Relationship of Command Packet in the first CBS page of an SMS-CB message

SMS-CB specific elements

Generalised Command Packet Elements (Refer to Table 1)



Refer to TS 03.41 [11]. Coded on 2 octets containing the ID of a particular message.


CPI=’1080′ to ‘109F’

Coded on 2 octets containing the source and type of the message. The Command Packet Identifier range is reserved in TS 03.41 [11]. (see note)


Refer to TS 03.41 [11]. Coded on 1 octet containing the alphabet coding and language as defined in TS 03.38 [13].


Refer to TS 03.41 [11]. Coded on 1 octet to indicate the page number and total number of pages.

Content of Message


Length of the Command Packet, coded over 2 octets, and shall not be coded according to ISO/IECĀ 7816-6 [8].


The Command Header Identifier. Null field.


This shall indicate the number of octets from and including the SPI to the end of the RC/CC/DS field. Binary coded over 1 octet.

SPI to RC/CC/DS in the Command Header

The remainder of the Command Header.

Secured Data

Application Message, including possible padding octets.

NOTE: Generally, the CPI is coded on 1 octet, as specified in Table 1. However, the CPI for the SMS-CB message is coded on 2 octets as the values reserved in TS 03.41 [11] to identify the Command Packet are MID values which are coded on 2 octets.

It is recognised that most checksum algorithms require input data in modulo 8 length. In order to achieve a modulo 8 length of the data before the RC/CC/DS field in the Command Header the Length of the Command Packet and the Length of the Command Header shall be included in the calculation of RC/CC/DS if used. These fields shall not be ciphered.

Securing of the complete CBS message is achieved outside the GSM specifications by the Sending Entity. The Secured CBS message is formatted in accordance with the GSM specifications and transmitted to the MS as CBS pages. The CBS pages are received by the ME and sent directly to the SIM, by analysing the MID value. The SIM shall then reassemble, decrypt and process the message.

An example illustrating the relationship between a Command Packet split over a sequence of three SMS-CB pages is shown below.

Figure 4: Example of command split using concatinated CB SMS

7.3 Structure of the Response Packet for a SMS-CB Message

As there is no response mechanism defined for SMS-CB, there is no defined structure for the (Secured) Response Packet. However, if a (Secured) Response Packet is sent via another bearer the structure shall be defined by the Receiving Application.